joyce8/EMBER2024-capa huggingface dataset:
Function at 0x702e1142
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x7ff80000
mov ebx, 0x10000
jbe 0x702e1166
lea eax, [esi - 0x7ff80000]
mov dword [ebp + 8], eax
jmp 0x702e1169
mov dword [ebp + 8], ebx
cmp esi, 0x80000000
jae 0x702e117c
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x702e1183
mov dword [ebp - 4], 0xfff80000
mov eax, dword [0x7035812c]
mov ecx, dword [0x70358128]
test eax, eax
jne 0x702e119d
test ecx, ecx
je 0x702e11b2
mov eax, ecx
mov dword [0x7035812c], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x702e11b2
cmp edx, dword [ebp + 8]
jb 0x702e11b2
cmp edx, dword [ebp - 4]
jbe 0x702e130b
mov eax, ecx
test ecx, ecx
mov dword [0x7035812c], eax
je 0x702e11e2
test eax, eax
je 0x702e11d6
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x702e11d6
cmp ecx, dword [ebp + 8]
jb 0x702e11d6
cmp ecx, dword [ebp - 4]
jbe 0x702e130b
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x7035812c], eax
jne 0x702e11c1
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp + 8]
mov edi, esi
jbe 0x702e124a
cmp edi, 0x70000000
jb 0x702e1207
cmp edi, 0x80000000
ja 0x702e1207
mov edi, 0x6fff0000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x702e124a
cmp dword [ebp - 0x10], ebx
jne 0x702e1222
cmp dword [ebp - 0x14], ebx
jae 0x702e1232
mov eax, dword [ebp - 0x1c]
lea edi, [eax - 0x10000]
cmp edi, dword [ebp + 8]
ja 0x702e11f2
jmp 0x702e124a
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x7035812c], eax
jne 0x702e12c1
cmp esi, dword [ebp - 4]
jae 0x702e1332
cmp esi, 0x70000000
jb 0x702e1268
cmp esi, 0x80000000
ja 0x702e1268
mov esi, 0x80010000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x702e1332
cmp dword [ebp - 0x10], ebx
jne 0x702e12b6
cmp dword [ebp - 0x14], ebx
jb 0x702e12b6
mov ecx, esi
and ecx, 0xffff
je 0x702e129e
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x14], eax
add dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x7035812c], eax
jne 0x702e12c1
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
lea esi, [eax + ecx]
jmp 0x702e124a
mov dword [eax], 0x52727464
mov eax, dword [0x7035812c]
xor ecx, ecx
mov dword [eax + 8], ecx
mov eax, dword [0x7035812c]
mov edx, dword [0x70358128]
mov dword [eax + 4], edx
mov eax, dword [0x7035812c]
mov dword [0x70358128], eax
add eax, 0xffe0
mov edx, 0x7fd
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec edx
jne 0x702e12f3
mov eax, dword [0x7035812c]
mov dword [eax + 8], ecx
mov eax, dword [0x7035812c]
mov esi, dword [eax + 8]
cmp esi, dword [ebp + 8]
jb 0x702e1332
cmp esi, dword [ebp - 4]
ja 0x702e1332
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.702e95e0
add esp, 0xc
mov eax, esi
jmp 0x702e1334
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x702e1339
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7031cb08
push 0x702e9fa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x702e13ae
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x702e13aa
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x702e13aa
cmp word [eax + 0x14], 0
jne 0x702e139f
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x702e13b0
mov eax, ecx
jmp 0x702e1399
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x702e13bf
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x70358134], eax
je 0x702e13de
mov eax, 0x10dd
jmp 0x702e14b4
mov eax, dword [0x70358138]
test eax, eax
jne 0x702e14b4
mov edi, dword [ebp + 8]
test edi, edi
jne 0x702e13fa
push 6
pop eax
jmp 0x702e14b4
cmp dword [edi], 0
jne 0x702e140c
push 6
pop eax
mov dword [0x70358138], eax
jmp 0x702e14ae
push 0x18
call fcn.702e1f8d
mov esi, eax
pop ecx
test esi, esi
jne 0x702e141f
push 8
pop edi
jmp 0x702e1498
mov edi, dword [edi]
push 0
push dword [ebp + 0xc]
call fcn.702e0950
movzx ecx, byte [edi + 0x17]
mov ebx, dword [edi + 0x18]
xor edx, edx
sub ebx, ecx
cmp ecx, edx
je 0x702e148d
cmp ecx, 0x17
ja 0x702e148d
cmp dword [edi + 0x1c], eax
jne 0x702e148d
lea eax, [ebp - 4]
mov dword [ebp - 4], edx
push eax
push 0x40
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x702e1463
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x702e1498
mov eax, dword [ebp + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x70358144]
mov dword [esi], eax
mov dword [0x70358144], esi
xor eax, eax
jmp 0x702e14b4
cmp dword [0x70358130], edx
push 9
pop edi
jne 0x702e149e
mov dword [0x70358138], edi
test esi, esi
je 0x702e14a9
push esi
call fcn.702e1c24
pop ecx
mov eax, edi
mov edi, dword [ebp + 8]
mov dword [0x7035813c], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x702e14bb
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor edi, edi
cmp dword [0x70358170], edi
jne 0x702e165b
mov eax, dword [0x7035816c]
cmp eax, edi
jne 0x702e165d
push 0x24
mov ebx, 0x70358148
push edi
push ebx
call fcn.702e95e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.dbghelp.dll
mov dword [0x70358148], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [0x7035814c], eax
je 0x702e161c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImagehlpApiVersionEx
push eax
call esi
push str.SymInitialize
mov dword [0x70358150], eax
push dword [0x7035814c]
call esi
push str.SymSetOptions
mov dword [0x70358154], eax
push dword [0x7035814c]
call esi
push str.SymGetOptions
mov dword [0x70358158], eax
push dword [0x7035814c]
call esi
push str.SymLoadModule64
mov dword [0x7035815c], eax
push dword [0x7035814c]
call esi
push str.SymGetModuleInfo64
mov dword [0x70358160], eax
push dword [0x7035814c]
call esi
push str.SymFromName
mov dword [0x70358164], eax
push dword [0x7035814c]
call esi
mov dword [0x70358168], eax
push 8
lea eax, [ebp - 8]
push edi
push eax
call fcn.702e95e0
mov eax, dword [0x70358150]
add esp, 0xc
cmp eax, edi
mov word [ebp - 8], 7
pop esi
je 0x702e1617
cmp dword [0x70358154], edi
je 0x702e1617
cmp dword [0x70358160], edi
je 0x702e1617
cmp dword [0x70358164], edi
je 0x702e1617
cmp dword [0x70358168], edi
je 0x702e1617
lea ecx, [ebp - 8]
push ecx
call eax
cmp word [ebp - 8], 7
jb 0x702e1617
push edi
push edi
push dword [0x70358148]
call dword [0x70358154]
test eax, eax
je 0x702e1617
mov eax, dword [0x7035815c]
cmp eax, edi
je 0x702e160d
cmp dword [0x70358158], edi
je 0x702e160d
call eax
and al, 0xfc
or al, 4
push eax
call dword [0x70358158]
mov dword [0x7035816c], ebx
mov eax, ebx
jmp 0x702e165d
mov eax, dword [0x7035814c]
cmp eax, edi
mov dword [0x70358170], 1
je 0x702e1631
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x70358150], edi
mov dword [0x70358154], edi
mov dword [0x70358158], edi
mov dword [0x7035815c], edi
mov dword [0x70358160], edi
mov dword [0x70358164], edi
mov dword [0x70358168], edi
xor eax, eax
pop edi
pop ebx
leave
ret

Function at 0x702ea339
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
add byte [edi + 0x51], dl
add esp, 4
xor edi, 0xb96f
call 0x702ea2f9
add byte [edx], bh
dec ebx
inc ebp
dec edx
dec ebx
dec ebx
dec esi
cmp al, 0x40
add esp, 4
pop edi
push edx
sub edx, 0x147bd
pop edx
push edi
push edi
add esp, 4
sub edi, 0xc666
pop edi
push edi
push ecx
add esp, 4
jmp 0x702ea31e
pop edi
push eax
push edi
add esp, 4
jmp 0x702ea32c
call 0x702ea339
add byte [eax], bh
dec edx
dec edi
dec esi
inc ecx
inc ecx
xor eax, 0xeb04c483
add al, 0x4a
dec ebp
dec edi
dec edi
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xdd4]
invalid
invalid
Function at 0x702ea66e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and esi, 0xa7c2
pop esi
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0xbfc], eax
jmp 0x702ea6c7
push edx
and edx, 0xec66
add edx, 0xf0e3
call fcn.702ea6e4
add byte [edx + 0x3b], al
Function at 0x702ea6dc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
cmp eax, 0x32414d39
dec edi
cmp eax, 0xe804c483
add esp, 4
call 0x702ea6f5
add byte [edi], dh
inc ecx
inc ecx
inc edi
push eax
inc esi
add esp, 4
pop edx
mov byte [ebp - 0x9c0], 0x45
mov byte [ebp - 0x9bf], 0x78
mov byte [ebp - 0x9be], 0x69
mov byte [ebp - 0x9bd], 0x74
mov byte [ebp - 0x9bc], 0x50
mov byte [ebp - 0x9bb], 0x72
mov byte [ebp - 0x9ba], 0x6f
mov byte [ebp - 0x9b9], 0x63
mov byte [ebp - 0x9b8], 0x65
mov byte [ebp - 0x9b7], 0x73
mov byte [ebp - 0x9b6], 0x73
mov byte [ebp - 0x9b5], 0
push eax
sub eax, 0x75dc
xor eax, 0x1628a
and eax, 0x6844
pop eax
push edx
push ebx
add esp, 4
xor edx, 0xa125
and edx, 0x10efe
xor edx, 0x1766b
jmp 0x702ea77e
pop edx
mov ecx, 0x6b
mov word [ebp - 0x1a68], cx
mov edx, 0x65
mov word [ebp - 0x1a66], dx
mov eax, 0x72
mov word [ebp - 0x1a64], ax
mov ecx, 0x6e
mov word [ebp - 0x1a62], cx
mov edx, 0x65
mov word [ebp - 0x1a60], dx
mov eax, 0x6c
mov word [ebp - 0x1a5e], ax
mov ecx, 0x33
mov word [ebp - 0x1a5c], cx
mov edx, 0x32
mov word [ebp - 0x1a5a], dx
mov eax, 0x2e
mov word [ebp - 0x1a58], ax
mov ecx, 0x64
mov word [ebp - 0x1a56], cx
mov edx, 0x6c
mov word [ebp - 0x1a54], dx
mov eax, 0x6c
mov word [ebp - 0x1a52], ax
xor ecx, ecx
mov word [ebp - 0x1a50], cx
push edx
sub edx, 0x135d8
xor edx, 0x57c9
call 0x702ea834
add byte [ecx], bh
dec eax
inc eax
inc ecx
xor ecx, dword [ebx + 0x47]
cmp byte [edi], bh
add esp, 4
add edx, 0x1905
pop edx
push ebx
push ebx
add esp, 4
sub ebx, 0xc70d
pop ebx
push edx
push edi
add esp, 4
sub edx, 0xae28
pop edx
push ebx
push edi
add esp, 4
or ebx, 0x1388a
xor ebx, 0x7db9
and ebx, 0x7fc1
sar dword [edi], 0
xor ebx, 0xe346
pop ebx
push esi
xor esi, 0x48aa
pop esi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x2688], edx
mov eax, dword [ebp - 0x2688]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x268c], ecx
mov edx, dword [ebp - 0x268c]
mov dword [ebp - 0x18ec], edx
push eax
push ebx
add esp, 4
jmp 0x702ea8b2
or eax, 0x52b2
pop eax
push edx
add edx, 0x552d
pop edx
push esi
push esi
add esp, 4
sub esi, 0x136cb
jmp 0x702ea8d5
pop esi
cmp dword [ebp - 0x18ec], 0
jne 0x702ea8ee
mov dword [ebp - 0x398], 0
jmp 0x702eabaa
mov eax, dword [ebp - 0x18ec]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xe98], edx
push edi
push eax
add esp, 4
sub edi, 0x8172
pop edi
push ecx
xor ecx, 0x1608
pop ecx
push edx
push ebx
add esp, 4
or edx, 0xa997
or edx, 0x12c1c
or edx, 0x128c2
and edx, 0x45c4
pop edx
cmp dword [ebp - 0xe98], 0
jne 0x702ea94a
mov dword [ebp - 0x398], 0
jmp 0x702eabaa
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x5c4], eax
push edx
xor edx, 0x9987
xor edx, 0x6901
sub edx, 0xf6b9
pop edx
push ecx
push edi
add esp, 4
sub ecx, 0x819f
and ecx, 0x1861
pop ecx
push edi
push ebx
add esp, 4
jmp 0x702ea987
pop edi
lea ecx, [ebp - 0x1a68]
invalid
invalid
Function at 0x702ea6e4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
cmp eax, 0x32414d39
dec edi
cmp eax, 0xe804c483
add esp, 4
call 0x702ea6f5
add byte [edi], dh
inc ecx
inc ecx
inc edi
push eax
inc esi
add esp, 4
pop edx
mov byte [ebp - 0x9c0], 0x45
mov byte [ebp - 0x9bf], 0x78
mov byte [ebp - 0x9be], 0x69
mov byte [ebp - 0x9bd], 0x74
mov byte [ebp - 0x9bc], 0x50
mov byte [ebp - 0x9bb], 0x72
mov byte [ebp - 0x9ba], 0x6f
mov byte [ebp - 0x9b9], 0x63
mov byte [ebp - 0x9b8], 0x65
mov byte [ebp - 0x9b7], 0x73
mov byte [ebp - 0x9b6], 0x73
mov byte [ebp - 0x9b5], 0
push eax
sub eax, 0x75dc
xor eax, 0x1628a
and eax, 0x6844
pop eax
push edx
push ebx
add esp, 4
xor edx, 0xa125
and edx, 0x10efe
xor edx, 0x1766b
jmp 0x702ea77e
pop edx
mov ecx, 0x6b
mov word [ebp - 0x1a68], cx
mov edx, 0x65
mov word [ebp - 0x1a66], dx
mov eax, 0x72
mov word [ebp - 0x1a64], ax
mov ecx, 0x6e
mov word [ebp - 0x1a62], cx
mov edx, 0x65
mov word [ebp - 0x1a60], dx
mov eax, 0x6c
mov word [ebp - 0x1a5e], ax
mov ecx, 0x33
mov word [ebp - 0x1a5c], cx
mov edx, 0x32
mov word [ebp - 0x1a5a], dx
mov eax, 0x2e
mov word [ebp - 0x1a58], ax
mov ecx, 0x64
mov word [ebp - 0x1a56], cx
mov edx, 0x6c
mov word [ebp - 0x1a54], dx
mov eax, 0x6c
mov word [ebp - 0x1a52], ax
xor ecx, ecx
mov word [ebp - 0x1a50], cx
push edx
sub edx, 0x135d8
xor edx, 0x57c9
call 0x702ea834
add byte [ecx], bh
dec eax
inc eax
inc ecx
xor ecx, dword [ebx + 0x47]
cmp byte [edi], bh
add esp, 4
add edx, 0x1905
pop edx
push ebx
push ebx
add esp, 4
sub ebx, 0xc70d
pop ebx
push edx
push edi
add esp, 4
sub edx, 0xae28
pop edx
push ebx
push edi
add esp, 4
or ebx, 0x1388a
xor ebx, 0x7db9
and ebx, 0x7fc1
sar dword [edi], 0
xor ebx, 0xe346
pop ebx
push esi
xor esi, 0x48aa
pop esi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x2688], edx
mov eax, dword [ebp - 0x2688]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x268c], ecx
mov edx, dword [ebp - 0x268c]
mov dword [ebp - 0x18ec], edx
push eax
push ebx
add esp, 4
jmp 0x702ea8b2
or eax, 0x52b2
pop eax
push edx
add edx, 0x552d
pop edx
push esi
push esi
add esp, 4
sub esi, 0x136cb
jmp 0x702ea8d5
pop esi
cmp dword [ebp - 0x18ec], 0
jne 0x702ea8ee
mov dword [ebp - 0x398], 0
jmp 0x702eabaa
mov eax, dword [ebp - 0x18ec]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xe98], edx
push edi
push eax
add esp, 4
sub edi, 0x8172
pop edi
push ecx
xor ecx, 0x1608
pop ecx
push edx
push ebx
add esp, 4
or edx, 0xa997
or edx, 0x12c1c
or edx, 0x128c2
and edx, 0x45c4
pop edx
cmp dword [ebp - 0xe98], 0
jne 0x702ea94a
mov dword [ebp - 0x398], 0
jmp 0x702eabaa
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x5c4], eax
push edx
xor edx, 0x9987
xor edx, 0x6901
sub edx, 0xf6b9
pop edx
push ecx
push edi
add esp, 4
sub ecx, 0x819f
and ecx, 0x1861
pop ecx
push edi
push ebx
add esp, 4
jmp 0x702ea987
pop edi
lea ecx, [ebp - 0x1a68]
invalid
invalid
Function at 0x702ea6f5
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
cmp eax, 0x32414d39
dec edi
cmp eax, 0xe804c483
add esp, 4
call 0x702ea6f5
add byte [edi], dh
inc ecx
inc ecx
inc edi
push eax
inc esi
add esp, 4
pop edx
mov byte [ebp - 0x9c0], 0x45
mov byte [ebp - 0x9bf], 0x78
mov byte [ebp - 0x9be], 0x69
mov byte [ebp - 0x9bd], 0x74
mov byte [ebp - 0x9bc], 0x50
mov byte [ebp - 0x9bb], 0x72
mov byte [ebp - 0x9ba], 0x6f
mov byte [ebp - 0x9b9], 0x63
mov byte [ebp - 0x9b8], 0x65
mov byte [ebp - 0x9b7], 0x73
mov byte [ebp - 0x9b6], 0x73
mov byte [ebp - 0x9b5], 0
push eax
sub eax, 0x75dc
xor eax, 0x1628a
and eax, 0x6844
pop eax
push edx
push ebx
add esp, 4
xor edx, 0xa125
and edx, 0x10efe
xor edx, 0x1766b
jmp 0x702ea77e
pop edx
mov ecx, 0x6b
mov word [ebp - 0x1a68], cx
mov edx, 0x65
mov word [ebp - 0x1a66], dx
mov eax, 0x72
mov word [ebp - 0x1a64], ax
mov ecx, 0x6e
mov word [ebp - 0x1a62], cx
mov edx, 0x65
mov word [ebp - 0x1a60], dx
mov eax, 0x6c
mov word [ebp - 0x1a5e], ax
mov ecx, 0x33
mov word [ebp - 0x1a5c], cx
mov edx, 0x32
mov word [ebp - 0x1a5a], dx
mov eax, 0x2e
mov word [ebp - 0x1a58], ax
mov ecx, 0x64
mov word [ebp - 0x1a56], cx
mov edx, 0x6c
mov word [ebp - 0x1a54], dx
mov eax, 0x6c
mov word [ebp - 0x1a52], ax
xor ecx, ecx
mov word [ebp - 0x1a50], cx
push edx
sub edx, 0x135d8
xor edx, 0x57c9
call 0x702ea834
add byte [ecx], bh
dec eax
inc eax
inc ecx
xor ecx, dword [ebx + 0x47]
cmp byte [edi], bh
add esp, 4
add edx, 0x1905
pop edx
push ebx
push ebx
add esp, 4
sub ebx, 0xc70d
pop ebx
push edx
push edi
add esp, 4
sub edx, 0xae28
pop edx
push ebx
push edi
add esp, 4
or ebx, 0x1388a
xor ebx, 0x7db9
and ebx, 0x7fc1
sar dword [edi], 0
xor ebx, 0xe346
pop ebx
push esi
xor esi, 0x48aa
pop esi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x2688], edx
mov eax, dword [ebp - 0x2688]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x268c], ecx
mov edx, dword [ebp - 0x268c]
mov dword [ebp - 0x18ec], edx
push eax
push ebx
add esp, 4
jmp 0x702ea8b2
or eax, 0x52b2
pop eax
push edx
add edx, 0x552d
pop edx
push esi
push esi
add esp, 4
sub esi, 0x136cb
jmp 0x702ea8d5
pop esi
cmp dword [ebp - 0x18ec], 0
jne 0x702ea8ee
mov dword [ebp - 0x398], 0
jmp 0x702eabaa
mov eax, dword [ebp - 0x18ec]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xe98], edx
push edi
push eax
add esp, 4
sub edi, 0x8172
pop edi
push ecx
xor ecx, 0x1608
pop ecx
push edx
push ebx
add esp, 4
or edx, 0xa997
or edx, 0x12c1c
or edx, 0x128c2
and edx, 0x45c4
pop edx
cmp dword [ebp - 0xe98], 0
jne 0x702ea94a
mov dword [ebp - 0x398], 0
jmp 0x702eabaa
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x5c4], eax
push edx
xor edx, 0x9987
xor edx, 0x6901
sub edx, 0xf6b9
pop edx
push ecx
push edi
add esp, 4
sub ecx, 0x819f
and ecx, 0x1861
pop ecx
push edi
push ebx
add esp, 4
jmp 0x702ea987
pop edi
lea ecx, [ebp - 0x1a68]
invalid
invalid
Function at 0x702ea834
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
cmp eax, 0x32414d39
dec edi
cmp eax, 0xe804c483
add esp, 4
call 0x702ea6f5
add byte [edi], dh
inc ecx
inc ecx
inc edi
push eax
inc esi
add esp, 4
pop edx
mov byte [ebp - 0x9c0], 0x45
mov byte [ebp - 0x9bf], 0x78
mov byte [ebp - 0x9be], 0x69
mov byte [ebp - 0x9bd], 0x74
mov byte [ebp - 0x9bc], 0x50
mov byte [ebp - 0x9bb], 0x72
mov byte [ebp - 0x9ba], 0x6f
mov byte [ebp - 0x9b9], 0x63
mov byte [ebp - 0x9b8], 0x65
mov byte [ebp - 0x9b7], 0x73
mov byte [ebp - 0x9b6], 0x73
mov byte [ebp - 0x9b5], 0
push eax
sub eax, 0x75dc
xor eax, 0x1628a
and eax, 0x6844
pop eax
push edx
push ebx
add esp, 4
xor edx, 0xa125
and edx, 0x10efe
xor edx, 0x1766b
jmp 0x702ea77e
pop edx
mov ecx, 0x6b
mov word [ebp - 0x1a68], cx
mov edx, 0x65
mov word [ebp - 0x1a66], dx
mov eax, 0x72
mov word [ebp - 0x1a64], ax
mov ecx, 0x6e
mov word [ebp - 0x1a62], cx
mov edx, 0x65
mov word [ebp - 0x1a60], dx
mov eax, 0x6c
mov word [ebp - 0x1a5e], ax
mov ecx, 0x33
mov word [ebp - 0x1a5c], cx
mov edx, 0x32
mov word [ebp - 0x1a5a], dx
mov eax, 0x2e
mov word [ebp - 0x1a58], ax
mov ecx, 0x64
mov word [ebp - 0x1a56], cx
mov edx, 0x6c
mov word [ebp - 0x1a54], dx
mov eax, 0x6c
mov word [ebp - 0x1a52], ax
xor ecx, ecx
mov word [ebp - 0x1a50], cx
push edx
sub edx, 0x135d8
xor edx, 0x57c9
call 0x702ea834
add byte [ecx], bh
dec eax
inc eax
inc ecx
xor ecx, dword [ebx + 0x47]
cmp byte [edi], bh
add esp, 4
add edx, 0x1905
pop edx
push ebx
push ebx
add esp, 4
sub ebx, 0xc70d
pop ebx
push edx
push edi
add esp, 4
sub edx, 0xae28
pop edx
push ebx
push edi
add esp, 4
or ebx, 0x1388a
xor ebx, 0x7db9
and ebx, 0x7fc1
sar dword [edi], 0
xor ebx, 0xe346
pop ebx
push esi
xor esi, 0x48aa
pop esi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x2688], edx
mov eax, dword [ebp - 0x2688]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x268c], ecx
mov edx, dword [ebp - 0x268c]
mov dword [ebp - 0x18ec], edx
push eax
push ebx
add esp, 4
jmp 0x702ea8b2
or eax, 0x52b2
pop eax
push edx
add edx, 0x552d
pop edx
push esi
push esi
add esp, 4
sub esi, 0x136cb
jmp 0x702ea8d5
pop esi
cmp dword [ebp - 0x18ec], 0
jne 0x702ea8ee
mov dword [ebp - 0x398], 0
jmp 0x702eabaa
mov eax, dword [ebp - 0x18ec]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xe98], edx
push edi
push eax
add esp, 4
sub edi, 0x8172
pop edi
push ecx
xor ecx, 0x1608
pop ecx
push edx
push ebx
add esp, 4
or edx, 0xa997
or edx, 0x12c1c
or edx, 0x128c2
and edx, 0x45c4
pop edx
cmp dword [ebp - 0xe98], 0
jne 0x702ea94a
mov dword [ebp - 0x398], 0
jmp 0x702eabaa
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x5c4], eax
push edx
xor edx, 0x9987
xor edx, 0x6901
sub edx, 0xf6b9
pop edx
push ecx
push edi
add esp, 4
sub ecx, 0x819f
and ecx, 0x1861
pop ecx
push edi
push ebx
add esp, 4
jmp 0x702ea987
pop edi
lea ecx, [ebp - 0x1a68]
invalid
invalid
Function at 0x702eabc2
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor esi, 0x3245
pop esi
push edi
push eax
add esp, 4
xor edi, 0xec00
pop edi
push ecx
jmp 0x702eabdb
pop ecx
cmp dword [ebp - 0x398], 0
jne 0x702eb4f5
mov edx, 0x6b
mov word [ebp - 0x1ac8], dx
mov eax, 0x65
mov word [ebp - 0x1ac6], ax
mov ecx, 0x72
mov word [ebp - 0x1ac4], cx
mov edx, 0x6e
mov word [ebp - 0x1ac2], dx
mov eax, 0x65
mov word [ebp - 0x1ac0], ax
mov dword [ebp - 0x1ac0], eax
mov ecx, 0x6c
mov word [ebp - 0x1abe], cx
mov edx, 0x33
mov word [ebp - 0x1abc], dx
mov eax, 0x32
mov word [ebp - 0x1aba], ax
mov ecx, 0x2e
mov word [ebp - 0x1ab8], cx
mov edx, 0x64
mov word [ebp - 0x1ab6], dx
mov eax, 0x6c
mov word [ebp - 0x1ab4], ax
mov ecx, 0x6c
mov word [ebp - 0x1ab2], cx
xor edx, edx
mov word [ebp - 0x1ab0], dx
push edi
and edi, 0x161ee
add edi, 0x173d2

Function at 0x702eac1f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x1ac0], eax
mov dword [ebp - 0x870], 0
jmp 0x702eb03c
mov ecx, dword [ebp - 0x18f8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xea4], eax
push ebx
push ebx
add esp, 4
or ebx, 0xf311
pop ebx
push ecx
add ecx, 0x13140
xor ecx, 0xd0b7
xor ecx, 0x71c2
and ecx, 0x15ec3
pop ecx
push eax
push ecx
add esp, 4
or eax, 0x1254b
pop eax
cmp dword [ebp - 0xea4], 0
jne 0x702eaddc
mov dword [ebp - 0x870], 0
jmp 0x702eb03c
mov ecx, dword [ebp - 0xea4]
mov dword [ebp - 0x5c8], ecx
push edi
push ebx
add esp, 4
call 0x702eadfd
add byte [esi + 0x45], al
inc edi
inc edi
dec edi
dec eax
xor eax, dword [ecx + 0x32]
add esp, 4
call 0x702eae10
add byte [edx + 0x32], cl
xor al, 0x4a
push eax
cmp dword [edx + 0x43], eax
aas
dec eax
add esp, 4
and edi, 0x50e0
pop edi
lea edx, [ebp - 0x1ac8]
mov dword [ebp - 0xea0], edx
mov eax, dword [ebp - 0x5c8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xe9c], ecx
xor edx, edx
mov word [ebp - 0x268], dx
xor eax, eax
mov word [ebp - 0x13c], ax

Function at 0x702eac8f
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or edi, 0x142d3
pop edi
push ebx
push esi
add esp, 4
add ebx, 0xb4b5
pop ebx
push edx
push edi
add esp, 4
and edx, 0xa133
add edx, 0x11237
pop edx
mov byte [ebp - 0xb0c], 0x4c
mov byte [ebp - 0xb0b], 0x6f
mov byte [ebp - 0xb0a], 0x61
mov byte [ebp - 0xb09], 0x64
invalid

Function at 0x702ead1a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx - 0x268f73]
dec dword [ebx - 0x6a76cfaf]
insb byte es:[edi], dx
fcos
dec dword [ebx - 0x26937b]
dec dword [ecx - 0x18f77b]
call dword [ebx - 0x7f]
jecxz 0x702eadac
and byte [eax], al
add byte [ecx + 0x9a99cb], al
add byte [ecx + 0xaa8ecb], al
add byte [ecx + 0x1919e3], al
jecxz 0x702ead65
sbb dword [eax], eax
add byte [ebx + 0x52], bl
push esi
add esp, 4
and edx, 0x142a2
and edx, 0x10cc1
and edx, 0xad27
pop edx
cmp dword [ebp - 0x18f8], 0
jne 0x702ead80
int1
ret 0x71