joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419116
Capabilities:
Get number of processors

Disassembly:
add byte [edi], dh
inc esp
cmp dh, byte [edx]
cmp byte [ebp - 0x7d], al
add esp, 4
pop edi
mov dword [ebp - 0x6c], 1
push edi
xor edi, 0x12cc2
pop edi
push ebx
add ebx, 0x1337
call 0x419144
add byte [esi + ecx*2 + 0x47], cl
cmp edi, dword [edx]
cmp eax, 0x4c4833a
add ebx, 0xf007
pop ebx
push ebx
push edi
add esp, 4
add ebx, 0xa599
pop ebx
imul eax, dword [ebp - 0x6c], 0xe9
add eax, 0x15f3673a
imul ecx, dword [ebp - 0x6c], 0xe9
sub eax, ecx
xor eax, 0x1154
imul eax, dword [ebp - 0x6c]
imul edx, dword [ebp - 0x6c], 0xe9
sub eax, edx
mov dword [ebp - 0x70], eax
push ecx
sub ecx, 0x77e7
or ecx, 0x343
and ecx, 0x2e0a
pop ecx
push eax
sub eax, 0x12a3b
cmp ebp, dword [edx]
add dword [eax], eax
call 0x4191ac
add byte [0x3d424635], bh
dec eax
inc ebx
add esp, 4
add eax, 0x8809
pop eax
push ebx
sub ebx, 0x16155
pop ebx
push ebx
and ebx, 0x11455
or ebx, 0xf118
jmp 0x4191d3
sub ebx, 0x15edb
pop ebx
push ebx
add ebx, 0x43a8
or ebx, 0xc1e5
pop ebx
mov dword [ebp - 4], 1
push eax
push edi
add esp, 4
add eax, 0x8720
pop eax
push esi
and esi, 0xfccd
xor esi, 0x16081
and esi, 0xc63d
or esi, 0xd3cd

Function at 0x41911d
Capabilities:
Get number of processors

Disassembly:
add byte [edi], dh
inc esp
cmp dh, byte [edx]
cmp byte [ebp - 0x7d], al
add esp, 4
pop edi
mov dword [ebp - 0x6c], 1
push edi
xor edi, 0x12cc2
pop edi
push ebx
add ebx, 0x1337
call 0x419144
add byte [esi + ecx*2 + 0x47], cl
cmp edi, dword [edx]
cmp eax, 0x4c4833a
add ebx, 0xf007
pop ebx
push ebx
push edi
add esp, 4
add ebx, 0xa599
pop ebx
imul eax, dword [ebp - 0x6c], 0xe9
add eax, 0x15f3673a
imul ecx, dword [ebp - 0x6c], 0xe9
sub eax, ecx
xor eax, 0x1154
imul eax, dword [ebp - 0x6c]
imul edx, dword [ebp - 0x6c], 0xe9
sub eax, edx
mov dword [ebp - 0x70], eax
push ecx
sub ecx, 0x77e7
or ecx, 0x343
and ecx, 0x2e0a
pop ecx
push eax
sub eax, 0x12a3b
cmp ebp, dword [edx]
add dword [eax], eax
call 0x4191ac
add byte [0x3d424635], bh
dec eax
inc ebx
add esp, 4
add eax, 0x8809
pop eax
push ebx
sub ebx, 0x16155
pop ebx
push ebx
and ebx, 0x11455
or ebx, 0xf118
jmp 0x4191d3
sub ebx, 0x15edb
pop ebx
push ebx
add ebx, 0x43a8
or ebx, 0xc1e5
pop ebx
mov dword [ebp - 4], 1
push eax
push edi
add esp, 4
add eax, 0x8720
pop eax
push esi
and esi, 0xfccd
xor esi, 0x16081
and esi, 0xc63d
or esi, 0xd3cd
Function at 0x419144
Capabilities:
Get number of processors

Disassembly:
add byte [edi], dh
inc esp
cmp dh, byte [edx]
cmp byte [ebp - 0x7d], al
add esp, 4
pop edi
mov dword [ebp - 0x6c], 1
push edi
xor edi, 0x12cc2
pop edi
push ebx
add ebx, 0x1337
call 0x419144
add byte [esi + ecx*2 + 0x47], cl
cmp edi, dword [edx]
cmp eax, 0x4c4833a
add ebx, 0xf007
pop ebx
push ebx
push edi
add esp, 4
add ebx, 0xa599
pop ebx
imul eax, dword [ebp - 0x6c], 0xe9
add eax, 0x15f3673a
imul ecx, dword [ebp - 0x6c], 0xe9
sub eax, ecx
xor eax, 0x1154
imul eax, dword [ebp - 0x6c]
imul edx, dword [ebp - 0x6c], 0xe9
sub eax, edx
mov dword [ebp - 0x70], eax
push ecx
sub ecx, 0x77e7
or ecx, 0x343
and ecx, 0x2e0a
pop ecx
push eax
sub eax, 0x12a3b
cmp ebp, dword [edx]
add dword [eax], eax
call 0x4191ac
add byte [0x3d424635], bh
dec eax
inc ebx
add esp, 4
add eax, 0x8809
pop eax
push ebx
sub ebx, 0x16155
pop ebx
push ebx
and ebx, 0x11455
or ebx, 0xf118
jmp 0x4191d3
sub ebx, 0x15edb
pop ebx
push ebx
add ebx, 0x43a8
or ebx, 0xc1e5
pop ebx
mov dword [ebp - 4], 1
push eax
push edi
add esp, 4
add eax, 0x8720
pop eax
push esi
and esi, 0xfccd
xor esi, 0x16081
and esi, 0xc63d
or esi, 0xd3cd

Function at 0x4191ac
Capabilities:
Get number of processors

Disassembly:
add byte [edi], dh
inc esp
cmp dh, byte [edx]
cmp byte [ebp - 0x7d], al
add esp, 4
pop edi
mov dword [ebp - 0x6c], 1
push edi
xor edi, 0x12cc2
pop edi
push ebx
add ebx, 0x1337
call 0x419144
add byte [esi + ecx*2 + 0x47], cl
cmp edi, dword [edx]
cmp eax, 0x4c4833a
add ebx, 0xf007
pop ebx
push ebx
push edi
add esp, 4
add ebx, 0xa599
pop ebx
imul eax, dword [ebp - 0x6c], 0xe9
add eax, 0x15f3673a
imul ecx, dword [ebp - 0x6c], 0xe9
sub eax, ecx
xor eax, 0x1154
imul eax, dword [ebp - 0x6c]
imul edx, dword [ebp - 0x6c], 0xe9
sub eax, edx
mov dword [ebp - 0x70], eax
push ecx
sub ecx, 0x77e7
or ecx, 0x343
and ecx, 0x2e0a
pop ecx
push eax
sub eax, 0x12a3b
cmp ebp, dword [edx]
add dword [eax], eax
call 0x4191ac
add byte [0x3d424635], bh
dec eax
inc ebx
add esp, 4
add eax, 0x8809
pop eax
push ebx
sub ebx, 0x16155
pop ebx
push ebx
and ebx, 0x11455
or ebx, 0xf118
jmp 0x4191d3
sub ebx, 0x15edb
pop ebx
push ebx
add ebx, 0x43a8
or ebx, 0xc1e5
pop ebx
mov dword [ebp - 4], 1
push eax
push edi
add esp, 4
add eax, 0x8720
pop eax
push esi
and esi, 0xfccd
xor esi, 0x16081
and esi, 0xc63d
or esi, 0xd3cd

Function at 0x419214
Capabilities:
Get number of processors

Disassembly:
pop esi
push ebx
push ecx
add esp, 4
add ebx, 0x13906
pop ebx
imul eax, dword [ebp - 4], 0xe9
add eax, 0x15f3673a
invalid
dec ebp
cld
Function at 0x41dd47
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xchg ebp, eax
call 0x1041dd4b
mov bh, 0x45
aam 0x2b
ror byte [ecx - 0xb676b], 1
invalid

Function at 0x41ecac
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
xor edi, 0x8b68
sub edi, 0x56df
pop edi
push edx
or edx, 0xe4fa
or edx, 0x550
xor edx, 0x166dd
call fcn.0041ecac
add byte [esi], bh
cmp cl, byte [eax + edx*2 + 0x46]
push eax
add esp, 4
pop edx
lea eax, [ebp - 0xc50]
mov dword [ebp - 0x6d8], eax
mov ecx, dword [ebp - 0x24c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x6d4], edx
xor eax, eax
mov word [ebp - 0x120], ax
xor ecx, ecx
mov word [ebp - 0x34], cx
push edi
and edi, 0xe948
sub edi, 0x7c8a
and edi, 0xb673
jmp 0x41ecf4
pop edi
push edi
push edi
add esp, 4
or edi, 0xa03e
sub edi, 0x10c12
jmp 0x41ed0b
pop edi
mov edx, dword [ebp - 0x6d4]
mov ax, word [edx]
mov word [ebp - 0x88e], ax
mov ecx, dword [ebp - 0x6d4]
add ecx, 2
mov dword [ebp - 0x6d4], ecx
mov dx, word [ebp - 0x88e]
mov word [ebp - 0x120], dx
mov eax, dword [ebp - 0x6d8]
mov cx, word [eax]
mov word [ebp - 0x890], cx
mov edx, dword [ebp - 0x6d8]
add edx, 2
mov dword [ebp - 0x6d8], edx
mov ax, word [ebp - 0x890]
mov word [ebp - 0x34], ax
push edi
push edx
add esp, 4
or edi, 0x104ea
pop edi
push ecx
push eax
add esp, 4
sub ecx, 0xbe6d
pop ecx
push edx
and edx, 0xa84f
sub edx, 0x213c
xor edx, 0xa583
add edx, 0x12526
pop edx
movzx ecx, word [ebp - 0x34]
test ecx, ecx
jne 0x41edb2
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0xb98], edx
jmp 0x41ee0c
movzx ecx, word [ebp - 0x120]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
je 0x41ecda
movzx eax, word [ebp - 0x120]
xor eax, 0x20
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x41ecda
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x34]
cmp edx, eax
jge 0x41edf6
mov dword [ebp - 0xb94], 0xffffffff
jmp 0x41ee00
mov dword [ebp - 0xb94], 1
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xb98], ecx
cmp dword [ebp - 0xb98], 0
jne 0x41ee55
push edx
or edx, 0x23dd
add edx, 0xe652
add edx, 0xdeea
xor edx, 0x181cf
pop edx
push eax
or eax, 0x11f09
add eax, 0xd80d
pop eax
push esi
jmp 0x41ee46
pop esi
mov edx, dword [ebp - 0x24c]
mov dword [ebp - 0x18c], edx
jmp 0x41eebd
push ebx
push ebx
add esp, 4
call 0x41ee69
add byte [esi + 0x41], al
xor eax, 0x3c324845
cmp byte [esi - 0x7d], cl
les eax, [ebx + ebx*2]
push edx
push esi
add esp, 4
and edx, 0x8fce
and edx, 0x98c6
jmp 0x41ee86
pop edx
mov eax, dword [ebp - 0x24c]
mov ecx, dword [eax]
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x24c]
cmp edx, dword [ebp - 0x6dc]
je 0x41eeb3
mov eax, dword [ebp - 0x24c]
cmp dword [eax + 0x30], 0
jne 0x41ec7e
mov dword [ebp - 0x18c], 0
Function at 0x41ee69
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
xor edi, 0x8b68
sub edi, 0x56df
pop edi
push edx
or edx, 0xe4fa
or edx, 0x550
xor edx, 0x166dd
call fcn.0041ecac
add byte [esi], bh
cmp cl, byte [eax + edx*2 + 0x46]
push eax
add esp, 4
pop edx
lea eax, [ebp - 0xc50]
mov dword [ebp - 0x6d8], eax
mov ecx, dword [ebp - 0x24c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x6d4], edx
xor eax, eax
mov word [ebp - 0x120], ax
xor ecx, ecx
mov word [ebp - 0x34], cx
push edi
and edi, 0xe948
sub edi, 0x7c8a
and edi, 0xb673
jmp 0x41ecf4
pop edi
push edi
push edi
add esp, 4
or edi, 0xa03e
sub edi, 0x10c12
jmp 0x41ed0b
pop edi
mov edx, dword [ebp - 0x6d4]
mov ax, word [edx]
mov word [ebp - 0x88e], ax
mov ecx, dword [ebp - 0x6d4]
add ecx, 2
mov dword [ebp - 0x6d4], ecx
mov dx, word [ebp - 0x88e]
mov word [ebp - 0x120], dx
mov eax, dword [ebp - 0x6d8]
mov cx, word [eax]
mov word [ebp - 0x890], cx
mov edx, dword [ebp - 0x6d8]
add edx, 2
mov dword [ebp - 0x6d8], edx
mov ax, word [ebp - 0x890]
mov word [ebp - 0x34], ax
push edi
push edx
add esp, 4
or edi, 0x104ea
pop edi
push ecx
push eax
add esp, 4
sub ecx, 0xbe6d
pop ecx
push edx
and edx, 0xa84f
sub edx, 0x213c
xor edx, 0xa583
add edx, 0x12526
pop edx
movzx ecx, word [ebp - 0x34]
test ecx, ecx
jne 0x41edb2
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0xb98], edx
jmp 0x41ee0c
movzx ecx, word [ebp - 0x120]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
je 0x41ecda
movzx eax, word [ebp - 0x120]
xor eax, 0x20
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x41ecda
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x34]
cmp edx, eax
jge 0x41edf6
mov dword [ebp - 0xb94], 0xffffffff
jmp 0x41ee00
mov dword [ebp - 0xb94], 1
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xb98], ecx
cmp dword [ebp - 0xb98], 0
jne 0x41ee55
push edx
or edx, 0x23dd
add edx, 0xe652
add edx, 0xdeea
xor edx, 0x181cf
pop edx
push eax
or eax, 0x11f09
add eax, 0xd80d
pop eax
push esi
jmp 0x41ee46
pop esi
mov edx, dword [ebp - 0x24c]
mov dword [ebp - 0x18c], edx
jmp 0x41eebd
push ebx
push ebx
add esp, 4
call 0x41ee69
add byte [esi + 0x41], al
xor eax, 0x3c324845
cmp byte [esi - 0x7d], cl
les eax, [ebx + ebx*2]
push edx
push esi
add esp, 4
and edx, 0x8fce
and edx, 0x98c6
jmp 0x41ee86
pop edx
mov eax, dword [ebp - 0x24c]
mov ecx, dword [eax]
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x24c]
cmp edx, dword [ebp - 0x6dc]
je 0x41eeb3
mov eax, dword [ebp - 0x24c]
cmp dword [eax + 0x30], 0
jne 0x41ec7e
mov dword [ebp - 0x18c], 0
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x100031d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x10003218
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x1000321e
add eax, 4
pop esi
dec esi
push esi
jne 0x10003200
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8
Function at 0x10005e4e
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x10005f02
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.10005dde
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x10005edb
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005f0e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x10005f29
test ebp, ebp
je 0x10005f29
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10005f31
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x10005f71
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x10005fcd
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10005fc8
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10005fb3
test dl, dl
je 0x10005faf
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10005fb3
add ecx, 2
add eax, 2
test dl, dl
jne 0x10005f93
xor eax, eax
jmp 0x10005fb8
sbb eax, eax
or eax, 1
test eax, eax
je 0x10005fd7
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x10005f80
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x10005fee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.10005e4e
test eax, eax
jne 0x10006006
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.10005f0e
mov esi, eax
test esi, esi
jne 0x1000603c
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x10006056
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x1000614e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.10005e4e
mov esi, eax
test esi, esi
jne 0x1000616c
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.10005f0e
mov dword [esp + 0x18], eax
test eax, eax
je 0x10006164
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.10005f0e
mov dword [esp + 0x34], eax
test eax, eax
je 0x10006164
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.10005f0e
mov dword [esp + 0x28], eax
test eax, eax
je 0x10006164
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.10005f0e
mov dword [esp + 0x30], eax
test eax, eax
je 0x10006164
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x10006333
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x10006333
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x10006296
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x10006317
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x100062b9
movzx esi, ax
jmp 0x100062be
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x100062dd
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x100062ec
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x10006340
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x100062ae
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x10006273
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x10006369
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x10006369
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x1000634e
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x1000637e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.10005e4e
mov esi, eax
test esi, esi
je 0x1000643a
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.10005f0e
mov ebp, eax
test ebp, ebp
je 0x10006439
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.10005f0e
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x10006439
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x10006439
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x10006438
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x1000641e
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x100066b7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x100066fc
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x10006702
add eax, 4
pop esi
dec esi
push esi
jne 0x100066e4
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8

Function at 0x1000771c
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x100077d0
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.100076ac
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x100077a9
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100077dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x100077f7
test ebp, ebp
je 0x100077f7
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100077ff
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x1000783f
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x1000789b
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10007896
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10007881
test dl, dl
je 0x1000787d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10007881
add ecx, 2
add eax, 2
test dl, dl
jne 0x10007861
xor eax, eax
jmp 0x10007886
sbb eax, eax
or eax, 1
test eax, eax
je 0x100078a5
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x1000784e
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret

Function at 0x100078bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.1000771c
mov esi, eax
test esi, esi
je 0x10007978
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.100077dc
mov ebp, eax
test ebp, ebp
je 0x10007977
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.100077dc
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x10007977
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x10007977
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x10007976
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x1000795c
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret