joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006825
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub ecx, 0xbb64
pop ecx
push edx
call 0x10006825
add byte [0x45423e41], dh
inc esp
inc eax
add esp, 4
call 0x10006837
add byte [edx], bh
dec ebp
cmp al, 0x41
inc ebp
dec edx
xor esi, dword [0x4c48343]
pop edx
mov byte [ebp - 0xb5c], 0x56
call dword [esi - 0x3a]
test dword [ebp + 0x69fffff4], esp
mov byte [ebp - 0xb5a], 0x72
mov byte [ebp - 0xb59], 0x74
mov byte [ebp - 0xb58], 0x75
mov byte [ebp - 0xb57], 0x61
mov byte [ebp - 0xb56], 0x6c
mov byte [ebp - 0xb55], 0x50
mov byte [ebp - 0xb54], 0x72
mov byte [ebp - 0xb53], 0x6f
mov byte [ebp - 0xb52], 0x74
mov byte [ebp - 0xb51], 0x65
mov byte [ebp - 0xb50], 0x63
mov byte [ebp - 0xb4f], 0x74
invalid
invalid
invalid

Function at 0x10006837
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub ecx, 0xbb64
pop ecx
push edx
call 0x10006825
add byte [0x45423e41], dh
inc esp
inc eax
add esp, 4
call 0x10006837
add byte [edx], bh
dec ebp
cmp al, 0x41
inc ebp
dec edx
xor esi, dword [0x4c48343]
pop edx
mov byte [ebp - 0xb5c], 0x56
call dword [esi - 0x3a]
test dword [ebp + 0x69fffff4], esp
mov byte [ebp - 0xb5a], 0x72
mov byte [ebp - 0xb59], 0x74
mov byte [ebp - 0xb58], 0x75
mov byte [ebp - 0xb57], 0x61
mov byte [ebp - 0xb56], 0x6c
mov byte [ebp - 0xb55], 0x50
mov byte [ebp - 0xb54], 0x72
mov byte [ebp - 0xb53], 0x6f
mov byte [ebp - 0xb52], 0x74
mov byte [ebp - 0xb51], 0x65
mov byte [ebp - 0xb50], 0x63
mov byte [ebp - 0xb4f], 0x74
invalid
invalid
invalid

Function at 0x10006840
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call dword [esi - 0x3a]
test dword [ebp + 0x69fffff4], esp
jmp 0x100068b8
call 0x100068c4
add byte [0x4b47443b], dh
xor eax, 0x8104c483
call fcn.10010167
pop eax
push edi
or edi, 0x103c2
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1f48], eax
mov ecx, dword [ebp - 0x1f48]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1f4c], edx
mov eax, dword [ebp - 0x1f4c]
mov dword [ebp - 0x1928], eax
push ecx
sub ecx, 0x1548e
pop ecx
push edx
xor edx, 0x834b
or edx, 0x9aaf
pop edx
push edx
xor edx, 0x4fab
jmp 0x10006922
jmp 0x10006928
or edx, 0x7395
pop edx
cmp dword [ebp - 0x1928], 0
mov ebp, 0xffffe6d8
add byte [ebp + 0xf], dh
mov dword [ebp - 0x394], 0
jmp 0x10006bee
mov ecx, dword [ebp - 0x1928]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xec4], eax
push eax
call 0x10006966
add byte [ebx + 0x4c], cl
xor al, 0x4c
dec ebx
cmp byte [ebx + 0x6eb04c4], al
xor ecx, dword [edx + 0x40]
inc eax
inc edx
Function at 0x100068c4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call dword [esi - 0x3a]
test dword [ebp + 0x69fffff4], esp
jmp 0x100068b8
call 0x100068c4
add byte [0x4b47443b], dh
xor eax, 0x8104c483
call fcn.10010167
pop eax
push edi
or edi, 0x103c2
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1f48], eax
mov ecx, dword [ebp - 0x1f48]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1f4c], edx
mov eax, dword [ebp - 0x1f4c]
mov dword [ebp - 0x1928], eax
push ecx
sub ecx, 0x1548e
pop ecx
push edx
xor edx, 0x834b
or edx, 0x9aaf
pop edx
push edx
xor edx, 0x4fab
jmp 0x10006922
jmp 0x10006928
or edx, 0x7395
pop edx
cmp dword [ebp - 0x1928], 0
mov ebp, 0xffffe6d8
add byte [ebp + 0xf], dh
mov dword [ebp - 0x394], 0
jmp 0x10006bee
mov ecx, dword [ebp - 0x1928]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xec4], eax
push eax
call 0x10006966
add byte [ebx + 0x4c], cl
xor al, 0x4c
dec ebx
cmp byte [ebx + 0x6eb04c4], al
xor ecx, dword [edx + 0x40]
inc eax
inc edx

Function at 0x10006966
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call dword [esi - 0x3a]
test dword [ebp + 0x69fffff4], esp
jmp 0x100068b8
call 0x100068c4
add byte [0x4b47443b], dh
xor eax, 0x8104c483
call fcn.10010167
pop eax
push edi
or edi, 0x103c2
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1f48], eax
mov ecx, dword [ebp - 0x1f48]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1f4c], edx
mov eax, dword [ebp - 0x1f4c]
mov dword [ebp - 0x1928], eax
push ecx
sub ecx, 0x1548e
pop ecx
push edx
xor edx, 0x834b
or edx, 0x9aaf
pop edx
push edx
xor edx, 0x4fab
jmp 0x10006922
jmp 0x10006928
or edx, 0x7395
pop edx
cmp dword [ebp - 0x1928], 0
mov ebp, 0xffffe6d8
add byte [ebp + 0xf], dh
mov dword [ebp - 0x394], 0
jmp 0x10006bee
mov ecx, dword [ebp - 0x1928]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xec4], eax
push eax
call 0x10006966
add byte [ebx + 0x4c], cl
xor al, 0x4c
dec ebx
cmp byte [ebx + 0x6eb04c4], al
xor ecx, dword [edx + 0x40]
inc eax
inc edx

Function at 0x10006970
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
aaa
call 0x10006981
add byte [esi], dh
cmp byte [eax], bh
inc edi
dec edi
xor eax, 0x34434a46
add esp, 4
and eax, 0xabf6
pop eax
cmp dword [ebp - 0xec4], 0
inc dword [eax]
jne 0x100069a3
mov dword [ebp - 0x394], 0
jmp 0x10006bee
mov ecx, dword [ebp - 0xec4]
mov dword [ebp - 0x5d4], ecx
push edi
push esi
call 0x10006bfe
add byte [esi], dh
inc ebp
xor ecx, dword [ebp + 0x35]
inc edi
cmp eax, 0xc483414a
add al, 0x5e
push esi
push edi
add esp, 4
call 0x10006c16
add byte [edi + 0x42], cl
push eax
Function at 0x10006981
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
aaa
call 0x10006981
add byte [esi], dh
cmp byte [eax], bh
inc edi
dec edi
xor eax, 0x34434a46
add esp, 4
and eax, 0xabf6
pop eax
cmp dword [ebp - 0xec4], 0
inc dword [eax]
jne 0x100069a3
mov dword [ebp - 0x394], 0
jmp 0x10006bee
mov ecx, dword [ebp - 0xec4]
mov dword [ebp - 0x5d4], ecx
push edi
push esi
call 0x10006bfe
add byte [esi], dh
inc ebp
xor ecx, dword [ebp + 0x35]
inc edi
cmp eax, 0xc483414a
add al, 0x5e
push esi
push edi
add esp, 4
call 0x10006c16
add byte [edi + 0x42], cl
push eax

Function at 0x100069b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor edi, 0x2817
jmp 0x100069bc
pop edi
push ebx
jmp 0x100069c7
call 0x100069d7
add byte [ebx], bh
dec esi
inc ecx
inc ecx
cmp eax, 0x3d4a3332
inc esp
add esp, 4
sub ebx, 0x924c
pop ebx
lea edx, [ebp - 0x1a68]
mov dword [ebp - 0xec0], edx
mov eax, dword [ebp - 0x5d4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xebc], ecx
xor edx, edx
mov word [ebp - 0x270], dx
xor eax, eax
mov word [ebp - 0x40], ax

Function at 0x100069d7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor edi, 0x2817
jmp 0x100069bc
pop edi
push ebx
jmp 0x100069c7
call 0x100069d7
add byte [ebx], bh
dec esi
inc ecx
inc ecx
cmp eax, 0x3d4a3332
inc esp
add esp, 4
sub ebx, 0x924c
pop ebx
lea edx, [ebp - 0x1a68]
mov dword [ebp - 0xec0], edx
mov eax, dword [ebp - 0x5d4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xebc], ecx
xor edx, edx
mov word [ebp - 0x270], dx
xor eax, eax
mov word [ebp - 0x40], ax

Function at 0x10006a10
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor esi, 0x116e2
and esi, 0x3fb6
sub esi, 0x11575
pop esi
push edx
add edx, 0x14a3
pop edx
push esi
push ecx
add esp, 4
and esi, 0x60be
sub esi, 0x3103
pop esi
mov ecx, dword [ebp - 0xebc]
mov dx, word [ecx]
mov word [ebp - 0x12ba], dx
mov eax, dword [ebp - 0xebc]
add eax, 2
mov dword [ebp - 0xebc], eax
mov cx, word [ebp - 0x12ba]
mov word [ebp - 0x270], cx
mov edx, dword [ebp - 0xec0]
Function at 0x10006a70
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push edx
add esp, 4
mov ax, word [edx]
mov word [ebp - 0x12bc], ax
mov ecx, dword [ebp - 0xec0]
add ecx, 2
mov dword [ebp - 0xec0], ecx
mov dx, word [ebp - 0x12bc]
mov word [ebp - 0x40], dx
push edi
push ecx
add esp, 4
jmp 0x10006a9f
or edi, 0x27d8
xor edi, 0x17a91
add edi, 0x5d8f
pop edi
push ecx
sub ecx, 0x1054c
jmp 0x10006abf
or ecx, 0x3ad
pop ecx
movzx eax, word [ebp - 0x40]
test eax, eax
jne 0x10006ae3
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
sub ecx, edx
mov dword [ebp - 0x1930], ecx
jmp 0x10006b3d
movzx eax, word [ebp - 0x270]
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x10006a0b
movzx edx, word [ebp - 0x270]
xor edx, 0x20
movzx eax, word [ebp - 0x40]
cmp edx, eax
je 0x10006a0b
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
jge 0x10006b27
mov dword [ebp - 0x192c], 0xffffffff
jmp 0x10006b31
mov dword [ebp - 0x192c], 1
mov eax, dword [ebp - 0x192c]
mov dword [ebp - 0x1930], eax
cmp dword [ebp - 0x1930], 0
jne 0x10006b86
push esi
push eax
add esp, 4
add esi, 0x17596
add byte [esi + 0x53], bl
or ebx, 0x17184
add ebx, 0xba3e
pop ebx
push ebx
push edi
add esp, 4
or ebx, 0xcc62
pop ebx
push edx
push ecx
add esp, 4
xor edx, 0x9132
xor edx, 0x5861
add edx, 0x10455
xor edx, 0x1a28
pop edx

Function at 0x10006b30
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ebx - 0x192b7b], cl
dec dword [ecx - 0x192f7b]
inc dword [ebx - 0x192f43]
out 0xff, al

Function at 0x10006b60
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0x6692
call 0x10006b74
add byte [edx], bh
aaa
dec esi
inc esp
inc esp
dec eax
add esp, 4
pop edx
mov ecx, dword [ebp - 0x5d4]
mov dword [ebp - 0x394], ecx
jmp 0x10006bee

Function at 0x10006b74
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0x6692
call 0x10006b74
add byte [edx], bh
aaa
dec esi
inc esp
inc esp
dec eax
add esp, 4
pop edx
mov ecx, dword [ebp - 0x5d4]
mov dword [ebp - 0x394], ecx
jmp 0x10006bee

Function at 0x10006bb0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
and esi, 0x74be
pop esi
mov edx, dword [ebp - 0x5d4]
mov eax, dword [edx]
mov dword [ebp - 0x5d4], eax
mov ecx, dword [ebp - 0x5d4]
cmp ecx, dword [ebp - 0xec4]
je 0x10006be4
mov edx, dword [ebp - 0x5d4]
cmp dword [edx + 0x30], 0
jne 0x100069af
mov dword [ebp - 0x394], 0
Function at 0x10006bfe
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
aaa
call 0x10006981
add byte [esi], dh
cmp byte [eax], bh
inc edi
dec edi
xor eax, 0x34434a46
add esp, 4
and eax, 0xabf6
pop eax
cmp dword [ebp - 0xec4], 0
inc dword [eax]
jne 0x100069a3
mov dword [ebp - 0x394], 0
jmp 0x10006bee
mov ecx, dword [ebp - 0xec4]
mov dword [ebp - 0x5d4], ecx
push edi
push esi
call 0x10006bfe
add byte [esi], dh
inc ebp
xor ecx, dword [ebp + 0x35]
inc edi
cmp eax, 0xc483414a
add al, 0x5e
push esi
push edi
add esp, 4
call 0x10006c16
add byte [edi + 0x42], cl
push eax

Function at 0x10006c10
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x434f3433
inc edi
add esp, 4
xor esi, 0xc7c
pop esi
cmp dword [ebp - 0x394], 0
jne 0x10007525
mov eax, 0x6b
mov word [ebp - 0x1ae4], ax
mov ecx, 0x65
mov word [ebp - 0x1ae2], cx
mov edx, 0x72
mov word [ebp - 0x1ae0], dx
mov eax, 0x6e
mov word [ebp - 0x1ade], ax
mov ecx, 0x65
mov word [ebp - 0x1adc], cx
mov edx, 0x6c
mov word [ebp - 0x1ada], dx
mov eax, 0x33
mov word [ebp - 0x1ad8], ax
mov ecx, 0x32
mov word [ebp - 0x1ad6], cx
mov edx, 0x2e
mov word [ebp - 0x1ad4], dx
mov eax, 0x64
mov word [ebp - 0x1ad2], ax
mov ecx, 0x6c
mov word [ebp - 0x1ad0], cx
mov edx, 0x6c
mov word [ebp - 0x1ace], dx
xor eax, eax
mov word [ebp - 0x1acc], ax
push edx
sub edx, 0x18a8
call 0x10006cdc
add byte [esi], dh
xor al, 0x42
cmp byte [edi], bh
xor bh, byte [ebx + ecx*2]
add esp, 4
and edx, 0x1406
call 0x10006cf4
add byte [edi], dh
dec ebx
inc esi
dec ecx
dec edi
dec ebx
cmp eax, dword ss:[edx - 0x7d]
les eax, [edx + ebx*2]
mov byte [ebp - 0xafc], 0x4c
mov byte [ebp - 0xafb], 0x6f
mov byte [ebp - 0xafa], 0x61
mov byte [ebp - 0xaf9], 0x64
mov byte [ebp - 0xaf8], 0x4c
mov byte [ebp - 0xaf7], 0x69
mov byte [ebp - 0xaf6], 0x62
mov byte [ebp - 0xaf5], 0x72
mov byte [ebp - 0xaf4], 0x61
mov byte [ebp - 0xaf3], 0x72
mov byte [ebp - 0xaf2], 0x79
mov byte [ebp - 0xaf1], 0x57
mov byte [ebp - 0xaf0], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1f50], ecx
mov edx, dword [ebp - 0x1f50]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1f54], eax
invalid
Function at 0x10006c16
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x434f3433
inc edi
add esp, 4
xor esi, 0xc7c
pop esi
cmp dword [ebp - 0x394], 0
jne 0x10007525
mov eax, 0x6b
mov word [ebp - 0x1ae4], ax
mov ecx, 0x65
mov word [ebp - 0x1ae2], cx
mov edx, 0x72
mov word [ebp - 0x1ae0], dx
mov eax, 0x6e
mov word [ebp - 0x1ade], ax
mov ecx, 0x65
mov word [ebp - 0x1adc], cx
mov edx, 0x6c
mov word [ebp - 0x1ada], dx
mov eax, 0x33
mov word [ebp - 0x1ad8], ax
mov ecx, 0x32
mov word [ebp - 0x1ad6], cx
mov edx, 0x2e
mov word [ebp - 0x1ad4], dx
mov eax, 0x64
mov word [ebp - 0x1ad2], ax
mov ecx, 0x6c
mov word [ebp - 0x1ad0], cx
mov edx, 0x6c
mov word [ebp - 0x1ace], dx
xor eax, eax
mov word [ebp - 0x1acc], ax
push edx
sub edx, 0x18a8
call 0x10006cdc
add byte [esi], dh
xor al, 0x42
cmp byte [edi], bh
xor bh, byte [ebx + ecx*2]
add esp, 4
and edx, 0x1406
call 0x10006cf4
add byte [edi], dh
dec ebx
inc esi
dec ecx
dec edi
dec ebx
cmp eax, dword ss:[edx - 0x7d]
les eax, [edx + ebx*2]
mov byte [ebp - 0xafc], 0x4c
mov byte [ebp - 0xafb], 0x6f
mov byte [ebp - 0xafa], 0x61
mov byte [ebp - 0xaf9], 0x64
mov byte [ebp - 0xaf8], 0x4c
mov byte [ebp - 0xaf7], 0x69
mov byte [ebp - 0xaf6], 0x62
mov byte [ebp - 0xaf5], 0x72
mov byte [ebp - 0xaf4], 0x61
mov byte [ebp - 0xaf3], 0x72
mov byte [ebp - 0xaf2], 0x79
mov byte [ebp - 0xaf1], 0x57
mov byte [ebp - 0xaf0], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1f50], ecx
mov edx, dword [ebp - 0x1f50]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1f54], eax
invalid

Function at 0x10006cdc
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
xor eax, 0x434f3433
inc edi
add esp, 4
xor esi, 0xc7c
pop esi
cmp dword [ebp - 0x394], 0
jne 0x10007525
mov eax, 0x6b
mov word [ebp - 0x1ae4], ax
mov ecx, 0x65
mov word [ebp - 0x1ae2], cx
mov edx, 0x72
mov word [ebp - 0x1ae0], dx
mov eax, 0x6e
mov word [ebp - 0x1ade], ax
mov ecx, 0x65
mov word [ebp - 0x1adc], cx
mov edx, 0x6c
mov word [ebp - 0x1ada], dx
mov eax, 0x33
mov word [ebp - 0x1ad8], ax
mov ecx, 0x32
mov word [ebp - 0x1ad6], cx
mov edx, 0x2e
mov word [ebp - 0x1ad4], dx
mov eax, 0x64
mov word [ebp - 0x1ad2], ax
mov ecx, 0x6c
mov word [ebp - 0x1ad0], cx
mov edx, 0x6c
mov word [ebp - 0x1ace], dx
xor eax, eax
mov word [ebp - 0x1acc], ax
push edx
sub edx, 0x18a8
call 0x10006cdc
add byte [esi], dh
xor al, 0x42
cmp byte [edi], bh
xor bh, byte [ebx + ecx*2]
add esp, 4
and edx, 0x1406
call 0x10006cf4
add byte [edi], dh
dec ebx
inc esi
dec ecx
dec edi
dec ebx
cmp eax, dword ss:[edx - 0x7d]
les eax, [edx + ebx*2]
mov byte [ebp - 0xafc], 0x4c
mov byte [ebp - 0xafb], 0x6f
mov byte [ebp - 0xafa], 0x61
mov byte [ebp - 0xaf9], 0x64
mov byte [ebp - 0xaf8], 0x4c
mov byte [ebp - 0xaf7], 0x69
mov byte [ebp - 0xaf6], 0x62
mov byte [ebp - 0xaf5], 0x72
mov byte [ebp - 0xaf4], 0x61
mov byte [ebp - 0xaf3], 0x72
mov byte [ebp - 0xaf2], 0x79
mov byte [ebp - 0xaf1], 0x57
mov byte [ebp - 0xaf0], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1f50], ecx
mov edx, dword [ebp - 0x1f50]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1f54], eax
invalid
Function at 0x10006cf4
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
xor eax, 0x434f3433
inc edi
add esp, 4
xor esi, 0xc7c
pop esi
cmp dword [ebp - 0x394], 0
jne 0x10007525
mov eax, 0x6b
mov word [ebp - 0x1ae4], ax
mov ecx, 0x65
mov word [ebp - 0x1ae2], cx
mov edx, 0x72
mov word [ebp - 0x1ae0], dx
mov eax, 0x6e
mov word [ebp - 0x1ade], ax
mov ecx, 0x65
mov word [ebp - 0x1adc], cx
mov edx, 0x6c
mov word [ebp - 0x1ada], dx
mov eax, 0x33
mov word [ebp - 0x1ad8], ax
mov ecx, 0x32
mov word [ebp - 0x1ad6], cx
mov edx, 0x2e
mov word [ebp - 0x1ad4], dx
mov eax, 0x64
mov word [ebp - 0x1ad2], ax
mov ecx, 0x6c
mov word [ebp - 0x1ad0], cx
mov edx, 0x6c
mov word [ebp - 0x1ace], dx
xor eax, eax
mov word [ebp - 0x1acc], ax
push edx
sub edx, 0x18a8
call 0x10006cdc
add byte [esi], dh
xor al, 0x42
cmp byte [edi], bh
xor bh, byte [ebx + ecx*2]
add esp, 4
and edx, 0x1406
call 0x10006cf4
add byte [edi], dh
dec ebx
inc esi
dec ecx
dec edi
dec ebx
cmp eax, dword ss:[edx - 0x7d]
les eax, [edx + ebx*2]
mov byte [ebp - 0xafc], 0x4c
mov byte [ebp - 0xafb], 0x6f
mov byte [ebp - 0xafa], 0x61
mov byte [ebp - 0xaf9], 0x64
mov byte [ebp - 0xaf8], 0x4c
mov byte [ebp - 0xaf7], 0x69
mov byte [ebp - 0xaf6], 0x62
mov byte [ebp - 0xaf5], 0x72
mov byte [ebp - 0xaf4], 0x61
mov byte [ebp - 0xaf3], 0x72
mov byte [ebp - 0xaf2], 0x79
mov byte [ebp - 0xaf1], 0x57
mov byte [ebp - 0xaf0], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1f50], ecx
mov edx, dword [ebp - 0x1f50]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1f54], eax
invalid

Function at 0x100070fb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x10007107
xor ecx, 0x12444
pop ecx
push ecx
push ecx
add esp, 4
xor ecx, 0xde4c
pop ecx
mov ecx, dword [ebp - 0x894]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3d0], edx
mov dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x1980], eax
cmp dword [ebp - 0x1980], 0
jne 0x10007159
mov ecx, dword [ebp - 0x8a4]
mov dword [ebp - 0x490], ecx
jmp 0x1000744a
mov edx, dword [ebp - 0x1980]
mov eax, dword [ebp - 0x3d0]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1984], eax
jne 0x10007181
mov ecx, dword [ebp - 0x8a4]
mov dword [ebp - 0x490], ecx
jmp 0x1000744a
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1984]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1988], edx
cmp dword [ebp - 0x1988], 0
jne 0x100071b3
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x490], eax
jmp 0x1000744a
mov ecx, dword [ebp - 0x3d0]
add ecx, dword [ebp - 0x1988]
mov dword [ebp - 0x898], ecx
jne 0x100071d8
mov edx, dword [ebp - 0x8a4]
invalid
xchg ebp, eax
invalid

Function at 0x10007210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb al, 0x89
xchg ebp, eax
movsb byte es:[edi], byte [esi]
loopne 0x10007215
invalid
inc edi
test dword [edi + esi*8 - 1], esp
inc dword [eax]
add byte [eax], al
add bl, ch
jnp 0xff7d6ad
inc dword [ebx - 0x7a76fe40]
idiv edi
dec dword [ebx - 0x89773]
dec dword [ebx - 0x89b6b]
invalid
Function at 0x10007250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x89c]
add eax, 1
mov dword [ebp - 0x89c], eax
mov ecx, dword [ebp - 0x898]
mov edx, dword [ebp - 0x89c]
cmp edx, dword [ecx + 0x18]
jae 0x1000743e
mov eax, dword [ebp - 0x89c]
mov ecx, dword [ebp - 0x1f58]
loopne 0x10007251
dec dword [ebx - 0x3cf6b]
inc dword [ebx]
adc al, 0x81
loopne 0x10007251
invalid
dec dword [ebx - 0x3cf6b]
inc dword [ebx]
adc al, 0x81
mov dword [ebp - 0x8a0], edx
mov eax, dword [ebp - 0x89c]
mov ecx, dword [ebp - 0x2364]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x1f5c]
mov ecx, dword [ebp - 0x3d0]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x1f60], ecx
invalid
test dword [eax], esp
invalid
invalid
inc dword [eax]
add byte [eax], al

Function at 0x10007290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add bl, ch
jnp 0xffe932d
inc dword [ebx - 0x6a76fe3e]
and dh, bh
invalid

Function at 0x10007630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call dword [ebx + 0x51]
add esp, 4
or ebx, 0x693
sub ebx, 0x15b07
pop ebx
push ecx
push ecx
add esp, 4
jmp 0x1000764e
pop ecx
push esi
xor esi, 0x185fd
or esi, 0x3252
add esi, 0x1554c
pop esi
lea eax, [ebp - 0x1a68]
mov dword [ebp - 0xedc], eax
mov ecx, dword [ebp - 0x5dc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xed8], edx
xor eax, eax
mov word [ebp - 0x278], ax
xor ecx, ecx
mov word [ebp - 0x48], cx
push esi
xor esi, 0xd23b
xor esi, 0x135cd
and esi, 0x77db
pop esi
push esi
push edx
add esp, 4
sub esi, 0xbe2c
and esi, 0x713d
add esi, 0x15ab7
sub esi, 0xb4c0
pop esi
mov edx, dword [ebp - 0xed8]
mov ax, word [edx]
mov word [ebp - 0x12c2], ax
mov ecx, dword [ebp - 0xed8]
add ecx, 2
mov dword [ebp - 0xed8], ecx
mov dx, word [ebp - 0x12c2]
mov word [ebp - 0x278], dx
mov eax, dword [ebp - 0xedc]
mov cx, word [eax]
mov word [ebp - 0x12c4], cx
mov edx, dword [ebp - 0xedc]
add edx, 2
mov dword [ebp - 0xedc], edx
mov ax, word [ebp - 0x12c4]
mov word [ebp - 0x48], ax
push edi
push edx
add esp, 4
or edi, 0x3a0d
pop edi
push edx
push ecx
add esp, 4
or edx, 0x4640
pop edx
push edx
call 0x1000773e
add byte [eax], bh
dec ecx
dec ebp
xor bh, byte [edi]
dec edx
inc ecx
dec edx
cmp al, 0x83
les eax, [ecx + eax*4]
ljmp 0xf5a
Function at 0x1000773e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call dword [ebx + 0x51]
add esp, 4
or ebx, 0x693
sub ebx, 0x15b07
pop ebx
push ecx
push ecx
add esp, 4
jmp 0x1000764e
pop ecx
push esi
xor esi, 0x185fd
or esi, 0x3252
add esi, 0x1554c
pop esi
lea eax, [ebp - 0x1a68]
mov dword [ebp - 0xedc], eax
mov ecx, dword [ebp - 0x5dc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xed8], edx
xor eax, eax
mov word [ebp - 0x278], ax
xor ecx, ecx
mov word [ebp - 0x48], cx
push esi
xor esi, 0xd23b
xor esi, 0x135cd
and esi, 0x77db
pop esi
push esi
push edx
add esp, 4
sub esi, 0xbe2c
and esi, 0x713d
add esi, 0x15ab7
sub esi, 0xb4c0
pop esi
mov edx, dword [ebp - 0xed8]
mov ax, word [edx]
mov word [ebp - 0x12c2], ax
mov ecx, dword [ebp - 0xed8]
add ecx, 2
mov dword [ebp - 0xed8], ecx
mov dx, word [ebp - 0x12c2]
mov word [ebp - 0x278], dx
mov eax, dword [ebp - 0xedc]
mov cx, word [eax]
mov word [ebp - 0x12c4], cx
mov edx, dword [ebp - 0xedc]
add edx, 2
mov dword [ebp - 0xedc], edx
mov ax, word [ebp - 0x12c4]
mov word [ebp - 0x48], ax
push edi
push edx
add esp, 4
or edi, 0x3a0d
pop edi
push edx
push ecx
add esp, 4
or edx, 0x4640
pop edx
push edx
call 0x1000773e
add byte [eax], bh
dec ecx
dec ebp
xor bh, byte [edi]
dec edx
inc ecx
dec edx
cmp al, 0x83
les eax, [ecx + eax*4]
ljmp 0xf5a
Function at 0x100077c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebp, 0xffffe668
add byte [ebp + 0x40], dh
push eax
or eax, 0xbc34
pop eax
push edx
push ecx
add esp, 4
sub edx, 0x290b
xor edx, 0x91c1
pop edx
push esi
push ecx
add esp, 4
call fcn.100077f6
add byte [eax + 0x39], cl
inc edx
dec edx
cmp al, 0x35
push eax
aas
push edi
call 0x1000787e
add byte [edi + 0x4d], cl
dec ebx
cmp byte [ebx], bh
xor al, 0x3c
add esp, 4
pop edi
push ebx
push ecx
add esp, 4
sub ebx, 0x10d43
or ebx, 0xaef1
pop ebx
push ecx
sub ecx, 0x9eeb
add ecx, 0xb7e9
pop ecx
mov ecx, dword [ebp - 0x394]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3cc], edx
call dword [edx - 0x7f]
loop 0x10007877
invalid
add dword [eax], eax
jmp 0x100078be
pop edx
push ebx
or ebx, 0x164f3
jmp 0x100078cb
pop ebx
push edi
push ecx
add esp, 4
xor edi, 0x2572
jmp 0x100078dc
or edi, 0xb1c7
pop edi
mov dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x199c], eax
cmp dword [ebp - 0x199c], 0
jne 0x10007913
mov ecx, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], ecx
jmp 0x10007c04
mov edx, dword [ebp - 0x199c]
mov eax, dword [ebp - 0x3cc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x19a0], eax
jne 0x1000793b
mov ecx, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], ecx
jmp 0x10007c04
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x19a0]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x19a4], edx
out 0xff, al
inc dword [ebx - 0x19a343]
inc dword [eax]
jne 0x1000796d
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], eax
jmp 0x10007c04
mov ecx, dword [ebp - 0x3cc]
add ecx, dword [ebp - 0x19a4]
mov dword [ebp - 0x8a8], ecx
jne 0x10007992
mov edx, dword [ebp - 0x8b4]
mov dword [ebp - 0x5e0], edx
jmp 0x10007c04
mov eax, dword [ebp - 0x8a8]
mov ecx, dword [ebp - 0x3cc]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x1f74], ecx
mov edx, dword [ebp - 0x8a8]
mov eax, dword [ebp - 0x3cc]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1f78], eax
mov ecx, dword [ebp - 0x8a8]
mov edx, dword [ebp - 0x3cc]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1f7c], edx
mov dword [ebp - 0x8ac], 0
jmp 0x100079ec

Function at 0x100077f6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
mov edx, dword [ebp - 0x5dc]
mov dword [ebp - 0x394], edx
jmp 0x10007870