joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415d7f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push ebx
add ebx, 0x139d5
sub ebx, 0x179e8
pop ebx
mov ecx, dword [ebp - 0x5e4]
mov dword [ebp - 0x944], ecx
jmp 0x415e07
push eax
sub eax, 0x164f5
xor eax, 0x13a7c
pop eax
push edi
jmp 0x415e1e
or edi, 0x7719
pop edi
push esi
push eax
add esp, 4
sub esi, 0x183c4
pop esi
push ecx
add ecx, 0x6480
pop ecx
cmp dword [ebp - 0x944], 0
jne 0x415e83
push edi
push ecx
add esp, 4
or edi, 0x7dee
and edi, 0xab98
sub edi, 0x447c
add edi, 0x16de7
pop edi
push ebx
add ebx, 0x703a
add ebx, 0xce5a
sub ebx, 0x152da
pop ebx
mov dword [ebp - 0x990], 0
jmp 0x4169aa
push edi
add edi, 0xc880
or edi, 0x11d16
sub edi, 0x160e3
pop edi
push esi
jmp 0x415ea1
jmp 0x415ea8
sub esi, 0xcffe
and esi, 0xa7c4
pop esi
mov eax, dword [ebp - 0x944]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x3d4], ecx
mov dword [ebp - 0x954], 0
mov edx, dword [ebp - 0x3d4]
mov dword [ebp - 0x1b78], edx
cmp dword [ebp - 0x1b78], 0
jne 0x415ef4
mov eax, dword [ebp - 0x954]
mov dword [ebp - 0x4c4], eax
jmp 0x4161e5
mov ecx, dword [ebp - 0x1b78]
mov edx, dword [ebp - 0x3d4]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1b7c], edx
jne 0x415f1c
mov eax, dword [ebp - 0x954]
mov dword [ebp - 0x4c4], eax
jmp 0x4161e5
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1b7c]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1b88], ecx
cmp dword [ebp - 0x1b88], 0
jne 0x415f4e
mov edx, dword [ebp - 0x954]
mov dword [ebp - 0x4c4], edx
jmp 0x4161e5
mov eax, dword [ebp - 0x3d4]
add eax, dword [ebp - 0x1b88]
mov dword [ebp - 0x948], eax
jne 0x415f73
mov ecx, dword [ebp - 0x954]
mov dword [ebp - 0x4c4], ecx
jmp 0x4161e5
mov edx, dword [ebp - 0x948]
mov eax, dword [ebp - 0x3d4]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1f24], eax
mov ecx, dword [ebp - 0x948]
mov edx, dword [ebp - 0x3d4]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x1f28], edx
mov eax, dword [ebp - 0x948]
mov ecx, dword [ebp - 0x3d4]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1f2c], ecx
mov dword [ebp - 0x94c], 0
jmp 0x415fcd
Function at 0x415dac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edx
add esp, 4
add esi, 0x16684
or esi, 0x11900
and esi, 0x17ba2
sub esi, 0x523a
pop esi
push esi
or esi, 0x12933
pop esi
push edx
push edi
add esp, 4
xor edx, 0x22fe
pop edx
lea edx, [ebp - 0x1c54]
mov dword [ebp - 0xfd4], edx
mov eax, dword [ebp - 0x5e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xfd0], ecx
xor edx, edx
mov word [ebp - 0x2a8], dx
xor eax, eax
mov word [ebp - 0x64], ax
push esi
sub esi, 0x3ffc
xor esi, 0xda83
pop esi
push ebx
or ebx, 0xad98
pop ebx
push edi
or edi, 0xe563
pop edi
push edi
sub edi, 0xb883
xor edi, 0x7710
add edi, 0x96c4
pop edi
mov ecx, dword [ebp - 0xfd0]
mov dx, word [ecx]
mov word [ebp - 0x1412], dx
mov eax, dword [ebp - 0xfd0]
add eax, 2
mov dword [ebp - 0xfd0], eax
mov cx, word [ebp - 0x1412]
mov word [ebp - 0x2a8], cx
mov edx, dword [ebp - 0xfd4]
mov ax, word [edx]
mov word [ebp - 0x1414], ax
mov ecx, dword [ebp - 0xfd4]
add ecx, 2
mov dword [ebp - 0xfd4], ecx
mov dx, word [ebp - 0x1414]
mov word [ebp - 0x64], dx
push esi
push esi
add esp, 4
add esi, 0xbf59
pop esi
push ebx
add ebx, 0x9d6
pop ebx
push esi
push ecx
add esp, 4
or esi, 0x10660
and esi, 0x1ef8
add esi, 0x64c4
add esi, 0xf259
pop esi
movzx eax, word [ebp - 0x64]
test eax, eax
jne 0x415cfc
movzx ecx, word [ebp - 0x2a8]
movzx edx, word [ebp - 0x64]
sub ecx, edx
mov dword [ebp - 0x1b74], ecx
jmp 0x415d56
movzx eax, word [ebp - 0x2a8]
movzx ecx, word [ebp - 0x64]
cmp eax, ecx
je 0x415c24
movzx edx, word [ebp - 0x2a8]
xor edx, 0x20
movzx eax, word [ebp - 0x64]
cmp edx, eax
je 0x415c24
movzx ecx, word [ebp - 0x2a8]
movzx edx, word [ebp - 0x64]
cmp ecx, edx
jge 0x415d40
mov dword [ebp - 0x1b70], 0xffffffff
jmp 0x415d4a
mov dword [ebp - 0x1b70], 1
mov eax, dword [ebp - 0x1b70]
mov dword [ebp - 0x1b74], eax
cmp dword [ebp - 0x1b74], 0
jne 0x415d9f
push edi
push edx
add esp, 4
add edi, 0xc81e
pop edi
push esi
sub esi, 0x91d
call fcn.00415d7f
add byte [eax + 0x46], dl
dec ebp
xor esi, dword [esi]
xor al, 0x49
push ecx
call fcn.00415dac
add byte [edi], bh
push eax
inc eax
inc edi
dec ecx
add esp, 4
and ecx, 0x17cbb
pop ecx
push edi
push esi
add esp, 4
jmp 0x415dc1
pop edi
push eax
add eax, 0x22ef
jmp 0x415dd0
pop eax
mov edx, dword [ebp - 0x5e4]
mov eax, dword [edx]
mov dword [ebp - 0x5e4], eax
mov ecx, dword [ebp - 0x5e4]
cmp ecx, dword [ebp - 0xfd8]
je 0x415dfd
mov edx, dword [ebp - 0x5e4]
cmp dword [edx + 0x30], 0
jne 0x415bc8
mov dword [ebp - 0x944], 0
Function at 0x416cf2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push edx
add esp, 4
or ebx, 0x38bf
or ebx, 0x11975
pop ebx
push ebx
sub ebx, 0x15e2a
pop ebx
push edx
push eax
add esp, 4
sub edx, 0x8f0b
sub edx, 0x3330
sub edx, 0xb60d
pop edx
lea edx, [ebp - 0x1ba8]
mov dword [ebp - 0xff4], edx
mov eax, dword [ebp - 0x63c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xff0], ecx
xor edx, edx
mov word [ebp - 0x2b0], dx
xor eax, eax
mov word [ebp - 0x6c], ax
push edi
push ebx
add esp, 4
call fcn.00416cf2
add byte [ecx], bh
inc esi
xor al, 0x3b
cmp dl, byte [eax + 0x3d]
dec ebx
dec edx
add esp, 4
call 0x416d05
add byte [edi + eax*2 + 0x32], al
xor al, 0x49
inc esi
cmp dword ss:[edi], edi
add esp, 4
jmp 0x416d0f
pop edi
mov ecx, dword [ebp - 0xff0]
mov dx, word [ecx]
mov word [ebp - 0x141a], dx
mov eax, dword [ebp - 0xff0]
add eax, 2
mov dword [ebp - 0xff0], eax
mov cx, word [ebp - 0x141a]
mov word [ebp - 0x2b0], cx
mov edx, dword [ebp - 0xff4]
mov ax, word [edx]
mov word [ebp - 0x141c], ax
invalid
invalid
invalid

Function at 0x416d05
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push edx
add esp, 4
or ebx, 0x38bf
or ebx, 0x11975
pop ebx
push ebx
sub ebx, 0x15e2a
pop ebx
push edx
push eax
add esp, 4
sub edx, 0x8f0b
sub edx, 0x3330
sub edx, 0xb60d
pop edx
lea edx, [ebp - 0x1ba8]
mov dword [ebp - 0xff4], edx
mov eax, dword [ebp - 0x63c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xff0], ecx
xor edx, edx
mov word [ebp - 0x2b0], dx
xor eax, eax
mov word [ebp - 0x6c], ax
push edi
push ebx
add esp, 4
call fcn.00416cf2
add byte [ecx], bh
inc esi
xor al, 0x3b
cmp dl, byte [eax + 0x3d]
dec ebx
dec edx
add esp, 4
call 0x416d05
add byte [edi + eax*2 + 0x32], al
xor al, 0x49
inc esi
cmp dword ss:[edi], edi
add esp, 4
jmp 0x416d0f
pop edi
mov ecx, dword [ebp - 0xff0]
mov dx, word [ecx]
mov word [ebp - 0x141a], dx
mov eax, dword [ebp - 0xff0]
add eax, 2
mov dword [ebp - 0xff0], eax
mov cx, word [ebp - 0x141a]
mov word [ebp - 0x2b0], cx
mov edx, dword [ebp - 0xff4]
mov ax, word [edx]
mov word [ebp - 0x141c], ax
invalid
invalid
invalid
Function at 0x417128
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
sub eax, 0xdeb9
add eax, 0x1f7c
add eax, 0x131cf
pop eax
push edi
push ecx
add esp, 4
call fcn.00417128
add byte [edx + 0x37], al
inc eax
push eax
inc esi
dec ecx
cmp al, byte [ebp + 0x40]
add esp, 4
and edi, 0x178d8
pop edi
lea eax, [ebp - 0x1c70]
mov dword [ebp - 0x1000], eax
mov ecx, dword [ebp - 0x640]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xffc], edx
xor eax, eax
mov word [ebp - 0x2b4], ax
xor ecx, ecx
mov word [ebp - 0x70], cx
push ebx
push esi
add esp, 4
call 0x41716e
add byte [ebp + 0x3e], al
xor al, 0x4d
cmp al, 0x3c
inc ebx
add esp, 4
pop ebx
push edx
push edi
add esp, 4
sub edx, 0xd48b
sub edx, 0x13ba2
pop edx
push eax
jmp 0x41718d
pop eax
mov edx, dword [ebp - 0xffc]
mov ax, word [edx]
mov word [ebp - 0x141e], ax
mov ecx, dword [ebp - 0xffc]
add ecx, 2
mov dword [ebp - 0xffc], ecx
mov dx, word [ebp - 0x141e]
mov word [ebp - 0x2b4], dx
mov eax, dword [ebp - 0x1000]
mov cx, word [eax]
mov word [ebp - 0x1420], cx
mov edx, dword [ebp - 0x1000]
add edx, 2
mov dword [ebp - 0x1000], edx
mov ax, word [ebp - 0x1420]
mov word [ebp - 0x70], ax
push esi
push esi
add esp, 4
jmp 0x4171f2
pop esi
push edi
push ebx
add esp, 4
call 0x417204
add byte [ebx + 0x35], cl
cmp bh, byte [esp + edi]
dec eax
add esp, 4
call 0x417213
add byte [esi], bh
inc esi
aas
inc esi
dec edx
aas
add esp, 4
pop edi
movzx ecx, word [ebp - 0x70]
test ecx, ecx
jne 0x417234
movzx edx, word [ebp - 0x2b4]
movzx eax, word [ebp - 0x70]
sub edx, eax
mov dword [ebp - 0x155c], edx
jmp 0x41728e
movzx ecx, word [ebp - 0x2b4]
movzx edx, word [ebp - 0x70]
cmp ecx, edx
je 0x41715c
movzx eax, word [ebp - 0x2b4]
xor eax, 0x20
movzx ecx, word [ebp - 0x70]
cmp eax, ecx
je 0x41715c
movzx edx, word [ebp - 0x2b4]
movzx eax, word [ebp - 0x70]
cmp edx, eax
jge 0x417278
mov dword [ebp - 0x1558], 0xffffffff
jmp 0x417282
mov dword [ebp - 0x1558], 1
mov ecx, dword [ebp - 0x1558]
mov dword [ebp - 0x155c], ecx
cmp dword [ebp - 0x155c], 0
jne 0x4172d7
push edx
or edx, 0x149b9
and edx, 0x9e34
add edx, 0x657e
pop edx
push edi
push edx
add esp, 4
push edx
sub edx, 0xba10
pop edx
push esi
call 0x4172ed
add byte [edi], dh
xor esi, dword [edx + eax*2]
dec esi
xor al, byte [ebx - 0x7d]
les eax, [ecx + eax*4]
out 0xa3, al
xchg dword [eax], eax
add byte [ecx + 0x2ea0f6], al
add byte [esi + 0x51], bl
push eax
add esp, 4
xor ecx, 0x83d7
pop ecx
mov eax, dword [ebp - 0x640]
mov ecx, dword [eax]
mov dword [ebp - 0x640], ecx
mov edx, dword [ebp - 0x640]
cmp edx, dword [ebp - 0x1004]
je 0x417335
mov eax, dword [ebp - 0x640]
cmp dword [eax + 0x30], 0
jne 0x417100
mov dword [ebp - 0x968], 0
Function at 0x41716e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
sub eax, 0xdeb9
add eax, 0x1f7c
add eax, 0x131cf
pop eax
push edi
push ecx
add esp, 4
call fcn.00417128
add byte [edx + 0x37], al
inc eax
push eax
inc esi
dec ecx
cmp al, byte [ebp + 0x40]
add esp, 4
and edi, 0x178d8
pop edi
lea eax, [ebp - 0x1c70]
mov dword [ebp - 0x1000], eax
mov ecx, dword [ebp - 0x640]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xffc], edx
xor eax, eax
mov word [ebp - 0x2b4], ax
xor ecx, ecx
mov word [ebp - 0x70], cx
push ebx
push esi
add esp, 4
call 0x41716e
add byte [ebp + 0x3e], al
xor al, 0x4d
cmp al, 0x3c
inc ebx
add esp, 4
pop ebx
push edx
push edi
add esp, 4
sub edx, 0xd48b
sub edx, 0x13ba2
pop edx
push eax
jmp 0x41718d
pop eax
mov edx, dword [ebp - 0xffc]
mov ax, word [edx]
mov word [ebp - 0x141e], ax
mov ecx, dword [ebp - 0xffc]
add ecx, 2
mov dword [ebp - 0xffc], ecx
mov dx, word [ebp - 0x141e]
mov word [ebp - 0x2b4], dx
mov eax, dword [ebp - 0x1000]
mov cx, word [eax]
mov word [ebp - 0x1420], cx
mov edx, dword [ebp - 0x1000]
add edx, 2
mov dword [ebp - 0x1000], edx
mov ax, word [ebp - 0x1420]
mov word [ebp - 0x70], ax
push esi
push esi
add esp, 4
jmp 0x4171f2
pop esi
push edi
push ebx
add esp, 4
call 0x417204
add byte [ebx + 0x35], cl
cmp bh, byte [esp + edi]
dec eax
add esp, 4
call 0x417213
add byte [esi], bh
inc esi
aas
inc esi
dec edx
aas
add esp, 4
pop edi
movzx ecx, word [ebp - 0x70]
test ecx, ecx
jne 0x417234
movzx edx, word [ebp - 0x2b4]
movzx eax, word [ebp - 0x70]
sub edx, eax
mov dword [ebp - 0x155c], edx
jmp 0x41728e
movzx ecx, word [ebp - 0x2b4]
movzx edx, word [ebp - 0x70]
cmp ecx, edx
je 0x41715c
movzx eax, word [ebp - 0x2b4]
xor eax, 0x20
movzx ecx, word [ebp - 0x70]
cmp eax, ecx
je 0x41715c
movzx edx, word [ebp - 0x2b4]
movzx eax, word [ebp - 0x70]
cmp edx, eax
jge 0x417278
mov dword [ebp - 0x1558], 0xffffffff
jmp 0x417282
mov dword [ebp - 0x1558], 1
mov ecx, dword [ebp - 0x1558]
mov dword [ebp - 0x155c], ecx
cmp dword [ebp - 0x155c], 0
jne 0x4172d7
push edx
or edx, 0x149b9
and edx, 0x9e34
add edx, 0x657e
pop edx
push edi
push edx
add esp, 4
push edx
sub edx, 0xba10
pop edx
push esi
call 0x4172ed
add byte [edi], dh
xor esi, dword [edx + eax*2]
dec esi
xor al, byte [ebx - 0x7d]
les eax, [ecx + eax*4]
out 0xa3, al
xchg dword [eax], eax
add byte [ecx + 0x2ea0f6], al
add byte [esi + 0x51], bl
push eax
add esp, 4
xor ecx, 0x83d7
pop ecx
mov eax, dword [ebp - 0x640]
mov ecx, dword [eax]
mov dword [ebp - 0x640], ecx
mov edx, dword [ebp - 0x640]
cmp edx, dword [ebp - 0x1004]
je 0x417335
mov eax, dword [ebp - 0x640]
cmp dword [eax + 0x30], 0
jne 0x417100
mov dword [ebp - 0x968], 0
Function at 0x417204
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
sub eax, 0xdeb9
add eax, 0x1f7c
add eax, 0x131cf
pop eax
push edi
push ecx
add esp, 4
call fcn.00417128
add byte [edx + 0x37], al
inc eax
push eax
inc esi
dec ecx
cmp al, byte [ebp + 0x40]
add esp, 4
and edi, 0x178d8
pop edi
lea eax, [ebp - 0x1c70]
mov dword [ebp - 0x1000], eax
mov ecx, dword [ebp - 0x640]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xffc], edx
xor eax, eax
mov word [ebp - 0x2b4], ax
xor ecx, ecx
mov word [ebp - 0x70], cx
push ebx
push esi
add esp, 4
call 0x41716e
add byte [ebp + 0x3e], al
xor al, 0x4d
cmp al, 0x3c
inc ebx
add esp, 4
pop ebx
push edx
push edi
add esp, 4
sub edx, 0xd48b
sub edx, 0x13ba2
pop edx
push eax
jmp 0x41718d
pop eax
mov edx, dword [ebp - 0xffc]
mov ax, word [edx]
mov word [ebp - 0x141e], ax
mov ecx, dword [ebp - 0xffc]
add ecx, 2
mov dword [ebp - 0xffc], ecx
mov dx, word [ebp - 0x141e]
mov word [ebp - 0x2b4], dx
mov eax, dword [ebp - 0x1000]
mov cx, word [eax]
mov word [ebp - 0x1420], cx
mov edx, dword [ebp - 0x1000]
add edx, 2
mov dword [ebp - 0x1000], edx
mov ax, word [ebp - 0x1420]
mov word [ebp - 0x70], ax
push esi
push esi
add esp, 4
jmp 0x4171f2
pop esi
push edi
push ebx
add esp, 4
call 0x417204
add byte [ebx + 0x35], cl
cmp bh, byte [esp + edi]
dec eax
add esp, 4
call 0x417213
add byte [esi], bh
inc esi
aas
inc esi
dec edx
aas
add esp, 4
pop edi
movzx ecx, word [ebp - 0x70]
test ecx, ecx
jne 0x417234
movzx edx, word [ebp - 0x2b4]
movzx eax, word [ebp - 0x70]
sub edx, eax
mov dword [ebp - 0x155c], edx
jmp 0x41728e
movzx ecx, word [ebp - 0x2b4]
movzx edx, word [ebp - 0x70]
cmp ecx, edx
je 0x41715c
movzx eax, word [ebp - 0x2b4]
xor eax, 0x20
movzx ecx, word [ebp - 0x70]
cmp eax, ecx
je 0x41715c
movzx edx, word [ebp - 0x2b4]
movzx eax, word [ebp - 0x70]
cmp edx, eax
jge 0x417278
mov dword [ebp - 0x1558], 0xffffffff
jmp 0x417282
mov dword [ebp - 0x1558], 1
mov ecx, dword [ebp - 0x1558]
mov dword [ebp - 0x155c], ecx
cmp dword [ebp - 0x155c], 0
jne 0x4172d7
push edx
or edx, 0x149b9
and edx, 0x9e34
add edx, 0x657e
pop edx
push edi
push edx
add esp, 4
push edx
sub edx, 0xba10
pop edx
push esi
call 0x4172ed
add byte [edi], dh
xor esi, dword [edx + eax*2]
dec esi
xor al, byte [ebx - 0x7d]
les eax, [ecx + eax*4]
out 0xa3, al
xchg dword [eax], eax
add byte [ecx + 0x2ea0f6], al
add byte [esi + 0x51], bl
push eax
add esp, 4
xor ecx, 0x83d7
pop ecx
mov eax, dword [ebp - 0x640]
mov ecx, dword [eax]
mov dword [ebp - 0x640], ecx
mov edx, dword [ebp - 0x640]
cmp edx, dword [ebp - 0x1004]
je 0x417335
mov eax, dword [ebp - 0x640]
cmp dword [eax + 0x30], 0
jne 0x417100
mov dword [ebp - 0x968], 0
Function at 0x417213
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
sub eax, 0xdeb9
add eax, 0x1f7c
add eax, 0x131cf
pop eax
push edi
push ecx
add esp, 4
call fcn.00417128
add byte [edx + 0x37], al
inc eax
push eax
inc esi
dec ecx
cmp al, byte [ebp + 0x40]
add esp, 4
and edi, 0x178d8
pop edi
lea eax, [ebp - 0x1c70]
mov dword [ebp - 0x1000], eax
mov ecx, dword [ebp - 0x640]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xffc], edx
xor eax, eax
mov word [ebp - 0x2b4], ax
xor ecx, ecx
mov word [ebp - 0x70], cx
push ebx
push esi
add esp, 4
call 0x41716e
add byte [ebp + 0x3e], al
xor al, 0x4d
cmp al, 0x3c
inc ebx
add esp, 4
pop ebx
push edx
push edi
add esp, 4
sub edx, 0xd48b
sub edx, 0x13ba2
pop edx
push eax
jmp 0x41718d
pop eax
mov edx, dword [ebp - 0xffc]
mov ax, word [edx]
mov word [ebp - 0x141e], ax
mov ecx, dword [ebp - 0xffc]
add ecx, 2
mov dword [ebp - 0xffc], ecx
mov dx, word [ebp - 0x141e]
mov word [ebp - 0x2b4], dx
mov eax, dword [ebp - 0x1000]
mov cx, word [eax]
mov word [ebp - 0x1420], cx
mov edx, dword [ebp - 0x1000]
add edx, 2
mov dword [ebp - 0x1000], edx
mov ax, word [ebp - 0x1420]
mov word [ebp - 0x70], ax
push esi
push esi
add esp, 4
jmp 0x4171f2
pop esi
push edi
push ebx
add esp, 4
call 0x417204
add byte [ebx + 0x35], cl
cmp bh, byte [esp + edi]
dec eax
add esp, 4
call 0x417213
add byte [esi], bh
inc esi
aas
inc esi
dec edx
aas
add esp, 4
pop edi
movzx ecx, word [ebp - 0x70]
test ecx, ecx
jne 0x417234
movzx edx, word [ebp - 0x2b4]
movzx eax, word [ebp - 0x70]
sub edx, eax
mov dword [ebp - 0x155c], edx
jmp 0x41728e
movzx ecx, word [ebp - 0x2b4]
movzx edx, word [ebp - 0x70]
cmp ecx, edx
je 0x41715c
movzx eax, word [ebp - 0x2b4]
xor eax, 0x20
movzx ecx, word [ebp - 0x70]
cmp eax, ecx
je 0x41715c
movzx edx, word [ebp - 0x2b4]
movzx eax, word [ebp - 0x70]
cmp edx, eax
jge 0x417278
mov dword [ebp - 0x1558], 0xffffffff
jmp 0x417282
mov dword [ebp - 0x1558], 1
mov ecx, dword [ebp - 0x1558]
mov dword [ebp - 0x155c], ecx
cmp dword [ebp - 0x155c], 0
jne 0x4172d7
push edx
or edx, 0x149b9
and edx, 0x9e34
add edx, 0x657e
pop edx
push edi
push edx
add esp, 4
push edx
sub edx, 0xba10
pop edx
push esi
call 0x4172ed
add byte [edi], dh
xor esi, dword [edx + eax*2]
dec esi
xor al, byte [ebx - 0x7d]
les eax, [ecx + eax*4]
out 0xa3, al
xchg dword [eax], eax
add byte [ecx + 0x2ea0f6], al
add byte [esi + 0x51], bl
push eax
add esp, 4
xor ecx, 0x83d7
pop ecx
mov eax, dword [ebp - 0x640]
mov ecx, dword [eax]
mov dword [ebp - 0x640], ecx
mov edx, dword [ebp - 0x640]
cmp edx, dword [ebp - 0x1004]
je 0x417335
mov eax, dword [ebp - 0x640]
cmp dword [eax + 0x30], 0
jne 0x417100
mov dword [ebp - 0x968], 0

Function at 0x4172b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and edi, 0x17fc1
pop edi
push edx
push eax
add esp, 4
add edx, 0x137a7
sub edx, 0x7366
pop edx
mov edx, dword [ebp - 0x640]
mov dword [ebp - 0x968], edx
jmp 0x41733f
push edi
push edx
add esp, 4
call 0x417353
add byte [edi + 0x47], cl
inc ecx
inc ebp
dec edx
inc ecx
inc esp
aas
xor al, 0x83
les eax, [ecx + eax*4]
invalid
Function at 0x4172ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
sub eax, 0xdeb9
add eax, 0x1f7c
add eax, 0x131cf
pop eax
push edi
push ecx
add esp, 4
call fcn.00417128
add byte [edx + 0x37], al
inc eax
push eax
inc esi
dec ecx
cmp al, byte [ebp + 0x40]
add esp, 4
and edi, 0x178d8
pop edi
lea eax, [ebp - 0x1c70]
mov dword [ebp - 0x1000], eax
mov ecx, dword [ebp - 0x640]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xffc], edx
xor eax, eax
mov word [ebp - 0x2b4], ax
xor ecx, ecx
mov word [ebp - 0x70], cx
push ebx
push esi
add esp, 4
call 0x41716e
add byte [ebp + 0x3e], al
xor al, 0x4d
cmp al, 0x3c
inc ebx
add esp, 4
pop ebx
push edx
push edi
add esp, 4
sub edx, 0xd48b
sub edx, 0x13ba2
pop edx
push eax
jmp 0x41718d
pop eax
mov edx, dword [ebp - 0xffc]
mov ax, word [edx]
mov word [ebp - 0x141e], ax
mov ecx, dword [ebp - 0xffc]
add ecx, 2
mov dword [ebp - 0xffc], ecx
mov dx, word [ebp - 0x141e]
mov word [ebp - 0x2b4], dx
mov eax, dword [ebp - 0x1000]
mov cx, word [eax]
mov word [ebp - 0x1420], cx
mov edx, dword [ebp - 0x1000]
add edx, 2
mov dword [ebp - 0x1000], edx
mov ax, word [ebp - 0x1420]
mov word [ebp - 0x70], ax
push esi
push esi
add esp, 4
jmp 0x4171f2
pop esi
push edi
push ebx
add esp, 4
call 0x417204
add byte [ebx + 0x35], cl
cmp bh, byte [esp + edi]
dec eax
add esp, 4
call 0x417213
add byte [esi], bh
inc esi
aas
inc esi
dec edx
aas
add esp, 4
pop edi
movzx ecx, word [ebp - 0x70]
test ecx, ecx
jne 0x417234
movzx edx, word [ebp - 0x2b4]
movzx eax, word [ebp - 0x70]
sub edx, eax
mov dword [ebp - 0x155c], edx
jmp 0x41728e
movzx ecx, word [ebp - 0x2b4]
movzx edx, word [ebp - 0x70]
cmp ecx, edx
je 0x41715c
movzx eax, word [ebp - 0x2b4]
xor eax, 0x20
movzx ecx, word [ebp - 0x70]
cmp eax, ecx
je 0x41715c
movzx edx, word [ebp - 0x2b4]
movzx eax, word [ebp - 0x70]
cmp edx, eax
jge 0x417278
mov dword [ebp - 0x1558], 0xffffffff
jmp 0x417282
mov dword [ebp - 0x1558], 1
mov ecx, dword [ebp - 0x1558]
mov dword [ebp - 0x155c], ecx
cmp dword [ebp - 0x155c], 0
jne 0x4172d7
push edx
or edx, 0x149b9
and edx, 0x9e34
add edx, 0x657e
pop edx
push edi
push edx
add esp, 4
push edx
sub edx, 0xba10
pop edx
push esi
call 0x4172ed
add byte [edi], dh
xor esi, dword [edx + eax*2]
dec esi
xor al, byte [ebx - 0x7d]
les eax, [ecx + eax*4]
out 0xa3, al
xchg dword [eax], eax
add byte [ecx + 0x2ea0f6], al
add byte [esi + 0x51], bl
push eax
add esp, 4
xor ecx, 0x83d7
pop ecx
mov eax, dword [ebp - 0x640]
mov ecx, dword [eax]
mov dword [ebp - 0x640], ecx
mov edx, dword [ebp - 0x640]
cmp edx, dword [ebp - 0x1004]
je 0x417335
mov eax, dword [ebp - 0x640]
cmp dword [eax + 0x30], 0
jne 0x417100
mov dword [ebp - 0x968], 0

Function at 0x417353
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and edi, 0x17fc1
pop edi
push edx
push eax
add esp, 4
add edx, 0x137a7
sub edx, 0x7366
pop edx
mov edx, dword [ebp - 0x640]
mov dword [ebp - 0x968], edx
jmp 0x41733f
push edi
push edx
add esp, 4
call 0x417353
add byte [edi + 0x47], cl
inc ecx
inc ebp
dec edx
inc ecx
inc esp
aas
xor al, 0x83
les eax, [ecx + eax*4]
invalid
Function at 0x417550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x970]
add eax, 1
mov dword [ebp - 0x970], eax
mov ecx, dword [ebp - 0x96c]
mov edx, dword [ebp - 0x970]
cmp edx, dword [ecx + 0x18]
jae 0x417711
mov eax, dword [ebp - 0x970]
mov ecx, dword [ebp - 0x1f68]
mov edx, dword [ebp - 0x3cc]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x974], edx
xchg ebp, eax
invalid
idiv bh
dec dword [ebx - 0x96f7b]
dec dword [ebx - 0x1f6b73]
dec dword [edi]
mov bh, 0x14
inc ecx
mov eax, dword [ebp - 0x1f70]
mov ecx, dword [ebp - 0x3cc]
inc dword [ebx]
or al, 0x90
mov dword [ebp - 0x1f74], ecx
mov dword [ebp - 0x1d8], 0
jmp 0x417575
mov edx, dword [ebp - 0x1d8]
add edx, 1
mov dword [ebp - 0x1d8], edx
xchg ebp, eax
sub dh, bh
invalid
invalid
mov eax, dword [ebp - 0x974]
add eax, dword [ebp - 0x1d8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x417627
mov edx, dword [ebp - 0x1d8]
movsx eax, byte [ebp + edx - 0xafc]
test eax, eax
je 0x417627
push eax
add eax, 0x5d77
jmp 0x4175af
and eax, 0x17347
or eax, 0x15192
pop eax
push edx
push ebx
add esp, 4
add edx, 0x6c36
or edx, 0x11bb6
xor edx, 0x7605
pop edx
mov ecx, dword [ebp - 0x974]
add ecx, dword [ebp - 0x1d8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1d8]
movsx ecx, byte [ebp + eax - 0xafc]
cmp edx, ecx
je 0x417619
mov edx, dword [ebp - 0x974]
add edx, dword [ebp - 0x1d8]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1d8]
movsx edx, byte [ebp + ecx - 0xafc]
cmp eax, edx
jne 0x417620
jmp 0x417566
jmp 0x417627
push ecx
push edx
add esp, 4
jmp 0x417631
and ecx, 0x12e1b
call 0x417647
add byte [edx], dh
xor eax, 0x43473e3b
inc esi
inc ebx
inc eax
cmp eax, dword [ebx - 0x167efb3c]
retf
movsx ecx, byte [ebp + eax - 0xafc]
or ecx, 0x20
cmp edx, ecx
jge 0x4176eb
mov dword [ebp - 0x1008], 0xffffffff
jmp 0x4176f5
mov dword [ebp - 0x1008], 1
cmp dword [ebp - 0x1008], 0
jne 0x41770c
mov edx, dword [ebp - 0x1f74]
mov dword [ebp - 0x4c8], edx
jmp 0x41771d
jmp 0x4174f6
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x4c8], eax