joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b860
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
add esp, 4
sub eax, 0xab89
or eax, 0x4032
pop eax
mov dword [ebp - 0x390], 0
push edx
and edx, 0x8273
xor edx, 0x168e6
xor edx, 0x75bd
add edx, 0x11052
pop edx
push edi
push eax
add esp, 4
add edi, 0xf9b4
add byte [edi + 0x51], bl
push ecx
add esp, 4
or ecx, 0x29b2
pop ecx
push esi
push esi
add esp, 4
and esi, 0xcf44
and esi, 0x11941
or esi, 0x1e2f
and esi, 0xfd00
pop esi
push edx
add edx, 0x5d8e
add edx, 0x2bfb
and edx, 0x2cde
pop edx
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0xb50]
mov dword [ebp - 0x14f4], edx
push esi
push edi
add esp, 4
xor esi, 0x8a5
xor esi, 0x3e6c
pop esi
push ebx
push ebx
add esp, 4
or ebx, 0x16738
add ebx, 0x1704f
xor ebx, 0xd9fa
pop ebx
push ebx
and ebx, 0x15e1e
pop ebx
mov dword [ebp - 0x1d20], 0xffffffff
call dword [esi + 0x50]
add esp, 4
jmp 0x1000b93c
sub esi, 0xa335
sub esi, 0xaf42
pop esi
push edi
add edi, 0x71a6
or edi, 0x10953
pop edi
push ebx
push ecx
add esp, 4
add ebx, 0x17987
pop ebx
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x4b8], eax
jmp 0x1000b980
push edi
xor edi, 0x8294
pop edi
push esi
jmp 0x1000b991
pop esi
push ecx
push ebx
add esp, 4
jmp 0x1000b99f
jmp 0x1000b9a5
jmp 0x1000b9ab
jmp 0x1000b9b1
pop ecx
mov edx, dword [ebp - 0x4b8]
sub edx, dword [ebp - 0x724]
cmp edx, 0xffffffff
push dword [edx + 0x37]
push esi
or esi, 0x19d5
and esi, 0x2294
sub esi, 0x63bf
pop esi
push eax
push ecx
add esp, 4
add eax, 0x159c3
or eax, 0xc8c6
sub eax, 0x85
and eax, 0x10a48
pop eax
jmp 0x1000bc28
mov dword [ebp - 0xc0c], 7
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0xa54], eax
push esi
push esi
add esp, 4
add esi, 0x7ec1
pop esi
push esi
call 0x1000ba2a
add byte [ebx + 0x4d], al
inc esi
inc ebp
cmp dword [esi], esi
add esp, 4
jmp 0x1000ba35
xor esi, 0x591b
xor esi, 0x15cab
pop esi
mov ecx, dword [ebp - 0x14f4]
mov dword [ebp - 0xa4c], ecx
invalid
invalid
Function at 0x1000ba2a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
add esp, 4
sub eax, 0xab89
or eax, 0x4032
pop eax
mov dword [ebp - 0x390], 0
push edx
and edx, 0x8273
xor edx, 0x168e6
xor edx, 0x75bd
add edx, 0x11052
pop edx
push edi
push eax
add esp, 4
add edi, 0xf9b4
add byte [edi + 0x51], bl
push ecx
add esp, 4
or ecx, 0x29b2
pop ecx
push esi
push esi
add esp, 4
and esi, 0xcf44
and esi, 0x11941
or esi, 0x1e2f
and esi, 0xfd00
pop esi
push edx
add edx, 0x5d8e
add edx, 0x2bfb
and edx, 0x2cde
pop edx
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0xb50]
mov dword [ebp - 0x14f4], edx
push esi
push edi
add esp, 4
xor esi, 0x8a5
xor esi, 0x3e6c
pop esi
push ebx
push ebx
add esp, 4
or ebx, 0x16738
add ebx, 0x1704f
xor ebx, 0xd9fa
pop ebx
push ebx
and ebx, 0x15e1e
pop ebx
mov dword [ebp - 0x1d20], 0xffffffff
call dword [esi + 0x50]
add esp, 4
jmp 0x1000b93c
sub esi, 0xa335
sub esi, 0xaf42
pop esi
push edi
add edi, 0x71a6
or edi, 0x10953
pop edi
push ebx
push ecx
add esp, 4
add ebx, 0x17987
pop ebx
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x4b8], eax
jmp 0x1000b980
push edi
xor edi, 0x8294
pop edi
push esi
jmp 0x1000b991
pop esi
push ecx
push ebx
add esp, 4
jmp 0x1000b99f
jmp 0x1000b9a5
jmp 0x1000b9ab
jmp 0x1000b9b1
pop ecx
mov edx, dword [ebp - 0x4b8]
sub edx, dword [ebp - 0x724]
cmp edx, 0xffffffff
push dword [edx + 0x37]
push esi
or esi, 0x19d5
and esi, 0x2294
sub esi, 0x63bf
pop esi
push eax
push ecx
add esp, 4
add eax, 0x159c3
or eax, 0xc8c6
sub eax, 0x85
and eax, 0x10a48
pop eax
jmp 0x1000bc28
mov dword [ebp - 0xc0c], 7
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0xa54], eax
push esi
push esi
add esp, 4
add esi, 0x7ec1
pop esi
push esi
call 0x1000ba2a
add byte [ebx + 0x4d], al
inc esi
inc ebp
cmp dword [esi], esi
add esp, 4
jmp 0x1000ba35
xor esi, 0x591b
xor esi, 0x15cab
pop esi
mov ecx, dword [ebp - 0x14f4]
mov dword [ebp - 0xa4c], ecx
invalid
invalid

Function at 0x1000ba94
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
mov eax, dword [ebp - 0xc10]
mov dword [ebp - 0x14fc], eax
jmp 0x1000bbda
cmp dword [ebp - 0x14fc], 0
jne 0x1000bc23
push edi
push edi
add esp, 4
call 0x1000bbf7
add byte [eax], bh
inc edx
inc edi
dec ebx
cmp eax, dword [ebx + 0x48]
cmp dword [ebx - 0x187efb3c], eax
iretd
jmp fcn.1000b971
Function at 0x1000bae4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc0c], 0
jle 0x1000bbce
push edi
sub edi, 0x4c19
and edi, 0x12f71
sub edi, 0xaf59
pop edi
push esi
and esi, 0x2cd7
pop esi
push esi
push edx
add esp, 4
call fcn.1000bae4
add byte [esi], bh
dec esi
inc ebp
push eax
dec eax
push eax
aaa
add esp, 4
pop esi
mov ecx, dword [ebp - 0xa54]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xa4c]
movzx ecx, byte [eax]
cmp edx, ecx
je 0x1000bb6a
push eax
push esi
push ebx
push edx
add esp, 4
or ebx, 0x17f12
and ebx, 0x13ac2
add ebx, 0x1771d
pop ebx
push eax
sub eax, 0x1909
sub eax, 0xef97
or eax, 0x1021f
enter 0x21f, 1
add byte [ecx + 0x87ebc0], al
add byte [eax - 0x75], bl
invalid
hlt
invalid
invalid
inc dword [ebx - 0x7276fe17]
hlt
invalid
invalid
dec dword [ebx - 0xa536b]
inc dword [ebx - 0x6a76fe3e]
lodsb al, byte [esi]
cmc
invalid
dec dword [ebx - 0xa4b7b]
inc dword [ebx - 0x7a76fe40]
mov ah, 0xf5
invalid
invalid
jmp 0x1000baa9
mov ecx, dword [ebp - 0xc10]
mov dword [ebp - 0x14fc], ecx

Function at 0x1000bb00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add eax, 0xfcfd
or eax, 0x8894
or eax, 0x69ff
or eax, 0x32bf
pop eax
push esi
or esi, 0x11d19
and esi, 0x43f6
and esi, 0x8525
pop esi
mov edx, dword [ebp - 0xa54]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa4c]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x1000bb52
mov dword [ebp - 0x14f8], 1
jmp 0x1000bb5c
mov dword [ebp - 0x14f8], 0xffffffff
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0xc10], eax
jmp 0x1000bbce

Function at 0x1000bb90
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
enter 0x21f, 1
add byte [ecx + 0x87ebc0], al
add byte [eax - 0x75], bl
invalid

Function at 0x1000bbf7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
mov eax, dword [ebp - 0xc10]
mov dword [ebp - 0x14fc], eax
jmp 0x1000bbda
cmp dword [ebp - 0x14fc], 0
jne 0x1000bc23
push edi
push edi
add esp, 4
call 0x1000bbf7
add byte [eax], bh
inc edx
inc edi
dec ebx
cmp eax, dword [ebx + 0x48]
cmp dword [ebx - 0x187efb3c], eax
iretd
jmp fcn.1000b971

Function at 0x1000bc3c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or ebx, 0x14505
jmp 0x1000bc4d
pop ebx
push edx
push edx

Function at 0x1000bc50
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edx, 0x738
pop edx
mov dword [ebp - 0xa48], 0
push eax
push edi
add esp, 4
add eax, 0xed60
jmp 0x1000bc77
pop eax
push eax
push edx
add esp, 4
add eax, 0xaadf
sub eax, 0x2a4f
sub eax, 0x4085
sub eax, 0xce9
pop eax
mov byte [ebp - 0x83c], 0x45
mov byte [ebp - 0x83b], 0x78
mov byte [ebp - 0x83a], 0x69
invalid
test edi, eax
idiv edi

Function at 0x1000bcb0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push dword [esi + eax*8 - 0x7b]
enter 0xfffffffffffffff7, 0xffffffffffffffff
push eax
Function at 0x1000bd10
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push esi
xor esi, 0x2a7f
pop esi
invalid
imul eax, dword [eax], 0

Function at 0x1000bd80
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [esi - 0x77], ah
xchg ebp, eax
inc esp
ljmp 0

Function at 0x1000bdc0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or eax, 0x8617
and eax, 0x20e
xor eax, 0x13970
pop eax
push ebx
and ebx, 0x15995
xor ebx, 0x8f62
xor ebx, 0x9110
pop ebx
push edx
xor edx, 0x7082
sub edx, 0x52d9
fst dword [edx]
add al, ch
or al, byte [eax]
add byte [eax], al

Function at 0x1000bdf0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
fst dword [edx]
add al, ch
or al, byte [eax]
add byte [eax], al
add byte [ebx + ecx*2 + 0x35], al
push eax
cmp al, 0x38
inc esi
xor bh, byte [edx]
add esp, 4
pop edx
push edi
push edi
add esp, 4
and edi, 0x386a
sub edi, 0xdb9
pop edi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1a18], ecx
mov edx, dword [ebp - 0x1a18]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1bcc], eax
test dword [esp], esi
invalid
dec dword [ebx - 0x1bcb73]
dec dword [ecx - 0x14ff73]
call dword [esi + 0x52]
add esp, 4
jmp 0x1000be4f
jmp 0x1000be56
or esi, 0x31ed
pop esi
push esi
push esi
add esp, 4
call 0x1000be6f
add byte [esi + eax*2], bh
cmp edi, dword [esi]
cmp dword [edi + 0x36], ecx
add esp, 4
les eax, [esi + ebx*2]
cmp dword [ebp - 0x1500], 0
jne 0x1000be8b
mov dword [ebp - 0x2a0], 0
jmp 0x1000c147
mov edx, dword [ebp - 0x1500]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc1c], ecx
push ecx
push esi
add esp, 4
or ecx, 0xec48
pop ecx
push ebx
sub ebx, 0x55fb

Function at 0x1000be03
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
fst dword [edx]
add al, ch
or al, byte [eax]
add byte [eax], al
add byte [ebx + ecx*2 + 0x35], al
push eax
cmp al, 0x38
inc esi
xor bh, byte [edx]
add esp, 4
pop edx
push edi
push edi
add esp, 4
and edi, 0x386a
sub edi, 0xdb9
pop edi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1a18], ecx
mov edx, dword [ebp - 0x1a18]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1bcc], eax
test dword [esp], esi
invalid
dec dword [ebx - 0x1bcb73]
dec dword [ecx - 0x14ff73]
call dword [esi + 0x52]
add esp, 4
jmp 0x1000be4f
jmp 0x1000be56
or esi, 0x31ed
pop esi
push esi
push esi
add esp, 4
call 0x1000be6f
add byte [esi + eax*2], bh
cmp edi, dword [esi]
cmp dword [edi + 0x36], ecx
add esp, 4
les eax, [esi + ebx*2]
cmp dword [ebp - 0x1500], 0
jne 0x1000be8b
mov dword [ebp - 0x2a0], 0
jmp 0x1000c147
mov edx, dword [ebp - 0x1500]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc1c], ecx
push ecx
push esi
add esp, 4
or ecx, 0xec48
pop ecx
push ebx
sub ebx, 0x55fb
Function at 0x1000be6f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
fst dword [edx]
add al, ch
or al, byte [eax]
add byte [eax], al
add byte [ebx + ecx*2 + 0x35], al
push eax
cmp al, 0x38
inc esi
xor bh, byte [edx]
add esp, 4
pop edx
push edi
push edi
add esp, 4
and edi, 0x386a
sub edi, 0xdb9
pop edi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1a18], ecx
mov edx, dword [ebp - 0x1a18]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1bcc], eax
test dword [esp], esi
invalid
dec dword [ebx - 0x1bcb73]
dec dword [ecx - 0x14ff73]
call dword [esi + 0x52]
add esp, 4
jmp 0x1000be4f
jmp 0x1000be56
or esi, 0x31ed
pop esi
push esi
push esi
add esp, 4
call 0x1000be6f
add byte [esi + eax*2], bh
cmp edi, dword [esi]
cmp dword [edi + 0x36], ecx
add esp, 4
les eax, [esi + ebx*2]
cmp dword [ebp - 0x1500], 0
jne 0x1000be8b
mov dword [ebp - 0x2a0], 0
jmp 0x1000c147
mov edx, dword [ebp - 0x1500]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc1c], ecx
push ecx
push esi
add esp, 4
or ecx, 0xec48
pop ecx
push ebx
sub ebx, 0x55fb

Function at 0x1000be70
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
fst dword [edx]
add al, ch
or al, byte [eax]
add byte [eax], al
add byte [ebx + ecx*2 + 0x35], al
push eax
cmp al, 0x38
inc esi
xor bh, byte [edx]
add esp, 4
pop edx
push edi
push edi
add esp, 4
and edi, 0x386a
sub edi, 0xdb9
pop edi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1a18], ecx
mov edx, dword [ebp - 0x1a18]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1bcc], eax
test dword [esp], esi
invalid
dec dword [ebx - 0x1bcb73]
dec dword [ecx - 0x14ff73]
call dword [esi + 0x52]
add esp, 4
jmp 0x1000be4f
jmp 0x1000be56
or esi, 0x31ed
pop esi
push esi
push esi
add esp, 4
call 0x1000be6f
add byte [esi + eax*2], bh
cmp edi, dword [esi]
cmp dword [edi + 0x36], ecx
add esp, 4
les eax, [esi + ebx*2]
cmp dword [ebp - 0x1500], 0
jne 0x1000be8b
mov dword [ebp - 0x2a0], 0
jmp 0x1000c147
mov edx, dword [ebp - 0x1500]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc1c], ecx
push ecx
push esi
add esp, 4
or ecx, 0xec48
pop ecx
push ebx
sub ebx, 0x55fb
Function at 0x1000beb0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub ebx, 0x4e21
jmp 0x1000bebc
and ebx, 0x229b
pop ebx
push edx
push ebx
add esp, 4
sub edx, 0x9a5a
pop edx
cmp dword [ebp - 0xc1c], 0
jne 0x1000bee7
mov dword [ebp - 0x2a0], 0
jmp 0x1000c147
mov edx, dword [ebp - 0xc1c]
mov dword [ebp - 0x4bc], edx
push eax
sub eax, 0x53b7
add eax, 0x324
add eax, 0x961b
pop eax
push edi
jmp 0x1000bf0e
jmp fcn.1000bf16
push esi
jmp 0x1000c150
and esi, 0x35e5
jmp 0x1000c15e
pop esi
push ecx
add ecx, 0x59d0
and ecx, 0xd212
add ecx, 0x7733
xor ecx, 0xf22e
pop ecx
cmp dword [ebp - 0x2a0], 0
jne 0x1000ca7e
mov ecx, 0x6b
mov word [ebp - 0x1638], cx
mov edx, 0x65
mov word [ebp - 0x1636], dx
mov eax, 0x72
mov word [ebp - 0x1634], ax
mov ecx, 0x6e
mov word [ebp - 0x1632], cx
mov edx, 0x65
mov word [ebp - 0x1630], dx
mov eax, 0x6c
mov word [ebp - 0x162e], ax
mov ecx, 0x33
mov word [ebp - 0x162c], cx
mov edx, 0x32
mov word [ebp - 0x162a], dx
mov eax, 0x2e
mov word [ebp - 0x1628], ax
mov ecx, 0x64
mov word [ebp - 0x1626], cx
mov edx, 0x6c
mov word [ebp - 0x1624], dx
mov eax, 0x6c
mov word [ebp - 0x1622], ax
xor ecx, ecx
mov word [ebp - 0x1620], cx
push edx

Function at 0x1000bf40
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
mov word [ebp - 0x1ac], ax
xor ecx, ecx
mov word [ebp - 0x100], cx
push esi
jmp 0x1000bf5b
pop esi
push eax
and eax, 0xb240
pop eax
push edi
add edi, 0x167c
invalid
out 0x31, eax
sub dword [eax], eax

Function at 0x1000bf80
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
mov edx, dword [ebp - 0xc14]
mov ax, word [edx]
mov word [ebp - 0xfb6], ax
mov ecx, dword [ebp - 0xc14]
add ecx, 2
mov dword [ebp - 0xc14], ecx
invalid
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
dec edx
invalid
invalid
jmp dword [esi - 0x77]
xchg ebp, eax
push esp
invalid
invalid
dec dword [ebx - 0xc177b]
jmp dword [esi - 0x75]
or byte [esi - 0x77], ah
lea ecx, [eax - 0x10]
invalid
dec dword [ebx - 0xc176b]
inc dword [ebx - 0x6a76fd3e]
invalid
invalid
invalid
invalid
Function at 0x1000bfd0
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ax, word [ebp - 0xfb8]
mov word [ebp - 0x100], ax
push ecx
push edx
add esp, 4
and ecx, 0x2458
pop ecx
push eax
push ebx
add esp, 4
or eax, 0x128a1
xor eax, 0x160db
or eax, 0x110e
pop eax
push eax
add eax, 0x429c
sub eax, 0x1316
pop eax
movzx ecx, word [ebp - 0x100]
test ecx, ecx
jne 0x1000c033
movzx edx, word [ebp - 0x1ac]
movzx eax, word [ebp - 0x100]
sub edx, eax
mov dword [ebp - 0x150c], edx
jmp 0x1000c096
movzx ecx, word [ebp - 0x1ac]
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x1000bf52
movzx eax, word [ebp - 0x1ac]
xor eax, 0x20
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
je 0x1000bf52
movzx edx, word [ebp - 0x1ac]
movzx eax, word [ebp - 0x100]
cmp edx, eax
jge 0x1000c080
mov dword [ebp - 0x1504], 0xffffffff
jmp 0x1000c08a
mov dword [ebp - 0x1504], 1
mov ecx, dword [ebp - 0x1504]
mov dword [ebp - 0x150c], ecx
cmp dword [ebp - 0x150c], 0
jne 0x1000c0df
push edx
sub edx, 0x15764
pop edx
push esi
push ecx
add esp, 4
or esi, 0x7b45
pop esi
push edx
push eax
add esp, 4
add edx, 0x236e
or edx, 0xdc16
xor edx, 0x14912
or edx, 0x15e36
pop edx
mov edx, dword [ebp - 0x4bc]
mov dword [ebp - 0x2a0], edx
jmp 0x1000c147
push eax
sub eax, 0x165a
jmp 0x1000c0ee
sub eax, 0x1992
pop eax
push eax
or eax, 0x12d06
or eax, 0x10713
pop eax
push ebx
or ebx, 0x32f4
sub ebx, 0x86a
pop ebx
mov eax, dword [ebp - 0x4bc]
mov ecx, dword [eax]
mov dword [ebp - 0x4bc], ecx
mov edx, dword [ebp - 0x4bc]
cmp edx, dword [ebp - 0xc1c]
je 0x1000c13d
mov eax, dword [ebp - 0x4bc]
cmp dword [eax + 0x30], 0
jne 0x1000bef3
mov dword [ebp - 0x2a0], 0

Function at 0x1000c220
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add edx, 0x17917
pop edx
push ecx
or ecx, 0x14277
pop ecx
push edx
sub edx, 0x16c07
sub edx, 0x16cb8
pop edx
push edi
xor edi, 0x17866
xor edi, 0x77f0
xor edi, 0x1506c
pop edi
mov byte [ebp - 0x84c], 0x4c
mov byte [ebp - 0x84b], 0x6f
mov byte [ebp - 0x84a], 0x61
mov byte [ebp - 0x849], 0x64
mov byte [ebp - 0x848], 0x4c
mov byte [ebp - 0x847], 0x69
mov byte [ebp - 0x846], 0x62
mov byte [ebp - 0x845], 0x72
mov byte [ebp - 0x844], 0x61
mov byte [ebp - 0x843], 0x72
mov byte [ebp - 0x842], 0x79
mov byte [ebp - 0x841], 0x57
mov byte [ebp - 0x840], 0
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1bd0], edx
mov eax, dword [ebp - 0x1bd0]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1bd4], ecx
mov edx, dword [ebp - 0x1bd4]
invalid
xchg ebp, eax
Function at 0x1000d9d2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
movzx eax, word [ebp - 0x30]
test eax, eax
jne 0x1000d9f3
movzx ecx, word [ebp - 0x1bc]
movzx edx, word [ebp - 0x30]
sub ecx, edx
mov dword [ebp - 0x1554], ecx
jmp 0x1000da4d
movzx eax, word [ebp - 0x1bc]
movzx ecx, word [ebp - 0x30]
cmp eax, ecx
je 0x1000d91b
movzx edx, word [ebp - 0x1bc]
xor edx, 0x20
movzx eax, word [ebp - 0x30]
cmp edx, eax
je 0x1000d91b
movzx ecx, word [ebp - 0x1bc]
movzx edx, word [ebp - 0x30]
cmp ecx, edx
jge 0x1000da37
mov dword [ebp - 0x1550], 0xffffffff
jmp 0x1000da41
mov dword [ebp - 0x1550], 1
mov eax, dword [ebp - 0x1550]
mov dword [ebp - 0x1554], eax
cmp dword [ebp - 0x1554], 0
jne 0x1000da96
push edi
push esi
add esp, 4
jmp 0x1000da63
xor edi, 0x774e
pop edi
push ecx
push ebx
add esp, 4
jmp 0x1000da75
and ecx, 0x4f62
pop ecx
push esi
push eax
add esp, 4
xor esi, 0x1370
add byte [esi - 0x75], bl
lea esi, [eax]
sti
invalid
dec dword [ecx - 0x74b73]
invalid
jmp 0x1000dafe
push eax
push ecx
add esp, 4
or eax, 0xa427
or eax, 0x911b
pop eax
push ecx
push edx
add esp, 4
jmp 0x1000dab4
jmp 0x1000dabc
jmp 0x1000dac1
and ecx, 0x16bd3
pop ecx
mov edx, dword [ebp - 0x4d0]
mov eax, dword [edx]
mov dword [ebp - 0x4d0], eax
mov ecx, dword [ebp - 0x4d0]
cmp ecx, dword [ebp - 0xc54]
je 0x1000daf4
mov edx, dword [ebp - 0x4d0]
cmp dword [edx + 0x30], 0
jne 0x1000d8bf
mov dword [ebp - 0x74c], 0
Function at 0xd11870
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x661000]
push edi
or ebp, 0xffffffff
jmp 0xd11892
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xd11899
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd11888
mov eax, 1
add ebx, ebx
jne 0xd118ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xd118bc
jne 0xd118db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd118db
dec eax
add ebx, ebx
jne 0xd118c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xd118a0
add ebx, ebx
jne 0xd118d7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xd1192d
xor ecx, ecx
sub eax, 3
jb 0xd118f3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xd11962
sar eax, 1
mov ebp, eax
jmp 0xd118fe
add ebx, ebx
jne 0xd118fe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd118cc
inc ecx
add ebx, ebx
jne 0xd1190c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd118cc
add ebx, ebx
jne 0xd11919
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xd1190e
jne 0xd1192a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xd1190e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xd1194c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xd1193e
jmp 0xd1188e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xd1194c
add edi, ecx
jmp 0xd1188e
pop esi
mov edi, esi
mov ecx, 0x4e4c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xd1196a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xd1196f
lea edi, [esi + 0x90f000]
mov eax, dword [edi]
or eax, eax
je 0xd119e0
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x915bc0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x915c10]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xd11995
mov ecx, edi
jns 0xd119c4
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x915c14]
or eax, eax
je 0xd119da
mov dword [ebx], eax
add ebx, 4
jmp 0xd119b2
call dword [esi + 0x915c24]
mov ebp, dword [esi + 0x915c18]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xd11a14
sub esp, 0xffffff80
jmp 0x4057b8
Function at 0x4c7e90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x85000]
push edi
jmp 0x4c7eaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c7eb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c7ea0
mov eax, 1
add ebx, ebx
jne 0x4c7ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c7ed4
jne 0x4c7ef3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c7ef3
dec eax
add ebx, ebx
jne 0x4c7ee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c7eb8
add ebx, ebx
jne 0x4c7eef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c7f45
xor ecx, ecx
sub eax, 3
jb 0x4c7f0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c7f7a
sar eax, 1
mov ebp, eax
jmp 0x4c7f16
add ebx, ebx
jne 0x4c7f16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c7ee4
inc ecx
add ebx, ebx
jne 0x4c7f24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c7ee4
add ebx, ebx
jne 0x4c7f31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c7f26
jne 0x4c7f42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c7f26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c7f64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c7f56
jmp 0x4c7ea6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c7f64
add edi, ecx
jmp 0x4c7ea6
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c7f82
cmp byte [edi], 0x13
jne 0x4c7f82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c7f87
lea edi, [esi + 0xc3000]
mov eax, dword [edi]
or eax, eax
je 0x4c7fff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xde7bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xde910]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c7fb4
mov ecx, edi
jns 0x4c7fe3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xde914]
or eax, eax
je 0x4c7ff9
mov dword [ebx], eax
add ebx, 4
jmp 0x4c7fd1
call dword [esi + 0xde924]
mov ebp, dword [esi + 0xde918]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c8033
sub esp, 0xffffff80
jmp 0x4165c1