joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000515f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
mov byte [ebp - 0xddc], 0x52
mov byte [ebp - 0xddb], 0xb9
mov byte [ebp - 0xdda], 0x10
mov byte [ebp - 0xdd9], 0x10
mov byte [ebp - 0xdd8], 0x10
mov byte [ebp - 0xdd7], 0x10
mov byte [ebp - 0xdd6], 0x5a
push edx
push esi
add esp, 4
add edx, 0xd9f3
pop edx
push ebx
push edx
add esp, 4
xor ebx, 0xc986
or ebx, 0x137cf
pop ebx
push eax
and eax, 0xe8da
or eax, 0x54a0
jmp 0x1000511c
pop eax
mov byte [ebp - 0xdd4], 0x52
mov byte [ebp - 0xdd3], 0xb9
mov byte [ebp - 0xdd2], 0x20
mov byte [ebp - 0xdd1], 0x20
mov byte [ebp - 0xdd0], 0x20
mov byte [ebp - 0xdcf], 0x20
mov byte [ebp - 0xdce], 0x5a
push edi
push esi
add esp, 4
call 0x1000515f
add byte [edi + 0x45], cl
cmp dword [ebx + 0x4e], eax
cmp eax, dword [ebx - 0x307efb3c]
sub eax, dword [ebx]
add byte [eax], al
add edi, 0x13a25
call 0x1000517c
add byte [edi], bh
cmp al, 0x37
cmp edi, dword [ebx]
dec ebp
dec esp
add esp, 4
pop edi
mov dword [ebp - 0x2774], 0xe
push ecx
call 0x1000519a
add byte [ebx + eax*2], dh
inc esi
cmp byte [esi + 0x42], cl
inc ebp
push eax
dec ebp
add esp, 4
call 0x100051ac
add byte [edi + 0x4b], cl
inc ebp
dec esp
xor al, 0x3b
dec esi
aaa
dec ebx
add esp, 4
jmp 0x100051b5
add ecx, 0xa3ee
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xddc]
mov dword [ebp - 0x18d8], eax
push ecx
jmp 0x100051d8
sub ecx, 0x6bf5
call 0x100051ed
add byte [edi + esi], dh
cmp byte [ebx], bh
dec esi
cmp eax, 0x834d4c32
les eax, [ecx + ebx*2]
push ecx
push eax
add esp, 4
and ecx, 0x4ea2
or ecx, 0x1052c
pop ecx
mov dword [ebp - 0x2778], 0xffffffff
push edi
or edi, 0x2db4
add edi, 0xc419
and edi, 0x6bae
sub edi, 0x12d32
pop edi
push ecx
push ebx
add esp, 4
xor ecx, 0x40a9
or ecx, 0x8247
and ecx, 0x619b
pop ecx
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x5bc], ecx
jmp 0x1000525c
push esi
push eax
add esp, 4
sub esi, 0x17f6a
pop esi
push esi
or esi, 0x6c0e
and esi, 0x14b90
or esi, 0xe2e8
call 0x1000528a
add byte [edi], bh
inc esi
xor edi, dword [edx]
inc eax
xor edx, dword [eax + 0x41]
cmp eax, dword [ebx - 0x74a1fb3c]
test dword [edx + edi*8 - 1], eax
jmp [ebx]
Function at 0x1000517c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
mov byte [ebp - 0xddc], 0x52
mov byte [ebp - 0xddb], 0xb9
mov byte [ebp - 0xdda], 0x10
mov byte [ebp - 0xdd9], 0x10
mov byte [ebp - 0xdd8], 0x10
mov byte [ebp - 0xdd7], 0x10
mov byte [ebp - 0xdd6], 0x5a
push edx
push esi
add esp, 4
add edx, 0xd9f3
pop edx
push ebx
push edx
add esp, 4
xor ebx, 0xc986
or ebx, 0x137cf
pop ebx
push eax
and eax, 0xe8da
or eax, 0x54a0
jmp 0x1000511c
pop eax
mov byte [ebp - 0xdd4], 0x52
mov byte [ebp - 0xdd3], 0xb9
mov byte [ebp - 0xdd2], 0x20
mov byte [ebp - 0xdd1], 0x20
mov byte [ebp - 0xdd0], 0x20
mov byte [ebp - 0xdcf], 0x20
mov byte [ebp - 0xdce], 0x5a
push edi
push esi
add esp, 4
call 0x1000515f
add byte [edi + 0x45], cl
cmp dword [ebx + 0x4e], eax
cmp eax, dword [ebx - 0x307efb3c]
sub eax, dword [ebx]
add byte [eax], al
add edi, 0x13a25
call 0x1000517c
add byte [edi], bh
cmp al, 0x37
cmp edi, dword [ebx]
dec ebp
dec esp
add esp, 4
pop edi
mov dword [ebp - 0x2774], 0xe
push ecx
call 0x1000519a
add byte [ebx + eax*2], dh
inc esi
cmp byte [esi + 0x42], cl
inc ebp
push eax
dec ebp
add esp, 4
call 0x100051ac
add byte [edi + 0x4b], cl
inc ebp
dec esp
xor al, 0x3b
dec esi
aaa
dec ebx
add esp, 4
jmp 0x100051b5
add ecx, 0xa3ee
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xddc]
mov dword [ebp - 0x18d8], eax
push ecx
jmp 0x100051d8
sub ecx, 0x6bf5
call 0x100051ed
add byte [edi + esi], dh
cmp byte [ebx], bh
dec esi
cmp eax, 0x834d4c32
les eax, [ecx + ebx*2]
push ecx
push eax
add esp, 4
and ecx, 0x4ea2
or ecx, 0x1052c
pop ecx
mov dword [ebp - 0x2778], 0xffffffff
push edi
or edi, 0x2db4
add edi, 0xc419
and edi, 0x6bae
sub edi, 0x12d32
pop edi
push ecx
push ebx
add esp, 4
xor ecx, 0x40a9
or ecx, 0x8247
and ecx, 0x619b
pop ecx
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x5bc], ecx
jmp 0x1000525c
push esi
push eax
add esp, 4
sub esi, 0x17f6a
pop esi
push esi
or esi, 0x6c0e
and esi, 0x14b90
or esi, 0xe2e8
call 0x1000528a
add byte [edi], bh
inc esi
xor edi, dword [edx]
inc eax
xor edx, dword [eax + 0x41]
cmp eax, dword [ebx - 0x74a1fb3c]
test dword [edx + edi*8 - 1], eax
jmp [ebx]
Function at 0x1000519a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
mov byte [ebp - 0xddc], 0x52
mov byte [ebp - 0xddb], 0xb9
mov byte [ebp - 0xdda], 0x10
mov byte [ebp - 0xdd9], 0x10
mov byte [ebp - 0xdd8], 0x10
mov byte [ebp - 0xdd7], 0x10
mov byte [ebp - 0xdd6], 0x5a
push edx
push esi
add esp, 4
add edx, 0xd9f3
pop edx
push ebx
push edx
add esp, 4
xor ebx, 0xc986
or ebx, 0x137cf
pop ebx
push eax
and eax, 0xe8da
or eax, 0x54a0
jmp 0x1000511c
pop eax
mov byte [ebp - 0xdd4], 0x52
mov byte [ebp - 0xdd3], 0xb9
mov byte [ebp - 0xdd2], 0x20
mov byte [ebp - 0xdd1], 0x20
mov byte [ebp - 0xdd0], 0x20
mov byte [ebp - 0xdcf], 0x20
mov byte [ebp - 0xdce], 0x5a
push edi
push esi
add esp, 4
call 0x1000515f
add byte [edi + 0x45], cl
cmp dword [ebx + 0x4e], eax
cmp eax, dword [ebx - 0x307efb3c]
sub eax, dword [ebx]
add byte [eax], al
add edi, 0x13a25
call 0x1000517c
add byte [edi], bh
cmp al, 0x37
cmp edi, dword [ebx]
dec ebp
dec esp
add esp, 4
pop edi
mov dword [ebp - 0x2774], 0xe
push ecx
call 0x1000519a
add byte [ebx + eax*2], dh
inc esi
cmp byte [esi + 0x42], cl
inc ebp
push eax
dec ebp
add esp, 4
call 0x100051ac
add byte [edi + 0x4b], cl
inc ebp
dec esp
xor al, 0x3b
dec esi
aaa
dec ebx
add esp, 4
jmp 0x100051b5
add ecx, 0xa3ee
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xddc]
mov dword [ebp - 0x18d8], eax
push ecx
jmp 0x100051d8
sub ecx, 0x6bf5
call 0x100051ed
add byte [edi + esi], dh
cmp byte [ebx], bh
dec esi
cmp eax, 0x834d4c32
les eax, [ecx + ebx*2]
push ecx
push eax
add esp, 4
and ecx, 0x4ea2
or ecx, 0x1052c
pop ecx
mov dword [ebp - 0x2778], 0xffffffff
push edi
or edi, 0x2db4
add edi, 0xc419
and edi, 0x6bae
sub edi, 0x12d32
pop edi
push ecx
push ebx
add esp, 4
xor ecx, 0x40a9
or ecx, 0x8247
and ecx, 0x619b
pop ecx
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x5bc], ecx
jmp 0x1000525c
push esi
push eax
add esp, 4
sub esi, 0x17f6a
pop esi
push esi
or esi, 0x6c0e
and esi, 0x14b90
or esi, 0xe2e8
call 0x1000528a
add byte [edi], bh
inc esi
xor edi, dword [edx]
inc eax
xor edx, dword [eax + 0x41]
cmp eax, dword [ebx - 0x74a1fb3c]
test dword [edx + edi*8 - 1], eax
jmp [ebx]
Function at 0x100051ac
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
mov byte [ebp - 0xddc], 0x52
mov byte [ebp - 0xddb], 0xb9
mov byte [ebp - 0xdda], 0x10
mov byte [ebp - 0xdd9], 0x10
mov byte [ebp - 0xdd8], 0x10
mov byte [ebp - 0xdd7], 0x10
mov byte [ebp - 0xdd6], 0x5a
push edx
push esi
add esp, 4
add edx, 0xd9f3
pop edx
push ebx
push edx
add esp, 4
xor ebx, 0xc986
or ebx, 0x137cf
pop ebx
push eax
and eax, 0xe8da
or eax, 0x54a0
jmp 0x1000511c
pop eax
mov byte [ebp - 0xdd4], 0x52
mov byte [ebp - 0xdd3], 0xb9
mov byte [ebp - 0xdd2], 0x20
mov byte [ebp - 0xdd1], 0x20
mov byte [ebp - 0xdd0], 0x20
mov byte [ebp - 0xdcf], 0x20
mov byte [ebp - 0xdce], 0x5a
push edi
push esi
add esp, 4
call 0x1000515f
add byte [edi + 0x45], cl
cmp dword [ebx + 0x4e], eax
cmp eax, dword [ebx - 0x307efb3c]
sub eax, dword [ebx]
add byte [eax], al
add edi, 0x13a25
call 0x1000517c
add byte [edi], bh
cmp al, 0x37
cmp edi, dword [ebx]
dec ebp
dec esp
add esp, 4
pop edi
mov dword [ebp - 0x2774], 0xe
push ecx
call 0x1000519a
add byte [ebx + eax*2], dh
inc esi
cmp byte [esi + 0x42], cl
inc ebp
push eax
dec ebp
add esp, 4
call 0x100051ac
add byte [edi + 0x4b], cl
inc ebp
dec esp
xor al, 0x3b
dec esi
aaa
dec ebx
add esp, 4
jmp 0x100051b5
add ecx, 0xa3ee
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xddc]
mov dword [ebp - 0x18d8], eax
push ecx
jmp 0x100051d8
sub ecx, 0x6bf5
call 0x100051ed
add byte [edi + esi], dh
cmp byte [ebx], bh
dec esi
cmp eax, 0x834d4c32
les eax, [ecx + ebx*2]
push ecx
push eax
add esp, 4
and ecx, 0x4ea2
or ecx, 0x1052c
pop ecx
mov dword [ebp - 0x2778], 0xffffffff
push edi
or edi, 0x2db4
add edi, 0xc419
and edi, 0x6bae
sub edi, 0x12d32
pop edi
push ecx
push ebx
add esp, 4
xor ecx, 0x40a9
or ecx, 0x8247
and ecx, 0x619b
pop ecx
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x5bc], ecx
jmp 0x1000525c
push esi
push eax
add esp, 4
sub esi, 0x17f6a
pop esi
push esi
or esi, 0x6c0e
and esi, 0x14b90
or esi, 0xe2e8
call 0x1000528a
add byte [edi], bh
inc esi
xor edi, dword [edx]
inc eax
xor edx, dword [eax + 0x41]
cmp eax, dword [ebx - 0x74a1fb3c]
test dword [edx + edi*8 - 1], eax
jmp [ebx]
Function at 0x100051ed
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
mov byte [ebp - 0xddc], 0x52
mov byte [ebp - 0xddb], 0xb9
mov byte [ebp - 0xdda], 0x10
mov byte [ebp - 0xdd9], 0x10
mov byte [ebp - 0xdd8], 0x10
mov byte [ebp - 0xdd7], 0x10
mov byte [ebp - 0xdd6], 0x5a
push edx
push esi
add esp, 4
add edx, 0xd9f3
pop edx
push ebx
push edx
add esp, 4
xor ebx, 0xc986
or ebx, 0x137cf
pop ebx
push eax
and eax, 0xe8da
or eax, 0x54a0
jmp 0x1000511c
pop eax
mov byte [ebp - 0xdd4], 0x52
mov byte [ebp - 0xdd3], 0xb9
mov byte [ebp - 0xdd2], 0x20
mov byte [ebp - 0xdd1], 0x20
mov byte [ebp - 0xdd0], 0x20
mov byte [ebp - 0xdcf], 0x20
mov byte [ebp - 0xdce], 0x5a
push edi
push esi
add esp, 4
call 0x1000515f
add byte [edi + 0x45], cl
cmp dword [ebx + 0x4e], eax
cmp eax, dword [ebx - 0x307efb3c]
sub eax, dword [ebx]
add byte [eax], al
add edi, 0x13a25
call 0x1000517c
add byte [edi], bh
cmp al, 0x37
cmp edi, dword [ebx]
dec ebp
dec esp
add esp, 4
pop edi
mov dword [ebp - 0x2774], 0xe
push ecx
call 0x1000519a
add byte [ebx + eax*2], dh
inc esi
cmp byte [esi + 0x42], cl
inc ebp
push eax
dec ebp
add esp, 4
call 0x100051ac
add byte [edi + 0x4b], cl
inc ebp
dec esp
xor al, 0x3b
dec esi
aaa
dec ebx
add esp, 4
jmp 0x100051b5
add ecx, 0xa3ee
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xddc]
mov dword [ebp - 0x18d8], eax
push ecx
jmp 0x100051d8
sub ecx, 0x6bf5
call 0x100051ed
add byte [edi + esi], dh
cmp byte [ebx], bh
dec esi
cmp eax, 0x834d4c32
les eax, [ecx + ebx*2]
push ecx
push eax
add esp, 4
and ecx, 0x4ea2
or ecx, 0x1052c
pop ecx
mov dword [ebp - 0x2778], 0xffffffff
push edi
or edi, 0x2db4
add edi, 0xc419
and edi, 0x6bae
sub edi, 0x12d32
pop edi
push ecx
push ebx
add esp, 4
xor ecx, 0x40a9
or ecx, 0x8247
and ecx, 0x619b
pop ecx
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x5bc], ecx
jmp 0x1000525c
push esi
push eax
add esp, 4
sub esi, 0x17f6a
pop esi
push esi
or esi, 0x6c0e
and esi, 0x14b90
or esi, 0xe2e8
call 0x1000528a
add byte [edi], bh
inc esi
xor edi, dword [edx]
inc eax
xor edx, dword [eax + 0x41]
cmp eax, dword [ebx - 0x74a1fb3c]
test dword [edx + edi*8 - 1], eax
jmp [ebx]
Function at 0x1000528a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
mov byte [ebp - 0xddc], 0x52
mov byte [ebp - 0xddb], 0xb9
mov byte [ebp - 0xdda], 0x10
mov byte [ebp - 0xdd9], 0x10
mov byte [ebp - 0xdd8], 0x10
mov byte [ebp - 0xdd7], 0x10
mov byte [ebp - 0xdd6], 0x5a
push edx
push esi
add esp, 4
add edx, 0xd9f3
pop edx
push ebx
push edx
add esp, 4
xor ebx, 0xc986
or ebx, 0x137cf
pop ebx
push eax
and eax, 0xe8da
or eax, 0x54a0
jmp 0x1000511c
pop eax
mov byte [ebp - 0xdd4], 0x52
mov byte [ebp - 0xdd3], 0xb9
mov byte [ebp - 0xdd2], 0x20
mov byte [ebp - 0xdd1], 0x20
mov byte [ebp - 0xdd0], 0x20
mov byte [ebp - 0xdcf], 0x20
mov byte [ebp - 0xdce], 0x5a
push edi
push esi
add esp, 4
call 0x1000515f
add byte [edi + 0x45], cl
cmp dword [ebx + 0x4e], eax
cmp eax, dword [ebx - 0x307efb3c]
sub eax, dword [ebx]
add byte [eax], al
add edi, 0x13a25
call 0x1000517c
add byte [edi], bh
cmp al, 0x37
cmp edi, dword [ebx]
dec ebp
dec esp
add esp, 4
pop edi
mov dword [ebp - 0x2774], 0xe
push ecx
call 0x1000519a
add byte [ebx + eax*2], dh
inc esi
cmp byte [esi + 0x42], cl
inc ebp
push eax
dec ebp
add esp, 4
call 0x100051ac
add byte [edi + 0x4b], cl
inc ebp
dec esp
xor al, 0x3b
dec esi
aaa
dec ebx
add esp, 4
jmp 0x100051b5
add ecx, 0xa3ee
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xddc]
mov dword [ebp - 0x18d8], eax
push ecx
jmp 0x100051d8
sub ecx, 0x6bf5
call 0x100051ed
add byte [edi + esi], dh
cmp byte [ebx], bh
dec esi
cmp eax, 0x834d4c32
les eax, [ecx + ebx*2]
push ecx
push eax
add esp, 4
and ecx, 0x4ea2
or ecx, 0x1052c
pop ecx
mov dword [ebp - 0x2778], 0xffffffff
push edi
or edi, 0x2db4
add edi, 0xc419
and edi, 0x6bae
sub edi, 0x12d32
pop edi
push ecx
push ebx
add esp, 4
xor ecx, 0x40a9
or ecx, 0x8247
and ecx, 0x619b
pop ecx
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x5bc], ecx
jmp 0x1000525c
push esi
push eax
add esp, 4
sub esi, 0x17f6a
pop esi
push esi
or esi, 0x6c0e
and esi, 0x14b90
or esi, 0xe2e8
call 0x1000528a
add byte [edi], bh
inc esi
xor edi, dword [edx]
inc eax
xor edx, dword [eax + 0x41]
cmp eax, dword [ebx - 0x74a1fb3c]
test dword [edx + edi*8 - 1], eax
jmp [ebx]
Function at 0x100053ee
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x5bc]
add edx, 1
mov dword [ebp - 0x5bc], edx
add esp, 4
pop edx
push edx
add edx, 0xef3a
add edx, 0x109d1
xor edx, 0x1ce
xor edx, 0xc4b
pop edx
mov eax, dword [ebp - 0xc0c]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xc08]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x1000542e
mov dword [ebp - 0x18dc], 1
jmp 0x10005438
mov dword [ebp - 0x18dc], 0xffffffff
mov ecx, dword [ebp - 0x18dc]
mov dword [ebp - 0xe84], ecx
jmp 0x100054aa
mov edx, dword [ebp - 0xe84]
mov dword [ebp - 0x18e0], edx
cmp dword [ebp - 0x18e0], 0
jne 0x100054ff
push eax
push ebx
add esp, 4
and eax, 0x1597c
or eax, 0x5d80
or eax, 0x6e7e
pop eax
push edi
or edi, 0x2aa2
and edi, 0x1231
sub edi, 0x94b
and edi, 0xf5a7
pop edi
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x494], eax
jmp 0x10005540
jmp 0x1000524d

Function at 0x10005454
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xe80], 0
jle 0x100054aa
push esi
push edx
add esp, 4
xor esi, 0x9f8
add esi, 0x37a2
pop esi
push edx
and edx, 0x11e1e
and edx, 0xe67d
sub edx, 0xd18
pop edx
push ecx
push esi
add esp, 4
or ecx, 0x15dc6
pop ecx
mov edx, dword [ebp - 0xc0c]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xc08]
movzx edx, byte [ecx]
cmp eax, edx
je 0x10005446
push edx
or edx, 0xb7b4
call fcn.100053ee
add byte [edx], bh
inc ecx
inc eax
dec edi
inc ecx
dec ebp
push ecx
call fcn.10005454
add byte [esi + 0x46], al
push eax
xor al, 0x4d
inc eax
add esp, 4
xor ecx, 0xfe01
pop ecx
push ebx
or ebx, 0x15b2c
call 0x10005474
add byte [edi + 0x4d], cl
dec esi
cmp esi, dword [esi + ecx*2]
inc eax
dec edx
dec esi
add esp, 4
pop ebx
mov edx, dword [ebp - 0xe80]
sub edx, 1
mov dword [ebp - 0xe80], edx
mov eax, dword [ebp - 0xc0c]
add eax, 1
mov dword [ebp - 0xc0c], eax
mov ecx, dword [ebp - 0xc08]
add ecx, 1
mov dword [ebp - 0xc08], ecx
jmp 0x10005385

Function at 0x10005474
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xe80], 0
jle 0x100054aa
push esi
push edx
add esp, 4
xor esi, 0x9f8
add esi, 0x37a2
pop esi
push edx
and edx, 0x11e1e
and edx, 0xe67d
sub edx, 0xd18
pop edx
push ecx
push esi
add esp, 4
or ecx, 0x15dc6
pop ecx
mov edx, dword [ebp - 0xc0c]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xc08]
movzx edx, byte [ecx]
cmp eax, edx
je 0x10005446
push edx
or edx, 0xb7b4
call fcn.100053ee
add byte [edx], bh
inc ecx
inc eax
dec edi
inc ecx
dec ebp
push ecx
call fcn.10005454
add byte [esi + 0x46], al
push eax
xor al, 0x4d
inc eax
add esp, 4
xor ecx, 0xfe01
pop ecx
push ebx
or ebx, 0x15b2c
call 0x10005474
add byte [edi + 0x4d], cl
dec esi
cmp esi, dword [esi + ecx*2]
inc eax
dec edx
dec esi
add esp, 4
pop ebx
mov edx, dword [ebp - 0xe80]
sub edx, 1
mov dword [ebp - 0xe80], edx
mov eax, dword [ebp - 0xc0c]
add eax, 1
mov dword [ebp - 0xc0c], eax
mov ecx, dword [ebp - 0xc08]
add ecx, 1
mov dword [ebp - 0xc08], ecx
jmp 0x10005385
Function at 0x10006077
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push edx
add esp, 4
sub edx, 0x70d8
sub edx, 0xec46
or edx, 0x6746
pop edx
push ebx
sub ebx, 0xc2b4
call 0x10006077
add byte [esi + 0x33], cl
inc ecx
dec ecx
xor ecx, dword [edx + 0x34]
inc esi
aaa
add esp, 4
pop ebx
lea edx, [ebp - 0x1ac8]
mov dword [ebp - 0xea0], edx
mov eax, dword [ebp - 0x5c8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xe9c], ecx
xor edx, edx
mov word [ebp - 0x268], dx
xor eax, eax
mov word [ebp - 0x13c], ax
push ecx
push eax
add esp, 4
and ecx, 0xbc60
add ecx, 0xed69
xor ecx, 0xdb21
pop ecx
mov dword [ebp - 0xea0], ecx
mov dx, word [ebp - 0x12b4]
mov word [ebp - 0x13c], dx
push eax
push ecx
add esp, 4
add eax, 0xcd3e
or eax, 0xbaff
enter 0xffffffffffffbaff, 0
add byte [ecx + 0x183e4c0], al
add byte [eax + 0x51], bl
push ebx
add esp, 4
sub ecx, 0x6bb8
and ecx, 0x1431e
pop ecx
push ebx
xor ebx, 0xac18
pop ebx
movzx eax, word [ebp - 0x13c]
test eax, eax
jne 0x10006189
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
sub ecx, edx
mov dword [ebp - 0x1900], ecx
jmp 0x100061ec
movzx eax, word [ebp - 0x268]
movzx ecx, word [ebp - 0x13c]
cmp eax, ecx
je 0x100060a8
movzx edx, word [ebp - 0x268]
xor edx, 0x20
movzx eax, word [ebp - 0x13c]
cmp edx, eax
je 0x100060a8
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
cmp ecx, edx
jge 0x100061d6
mov dword [ebp - 0x18fc], 0xffffffff
jmp 0x100061e0
mov dword [ebp - 0x18fc], 1
mov eax, dword [ebp - 0x18fc]
mov dword [ebp - 0x1900], eax
cmp dword [ebp - 0x1900], 0
jne 0x10006235
push edx
and edx, 0x11a58
jmp 0x10006204
pop edx
push ecx
xor ecx, 0x168bb
or ecx, 0xf8ae
pop ecx
push eax
or eax, 0x14de3
and eax, 0x221b
push ebx
push ebx
add esp, 4
sub ebx, 0x14952
add ebx, 0x5a94
and ebx, 0x12d6e
or ebx, 0xeae4
pop ebx
push edx
call 0x10006263
add byte [ecx + 0x41], al
inc ebx
inc eax
inc edx
xor al, 0x3f
inc edx
add esp, 4
pop edx
mov edx, dword [ebp - 0x5c8]
mov eax, dword [edx]
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [ebp - 0xea4]
je 0x10006293
mov edx, dword [ebp - 0x5c8]
cmp dword [edx + 0x30], 0
jne 0x10006049
mov dword [ebp - 0x870], 0
push esi
push edi
add esp, 4
and esi, 0x12577
pop esi
push esi
sub esi, 0x16974
sub esi, 0x17a8f
add esi, 0xe936
pop esi
push eax
push eax
add esp, 4
or eax, 0x8ef8
jmp 0x100062ce
pop eax
cmp dword [ebp - 0x870], 0
mov ebp, 0xfffff790
add byte [ebp + 0x41], dh
push eax
xor eax, 0xad7f
add eax, 0x12c42
call 0x100062f4
add byte [ebx], dh
inc eax
cmp edi, dword [ecx*2 + 0x4e354f36]
add esp, 4
pop eax
push ebx
push eax
add esp, 4
add ebx, 0x111f8
and ebx, 0x12f23
pop ebx
mov dword [ebp - 0x8bc], 0
jmp 0x10006e55
push eax
sub eax, 0x74ec
pop eax
push ebx
sub ebx, 0x138d2
xor ebx, 0x4ebc
sub ebx, 0xa418
xor ebx, 0x1625d
pop ebx
push edx
sub edx, 0xaf17
pop edx
push edi
add edi, 0x14e73
pop edi
mov eax, dword [ebp - 0x870]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x880], 0
mov edx, dword [ebp - 0x428]
mov dword [ebp - 0x1904], edx
cmp dword [ebp - 0x1904], 0
jne 0x1000638a
mov eax, dword [ebp - 0x880]
invalid
Function at 0x100060c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
jmp 0x100060c9
call 0x100060d6
add byte [esi + 0x4b], cl
cmp byte [ecx + 0x3e], al
push eax
inc edx
add esp, 4
pop edx
mov ecx, dword [ebp - 0xe9c]

Function at 0x100060d6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
jmp 0x100060c9
call 0x100060d6
add byte [esi + 0x4b], cl
cmp byte [ecx + 0x3e], al
push eax
inc edx
add esp, 4
pop edx
mov ecx, dword [ebp - 0xe9c]

Function at 0x100060e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dx, word [ecx]
mov word [ebp - 0x12b2], dx
mov eax, dword [ebp - 0xe9c]
add eax, 2
mov dword [ebp - 0xe9c], eax
mov cx, word [ebp - 0x12b2]
mov word [ebp - 0x268], cx
mov edx, dword [ebp - 0xea0]
mov ax, word [edx]
mov word [ebp - 0x12b4], ax
mov ecx, dword [ebp - 0xea0]
add ecx, 2
Function at 0x10006120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push edx
add esp, 4
sub edx, 0x70d8
sub edx, 0xec46
or edx, 0x6746
pop edx
push ebx
sub ebx, 0xc2b4
call 0x10006077
add byte [esi + 0x33], cl
inc ecx
dec ecx
xor ecx, dword [edx + 0x34]
inc esi
aaa
add esp, 4
pop ebx
lea edx, [ebp - 0x1ac8]
mov dword [ebp - 0xea0], edx
mov eax, dword [ebp - 0x5c8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xe9c], ecx
xor edx, edx
mov word [ebp - 0x268], dx
xor eax, eax
mov word [ebp - 0x13c], ax
push ecx
push eax
add esp, 4
and ecx, 0xbc60
add ecx, 0xed69
xor ecx, 0xdb21
pop ecx
mov dword [ebp - 0xea0], ecx
mov dx, word [ebp - 0x12b4]
mov word [ebp - 0x13c], dx
push eax
push ecx
add esp, 4
add eax, 0xcd3e
or eax, 0xbaff
enter 0xffffffffffffbaff, 0
add byte [ecx + 0x183e4c0], al
add byte [eax + 0x51], bl
push ebx
add esp, 4
sub ecx, 0x6bb8
and ecx, 0x1431e
pop ecx
push ebx
xor ebx, 0xac18
pop ebx
movzx eax, word [ebp - 0x13c]
test eax, eax
jne 0x10006189
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
sub ecx, edx
mov dword [ebp - 0x1900], ecx
jmp 0x100061ec
movzx eax, word [ebp - 0x268]
movzx ecx, word [ebp - 0x13c]
cmp eax, ecx
je 0x100060a8
movzx edx, word [ebp - 0x268]
xor edx, 0x20
movzx eax, word [ebp - 0x13c]
cmp edx, eax
je 0x100060a8
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
cmp ecx, edx
jge 0x100061d6
mov dword [ebp - 0x18fc], 0xffffffff
jmp 0x100061e0
mov dword [ebp - 0x18fc], 1
mov eax, dword [ebp - 0x18fc]
mov dword [ebp - 0x1900], eax
cmp dword [ebp - 0x1900], 0
jne 0x10006235
push edx
and edx, 0x11a58
jmp 0x10006204
pop edx
push ecx
xor ecx, 0x168bb
or ecx, 0xf8ae
pop ecx
push eax
or eax, 0x14de3
and eax, 0x221b
push ebx
push ebx
add esp, 4
sub ebx, 0x14952
add ebx, 0x5a94
and ebx, 0x12d6e
or ebx, 0xeae4
pop ebx
push edx
call 0x10006263
add byte [ecx + 0x41], al
inc ebx
inc eax
inc edx
xor al, 0x3f
inc edx
add esp, 4
pop edx
mov edx, dword [ebp - 0x5c8]
mov eax, dword [edx]
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [ebp - 0xea4]
je 0x10006293
mov edx, dword [ebp - 0x5c8]
cmp dword [edx + 0x30], 0
jne 0x10006049
mov dword [ebp - 0x870], 0
push esi
push edi
add esp, 4
and esi, 0x12577
pop esi
push esi
sub esi, 0x16974
sub esi, 0x17a8f
add esi, 0xe936
pop esi
push eax
push eax
add esp, 4
or eax, 0x8ef8
jmp 0x100062ce
pop eax
cmp dword [ebp - 0x870], 0
mov ebp, 0xfffff790
add byte [ebp + 0x41], dh
push eax
xor eax, 0xad7f
add eax, 0x12c42
call 0x100062f4
add byte [ebx], dh
inc eax
cmp edi, dword [ecx*2 + 0x4e354f36]
add esp, 4
pop eax
push ebx
push eax
add esp, 4
add ebx, 0x111f8
and ebx, 0x12f23
pop ebx
mov dword [ebp - 0x8bc], 0
jmp 0x10006e55
push eax
sub eax, 0x74ec
pop eax
push ebx
sub ebx, 0x138d2
xor ebx, 0x4ebc
sub ebx, 0xa418
xor ebx, 0x1625d
pop ebx
push edx
sub edx, 0xaf17
pop edx
push edi
add edi, 0x14e73
pop edi
mov eax, dword [ebp - 0x870]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x880], 0
mov edx, dword [ebp - 0x428]
mov dword [ebp - 0x1904], edx
cmp dword [ebp - 0x1904], 0
jne 0x1000638a
mov eax, dword [ebp - 0x880]
invalid
Function at 0x10006140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
enter 0xffffffffffffbaff, 0
add byte [ecx + 0x183e4c0], al
add byte [eax + 0x51], bl

Function at 0x10006220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or eax, 0x4837
pop eax
mov ecx, dword [ebp - 0x5c8]
mov dword [ebp - 0x870], ecx
jmp 0x1000629d