joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4555d4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x490bb4]
cmp dword [eax + 0x30], 0
je 0x45567e
cmp dword [ebx + 0x94], 0
jne 0x455678
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x455564
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x455678
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45563e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x455678
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041bdf0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45564d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4561e0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x456215
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404100
jmp 0x456222
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404064
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x457274
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4572b5
mov eax, esi
call fcn.0043dc40
test al, al
je 0x4572b5
mov eax, dword [ebx + 0x84]
call fcn.0043d9e0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4572b5
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043d9e0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x47b387
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x48edde
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x47b3df
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x48edff
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x47b3d5
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x47b3e3
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4881c8
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0x14]
shr eax, 1
add eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..retplne
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1da202f8
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6deb0f1f
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4470fe
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44712c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44714a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00447068
jmp 0x44714a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44714a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00447068
test edi, edi
mov eax, edi
jne 0x447134
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x47927c]
test ecx, ecx
je 0x4471fd
jmp 0x4470fd
ret 8

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x533080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xde000]
push edi
jmp 0x53309a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5330a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x533090
mov eax, 1
add ebx, ebx
jne 0x5330b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5330c4
jne 0x5330e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5330e3
dec eax
add ebx, ebx
jne 0x5330d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5330a8
add ebx, ebx
jne 0x5330df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x533135
xor ecx, ecx
sub eax, 3
jb 0x5330fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53316a
sar eax, 1
mov ebp, eax
jmp 0x533106
add ebx, ebx
jne 0x533106
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5330d4
inc ecx
add ebx, ebx
jne 0x533114
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5330d4
add ebx, ebx
jne 0x533121
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x533116
jne 0x533132
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x533116
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x533154
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x533146
jmp 0x533096
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x533154
add edi, ecx
jmp 0x533096
pop esi
mov edi, esi
mov ecx, 0x3eef
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x533172
cmp byte [edi], 0x11
jne 0x533172
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x533177
lea edi, [esi + 0x12c000]
mov eax, dword [edi]
or eax, eax
je 0x5331ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18ea08]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18eb84]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5331a4
mov ecx, edi
jns 0x5331d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18eb88]
or eax, eax
je 0x5331e9
mov dword [ebx], eax
add ebx, 4
jmp 0x5331c1
call dword [esi + 0x18eb98]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x533220
cmp al, 0xef
ja 0x533213
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5331f5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x533202
mov ebp, dword [esi + 0x18eb8c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x533254
sub esp, 0xffffff80
jmp 0x426bf7
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x407ef8
mov ecx, 0x699336e8
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section._RDATA
nop
mov ebx, 0x42cd70
mov ecx, 0x4f27283e
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x135861e8
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x60b63d52
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x427845
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [eax], eax
push edx
sub edx, 0xbf8
pop edx
push eax
call fcn.00427830
add byte [ecx + 0x4c], cl
xor eax, dword [edx + esi + 0x42]
cmp al, 0x50
cmp eax, dword [ebx - 0x7d]
add esp, 4
invalid
loopne 0x4277ca
add esp, 4
and eax, 0xbb94
call 0x427845
add byte [edi + 0x37], al
mov ebx, 0x7e80000
add byte [eax], al
add byte [eax], al
inc edi
aaa
inc ecx
xor al, 0x47
inc edx
add esp, 4
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edi
or edi, 0xdfc6
pop edi
push eax
push esi
add esp, 4
xor eax, 0x7d76
pop eax
push esi
push eax
add esp, 4
xor esi, 0x10699
xor esi, 0xf4c
add esi, 0x1a4b
and esi, 0x9cdb
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4278ef
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x427949
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x427817
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x427817
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x427933
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x42793d
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x427992
push edi
push edi
add esp, 4
add edi, 0xe3f3
pop edi
push ebx
push edi
add esp, 4
xor ebx, 0x26e2
pop ebx
push ebx
jmp 0x427974
jmp 0x42797d
or ebx, 0xf5f6
pop ebx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4279fa
push ebx
call 0x42799f
add byte [ebx + 0x3c], cl
inc edx
inc edx
cmp byte [ebx + eax*4], dh
les eax, [ebx + ebx*2]
push esi
push ecx
add esp, 4
xor esi, 0x1510d
call 0x4279ba
add byte [ebp + 0x45], al
dec edi
dec eax
inc edi
xor al, 0x83
les eax, [ecx + eax*4]
into
loopne 0x4279d6
add dword [eax], eax
pop esi
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x4279f0
invalid
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x4277bb
mov dword [ebp - 0x2a8], 0
Function at 0x4279ba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [eax], eax
push edx
sub edx, 0xbf8
pop edx
push eax
call fcn.00427830
add byte [ecx + 0x4c], cl
xor eax, dword [edx + esi + 0x42]
cmp al, 0x50
cmp eax, dword [ebx - 0x7d]
add esp, 4
invalid
loopne 0x4277ca
add esp, 4
and eax, 0xbb94
call 0x427845
add byte [edi + 0x37], al
mov ebx, 0x7e80000
add byte [eax], al
add byte [eax], al
inc edi
aaa
inc ecx
xor al, 0x47
inc edx
add esp, 4
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edi
or edi, 0xdfc6
pop edi
push eax
push esi
add esp, 4
xor eax, 0x7d76
pop eax
push esi
push eax
add esp, 4
xor esi, 0x10699
xor esi, 0xf4c
add esi, 0x1a4b
and esi, 0x9cdb
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4278ef
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x427949
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x427817
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x427817
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x427933
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x42793d
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x427992
push edi
push edi
add esp, 4
add edi, 0xe3f3
pop edi
push ebx
push edi
add esp, 4
xor ebx, 0x26e2
pop ebx
push ebx
jmp 0x427974
jmp 0x42797d
or ebx, 0xf5f6
pop ebx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4279fa
push ebx
call 0x42799f
add byte [ebx + 0x3c], cl
inc edx
inc edx
cmp byte [ebx + eax*4], dh
les eax, [ebx + ebx*2]
push esi
push ecx
add esp, 4
xor esi, 0x1510d
call 0x4279ba
add byte [ebp + 0x45], al
dec edi
dec eax
inc edi
xor al, 0x83
les eax, [ecx + eax*4]
into
loopne 0x4279d6
add dword [eax], eax
pop esi
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x4279f0
invalid
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x4277bb
mov dword [ebp - 0x2a8], 0
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x5a1a5390
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x4deb6b81
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10007492
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
add esp, 4
and edi, 0xc2a9
pop edi

Function at 0x100074b0
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov byte [ebp - 0xb24], 0x4c
mov byte [ebp - 0xb23], 0x6f
mov byte [ebp - 0xb22], 0x61
fdivrp st(4)
invalid
jmp dword [ecx - 0x3a]
test edi, ebx
hlt
invalid
jmp dword [esi + eax*8 - 0x7b]
loopne 0x100074c4
invalid
invalid
dec esp

Function at 0x10007547
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push ebx
push edi
add esp, 4

Function at 0x10007550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and ebx, 0xea98
sub ebx, 0xb0fd
pop ebx
push ebx
add ebx, 0xa636
cmpsb byte ss:[esi], byte es:[edi]
add byte [eax], al

Function at 0x100076fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
lea eax, [ebp - 0x1b38]
mov dword [ebp - 0xeb8], eax
mov ecx, dword [ebp - 0x5d4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xeb4], edx
xor eax, eax
mov word [ebp - 0x274], ax
xor ecx, ecx
mov word [ebp - 0x13c], cx
push edx
push edi
add esp, 4
or edx, 0xe480
call 0x1000765d
add byte [ebx + 0x4a], cl
aaa
dec edi
inc esi
dec esp
aaa
add esp, 4
call 0x1000766c
add byte [ebx], dh
cmp dword [ecx + ecx*2], esi
cmp al, 0x4e
add esp, 4
or edx, 0x25f8
pop edx
mov edx, dword [ebp - 0xeb4]
mov ax, word [edx]
mov word [ebp - 0x12ca], ax
mov ecx, dword [ebp - 0xeb4]
add ecx, 2
mov dword [ebp - 0xeb4], ecx
mov dx, word [ebp - 0x12ca]
mov word [ebp - 0x274], dx
mov eax, dword [ebp - 0xeb8]
mov cx, word [eax]
mov word [ebp - 0x12cc], cx
mov edx, dword [ebp - 0xeb8]
add edx, 2
mov dword [ebp - 0xeb8], edx
invalid
jmp dword [esi - 0x75]
test dword [ebp*8 - 0x76990001], esi
test esp, eax
invalid
invalid
call dword [esi - 0x7f]
out 0xd4, al
mov dh, 0
add byte [ecx + 0x18501ce], al
add byte [esi + 0x52], bl
push esi
add esp, 4
call 0x100076ef
add byte [edx + 0x4c], cl
cmp dword [esi + 0x38], ecx
xor al, byte [ebx + 0x7e804c4]
add byte [eax], al
add byte [eax], al
dec eax
dec ebx
dec ebp
cmp byte [edi], dh
dec esi
add esp, 4
pop edx
movzx ecx, word [ebp - 0x13c]
test ecx, ecx
jne 0x10007725
movzx edx, word [ebp - 0x274]
movzx eax, word [ebp - 0x13c]
sub edx, eax
invalid
xchg ebp, eax
invalid

Function at 0x100077bf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [eax], eax
add esi, 0x143d8
sub esi, 0x5903
pop esi
push edi
call 0x100077bf
add byte [ebx + 0x42], cl
push eax
inc edi
cmp eax, 0x374c333c
add esp, 4
pop edi
mov edx, dword [ebp - 0x5d4]
mov dword [ebp - 0x888], edx
jmp fcn.10007839

Function at 0x100077e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
in al, dx
adc dword [eax], eax
add byte [ecx + 0x51], bl
push ebx
add esp, 4
and ecx, 0x13323
Function at 0x100077f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
xor ecx, 0x2229
jmp 0x100075f1
and ecx, 0x52ce
pop ecx
push ecx
and ecx, 0x14093
or ecx, 0x1beb
call fcn.10007613
add byte [ecx + 0x46], cl
xor al, 0x4b
cmp byte [edi + 0x33], al
inc edi
xor edi, dword [edx]
add esp, 4
pop ecx
lea eax, [ebp - 0x1b38]
mov dword [ebp - 0xeb8], eax
mov ecx, dword [ebp - 0x5d4]
mov edx, dword [ecx + 0x30]
invalid
xchg ebp, eax
dec esp
int1
invalid
jmp 0x100077f5
pop ecx
push ebx
push ecx
add esp, 4
jmp 0x10007802
pop ebx
mov eax, dword [ebp - 0x5d4]
mov ecx, dword [eax]
mov dword [ebp - 0x5d4], ecx
mov edx, dword [ebp - 0x5d4]
cmp edx, dword [ebp - 0xebc]
je 0x1000782f
mov eax, dword [ebp - 0x5d4]
cmp dword [eax + 0x30], 0
jne 0x100075e5
mov dword [ebp - 0x888], 0
push edx
xor edx, 0x1498f
add edx, 0xa497
xor edx, 0x3e48
jmp 0x1000840c
pop edx
push ebx
push edx
add esp, 4
les eax, [ebx + ebp*8]
invalid
sub ebx, 0x10d0e
xor ebx, 0x12d79
pop ebx
mov edx, dword [ebp - 0x494]
add edx, 0xe
mov dword [ebp - 0x1ff0], edx
push edx
push ecx
add esp, 4
call 0x10008447
add byte [eax + 0x32], dl
cmp eax, 0x443c3a45
xor bh, byte [ecx]
add esp, 4
add edx, 0xf30e
pop edx
push edi
add edi, 0x1007a
xor edi, 0x184db
add edi, 0x11a60
pop edi
cmp dword [ebp - 0x494], 0
je 0x10008477
cmp dword [ebp - 0xc20], 0
jne 0x100084bd
push eax
or eax, 0x1015f
invalid
invalid

Function at 0x100080c1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
pop ecx
push ecx
push ebx
add esp, 4
jmp 0x10008070
and ecx, 0x14786
jmp 0x1000807b
pop ecx
push edi
xor edi, 0x14a76
pop edi
mov ecx, dword [ebp - 0x37c]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3d4], edx
push esi
push edx
add esp, 4
call 0x100080a8
add byte [ecx + 0x4f], al
xor al, byte [ebp + 0x50]
dec ebp
inc eax
cmp al, 0x38
add esp, 4
jmp 0x100080b4
call 0x100080c1
add byte [eax], bh
cmp al, byte [esi + 0x40]
inc eax
inc esi
cmp byte [ebx - 0x38a1fb3c], al
test dword [eax - 9], ebx
invalid

Function at 0x1000853e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fdivr st(7)
dec dword [edx]
add byte [eax], al
add byte [esi + 0x57], dl
add esp, 4
sub esi, 0x17fb8
sub esi, 0x15058
pop esi
push eax
push edi
add esp, 4
or eax, 0x125d1
xor eax, 0x74a5
jmp 0x100084f0
jmp 0x100084f8
pop eax
mov ecx, dword [ebp - 0x494]
mov dl, byte [ecx + 0xa]
mov byte [ebp - 0x459], dl
mov eax, dword [ebp - 0xc20]
sub eax, dword [ebp - 0x494]
mov dword [ebp - 0x19c8], eax
mov dword [ebp - 0xf00], 0
push ebx
push edx
add esp, 4
sub ebx, 0x8a73
call 0x1000853e
or al, byte [eax]
add byte [eax], al
add byte [esi + edi], dh
cmp eax, 0x34344346
dec edx
inc ebp
add esp, 4
sub ebx, 0x13b40
and ebx, 0x2590
pop ebx
push ebx
xor ebx, 0x12bb
pop ebx
mov byte [ebp - 0xb74], 0x56
mov byte [ebp - 0xb73], 0x69
mov byte [ebp - 0xb72], 0x72
mov byte [ebp - 0xb71], 0x74
mov byte [ebp - 0xb70], 0x75
mov byte [ebp - 0xb6f], 0x61
mov byte [ebp - 0xb6e], 0x6c
mov byte [ebp - 0xb6d], 0x50
invalid
invalid

Function at 0x100085e7
Capabilities:
Get number of processors

Disassembly:
add esp, 4
sub edi, 0x2d66
Function at 0x100085f0
Capabilities:
Get number of processors

Disassembly:
pop edi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1fac], ecx
mov edx, dword [ebp - 0x1fac]
push esp
loopne 0x10008602
dec dword [ebx - 0x7a76cfbe]
push eax
loopne 0x1000860b
dec dword [ebx - 0x1faf73]
dec dword [ecx - 0x194773]
call dword [ebx + 0x57]

Function at 0x10008600
Capabilities:
Get number of processors

Disassembly:
push esp
loopne 0x10008602
invalid
dec dword [ebx - 0x7a76cfbe]
push eax
loopne 0x1000860b
invalid
dec dword [ebx - 0x1faf73]
dec dword [ecx - 0x194773]
call dword [ebx + 0x57]
add esp, 4
or ebx, 0x566f
xor ebx, 0x56f1
add ebx, 0x2afc
pop ebx
push ebx
push eax
add esp, 4
and ebx, 0x137d4
pop ebx
push edx
xor edx, 0x17b11
adc dword [ebx + 1], edi
add byte [ecx + 0x146cdf2], al
add byte [edx - 0x7d], bl
mov ebp, 0xffffe6b8
inc dword [eax]
jne 0x10008663
mov edx, dword [ebp - 0x1948]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xedc], ecx
push ecx
push edi
add esp, 4
add ecx, 0x821d

Function at 0x10008680
Capabilities:
Get number of processors

Disassembly:
jmp 0x10008686
add ecx, 0xa24b
pop ecx
push eax
sub eax, 0xfedf
or eax, 0x10728
and eax, 0xedf4
and eax, 0x96c8
pop eax
cmp dword [ebp - 0xedc], 0
jne 0x100086bf
mov dword [ebp - 0x378], 0
jmp 0x1000891f
invalid