joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429564
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
sub eax, dword [esp + 0x10]
sar eax, 2
push edi
mov edi, dword [esp + 0x20]
test eax, eax
je 0x42963c
push ebx
xor ebx, ebx
push esi
mov esi, ebx
cmp dword [esp + 0x2c], ebx
jbe 0x42963a
push ebp
mov dword [esp + 0x10], ebx
mov ebp, 0x4671e0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov al, byte [edi + esi]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
push str.Own_head
push ebp
mov byte [edi + esi], al
call fcn.0040146b
push eax
call fcn.004027a6
mov al, byte [edi + esi]
add al, 0x4e
xor al, 0xdc
push str.Earth
push ebp
mov byte [edi + esi], al
call fcn.0040146b
push eax
call fcn.004027a6
mov al, byte [edi + esi]
xor al, 0xac
sub al, 0x65
xor al, 0x22
sub al, 0x73
push 0x42a594
mov byte [edi + esi], al
call fcn.00410dee
add esp, 0x1c
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
push ebx
call fcn.00401b63
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
xor byte [edi + esi], al
mov eax, dword [esp + 0x18]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
call fcn.00401a43
inc esi
mov dword [esp + 0x18], ebx
pop ecx
pop ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
cmp esi, dword [esp + 0x30]
jb 0x4295a1
pop ebp
pop esi
pop ebx
lea ecx, [esp + 0x14]
call fcn.004058b0
pop edi
add esp, 0xc
ret 0x14

Function at 0x42964c
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x429668
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x2526249
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x21b54478
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x1000d9d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov esi, dword [eax]
cmp esi, eax
je 0x1000da57
push ebx

Function at 0x1000d9de
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d44
push ebx
push esi
push edi
push edi
push edi
add esp, 4
xor edi, 0x16f3
pop edi
push edi
push esi
add esp, 4
xor edi, 0x8fa
jmp 0x1000da07
or edi, 0x9281
pop edi
push edi
and edi, 0xb7e0
add edi, 0x13ea2
pop edi
mov dword [ebp - 0x724], 0
call 0x1000da2b
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x724], eax
push ebx
jmp 0x1000da3d
or ebx, 0x1c55
pop ebx
push edx
add edx, 0xb5ca
jmp 0x1000da50
xor edx, 0x63ee
pop edx
push eax
call 0x1000da65
add byte [esi], dh
dec esi
dec ecx
dec esp
inc ecx
inc edi
add esp, 4
pop eax
push eax
call 0x1000da78
add byte [ebx + 0x3d], al
xor cl, byte [edx + 0x32]
inc esp
inc edi
add esp, 4
jmp 0x1000da81
or eax, 0x46ce
pop eax
push ecx
and ecx, 0x15c26
or ecx, 0x4e73
jmp 0x1000da9a
pop ecx
mov byte [ebp - 0xb48], 0x52
mov byte [ebp - 0xb47], 0xb9
mov byte [ebp - 0xb46], 0x10
mov byte [ebp - 0xb45], 0x10
mov byte [ebp - 0xb44], 0x10
mov byte [ebp - 0xb43], 0x10
mov byte [ebp - 0xb42], 0x5a
push eax
push esi
add esp, 4
call 0x1000dadf
add byte [edx + 0x44], cl
cmp eax, 0x4b403437
xor eax, 0x8104c483
invalid

Function at 0x1000da65
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d44
push ebx
push esi
push edi
push edi
push edi
add esp, 4
xor edi, 0x16f3
pop edi
push edi
push esi
add esp, 4
xor edi, 0x8fa
jmp 0x1000da07
or edi, 0x9281
pop edi
push edi
and edi, 0xb7e0
add edi, 0x13ea2
pop edi
mov dword [ebp - 0x724], 0
call 0x1000da2b
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x724], eax
push ebx
jmp 0x1000da3d
or ebx, 0x1c55
pop ebx
push edx
add edx, 0xb5ca
jmp 0x1000da50
xor edx, 0x63ee
pop edx
push eax
call 0x1000da65
add byte [esi], dh
dec esi
dec ecx
dec esp
inc ecx
inc edi
add esp, 4
pop eax
push eax
call 0x1000da78
add byte [ebx + 0x3d], al
xor cl, byte [edx + 0x32]
inc esp
inc edi
add esp, 4
jmp 0x1000da81
or eax, 0x46ce
pop eax
push ecx
and ecx, 0x15c26
or ecx, 0x4e73
jmp 0x1000da9a
pop ecx
mov byte [ebp - 0xb48], 0x52
mov byte [ebp - 0xb47], 0xb9
mov byte [ebp - 0xb46], 0x10
mov byte [ebp - 0xb45], 0x10
mov byte [ebp - 0xb44], 0x10
mov byte [ebp - 0xb43], 0x10
mov byte [ebp - 0xb42], 0x5a
push eax
push esi
add esp, 4
call 0x1000dadf
add byte [edx + 0x44], cl
cmp eax, 0x4b403437
xor eax, 0x8104c483
invalid
Function at 0x1000da78
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d44
push ebx
push esi
push edi
push edi
push edi
add esp, 4
xor edi, 0x16f3
pop edi
push edi
push esi
add esp, 4
xor edi, 0x8fa
jmp 0x1000da07
or edi, 0x9281
pop edi
push edi
and edi, 0xb7e0
add edi, 0x13ea2
pop edi
mov dword [ebp - 0x724], 0
call 0x1000da2b
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x724], eax
push ebx
jmp 0x1000da3d
or ebx, 0x1c55
pop ebx
push edx
add edx, 0xb5ca
jmp 0x1000da50
xor edx, 0x63ee
pop edx
push eax
call 0x1000da65
add byte [esi], dh
dec esi
dec ecx
dec esp
inc ecx
inc edi
add esp, 4
pop eax
push eax
call 0x1000da78
add byte [ebx + 0x3d], al
xor cl, byte [edx + 0x32]
inc esp
inc edi
add esp, 4
jmp 0x1000da81
or eax, 0x46ce
pop eax
push ecx
and ecx, 0x15c26
or ecx, 0x4e73
jmp 0x1000da9a
pop ecx
mov byte [ebp - 0xb48], 0x52
mov byte [ebp - 0xb47], 0xb9
mov byte [ebp - 0xb46], 0x10
mov byte [ebp - 0xb45], 0x10
mov byte [ebp - 0xb44], 0x10
mov byte [ebp - 0xb43], 0x10
mov byte [ebp - 0xb42], 0x5a
push eax
push esi
add esp, 4
call 0x1000dadf
add byte [edx + 0x44], cl
cmp eax, 0x4b403437
xor eax, 0x8104c483
invalid

Function at 0x1000dadf
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d44
push ebx
push esi
push edi
push edi
push edi
add esp, 4
xor edi, 0x16f3
pop edi
push edi
push esi
add esp, 4
xor edi, 0x8fa
jmp 0x1000da07
or edi, 0x9281
pop edi
push edi
and edi, 0xb7e0
add edi, 0x13ea2
pop edi
mov dword [ebp - 0x724], 0
call 0x1000da2b
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x724], eax
push ebx
jmp 0x1000da3d
or ebx, 0x1c55
pop ebx
push edx
add edx, 0xb5ca
jmp 0x1000da50
xor edx, 0x63ee
pop edx
push eax
call 0x1000da65
add byte [esi], dh
dec esi
dec ecx
dec esp
inc ecx
inc edi
add esp, 4
pop eax
push eax
call 0x1000da78
add byte [ebx + 0x3d], al
xor cl, byte [edx + 0x32]
inc esp
inc edi
add esp, 4
jmp 0x1000da81
or eax, 0x46ce
pop eax
push ecx
and ecx, 0x15c26
or ecx, 0x4e73
jmp 0x1000da9a
pop ecx
mov byte [ebp - 0xb48], 0x52
mov byte [ebp - 0xb47], 0xb9
mov byte [ebp - 0xb46], 0x10
mov byte [ebp - 0xb45], 0x10
mov byte [ebp - 0xb44], 0x10
mov byte [ebp - 0xb43], 0x10
mov byte [ebp - 0xb42], 0x5a
push eax
push esi
add esp, 4
call 0x1000dadf
add byte [edx + 0x44], cl
cmp eax, 0x4b403437
xor eax, 0x8104c483
invalid
Function at 0x1000dfb0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x7d14
pop eax
push esi
call 0x1000dfc8
add byte [eax + 0x38], al
dec eax
xor esi, dword [esi]
dec ebp
dec ebp
dec ebp
inc esp
inc edx
add esp, 4
pop esi
mov dword [ebp - 0x1d20], 0xffffffff
push edi
xor edi, 0x17660
pop edi
push ecx
xor ecx, 0x73e5
int1
in eax, 0x73
add byte [eax], al
call 0x1000dff2
add byte [edi + 0x50], al
dec ebx
inc edx
dec edi
dec ebx
xor eax, dword [ebx + 0xae804c4]
add byte [eax], al
add byte [eax], al
cmp byte [edi + 0x4d], cl
aas
xor eax, dword [esi + 0x45]
inc ebp
aaa
add esp, 4
pop ecx
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x4b8], eax
jmp 0x1000e025

Function at 0x1000dfc8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x7d14
pop eax
push esi
call 0x1000dfc8
add byte [eax + 0x38], al
dec eax
xor esi, dword [esi]
dec ebp
dec ebp
dec ebp
inc esp
inc edx
add esp, 4
pop esi
mov dword [ebp - 0x1d20], 0xffffffff
push edi
xor edi, 0x17660
pop edi
push ecx
xor ecx, 0x73e5
int1
in eax, 0x73
add byte [eax], al
call 0x1000dff2
add byte [edi + 0x50], al
dec ebx
inc edx
dec edi
dec ebx
xor eax, dword [ebx + 0xae804c4]
add byte [eax], al
add byte [eax], al
cmp byte [edi + 0x4d], cl
aas
xor eax, dword [esi + 0x45]
inc ebp
aaa
add esp, 4
pop ecx
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x4b8], eax
jmp 0x1000e025

Function at 0x1000dff2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x7d14
pop eax
push esi
call 0x1000dfc8
add byte [eax + 0x38], al
dec eax
xor esi, dword [esi]
dec ebp
dec ebp
dec ebp
inc esp
inc edx
add esp, 4
pop esi
mov dword [ebp - 0x1d20], 0xffffffff
push edi
xor edi, 0x17660
pop edi
push ecx
xor ecx, 0x73e5
int1
in eax, 0x73
add byte [eax], al
call 0x1000dff2
add byte [edi + 0x50], al
dec ebx
inc edx
dec edi
dec ebx
xor eax, dword [ebx + 0xae804c4]
add byte [eax], al
add byte [eax], al
cmp byte [edi + 0x4d], cl
aas
xor eax, dword [esi + 0x45]
inc ebp
aaa
add esp, 4
pop ecx
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x4b8], eax
jmp 0x1000e025

Function at 0x1000e004
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x7d14
pop eax
push esi
call 0x1000dfc8
add byte [eax + 0x38], al
dec eax
xor esi, dword [esi]
dec ebp
dec ebp
dec ebp
inc esp
inc edx
add esp, 4
pop esi
mov dword [ebp - 0x1d20], 0xffffffff
push edi
xor edi, 0x17660
pop edi
push ecx
xor ecx, 0x73e5
int1
in eax, 0x73
add byte [eax], al
call 0x1000dff2
add byte [edi + 0x50], al
dec ebx
inc edx
dec edi
dec ebx
xor eax, dword [ebx + 0xae804c4]
add byte [eax], al
add byte [eax], al
cmp byte [edi + 0x4d], cl
aas
xor eax, dword [esi + 0x45]
inc ebp
aaa
add esp, 4
pop ecx
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x4b8], eax
jmp 0x1000e025
Function at 0x1000e0d7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x4b8]
add ecx, 1
mov dword [ebp - 0x4b8], ecx
push edx
push ecx
add esp, 4
xor edx, 0x13f71
sub edx, 0x1601
add edx, 0x1628
xor edx, 0x14e85
pop edx
push esi
add esi, 0x5526
add esi, 0xb3f0
xor esi, 0x163c6
pop esi
mov edx, dword [ebp - 0x4b8]
sub edx, dword [ebp - 0x724]
cmp edx, 0xffffffff
jb 0x1000e09f
push edx
push ebx
add esp, 4
xor edx, 0xc5fd
lds eax, [eax]
add byte [edx + 0x50], bl
sub eax, 0xa061
sub eax, 0x29a8
pop eax
push ecx
push eax
add esp, 4
sub ecx, 0x1415
sub ecx, 0x1572b
or ecx, 0x4b73
pop ecx
jmp 0x1000e2cd
mov dword [ebp - 0xc0c], 7
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0xa54], eax
push esi
and esi, 0x130c4
xor esi, 0x3e3a
pop esi
push ecx
push ecx
add esp, 4
call 0x1000e0d7
add byte [esi + 0x39], cl
dec ebp
cmp dword [ebx], esi
xor eax, dword [edi + eax*2 + 0x37]
add esp, 4
and ecx, 0xba28
sub ecx, 0x141b9
pop ecx
mov ecx, dword [ebp - 0x14f4]
mov dword [ebp - 0xa4c], ecx
mov dword [ebp - 0xc10], 0
invalid
xchg ebp, eax
dec eax

Function at 0x1000e180
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esi, 0x10054
xor esi, 0x6a5e
pop esi
mov ecx, dword [ebp - 0xa54]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xa4c]
movzx ecx, byte [eax]
cmp edx, ecx
je 0x1000e20f
push ecx
push eax
add esp, 4
sub ecx, 0x6b66
or ecx, 0x433a
xor ecx, 0x136b9
pop ecx
push ebx
and ebx, 0xeca3
call 0x1000e1d1
add byte [edx], dh
inc eax
cmp dword [edx + 0x4f], eax
cmp al, 0x35
aas
cmp al, 0x83
les eax, [ebx + ebx*2]
mov edx, dword [ebp - 0xa54]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa4c]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x1000e1f7
mov dword [ebp - 0x14f8], 1
jmp 0x1000e201
mov dword [ebp - 0x14f8], 0xffffffff
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0xc10], eax
jmp 0x1000e273
push edi
push ebx
add esp, 4
and edi, 0x1b1b
pop edi
push esi
sub esi, 0x8d24
sub esi, 0xdcc
or esi, 0xef33
add esi, 0xd19a
pop esi
push esi
push esi
add esp, 4
or esi, 0x13b79

Function at 0x1000e1d1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esi, 0x10054
xor esi, 0x6a5e
pop esi
mov ecx, dword [ebp - 0xa54]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xa4c]
movzx ecx, byte [eax]
cmp edx, ecx
je 0x1000e20f
push ecx
push eax
add esp, 4
sub ecx, 0x6b66
or ecx, 0x433a
xor ecx, 0x136b9
pop ecx
push ebx
and ebx, 0xeca3
call 0x1000e1d1
add byte [edx], dh
inc eax
cmp dword [edx + 0x4f], eax
cmp al, 0x35
aas
cmp al, 0x83
les eax, [ebx + ebx*2]
mov edx, dword [ebp - 0xa54]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa4c]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x1000e1f7
mov dword [ebp - 0x14f8], 1
jmp 0x1000e201
mov dword [ebp - 0x14f8], 0xffffffff
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0xc10], eax
jmp 0x1000e273
push edi
push ebx
add esp, 4
and edi, 0x1b1b
pop edi
push esi
sub esi, 0x8d24
sub esi, 0xdcc
or esi, 0xef33
add esi, 0xd19a
pop esi
push esi
push esi
add esp, 4
or esi, 0x13b79
Function at 0x1000e240
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc0c], 0
jle 0x1000e273
push edi
xor edi, 0x4b0d
add edi, 0x4be3
pop edi
push esi
push ebx
add esp, 4
jmp 0x1000e174
xor esi, 0xf3c1
pop esi
push esi
push ebx
add esp, 4
pop esi
mov ecx, dword [ebp - 0xc0c]
sub ecx, 1
mov dword [ebp - 0xc0c], ecx
mov edx, dword [ebp - 0xa54]
add edx, 1
mov dword [ebp - 0xa54], edx
mov eax, dword [ebp - 0xa4c]
add eax, 1
mov dword [ebp - 0xa4c], eax
jmp 0x1000e14e
mov ecx, dword [ebp - 0xc10]
mov dword [ebp - 0x14fc], ecx
cmp dword [ebp - 0x14fc], 0
jne 0x1000e2c8
push esi
push ecx
add esp, 4
add esi, 0x11ae
sub esi, 0x12815
call 0x1000e2a8
add byte [eax + 0x3c], al
inc ecx
aas
dec esp
inc ebp
dec eax
add esp, 4
pop esi
push edx
add edx, 0x103ab
add edx, 0x14a66
pop edx
mov edx, dword [ebp - 0x4b8]
mov dword [ebp - 0xa48], edx
jmp 0x1000e309
jmp fcn.1000e016
push esi
push edi
add esp, 4
xor esi, 0xfea6
add esi, 0x110e0
call 0x1000e327

Function at 0x1000e2a8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc0c], 0
jle 0x1000e273
push edi
xor edi, 0x4b0d
add edi, 0x4be3
pop edi
push esi
push ebx
add esp, 4
jmp 0x1000e174
xor esi, 0xf3c1
pop esi
push esi
push ebx
add esp, 4
pop esi
mov ecx, dword [ebp - 0xc0c]
sub ecx, 1
mov dword [ebp - 0xc0c], ecx
mov edx, dword [ebp - 0xa54]
add edx, 1
mov dword [ebp - 0xa54], edx
mov eax, dword [ebp - 0xa4c]
add eax, 1
mov dword [ebp - 0xa4c], eax
jmp 0x1000e14e
mov ecx, dword [ebp - 0xc10]
mov dword [ebp - 0x14fc], ecx
cmp dword [ebp - 0x14fc], 0
jne 0x1000e2c8
push esi
push ecx
add esp, 4
add esi, 0x11ae
sub esi, 0x12815
call 0x1000e2a8
add byte [eax + 0x3c], al
inc ecx
aas
dec esp
inc ebp
dec eax
add esp, 4
pop esi
push edx
add edx, 0x103ab
add edx, 0x14a66
pop edx
mov edx, dword [ebp - 0x4b8]
mov dword [ebp - 0xa48], edx
jmp 0x1000e309
jmp fcn.1000e016
push esi
push edi
add esp, 4
xor esi, 0xfea6
add esi, 0x110e0
call 0x1000e327

Function at 0x1000e2d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc esi
dec edi
inc esp
dec eax
jmp 0x1000e2da
jmp 0x1000e2e0
pop edx
push edi
push ebx
add esp, 4
and edi, 0xc14f
or edi, 0xa16a
pop edi
push esi
push eax
add esp, 4
sub esi, 0xe683
pop esi
mov dword [ebp - 0xa48], 0
Function at 0x1000e327
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmpsb byte [esi], byte es:[edi]
inc byte [eax]
add byte [ecx + 0x110e0c6], al
add al, ch
or byte [eax], al
add byte [eax], al
add byte [0x3a374950], bh
dec edx
push eax
add esp, 4
jmp 0x1000e332
pop esi
push ebx
and ebx, 0x12a4e
pop ebx
mov byte [ebp - 0x83c], 0x45
mov byte [ebp - 0x83b], 0x78
mov byte [ebp - 0x83a], 0x69
mov byte [ebp - 0x839], 0x74
mov byte [ebp - 0x838], 0x50
mov byte [ebp - 0x837], 0x72
leave
idiv edi
push dword [edx - 0x3a]
test edx, ecx
idiv edi
jmp [edi - 0x3a]
test ebx, ecx
idiv edi
jmp dword [ebx - 0x3a]
test esp, ecx
idiv edi
jmp dword [ebp - 0x3a]
test ebp, ecx
idiv edi
push dword [ebx - 0x3a]
jae 0x1000e348
test esi, ecx
idiv edi
push dword [ebx - 0x3a]
test edi, ecx
idiv edi
inc dword [eax]
js 0x1000e310
test esi, eax
idiv edi
jmp [ecx - 0x3a]
jae 0x1000e348
test esi, ecx
idiv edi
push dword [ebx - 0x3a]
test edi, ecx
idiv edi
inc dword [eax]
push ecx
push ecx
add esp, 4
call 0x1000e3a2
add byte [esi + 0x4b], cl
inc ebp
dec ecx
inc esp
dec esp
xor eax, 0x4c4833f
pop ecx
push edi
sub edi, 0x17627
and edi, 0x609c
xor edi, 0x8d0d
jmp 0x1000e3c0
pop edi
mov eax, 0x6b
mov word [ebp - 0x15cc], ax
mov ecx, 0x65
mov word [ebp - 0x15ca], cx
mov edx, 0x72
invalid
invalid

Function at 0x1000e360
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmpsb byte [esi], byte es:[edi]
inc byte [eax]
add byte [ecx + 0x110e0c6], al
add al, ch
or byte [eax], al
add byte [eax], al
add byte [0x3a374950], bh
dec edx
push eax
add esp, 4
jmp 0x1000e332
pop esi
push ebx
and ebx, 0x12a4e
pop ebx
mov byte [ebp - 0x83c], 0x45
mov byte [ebp - 0x83b], 0x78
mov byte [ebp - 0x83a], 0x69
mov byte [ebp - 0x839], 0x74
mov byte [ebp - 0x838], 0x50
mov byte [ebp - 0x837], 0x72
leave
idiv edi
push dword [edx - 0x3a]
test edx, ecx
idiv edi
jmp [edi - 0x3a]
test ebx, ecx
idiv edi
jmp dword [ebx - 0x3a]
test esp, ecx
idiv edi
jmp dword [ebp - 0x3a]
test ebp, ecx
idiv edi
push dword [ebx - 0x3a]
jae 0x1000e348
test esi, ecx
idiv edi
push dword [ebx - 0x3a]
test edi, ecx
idiv edi
inc dword [eax]
js 0x1000e310
test esi, eax
idiv edi
jmp [ecx - 0x3a]
jae 0x1000e348
test esi, ecx
idiv edi
push dword [ebx - 0x3a]
test edi, ecx
idiv edi
inc dword [eax]
push ecx
push ecx
add esp, 4
call 0x1000e3a2
add byte [esi + 0x4b], cl
inc ebp
dec ecx
inc esp
dec esp
xor eax, 0x4c4833f
pop ecx
push edi
sub edi, 0x17627
and edi, 0x609c
xor edi, 0x8d0d
jmp 0x1000e3c0
pop edi
mov eax, 0x6b
mov word [ebp - 0x15cc], ax
mov ecx, 0x65
mov word [ebp - 0x15ca], cx
mov edx, 0x72
invalid
invalid
Function at 0x1000e380
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmpsb byte [esi], byte es:[edi]
inc byte [eax]
add byte [ecx + 0x110e0c6], al
add al, ch
or byte [eax], al
add byte [eax], al
add byte [0x3a374950], bh
dec edx
push eax
add esp, 4
jmp 0x1000e332
pop esi
push ebx
and ebx, 0x12a4e
pop ebx
mov byte [ebp - 0x83c], 0x45
mov byte [ebp - 0x83b], 0x78
mov byte [ebp - 0x83a], 0x69
mov byte [ebp - 0x839], 0x74
mov byte [ebp - 0x838], 0x50
mov byte [ebp - 0x837], 0x72
leave
idiv edi
push dword [edx - 0x3a]
test edx, ecx
idiv edi
jmp [edi - 0x3a]
test ebx, ecx
idiv edi
jmp dword [ebx - 0x3a]
test esp, ecx
idiv edi
jmp dword [ebp - 0x3a]
test ebp, ecx
idiv edi
push dword [ebx - 0x3a]
jae 0x1000e348
test esi, ecx
idiv edi
push dword [ebx - 0x3a]
test edi, ecx
idiv edi
inc dword [eax]
js 0x1000e310
test esi, eax
idiv edi
jmp [ecx - 0x3a]
jae 0x1000e348
test esi, ecx
idiv edi
push dword [ebx - 0x3a]
test edi, ecx
idiv edi
inc dword [eax]
push ecx
push ecx
add esp, 4
call 0x1000e3a2
add byte [esi + 0x4b], cl
inc ebp
dec ecx
inc esp
dec esp
xor eax, 0x4c4833f
pop ecx
push edi
sub edi, 0x17627
and edi, 0x609c
xor edi, 0x8d0d
jmp 0x1000e3c0
pop edi
mov eax, 0x6b
mov word [ebp - 0x15cc], ax
mov ecx, 0x65
mov word [ebp - 0x15ca], cx
mov edx, 0x72
invalid
invalid

Function at 0x1000e3a2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmpsb byte [esi], byte es:[edi]
inc byte [eax]
add byte [ecx + 0x110e0c6], al
add al, ch
or byte [eax], al
add byte [eax], al
add byte [0x3a374950], bh
dec edx
push eax
add esp, 4
jmp 0x1000e332
pop esi
push ebx
and ebx, 0x12a4e
pop ebx
mov byte [ebp - 0x83c], 0x45
mov byte [ebp - 0x83b], 0x78
mov byte [ebp - 0x83a], 0x69
mov byte [ebp - 0x839], 0x74
mov byte [ebp - 0x838], 0x50
mov byte [ebp - 0x837], 0x72
leave
idiv edi
push dword [edx - 0x3a]
test edx, ecx
idiv edi
jmp [edi - 0x3a]
test ebx, ecx
idiv edi
jmp dword [ebx - 0x3a]
test esp, ecx
idiv edi
jmp dword [ebp - 0x3a]
test ebp, ecx
idiv edi
push dword [ebx - 0x3a]
jae 0x1000e348
test esi, ecx
idiv edi
push dword [ebx - 0x3a]
test edi, ecx
idiv edi
inc dword [eax]
js 0x1000e310
test esi, eax
idiv edi
jmp [ecx - 0x3a]
jae 0x1000e348
test esi, ecx
idiv edi
push dword [ebx - 0x3a]
test edi, ecx
idiv edi
inc dword [eax]
push ecx
push ecx
add esp, 4
call 0x1000e3a2
add byte [esi + 0x4b], cl
inc ebp
dec ecx
inc esp
dec esp
xor eax, 0x4c4833f
pop ecx
push edi
sub edi, 0x17627
and edi, 0x609c
xor edi, 0x8d0d
jmp 0x1000e3c0
pop edi
mov eax, 0x6b
mov word [ebp - 0x15cc], ax
mov ecx, 0x65
mov word [ebp - 0x15ca], cx
mov edx, 0x72
invalid
invalid

Function at 0x1000e4ac
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and eax, 0x13dbb
loopne 0x1000e46d
cmp eax, 0x53580001

Function at 0x1000e4b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
loopne 0x1000e46d
cmp eax, 0x53580001
sub ebx, 0x16edb
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1a18], ecx
mov edx, dword [ebp - 0x1a18]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1bcc], eax
mov ecx, dword [ebp - 0x1bcc]