joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4167ba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edx
add esp, 4
sub esi, 0x46b5
pop esi
push ebx
push ebx
add esp, 4
or ebx, 0x6f34
or ebx, 0x17f31
sub ebx, 0x32d4
pop ebx
push eax
sub eax, 0x9922
sub eax, 0x165e8
pop eax
lea edx, [ebp - 0x1770]
mov dword [ebp - 0xccc], edx
mov eax, dword [ebp - 0x450]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcc8], ecx
xor edx, edx
mov word [ebp - 0x1c4], dx
xor eax, eax
mov word [ebp - 0x30], ax
push ecx
push edi
add esp, 4
jmp 0x4166cc
or ecx, 0xa7e5
pop ecx
push esi
xor esi, 0xe5c7
pop esi
push ebx
push eax
add esp, 4
or ebx, 0x130a5
pop ebx
push ecx
push ebx
add esp, 4
or ecx, 0xa75c
pop ecx
mov ecx, dword [ebp - 0xcc8]
mov dx, word [ecx]
mov word [ebp - 0x104e], dx
mov eax, dword [ebp - 0xcc8]
add eax, 2
mov dword [ebp - 0xcc8], eax
mov cx, word [ebp - 0x104e]
mov word [ebp - 0x1c4], cx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1064], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1064]
cmp edx, eax
je 0x4166c1
movzx ecx, word [ebp - 0x1c4]
movzx edx, word [ebp - 0x30]
cmp ecx, edx
jge 0x4167dd
mov dword [ebp - 0x1620], 0xffffffff
jmp 0x4167e7
mov dword [ebp - 0x1620], 1
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x1624], eax
cmp dword [ebp - 0x1624], 0
jne 0x41683c
push esi
sub esi, 0x8429
call 0x416813
add byte [edx], dh
dec eax
cmp eax, 0x473d463c
aas
inc esp
xor al, byte [ebx + 0x7eb04c4]
aas
cmp ecx, dword [edx + esi + 0x38]
dec ebp
dec esi
pop esi
push ebx
xor ebx, 0x7cab
or ebx, 0x1c3f
pop ebx
mov ecx, dword [ebp - 0x450]
mov dword [ebp - 0x2f8], ecx
jmp 0x4168a4
push ecx
push edi
add esp, 4
add ecx, 0xb8a5
pop ecx
push ebx
and ebx, 0x1253c
jmp 0x416855
and ebx, 0x5f52
or ebx, 0x1bcc
pop ebx
push ebx
push edx
add esp, 4
or ebx, 0x35d8
pop ebx
mov edx, dword [ebp - 0x450]
mov eax, dword [edx]
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp - 0x450]
cmp ecx, dword [ebp - 0xcd0]
je 0x41689a
mov edx, dword [ebp - 0x450]
cmp dword [edx + 0x30], 0
jne 0x416665
mov dword [ebp - 0x2f8], 0
push edx
and edx, 0x1742b
or edx, 0x148c3
pop edx
push ebx
push esi
add esp, 4
call 0x4168c6
add byte [ecx + 0x47], cl
cmp eax, 0x4c473f3e
dec ecx
inc ebp
add esp, 4
sub ebx, 0x634c
and ebx, 0x43f0
pop ebx
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x398], ecx
push ebx
push edx
add esp, 4
sub ebx, 0xb1da
pop ebx
push edx
or edx, 0x3315
call 0x416907
add byte [eax + ecx*2 + 0x38], cl
cmp al, 0x4e
dec ecx
dec ebx
cmp al, 0x83
les eax, [ecx + eax*4]
or edi, dword [edi + 1]
add byte [ecx + 0x203dca], al
add byte [edx - 0x39], bl
test dword [eax + 0xfffff8], eax
add byte [eax], al
add byte [ebx - 0x3976b], cl
dec dword [ecx - 0x16276b]
inc dword [ebx - 0x162743]
inc dword [eax]
jne 0x416947
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x44c], eax
jmp 0x416c38
mov ecx, dword [ebp - 0x1628]
mov edx, dword [ebp - 0x398]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x162c], edx
jne 0x41696f
mov eax, dword [ebp - 0x780]
invalid
invalid
mov ah, 0xfb
invalid
Function at 0x416813
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edx
add esp, 4
sub esi, 0x46b5
pop esi
push ebx
push ebx
add esp, 4
or ebx, 0x6f34
or ebx, 0x17f31
sub ebx, 0x32d4
pop ebx
push eax
sub eax, 0x9922
sub eax, 0x165e8
pop eax
lea edx, [ebp - 0x1770]
mov dword [ebp - 0xccc], edx
mov eax, dword [ebp - 0x450]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcc8], ecx
xor edx, edx
mov word [ebp - 0x1c4], dx
xor eax, eax
mov word [ebp - 0x30], ax
push ecx
push edi
add esp, 4
jmp 0x4166cc
or ecx, 0xa7e5
pop ecx
push esi
xor esi, 0xe5c7
pop esi
push ebx
push eax
add esp, 4
or ebx, 0x130a5
pop ebx
push ecx
push ebx
add esp, 4
or ecx, 0xa75c
pop ecx
mov ecx, dword [ebp - 0xcc8]
mov dx, word [ecx]
mov word [ebp - 0x104e], dx
mov eax, dword [ebp - 0xcc8]
add eax, 2
mov dword [ebp - 0xcc8], eax
mov cx, word [ebp - 0x104e]
mov word [ebp - 0x1c4], cx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1064], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1064]
cmp edx, eax
je 0x4166c1
movzx ecx, word [ebp - 0x1c4]
movzx edx, word [ebp - 0x30]
cmp ecx, edx
jge 0x4167dd
mov dword [ebp - 0x1620], 0xffffffff
jmp 0x4167e7
mov dword [ebp - 0x1620], 1
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x1624], eax
cmp dword [ebp - 0x1624], 0
jne 0x41683c
push esi
sub esi, 0x8429
call 0x416813
add byte [edx], dh
dec eax
cmp eax, 0x473d463c
aas
inc esp
xor al, byte [ebx + 0x7eb04c4]
aas
cmp ecx, dword [edx + esi + 0x38]
dec ebp
dec esi
pop esi
push ebx
xor ebx, 0x7cab
or ebx, 0x1c3f
pop ebx
mov ecx, dword [ebp - 0x450]
mov dword [ebp - 0x2f8], ecx
jmp 0x4168a4
push ecx
push edi
add esp, 4
add ecx, 0xb8a5
pop ecx
push ebx
and ebx, 0x1253c
jmp 0x416855
and ebx, 0x5f52
or ebx, 0x1bcc
pop ebx
push ebx
push edx
add esp, 4
or ebx, 0x35d8
pop ebx
mov edx, dword [ebp - 0x450]
mov eax, dword [edx]
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp - 0x450]
cmp ecx, dword [ebp - 0xcd0]
je 0x41689a
mov edx, dword [ebp - 0x450]
cmp dword [edx + 0x30], 0
jne 0x416665
mov dword [ebp - 0x2f8], 0
push edx
and edx, 0x1742b
or edx, 0x148c3
pop edx
push ebx
push esi
add esp, 4
call 0x4168c6
add byte [ecx + 0x47], cl
cmp eax, 0x4c473f3e
dec ecx
inc ebp
add esp, 4
sub ebx, 0x634c
and ebx, 0x43f0
pop ebx
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x398], ecx
push ebx
push edx
add esp, 4
sub ebx, 0xb1da
pop ebx
push edx
or edx, 0x3315
call 0x416907
add byte [eax + ecx*2 + 0x38], cl
cmp al, 0x4e
dec ecx
dec ebx
cmp al, 0x83
les eax, [ecx + eax*4]
or edi, dword [edi + 1]
add byte [ecx + 0x203dca], al
add byte [edx - 0x39], bl
test dword [eax + 0xfffff8], eax
add byte [eax], al
add byte [ebx - 0x3976b], cl
dec dword [ecx - 0x16276b]
inc dword [ebx - 0x162743]
inc dword [eax]
jne 0x416947
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x44c], eax
jmp 0x416c38
mov ecx, dword [ebp - 0x1628]
mov edx, dword [ebp - 0x398]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x162c], edx
jne 0x41696f
mov eax, dword [ebp - 0x780]
invalid
invalid
mov ah, 0xfb
invalid
Function at 0x4168c6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edx
add esp, 4
sub esi, 0x46b5
pop esi
push ebx
push ebx
add esp, 4
or ebx, 0x6f34
or ebx, 0x17f31
sub ebx, 0x32d4
pop ebx
push eax
sub eax, 0x9922
sub eax, 0x165e8
pop eax
lea edx, [ebp - 0x1770]
mov dword [ebp - 0xccc], edx
mov eax, dword [ebp - 0x450]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcc8], ecx
xor edx, edx
mov word [ebp - 0x1c4], dx
xor eax, eax
mov word [ebp - 0x30], ax
push ecx
push edi
add esp, 4
jmp 0x4166cc
or ecx, 0xa7e5
pop ecx
push esi
xor esi, 0xe5c7
pop esi
push ebx
push eax
add esp, 4
or ebx, 0x130a5
pop ebx
push ecx
push ebx
add esp, 4
or ecx, 0xa75c
pop ecx
mov ecx, dword [ebp - 0xcc8]
mov dx, word [ecx]
mov word [ebp - 0x104e], dx
mov eax, dword [ebp - 0xcc8]
add eax, 2
mov dword [ebp - 0xcc8], eax
mov cx, word [ebp - 0x104e]
mov word [ebp - 0x1c4], cx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1064], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1064]
cmp edx, eax
je 0x4166c1
movzx ecx, word [ebp - 0x1c4]
movzx edx, word [ebp - 0x30]
cmp ecx, edx
jge 0x4167dd
mov dword [ebp - 0x1620], 0xffffffff
jmp 0x4167e7
mov dword [ebp - 0x1620], 1
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x1624], eax
cmp dword [ebp - 0x1624], 0
jne 0x41683c
push esi
sub esi, 0x8429
call 0x416813
add byte [edx], dh
dec eax
cmp eax, 0x473d463c
aas
inc esp
xor al, byte [ebx + 0x7eb04c4]
aas
cmp ecx, dword [edx + esi + 0x38]
dec ebp
dec esi
pop esi
push ebx
xor ebx, 0x7cab
or ebx, 0x1c3f
pop ebx
mov ecx, dword [ebp - 0x450]
mov dword [ebp - 0x2f8], ecx
jmp 0x4168a4
push ecx
push edi
add esp, 4
add ecx, 0xb8a5
pop ecx
push ebx
and ebx, 0x1253c
jmp 0x416855
and ebx, 0x5f52
or ebx, 0x1bcc
pop ebx
push ebx
push edx
add esp, 4
or ebx, 0x35d8
pop ebx
mov edx, dword [ebp - 0x450]
mov eax, dword [edx]
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp - 0x450]
cmp ecx, dword [ebp - 0xcd0]
je 0x41689a
mov edx, dword [ebp - 0x450]
cmp dword [edx + 0x30], 0
jne 0x416665
mov dword [ebp - 0x2f8], 0
push edx
and edx, 0x1742b
or edx, 0x148c3
pop edx
push ebx
push esi
add esp, 4
call 0x4168c6
add byte [ecx + 0x47], cl
cmp eax, 0x4c473f3e
dec ecx
inc ebp
add esp, 4
sub ebx, 0x634c
and ebx, 0x43f0
pop ebx
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x398], ecx
push ebx
push edx
add esp, 4
sub ebx, 0xb1da
pop ebx
push edx
or edx, 0x3315
call 0x416907
add byte [eax + ecx*2 + 0x38], cl
cmp al, 0x4e
dec ecx
dec ebx
cmp al, 0x83
les eax, [ecx + eax*4]
or edi, dword [edi + 1]
add byte [ecx + 0x203dca], al
add byte [edx - 0x39], bl
test dword [eax + 0xfffff8], eax
add byte [eax], al
add byte [ebx - 0x3976b], cl
dec dword [ecx - 0x16276b]
inc dword [ebx - 0x162743]
inc dword [eax]
jne 0x416947
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x44c], eax
jmp 0x416c38
mov ecx, dword [ebp - 0x1628]
mov edx, dword [ebp - 0x398]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x162c], edx
jne 0x41696f
mov eax, dword [ebp - 0x780]
invalid
invalid
mov ah, 0xfb
invalid
Function at 0x416907
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edx
add esp, 4
sub esi, 0x46b5
pop esi
push ebx
push ebx
add esp, 4
or ebx, 0x6f34
or ebx, 0x17f31
sub ebx, 0x32d4
pop ebx
push eax
sub eax, 0x9922
sub eax, 0x165e8
pop eax
lea edx, [ebp - 0x1770]
mov dword [ebp - 0xccc], edx
mov eax, dword [ebp - 0x450]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcc8], ecx
xor edx, edx
mov word [ebp - 0x1c4], dx
xor eax, eax
mov word [ebp - 0x30], ax
push ecx
push edi
add esp, 4
jmp 0x4166cc
or ecx, 0xa7e5
pop ecx
push esi
xor esi, 0xe5c7
pop esi
push ebx
push eax
add esp, 4
or ebx, 0x130a5
pop ebx
push ecx
push ebx
add esp, 4
or ecx, 0xa75c
pop ecx
mov ecx, dword [ebp - 0xcc8]
mov dx, word [ecx]
mov word [ebp - 0x104e], dx
mov eax, dword [ebp - 0xcc8]
add eax, 2
mov dword [ebp - 0xcc8], eax
mov cx, word [ebp - 0x104e]
mov word [ebp - 0x1c4], cx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1064], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1064]
cmp edx, eax
je 0x4166c1
movzx ecx, word [ebp - 0x1c4]
movzx edx, word [ebp - 0x30]
cmp ecx, edx
jge 0x4167dd
mov dword [ebp - 0x1620], 0xffffffff
jmp 0x4167e7
mov dword [ebp - 0x1620], 1
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x1624], eax
cmp dword [ebp - 0x1624], 0
jne 0x41683c
push esi
sub esi, 0x8429
call 0x416813
add byte [edx], dh
dec eax
cmp eax, 0x473d463c
aas
inc esp
xor al, byte [ebx + 0x7eb04c4]
aas
cmp ecx, dword [edx + esi + 0x38]
dec ebp
dec esi
pop esi
push ebx
xor ebx, 0x7cab
or ebx, 0x1c3f
pop ebx
mov ecx, dword [ebp - 0x450]
mov dword [ebp - 0x2f8], ecx
jmp 0x4168a4
push ecx
push edi
add esp, 4
add ecx, 0xb8a5
pop ecx
push ebx
and ebx, 0x1253c
jmp 0x416855
and ebx, 0x5f52
or ebx, 0x1bcc
pop ebx
push ebx
push edx
add esp, 4
or ebx, 0x35d8
pop ebx
mov edx, dword [ebp - 0x450]
mov eax, dword [edx]
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp - 0x450]
cmp ecx, dword [ebp - 0xcd0]
je 0x41689a
mov edx, dword [ebp - 0x450]
cmp dword [edx + 0x30], 0
jne 0x416665
mov dword [ebp - 0x2f8], 0
push edx
and edx, 0x1742b
or edx, 0x148c3
pop edx
push ebx
push esi
add esp, 4
call 0x4168c6
add byte [ecx + 0x47], cl
cmp eax, 0x4c473f3e
dec ecx
inc ebp
add esp, 4
sub ebx, 0x634c
and ebx, 0x43f0
pop ebx
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x398], ecx
push ebx
push edx
add esp, 4
sub ebx, 0xb1da
pop ebx
push edx
or edx, 0x3315
call 0x416907
add byte [eax + ecx*2 + 0x38], cl
cmp al, 0x4e
dec ecx
dec ebx
cmp al, 0x83
les eax, [ecx + eax*4]
or edi, dword [edi + 1]
add byte [ecx + 0x203dca], al
add byte [edx - 0x39], bl
test dword [eax + 0xfffff8], eax
add byte [eax], al
add byte [ebx - 0x3976b], cl
dec dword [ecx - 0x16276b]
inc dword [ebx - 0x162743]
inc dword [eax]
jne 0x416947
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x44c], eax
jmp 0x416c38
mov ecx, dword [ebp - 0x1628]
mov edx, dword [ebp - 0x398]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x162c], edx
jne 0x41696f
mov eax, dword [ebp - 0x780]
invalid
invalid
mov ah, 0xfb
invalid
Function at 0x417012
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
jmp 0x417018
pop ebx
push ebx
push esi
add esp, 4
jmp 0x417026
or ebx, 0xb0f1
and ebx, 0x11421
pop ebx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x417050
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x163c], ecx
jmp 0x4170aa
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x416f78
movzx edx, word [ebp - 0x1c8]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x416f78
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x417094
mov dword [ebp - 0x1638], 0xffffffff
jmp 0x41709e
mov dword [ebp - 0x1638], 1
mov eax, dword [ebp - 0x1638]
mov dword [ebp - 0x163c], eax
cmp dword [ebp - 0x163c], 0
jne 0x4170f3
push edx
push ebx
add esp, 4
call 0x4170c5
add byte [ecx + 0x39], al
inc esi
aaa
inc esp
dec eax
aaa
add esp, 4
or edx, 0x103b9
sub edx, 0xe1b6
pop edx
push esi
jmp 0x4170de
xor esi, 0xae18
pop esi
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x2fc], ecx
jmp 0x41715b
push edi
call 0x417103
add byte [ebp + 0x36], al
aas
xor al, 0x45
dec edi
aaa
dec eax
xor eax, 0x8104c483
out dx, eax
inc ecx
pop ss
add dword [eax], eax
sub edi, 0xae3a
pop edi
push eax
push edi
add esp, 4
and eax, 0x17df
and eax, 0xcb1
pop eax
mov edx, dword [ebp - 0x448]
mov eax, dword [edx]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
cmp ecx, dword [ebp - 0xce0]
je 0x417151
mov edx, dword [ebp - 0x448]
cmp dword [edx + 0x30], 0
jne 0x416f1c
mov dword [ebp - 0x2fc], 0
Function at 0x4170c5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
jmp 0x417018
pop ebx
push ebx
push esi
add esp, 4
jmp 0x417026
or ebx, 0xb0f1
and ebx, 0x11421
pop ebx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x417050
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x163c], ecx
jmp 0x4170aa
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x416f78
movzx edx, word [ebp - 0x1c8]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x416f78
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x417094
mov dword [ebp - 0x1638], 0xffffffff
jmp 0x41709e
mov dword [ebp - 0x1638], 1
mov eax, dword [ebp - 0x1638]
mov dword [ebp - 0x163c], eax
cmp dword [ebp - 0x163c], 0
jne 0x4170f3
push edx
push ebx
add esp, 4
call 0x4170c5
add byte [ecx + 0x39], al
inc esi
aaa
inc esp
dec eax
aaa
add esp, 4
or edx, 0x103b9
sub edx, 0xe1b6
pop edx
push esi
jmp 0x4170de
xor esi, 0xae18
pop esi
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x2fc], ecx
jmp 0x41715b
push edi
call 0x417103
add byte [ebp + 0x36], al
aas
xor al, 0x45
dec edi
aaa
dec eax
xor eax, 0x8104c483
out dx, eax
inc ecx
pop ss
add dword [eax], eax
sub edi, 0xae3a
pop edi
push eax
push edi
add esp, 4
and eax, 0x17df
and eax, 0xcb1
pop eax
mov edx, dword [ebp - 0x448]
mov eax, dword [edx]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
cmp ecx, dword [ebp - 0xce0]
je 0x417151
mov edx, dword [ebp - 0x448]
cmp dword [edx + 0x30], 0
jne 0x416f1c
mov dword [ebp - 0x2fc], 0
Function at 0x417103
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
jmp 0x417018
pop ebx
push ebx
push esi
add esp, 4
jmp 0x417026
or ebx, 0xb0f1
and ebx, 0x11421
pop ebx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x417050
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x163c], ecx
jmp 0x4170aa
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x416f78
movzx edx, word [ebp - 0x1c8]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x416f78
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x417094
mov dword [ebp - 0x1638], 0xffffffff
jmp 0x41709e
mov dword [ebp - 0x1638], 1
mov eax, dword [ebp - 0x1638]
mov dword [ebp - 0x163c], eax
cmp dword [ebp - 0x163c], 0
jne 0x4170f3
push edx
push ebx
add esp, 4
call 0x4170c5
add byte [ecx + 0x39], al
inc esi
aaa
inc esp
dec eax
aaa
add esp, 4
or edx, 0x103b9
sub edx, 0xe1b6
pop edx
push esi
jmp 0x4170de
xor esi, 0xae18
pop esi
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x2fc], ecx
jmp 0x41715b
push edi
call 0x417103
add byte [ebp + 0x36], al
aas
xor al, 0x45
dec edi
aaa
dec eax
xor eax, 0x8104c483
out dx, eax
inc ecx
pop ss
add dword [eax], eax
sub edi, 0xae3a
pop edi
push eax
push edi
add esp, 4
and eax, 0x17df
and eax, 0xcb1
pop eax
mov edx, dword [ebp - 0x448]
mov eax, dword [edx]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
cmp ecx, dword [ebp - 0xce0]
je 0x417151
mov edx, dword [ebp - 0x448]
cmp dword [edx + 0x30], 0
jne 0x416f1c
mov dword [ebp - 0x2fc], 0
Function at 0x417492
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x41749a
xor esi, 0x12e17
pop esi
push esi
sub esi, 0x16b3
jmp 0x4174b0
pop esi
movzx ecx, word [ebp - 0x38]
test ecx, ecx
jne 0x4174ce
movzx edx, word [ebp - 0x1cc]
movzx eax, word [ebp - 0x38]
sub edx, eax
mov dword [ebp - 0x1648], edx
jmp 0x417528
movzx ecx, word [ebp - 0x1cc]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
je 0x4173f6
movzx eax, word [ebp - 0x1cc]
xor eax, 0x20
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x4173f6
movzx edx, word [ebp - 0x1cc]
movzx eax, word [ebp - 0x38]
cmp edx, eax
jge 0x417512
mov dword [ebp - 0x1644], 0xffffffff
jmp 0x41751c
mov dword [ebp - 0x1644], 1
mov ecx, dword [ebp - 0x1644]
mov dword [ebp - 0x1648], ecx
cmp dword [ebp - 0x1648], 0
jne 0x417571
push edi
jmp 0x417538
sub edi, 0x108df
xor edi, 0x1550e
and edi, 0x2650
pop edi
push ecx
call 0x417559
add byte [edx], bh
dec eax
cmp al, 0x37
inc ebx
cmp al, 0x48
add esp, 4
or ecx, 0x11866
pop ecx
mov edx, dword [ebp - 0x444]
mov dword [ebp - 0x784], edx
jmp 0x4175d9
push ecx
call 0x417581
add byte [eax], bh
xor eax, 0x3b41423b
cmp dword [edx], esi
add esp, 4
add ecx, 0x934a
and ecx, 0x10cf8
xor ecx, 0x154a5
pop ecx
push edx
push edi
add esp, 4
add edx, 0x14c43
pop edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax]
mov dword [ebp - 0x444], ecx
mov edx, dword [ebp - 0x444]
cmp edx, dword [ebp - 0xcec]
je 0x4175cf
mov eax, dword [ebp - 0x444]
cmp dword [eax + 0x30], 0
jne 0x41739a
mov dword [ebp - 0x784], 0
push esi
push esi
add esp, 4
xor esi, 0x135b7
or esi, 0x158d1
pop esi
push edi
push ebx
add esp, 4
sub edi, 0x13e1a
or edi, 0xd0e7
pop edi
push edx
or edx, 0xd357
xor edx, 0x9155
pop edx
cmp dword [ebp - 0x784], 0
jne 0x417655
push ecx
sub ecx, 0x12e10
xor ecx, 0x135b1
pop ecx
push ecx
push edi
add esp, 4
add ecx, 0xfa0b
sub ecx, 0x4d8c
call 0x417642
add byte [edi], bh
dec ecx
inc esp
xor edi, dword [0x384c4844]
add esp, 4
pop ecx
mov dword [ebp - 0xa80], 0
jmp 0x41817d
push ebx
jmp 0x41765d
call 0x41766b
add byte [edx], dh
cmp al, 0x36
xor al, 0x45
inc edx
xor esi, dword [ebx + eax*4]
les eax, [ebx + ebx*2]
push ecx
push eax
add esp, 4
or ecx, 0x160a7
xor ecx, 0x1628
or ecx, 0x11365
pop ecx
mov ecx, dword [ebp - 0x784]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x39c], edx
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x164c], eax
cmp dword [ebp - 0x164c], 0
jne 0x4176c6
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x40c], ecx
jmp 0x4179b7
mov edx, dword [ebp - 0x164c]
mov eax, dword [ebp - 0x39c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x16a0], eax
jne 0x4176ee
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x40c], ecx
jmp 0x4179b7
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x16a0]
mov edx, dword [ecx + eax + 0x78]
invalid
xchg ebp, eax
Function at 0x417559
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x41749a
xor esi, 0x12e17
pop esi
push esi
sub esi, 0x16b3
jmp 0x4174b0
pop esi
movzx ecx, word [ebp - 0x38]
test ecx, ecx
jne 0x4174ce
movzx edx, word [ebp - 0x1cc]
movzx eax, word [ebp - 0x38]
sub edx, eax
mov dword [ebp - 0x1648], edx
jmp 0x417528
movzx ecx, word [ebp - 0x1cc]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
je 0x4173f6
movzx eax, word [ebp - 0x1cc]
xor eax, 0x20
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x4173f6
movzx edx, word [ebp - 0x1cc]
movzx eax, word [ebp - 0x38]
cmp edx, eax
jge 0x417512
mov dword [ebp - 0x1644], 0xffffffff
jmp 0x41751c
mov dword [ebp - 0x1644], 1
mov ecx, dword [ebp - 0x1644]
mov dword [ebp - 0x1648], ecx
cmp dword [ebp - 0x1648], 0
jne 0x417571
push edi
jmp 0x417538
sub edi, 0x108df
xor edi, 0x1550e
and edi, 0x2650
pop edi
push ecx
call 0x417559
add byte [edx], bh
dec eax
cmp al, 0x37
inc ebx
cmp al, 0x48
add esp, 4
or ecx, 0x11866
pop ecx
mov edx, dword [ebp - 0x444]
mov dword [ebp - 0x784], edx
jmp 0x4175d9
push ecx
call 0x417581
add byte [eax], bh
xor eax, 0x3b41423b
cmp dword [edx], esi
add esp, 4
add ecx, 0x934a
and ecx, 0x10cf8
xor ecx, 0x154a5
pop ecx
push edx
push edi
add esp, 4
add edx, 0x14c43
pop edx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax]
mov dword [ebp - 0x444], ecx
mov edx, dword [ebp - 0x444]
cmp edx, dword [ebp - 0xcec]
je 0x4175cf
mov eax, dword [ebp - 0x444]
cmp dword [eax + 0x30], 0
jne 0x41739a
mov dword [ebp - 0x784], 0
push esi
push esi
add esp, 4
xor esi, 0x135b7
or esi, 0x158d1
pop esi
push edi
push ebx
add esp, 4
sub edi, 0x13e1a
or edi, 0xd0e7
pop edi
push edx
or edx, 0xd357
xor edx, 0x9155
pop edx
cmp dword [ebp - 0x784], 0
jne 0x417655
push ecx
sub ecx, 0x12e10
xor ecx, 0x135b1
pop ecx
push ecx
push edi
add esp, 4
add ecx, 0xfa0b
sub ecx, 0x4d8c
call 0x417642
add byte [edi], bh
dec ecx
inc esp
xor edi, dword [0x384c4844]
add esp, 4
pop ecx
mov dword [ebp - 0xa80], 0
jmp 0x41817d
push ebx
jmp 0x41765d
call 0x41766b
add byte [edx], dh
cmp al, 0x36
xor al, 0x45
inc edx
xor esi, dword [ebx + eax*4]
les eax, [ebx + ebx*2]
push ecx
push eax
add esp, 4
or ecx, 0x160a7
xor ecx, 0x1628
or ecx, 0x11365
pop ecx
mov ecx, dword [ebp - 0x784]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x39c], edx
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x164c], eax
cmp dword [ebp - 0x164c], 0
jne 0x4176c6
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x40c], ecx
jmp 0x4179b7
mov edx, dword [ebp - 0x164c]
mov eax, dword [ebp - 0x39c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x16a0], eax
jne 0x4176ee
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x40c], ecx
jmp 0x4179b7
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x16a0]
mov edx, dword [ecx + eax + 0x78]
invalid
xchg ebp, eax