joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c0df
Capabilities:
Get common file path

Disassembly:
push 0x10
mov eax, 0x41f7dd
call fcn.0040cc0a
mov esi, dword [ebp + 8]
push 0x5c
push esi
call fcn.0040fa40
pop ecx
pop ecx
test eax, eax
jne 0x40c265
xor ebx, ebx
cmp byte [0x42b600], bl
jne 0x40c193
mov edi, 0x400
push edi
push 0x42b600
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0x42b600
call fcn.0040fb70
pop ecx
pop ecx
test eax, eax
je 0x40c135
mov byte [eax + 1], bl
push edi
push 0x42ba00
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40c164
cmp byte [eax + 0x42b9ff], 0x5c
je 0x40c164
mov byte [eax + 0x42ba00], 0x5c
inc eax
cmp eax, edi
jae 0x40c276
mov byte [eax + 0x42ba00], bl
push edi
push 0x42be00
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40c193
cmp byte [eax + 0x42bdff], 0x5c
je 0x40c193
mov byte [eax + 0x42be00], 0x5c
inc eax
cmp eax, edi
jae 0x40c276
mov byte [eax + 0x42be00], bl
push 0x42ba00
lea ecx, [ebp - 0x14]
call fcn.00408ff9
push esi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
push eax
call fcn.004092ff
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x10]
mov edi, eax
lea ecx, [ecx - 0x10]
call fcn.00405d50
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00405d50
test edi, edi
jne 0x40c26e
push 0x42be00
lea ecx, [ebp - 0x10]
call fcn.00408ff9
push esi
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.004092ff
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x14]
mov edi, eax
lea ecx, [ecx - 0x10]
call fcn.00405d50
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00405d50
test edi, edi
jne 0x40c26e
push 0x42b600
lea ecx, [ebp - 0x1c]
call fcn.00408ff9
push esi
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 2
push eax
call fcn.004092ff
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x18]
mov edi, eax
add ecx, 0xfffffff0
call fcn.00405d50
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00405d50
jmp 0x40c26e
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov eax, edi
call fcn.0040cbd3
ret
call fcn.0040ca8f
int3
Function at 0x65010604
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc ebp
dec ecx
inc edi
xor al, byte [ebx - 0x377efb3c]
add esp, 4
or eax, 0x13506
jmp 0x65010616
dec ebp
inc esp
inc eax
cmp dword [esi], esi
xor eax, 0xeb52584c
push es
xor al, 0x43
dec ebp
cmp eax, 0xe2814243
mov dh, 0x4a
add byte [eax], al
pop edx
mov ecx, dword [ebp - 0x3f4]
mov dword [ebp - 0x500], ecx
jmp 0x65010644
Function at 0x65010aca
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push esi
push edx
add esp, 4
xor esi, 0x63bd
add byte [eax], al
or esi, 0x12bf4
or esi, 0x8f23
pop esi
mov ecx, dword [ebp - 0x3f4]
mov dword [ebp - 0x504], ecx
jmp 0x65010a2c
mov edx, dword [ebp - 0x504]
add edx, 1
mov dword [ebp - 0x504], edx
push ebx
push ecx
add esp, 4
or ebx, 0x12154
pop ebx
push edi
push ebx
add esp, 4
xor edi, 0x8c65
jmp 0x65010a4b
pop edi
push eax
push edx
add esp, 4
xor eax, 0x15a56
sub eax, 0x1217a
pop eax
mov eax, dword [ebp - 0x504]
sub eax, dword [ebp - 0x3f4]
cmp eax, 0xffffffff
jb 0x65010aa6
push edx
push ebx
add esp, 4
xor edx, 0x8b22
pop edx
push esi
push edx
add esp, 4
xor esi, 0x11ed9
add esi, 0x15ea1
sub esi, 0x150e7
or esi, 0x1453
pop esi
push edi
xor edi, 0xf737
pop edi
jmp 0x65010cd4
mov dword [ebp - 0xc8c], 7
mov ecx, dword [ebp - 0x504]
mov dword [ebp - 0xac8], ecx
push ecx
call 0x65010aca
add byte [edx + edi], dh
aaa
inc ecx
aaa
cmp eax, dword [esi - 0x7d]
les eax, [ecx + eax*4]
jmp 0x65010c75
cmp dword [ebp - 0xc8c], 0
jle 0x65010c7a
push ebx
push edx
add esp, 4
xor ebx, 0x90a9
or ebx, 0x5dce
pop ebx
push eax
push ebx
add esp, 4
jmp 0x65010b7f
jmp 0x65010b87
or eax, 0x14de1
sub eax, 0x8b4e
pop eax
mov edx, dword [ebp - 0xac8]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa64]
movzx edx, byte [ecx]
cmp eax, edx
je 0x65010c16
push esi
add esi, 0xaa1
call 0x65010bbd
add byte [esi + 0x4d], al
dec ecx
cmp byte [0x4c48340], bh
pop esi
push edi
push ecx
add esp, 4
and edi, 0x93f0
jmp 0x65010bd5
xor edi, 0x44f0
pop edi
mov eax, dword [ebp - 0xac8]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa64]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x65010bfe
mov dword [ebp - 0x15dc], 1
jmp 0x65010c08
mov dword [ebp - 0x15dc], 0xffffffff
mov ecx, dword [ebp - 0x15dc]
mov dword [ebp - 0xc90], ecx
jmp 0x65010c7a
push ecx
jmp 0x65010c20
add ecx, 0x14b24
jmp 0x65010c2f
pop ecx
push ecx
sub ecx, 0x6fe9
call 0x65010c44
add byte [ebp + 0x3a], al
xor dh, byte [ebx]
xor al, 0x33
inc eax
add esp, 4
pop ecx
mov edx, dword [ebp - 0xc8c]
sub edx, 1
mov dword [ebp - 0xc8c], edx
mov eax, dword [ebp - 0xac8]
add eax, 1
mov dword [ebp - 0xac8], eax
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
jmp 0x65010b55
mov edx, dword [ebp - 0xc90]
mov dword [ebp - 0x15a8], edx
cmp dword [ebp - 0x15a8], 0
jne 0x65010ccf
push ecx
jmp 0x65010c98
add ecx, 0x945
jmp 0x65010ca7
pop ecx
push esi
push ecx
add esp, 4
jmp 0x65010cb2
add esi, 0x12bad
pop esi
push ebx
and ebx, 0xd97e
pop ebx
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0xac4], eax
jmp 0x65010d10
jmp 0x65010a1d
push edx
push edi
add esp, 4
xor edx, 0x6096
jmp 0x65010ce8
jmp 0x65010ced
pop edx
push ecx
push esi
add esp, 4
jmp 0x65010cf9
jmp 0x65010cff
or ecx, 0x9c2b
pop ecx
mov dword [ebp - 0xac4], 0
push eax
jmp 0x65010d17
pop eax
push edi
push edx
add esp, 4
sub edi, 0xb68a
mov dh, 0
add byte [ecx + 0xa2c7c7], al
add bl, ch
invalid
invalid
Function at 0x65010b26
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0x10dbe
xor edx, 0x44f4
add edx, 0x2219
pop edx
push eax
sub eax, 0x16c17
pop eax
mov ecx, dword [ebp - 0xc90]
mov dword [ebp - 0x15a8], ecx
jmp 0x65010c86
Function at 0x65010bbd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push esi
push edx
add esp, 4
xor esi, 0x63bd
add byte [eax], al
or esi, 0x12bf4
or esi, 0x8f23
pop esi
mov ecx, dword [ebp - 0x3f4]
mov dword [ebp - 0x504], ecx
jmp 0x65010a2c
mov edx, dword [ebp - 0x504]
add edx, 1
mov dword [ebp - 0x504], edx
push ebx
push ecx
add esp, 4
or ebx, 0x12154
pop ebx
push edi
push ebx
add esp, 4
xor edi, 0x8c65
jmp 0x65010a4b
pop edi
push eax
push edx
add esp, 4
xor eax, 0x15a56
sub eax, 0x1217a
pop eax
mov eax, dword [ebp - 0x504]
sub eax, dword [ebp - 0x3f4]
cmp eax, 0xffffffff
jb 0x65010aa6
push edx
push ebx
add esp, 4
xor edx, 0x8b22
pop edx
push esi
push edx
add esp, 4
xor esi, 0x11ed9
add esi, 0x15ea1
sub esi, 0x150e7
or esi, 0x1453
pop esi
push edi
xor edi, 0xf737
pop edi
jmp 0x65010cd4
mov dword [ebp - 0xc8c], 7
mov ecx, dword [ebp - 0x504]
mov dword [ebp - 0xac8], ecx
push ecx
call 0x65010aca
add byte [edx + edi], dh
aaa
inc ecx
aaa
cmp eax, dword [esi - 0x7d]
les eax, [ecx + eax*4]
jmp 0x65010c75
cmp dword [ebp - 0xc8c], 0
jle 0x65010c7a
push ebx
push edx
add esp, 4
xor ebx, 0x90a9
or ebx, 0x5dce
pop ebx
push eax
push ebx
add esp, 4
jmp 0x65010b7f
jmp 0x65010b87
or eax, 0x14de1
sub eax, 0x8b4e
pop eax
mov edx, dword [ebp - 0xac8]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa64]
movzx edx, byte [ecx]
cmp eax, edx
je 0x65010c16
push esi
add esi, 0xaa1
call 0x65010bbd
add byte [esi + 0x4d], al
dec ecx
cmp byte [0x4c48340], bh
pop esi
push edi
push ecx
add esp, 4
and edi, 0x93f0
jmp 0x65010bd5
xor edi, 0x44f0
pop edi
mov eax, dword [ebp - 0xac8]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa64]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x65010bfe
mov dword [ebp - 0x15dc], 1
jmp 0x65010c08
mov dword [ebp - 0x15dc], 0xffffffff
mov ecx, dword [ebp - 0x15dc]
mov dword [ebp - 0xc90], ecx
jmp 0x65010c7a
push ecx
jmp 0x65010c20
add ecx, 0x14b24
jmp 0x65010c2f
pop ecx
push ecx
sub ecx, 0x6fe9
call 0x65010c44
add byte [ebp + 0x3a], al
xor dh, byte [ebx]
xor al, 0x33
inc eax
add esp, 4
pop ecx
mov edx, dword [ebp - 0xc8c]
sub edx, 1
mov dword [ebp - 0xc8c], edx
mov eax, dword [ebp - 0xac8]
add eax, 1
mov dword [ebp - 0xac8], eax
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
jmp 0x65010b55
mov edx, dword [ebp - 0xc90]
mov dword [ebp - 0x15a8], edx
cmp dword [ebp - 0x15a8], 0
jne 0x65010ccf
push ecx
jmp 0x65010c98
add ecx, 0x945
jmp 0x65010ca7
pop ecx
push esi
push ecx
add esp, 4
jmp 0x65010cb2
add esi, 0x12bad
pop esi
push ebx
and ebx, 0xd97e
pop ebx
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0xac4], eax
jmp 0x65010d10
jmp 0x65010a1d
push edx
push edi
add esp, 4
xor edx, 0x6096
jmp 0x65010ce8
jmp 0x65010ced
pop edx
push ecx
push esi
add esp, 4
jmp 0x65010cf9
jmp 0x65010cff
or ecx, 0x9c2b
pop ecx
mov dword [ebp - 0xac4], 0
push eax
jmp 0x65010d17
pop eax
push edi
push edx
add esp, 4
sub edi, 0xb68a
mov dh, 0
add byte [ecx + 0xa2c7c7], al
add bl, ch
invalid
invalid
Function at 0x65010c44
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push esi
push edx
add esp, 4
xor esi, 0x63bd
add byte [eax], al
or esi, 0x12bf4
or esi, 0x8f23
pop esi
mov ecx, dword [ebp - 0x3f4]
mov dword [ebp - 0x504], ecx
jmp 0x65010a2c
mov edx, dword [ebp - 0x504]
add edx, 1
mov dword [ebp - 0x504], edx
push ebx
push ecx
add esp, 4
or ebx, 0x12154
pop ebx
push edi
push ebx
add esp, 4
xor edi, 0x8c65
jmp 0x65010a4b
pop edi
push eax
push edx
add esp, 4
xor eax, 0x15a56
sub eax, 0x1217a
pop eax
mov eax, dword [ebp - 0x504]
sub eax, dword [ebp - 0x3f4]
cmp eax, 0xffffffff
jb 0x65010aa6
push edx
push ebx
add esp, 4
xor edx, 0x8b22
pop edx
push esi
push edx
add esp, 4
xor esi, 0x11ed9
add esi, 0x15ea1
sub esi, 0x150e7
or esi, 0x1453
pop esi
push edi
xor edi, 0xf737
pop edi
jmp 0x65010cd4
mov dword [ebp - 0xc8c], 7
mov ecx, dword [ebp - 0x504]
mov dword [ebp - 0xac8], ecx
push ecx
call 0x65010aca
add byte [edx + edi], dh
aaa
inc ecx
aaa
cmp eax, dword [esi - 0x7d]
les eax, [ecx + eax*4]
jmp 0x65010c75
cmp dword [ebp - 0xc8c], 0
jle 0x65010c7a
push ebx
push edx
add esp, 4
xor ebx, 0x90a9
or ebx, 0x5dce
pop ebx
push eax
push ebx
add esp, 4
jmp 0x65010b7f
jmp 0x65010b87
or eax, 0x14de1
sub eax, 0x8b4e
pop eax
mov edx, dword [ebp - 0xac8]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa64]
movzx edx, byte [ecx]
cmp eax, edx
je 0x65010c16
push esi
add esi, 0xaa1
call 0x65010bbd
add byte [esi + 0x4d], al
dec ecx
cmp byte [0x4c48340], bh
pop esi
push edi
push ecx
add esp, 4
and edi, 0x93f0
jmp 0x65010bd5
xor edi, 0x44f0
pop edi
mov eax, dword [ebp - 0xac8]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa64]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x65010bfe
mov dword [ebp - 0x15dc], 1
jmp 0x65010c08
mov dword [ebp - 0x15dc], 0xffffffff
mov ecx, dword [ebp - 0x15dc]
mov dword [ebp - 0xc90], ecx
jmp 0x65010c7a
push ecx
jmp 0x65010c20
add ecx, 0x14b24
jmp 0x65010c2f
pop ecx
push ecx
sub ecx, 0x6fe9
call 0x65010c44
add byte [ebp + 0x3a], al
xor dh, byte [ebx]
xor al, 0x33
inc eax
add esp, 4
pop ecx
mov edx, dword [ebp - 0xc8c]
sub edx, 1
mov dword [ebp - 0xc8c], edx
mov eax, dword [ebp - 0xac8]
add eax, 1
mov dword [ebp - 0xac8], eax
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
jmp 0x65010b55
mov edx, dword [ebp - 0xc90]
mov dword [ebp - 0x15a8], edx
cmp dword [ebp - 0x15a8], 0
jne 0x65010ccf
push ecx
jmp 0x65010c98
add ecx, 0x945
jmp 0x65010ca7
pop ecx
push esi
push ecx
add esp, 4
jmp 0x65010cb2
add esi, 0x12bad
pop esi
push ebx
and ebx, 0xd97e
pop ebx
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0xac4], eax
jmp 0x65010d10
jmp 0x65010a1d
push edx
push edi
add esp, 4
xor edx, 0x6096
jmp 0x65010ce8
jmp 0x65010ced
pop edx
push ecx
push esi
add esp, 4
jmp 0x65010cf9
jmp 0x65010cff
or ecx, 0x9c2b
pop ecx
mov dword [ebp - 0xac4], 0
push eax
jmp 0x65010d17
pop eax
push edi
push edx
add esp, 4
sub edi, 0xb68a
mov dh, 0
add byte [ecx + 0xa2c7c7], al
add bl, ch
invalid
invalid
Function at 0x65010db0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov byte [ebp - 0x87a], 0x69
mov byte [ebp - 0x879], 0x74
mov byte [ebp - 0x878], 0x50
mov byte [ebp - 0x877], 0x72
mov byte [ebp - 0x876], 0x6f
invalid
jmp [edi - 0x3a]
test dword [ebx + 0x63fffff7], ecx
mov byte [ebp - 0x874], 0x65
mov byte [ebp - 0x873], 0x73
mov byte [ebp - 0x872], 0x73
mov byte [ebp - 0x871], 0
push edx
push ecx
add esp, 4
add edx, 0x2b64
pop edx
push esi
push esi
add esp, 4
or esi, 0x11aee
and esi, 0x147f4
inc edi
add dword [eax], eax
pop esi
push esi
or esi, 0x13484
sub esi, 0x107bc
sub esi, 0x12a66
pop esi
mov ecx, 0x6b
mov word [ebp - 0x1740], cx
mov edx, 0x65
mov word [ebp - 0x173e], dx
mov eax, 0x72
mov word [ebp - 0x173c], ax
invalid
outsb dx, byte [esi]
add byte [eax], al
Function at 0x650114af
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
or edi, 0x91fe
add edi, 0x1516c
add edi, 0x14168
pop edi
push ebx
add ebx, 0x152ca
add ebx, 0x2da5
jmp 0x6501145a
jmp 0x65011462
pop ebx
lea edx, [ebp - 0x1784]
mov dword [ebp - 0xca4], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xca0], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ecx
push ecx
add esp, 4
xor ecx, 0x49ae
or ecx, 0x3d0f
call fcn.650114af
add byte [eax + 0x47], cl
cmp eax, 0x3e43483d
inc ebp
add esp, 4
call 0x650114be
add byte [ebp + 0x40], cl
xor al, 0x4c
cmp eax, dword [eax - 0x7d]
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0xca0]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xca0]
add eax, 2
mov dword [ebp - 0xca0], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca4]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xca4]
add ecx, 2
mov dword [ebp - 0xca4], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x110], dx
push edi
call 0x6501152a
add byte [ebx + ecx*2 + 0x50], al
inc esp
dec esp
inc edi
xor eax, dword [ebx + 0x535f04c4]
push eax
add esp, 4
and ebx, 0x10a45
sub ebx, 0x3e29
pop ebx
push eax
add eax, 0x192b
jmp 0x6501154d
pop eax
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x65011571
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15f4], ecx
jmp 0x650115d4
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x65011490
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x65011490
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x650115be
mov dword [ebp - 0x15f0], 0xffffffff
jmp 0x650115c8
mov dword [ebp - 0x15f0], 1
mov eax, dword [ebp - 0x15f0]
mov dword [ebp - 0x15f4], eax
cmp dword [ebp - 0x15f4], 0
jne 0x6501161d
push ecx
xor ecx, 0x7468
xor ecx, 0x14f59
and ecx, 0x161a8
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0xc44b
call 0x6501160b
add byte [0x4c434d4d], dh
cmp byte [edi], bh
cmp dword [edi - 0x7d], eax
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x754], ecx
jmp 0x65011685
push esi
push esi
add esp, 4
add esi, 0x561c
sub esi, 0x14758
or esi, 0xd0b4
sub esi, 0x13f4
pop esi
push eax
sub eax, 0x55de
xor eax, 0x8179
or eax, 0x42f0
pop eax
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xca8]
je 0x6501167b
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x65011431
mov dword [ebp - 0x754], 0
Function at 0x650114be
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
or edi, 0x91fe
add edi, 0x1516c
add edi, 0x14168
pop edi
push ebx
add ebx, 0x152ca
add ebx, 0x2da5
jmp 0x6501145a
jmp 0x65011462
pop ebx
lea edx, [ebp - 0x1784]
mov dword [ebp - 0xca4], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xca0], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ecx
push ecx
add esp, 4
xor ecx, 0x49ae
or ecx, 0x3d0f
call fcn.650114af
add byte [eax + 0x47], cl
cmp eax, 0x3e43483d
inc ebp
add esp, 4
call 0x650114be
add byte [ebp + 0x40], cl
xor al, 0x4c
cmp eax, dword [eax - 0x7d]
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0xca0]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xca0]
add eax, 2
mov dword [ebp - 0xca0], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca4]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xca4]
add ecx, 2
mov dword [ebp - 0xca4], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x110], dx
push edi
call 0x6501152a
add byte [ebx + ecx*2 + 0x50], al
inc esp
dec esp
inc edi
xor eax, dword [ebx + 0x535f04c4]
push eax
add esp, 4
and ebx, 0x10a45
sub ebx, 0x3e29
pop ebx
push eax
add eax, 0x192b
jmp 0x6501154d
pop eax
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x65011571
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15f4], ecx
jmp 0x650115d4
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x65011490
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x65011490
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x650115be
mov dword [ebp - 0x15f0], 0xffffffff
jmp 0x650115c8
mov dword [ebp - 0x15f0], 1
mov eax, dword [ebp - 0x15f0]
mov dword [ebp - 0x15f4], eax
cmp dword [ebp - 0x15f4], 0
jne 0x6501161d
push ecx
xor ecx, 0x7468
xor ecx, 0x14f59
and ecx, 0x161a8
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0xc44b
call 0x6501160b
add byte [0x4c434d4d], dh
cmp byte [edi], bh
cmp dword [edi - 0x7d], eax
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x754], ecx
jmp 0x65011685
push esi
push esi
add esp, 4
add esi, 0x561c
sub esi, 0x14758
or esi, 0xd0b4
sub esi, 0x13f4
pop esi
push eax
sub eax, 0x55de
xor eax, 0x8179
or eax, 0x42f0
pop eax
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xca8]
je 0x6501167b
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x65011431
mov dword [ebp - 0x754], 0
Function at 0x6501152a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
or edi, 0x91fe
add edi, 0x1516c
add edi, 0x14168
pop edi
push ebx
add ebx, 0x152ca
add ebx, 0x2da5
jmp 0x6501145a
jmp 0x65011462
pop ebx
lea edx, [ebp - 0x1784]
mov dword [ebp - 0xca4], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xca0], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ecx
push ecx
add esp, 4
xor ecx, 0x49ae
or ecx, 0x3d0f
call fcn.650114af
add byte [eax + 0x47], cl
cmp eax, 0x3e43483d
inc ebp
add esp, 4
call 0x650114be
add byte [ebp + 0x40], cl
xor al, 0x4c
cmp eax, dword [eax - 0x7d]
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0xca0]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xca0]
add eax, 2
mov dword [ebp - 0xca0], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca4]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xca4]
add ecx, 2
mov dword [ebp - 0xca4], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x110], dx
push edi
call 0x6501152a
add byte [ebx + ecx*2 + 0x50], al
inc esp
dec esp
inc edi
xor eax, dword [ebx + 0x535f04c4]
push eax
add esp, 4
and ebx, 0x10a45
sub ebx, 0x3e29
pop ebx
push eax
add eax, 0x192b
jmp 0x6501154d
pop eax
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x65011571
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15f4], ecx
jmp 0x650115d4
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x65011490
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x65011490
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x650115be
mov dword [ebp - 0x15f0], 0xffffffff
jmp 0x650115c8
mov dword [ebp - 0x15f0], 1
mov eax, dword [ebp - 0x15f0]
mov dword [ebp - 0x15f4], eax
cmp dword [ebp - 0x15f4], 0
jne 0x6501161d
push ecx
xor ecx, 0x7468
xor ecx, 0x14f59
and ecx, 0x161a8
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0xc44b
call 0x6501160b
add byte [0x4c434d4d], dh
cmp byte [edi], bh
cmp dword [edi - 0x7d], eax
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x754], ecx
jmp 0x65011685
push esi
push esi
add esp, 4
add esi, 0x561c
sub esi, 0x14758
or esi, 0xd0b4
sub esi, 0x13f4
pop esi
push eax
sub eax, 0x55de
xor eax, 0x8179
or eax, 0x42f0
pop eax
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xca8]
je 0x6501167b
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x65011431
mov dword [ebp - 0x754], 0
Function at 0x6501160b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
or edi, 0x91fe
add edi, 0x1516c
add edi, 0x14168
pop edi
push ebx
add ebx, 0x152ca
add ebx, 0x2da5
jmp 0x6501145a
jmp 0x65011462
pop ebx
lea edx, [ebp - 0x1784]
mov dword [ebp - 0xca4], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xca0], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ecx
push ecx
add esp, 4
xor ecx, 0x49ae
or ecx, 0x3d0f
call fcn.650114af
add byte [eax + 0x47], cl
cmp eax, 0x3e43483d
inc ebp
add esp, 4
call 0x650114be
add byte [ebp + 0x40], cl
xor al, 0x4c
cmp eax, dword [eax - 0x7d]
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0xca0]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xca0]
add eax, 2
mov dword [ebp - 0xca0], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca4]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xca4]
add ecx, 2
mov dword [ebp - 0xca4], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x110], dx
push edi
call 0x6501152a
add byte [ebx + ecx*2 + 0x50], al
inc esp
dec esp
inc edi
xor eax, dword [ebx + 0x535f04c4]
push eax
add esp, 4
and ebx, 0x10a45
sub ebx, 0x3e29
pop ebx
push eax
add eax, 0x192b
jmp 0x6501154d
pop eax
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x65011571
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15f4], ecx
jmp 0x650115d4
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x65011490
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x65011490
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x650115be
mov dword [ebp - 0x15f0], 0xffffffff
jmp 0x650115c8
mov dword [ebp - 0x15f0], 1
mov eax, dword [ebp - 0x15f0]
mov dword [ebp - 0x15f4], eax
cmp dword [ebp - 0x15f4], 0
jne 0x6501161d
push ecx
xor ecx, 0x7468
xor ecx, 0x14f59
and ecx, 0x161a8
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0xc44b
call 0x6501160b
add byte [0x4c434d4d], dh
cmp byte [edi], bh
cmp dword [edi - 0x7d], eax
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x754], ecx
jmp 0x65011685
push esi
push esi
add esp, 4
add esi, 0x561c
sub esi, 0x14758
or esi, 0xd0b4
sub esi, 0x13f4
pop esi
push eax
sub eax, 0x55de
xor eax, 0x8179
or eax, 0x42f0
pop eax
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xca8]
je 0x6501167b
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x65011431
mov dword [ebp - 0x754], 0