joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468dcf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x16dfc
pop edx
push eax
push ecx
add esp, 4
sub eax, 0x13138
jmp 0x468c91
or eax, 0xd295
pop eax
cmp dword [ebp - 0xc58], 0
jne 0x468cb0
mov dword [ebp - 0x710], 0
jmp 0x468efb
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx
push ebx
call 0x468ccb
add byte [0x3b39383f], dh
dec esp
xor cl, byte [edi - 0x7d]
les eax, [ecx + eax*4]
fstp xword [eax + eax]
and ebx, 0x9ef9
sub ebx, 0x16fc5
pop ebx
push ebx
jmp 0x468ce7
add ebx, 0xd9df
pop ebx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ecx
sub ecx, 0x174c7
pop ecx
push edi
push ebx
add esp, 4
and edi, 0x14eb2
and edi, 0x13a0a
pop edi
push ecx
push esi
add esp, 4
call 0x468d46
add byte [edi], dh
cmp dword [edi + 0x37], ecx
dec esp
xor eax, 0x83373f44
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push ecx
push esi
add esp, 4
and ecx, 0x140e4
call 0x468db8
add byte [0x39354b4d], bh
xor al, byte [ebx + 0x565904c4]
and esi, 0x49e0
call 0x468dcf
add byte [0x36504c4c], dh
xor eax, 0x5e04c483
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x468df0
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x468e4a
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x468d18
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x468d18
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x468e34
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x468e3e
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x468e93
push eax
push edx
add esp, 4
call 0x468e68
add byte [ebx + 0x35], cl
dec ebx
inc esi
aas
xor eax, 0x3f465044
add esp, 4
pop eax
push edx
push edi
add esp, 4
call 0x468e81
add byte [ecx], bh
cmp byte [edx + 0x45], cl
dec edi
dec esi
inc eax
dec edx
xor cl, byte [esi - 0x7d]
les eax, [edx + ebx*2]
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x468efb
push edx
push ebx
add esp, 4
or edx, 0x13b79
jmp 0x468ea4
pop edx
push ebx
and ebx, 0x9fec
add ebx, 0x15f6a
or ebx, 0x12b98
pop ebx
push ebx
push esi
add esp, 4
and ebx, 0x84a6
pop ebx
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x468ef1
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x468cbc
mov dword [ebp - 0x710], 0
Function at 0x468e68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x16dfc
pop edx
push eax
push ecx
add esp, 4
sub eax, 0x13138
jmp 0x468c91
or eax, 0xd295
pop eax
cmp dword [ebp - 0xc58], 0
jne 0x468cb0
mov dword [ebp - 0x710], 0
jmp 0x468efb
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx
push ebx
call 0x468ccb
add byte [0x3b39383f], dh
dec esp
xor cl, byte [edi - 0x7d]
les eax, [ecx + eax*4]
fstp xword [eax + eax]
and ebx, 0x9ef9
sub ebx, 0x16fc5
pop ebx
push ebx
jmp 0x468ce7
add ebx, 0xd9df
pop ebx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ecx
sub ecx, 0x174c7
pop ecx
push edi
push ebx
add esp, 4
and edi, 0x14eb2
and edi, 0x13a0a
pop edi
push ecx
push esi
add esp, 4
call 0x468d46
add byte [edi], dh
cmp dword [edi + 0x37], ecx
dec esp
xor eax, 0x83373f44
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push ecx
push esi
add esp, 4
and ecx, 0x140e4
call 0x468db8
add byte [0x39354b4d], bh
xor al, byte [ebx + 0x565904c4]
and esi, 0x49e0
call 0x468dcf
add byte [0x36504c4c], dh
xor eax, 0x5e04c483
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x468df0
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x468e4a
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x468d18
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x468d18
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x468e34
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x468e3e
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x468e93
push eax
push edx
add esp, 4
call 0x468e68
add byte [ebx + 0x35], cl
dec ebx
inc esi
aas
xor eax, 0x3f465044
add esp, 4
pop eax
push edx
push edi
add esp, 4
call 0x468e81
add byte [ecx], bh
cmp byte [edx + 0x45], cl
dec edi
dec esi
inc eax
dec edx
xor cl, byte [esi - 0x7d]
les eax, [edx + ebx*2]
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x468efb
push edx
push ebx
add esp, 4
or edx, 0x13b79
jmp 0x468ea4
pop edx
push ebx
and ebx, 0x9fec
add ebx, 0x15f6a
or ebx, 0x12b98
pop ebx
push ebx
push esi
add esp, 4
and ebx, 0x84a6
pop ebx
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x468ef1
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x468cbc
mov dword [ebp - 0x710], 0
Function at 0x468e81
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x16dfc
pop edx
push eax
push ecx
add esp, 4
sub eax, 0x13138
jmp 0x468c91
or eax, 0xd295
pop eax
cmp dword [ebp - 0xc58], 0
jne 0x468cb0
mov dword [ebp - 0x710], 0
jmp 0x468efb
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx
push ebx
call 0x468ccb
add byte [0x3b39383f], dh
dec esp
xor cl, byte [edi - 0x7d]
les eax, [ecx + eax*4]
fstp xword [eax + eax]
and ebx, 0x9ef9
sub ebx, 0x16fc5
pop ebx
push ebx
jmp 0x468ce7
add ebx, 0xd9df
pop ebx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ecx
sub ecx, 0x174c7
pop ecx
push edi
push ebx
add esp, 4
and edi, 0x14eb2
and edi, 0x13a0a
pop edi
push ecx
push esi
add esp, 4
call 0x468d46
add byte [edi], dh
cmp dword [edi + 0x37], ecx
dec esp
xor eax, 0x83373f44
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push ecx
push esi
add esp, 4
and ecx, 0x140e4
call 0x468db8
add byte [0x39354b4d], bh
xor al, byte [ebx + 0x565904c4]
and esi, 0x49e0
call 0x468dcf
add byte [0x36504c4c], dh
xor eax, 0x5e04c483
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x468df0
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x468e4a
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x468d18
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x468d18
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x468e34
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x468e3e
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x468e93
push eax
push edx
add esp, 4
call 0x468e68
add byte [ebx + 0x35], cl
dec ebx
inc esi
aas
xor eax, 0x3f465044
add esp, 4
pop eax
push edx
push edi
add esp, 4
call 0x468e81
add byte [ecx], bh
cmp byte [edx + 0x45], cl
dec edi
dec esi
inc eax
dec edx
xor cl, byte [esi - 0x7d]
les eax, [edx + ebx*2]
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x468efb
push edx
push ebx
add esp, 4
or edx, 0x13b79
jmp 0x468ea4
pop edx
push ebx
and ebx, 0x9fec
add ebx, 0x15f6a
or ebx, 0x12b98
pop ebx
push ebx
push esi
add esp, 4
and ebx, 0x84a6
pop ebx
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x468ef1
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x468cbc
mov dword [ebp - 0x710], 0
Function at 0x46925c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x718]
add eax, 1
mov dword [ebp - 0x718], eax
add esp, 4
pop esi
push esi
sub esi, 0x14a0a
and esi, 0x26aa
add esi, 0xe3a
pop esi
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x188]
movsx ecx, byte [ebp + eax - 0x830]
or ecx, 0x20
cmp edx, ecx
jge 0x4692a7
mov dword [ebp - 0xc5c], 0xffffffff
jmp 0x4692b1
mov dword [ebp - 0xc5c], 1
cmp dword [ebp - 0xc5c], 0
jne 0x4692c8
mov edx, dword [ebp - 0x18ec]
mov dword [ebp - 0x3c8], edx
jmp 0x4692d9
jmp 0x4690b2
Function at 0x4694d5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0x903b
call 0x4694d5
add byte [edx], bh
inc esp
cmp edi, dword [edx]
cmp eax, 0x83413f40
les eax, [ecx + eax*4]
loopne 0x4694dc
xor byte [ecx], al
add byte [eax + 0x57], bl
add dword [eax], eax
pop eax
push edi
call 0x4694ee
add byte [edi + 0x46], cl
dec eax
inc eax
inc ebx
inc edx
inc edi
dec edx
add esp, 4
pop edi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
push edi
add esp, 4
add edx, 0x12fd5
or edx, 0x11924
add edx, 0xbe05
pop edx
push edi
add edi, 0x171a8
or edi, 0x118b1
sub edi, 0x5bb9
xor edi, 0x30d7
pop edi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edi
or edi, 0x1098c
jmp 0x4695b1
pop edi
push esi
push ebx
add esp, 4
call 0x4695c7
add byte [edi + 0x33], cl
inc ebx
inc edx
dec ebp
cmp dh, byte [esi + 0x4c48336]
add esi, 0x6a22
add esi, 0x47ba
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4695f4
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x46964e
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x46951c
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x46951c
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x469638
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x469642
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x469697
push eax
push eax
add esp, 4
and eax, 0x9fc0
and eax, 0x12a3a
or eax, 0x26c4
pop eax
push edi
and edi, 0x7d72
xor edi, 0x50fe
sub edi, 0xb3b8
or edi, 0x14b04
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4696ff
push ebx
and ebx, 0x9db8
add ebx, 0xf027
xor ebx, 0x1da0
pop ebx
push edx
and edx, 0xa86f
add byte [eax], al
add byte [eax], al
or edx, 0xbd43
call 0x4696c5
add byte [esi + esi + 0x47], al
dec esi
cmp eax, 0xc483464d
add al, 0x5a
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x4696f5
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x4694c0
mov dword [ebp - 0x2a8], 0
push ebx
sub ebx, 0x11c0e
call 0x469713
add byte [ecx], bh
inc eax
dec esp
cmp cl, byte [ebx + esi - 0x7d]
les eax, [ecx + eax*4]
retf
Function at 0x4694ee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0x903b
call 0x4694d5
add byte [edx], bh
inc esp
cmp edi, dword [edx]
cmp eax, 0x83413f40
les eax, [ecx + eax*4]
loopne 0x4694dc
xor byte [ecx], al
add byte [eax + 0x57], bl
add dword [eax], eax
pop eax
push edi
call 0x4694ee
add byte [edi + 0x46], cl
dec eax
inc eax
inc ebx
inc edx
inc edi
dec edx
add esp, 4
pop edi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
push edi
add esp, 4
add edx, 0x12fd5
or edx, 0x11924
add edx, 0xbe05
pop edx
push edi
add edi, 0x171a8
or edi, 0x118b1
sub edi, 0x5bb9
xor edi, 0x30d7
pop edi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edi
or edi, 0x1098c
jmp 0x4695b1
pop edi
push esi
push ebx
add esp, 4
call 0x4695c7
add byte [edi + 0x33], cl
inc ebx
inc edx
dec ebp
cmp dh, byte [esi + 0x4c48336]
add esi, 0x6a22
add esi, 0x47ba
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4695f4
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x46964e
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x46951c
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x46951c
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x469638
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x469642
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x469697
push eax
push eax
add esp, 4
and eax, 0x9fc0
and eax, 0x12a3a
or eax, 0x26c4
pop eax
push edi
and edi, 0x7d72
xor edi, 0x50fe
sub edi, 0xb3b8
or edi, 0x14b04
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4696ff
push ebx
and ebx, 0x9db8
add ebx, 0xf027
xor ebx, 0x1da0
pop ebx
push edx
and edx, 0xa86f
add byte [eax], al
add byte [eax], al
or edx, 0xbd43
call 0x4696c5
add byte [esi + esi + 0x47], al
dec esi
cmp eax, 0xc483464d
add al, 0x5a
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x4696f5
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x4694c0
mov dword [ebp - 0x2a8], 0
push ebx
sub ebx, 0x11c0e
call 0x469713
add byte [ecx], bh
inc eax
dec esp
cmp cl, byte [ebx + esi - 0x7d]
les eax, [ecx + eax*4]
retf
Function at 0x4695c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0x903b
call 0x4694d5
add byte [edx], bh
inc esp
cmp edi, dword [edx]
cmp eax, 0x83413f40
les eax, [ecx + eax*4]
loopne 0x4694dc
xor byte [ecx], al
add byte [eax + 0x57], bl
add dword [eax], eax
pop eax
push edi
call 0x4694ee
add byte [edi + 0x46], cl
dec eax
inc eax
inc ebx
inc edx
inc edi
dec edx
add esp, 4
pop edi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
push edi
add esp, 4
add edx, 0x12fd5
or edx, 0x11924
add edx, 0xbe05
pop edx
push edi
add edi, 0x171a8
or edi, 0x118b1
sub edi, 0x5bb9
xor edi, 0x30d7
pop edi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edi
or edi, 0x1098c
jmp 0x4695b1
pop edi
push esi
push ebx
add esp, 4
call 0x4695c7
add byte [edi + 0x33], cl
inc ebx
inc edx
dec ebp
cmp dh, byte [esi + 0x4c48336]
add esi, 0x6a22
add esi, 0x47ba
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4695f4
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x46964e
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x46951c
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x46951c
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x469638
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x469642
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x469697
push eax
push eax
add esp, 4
and eax, 0x9fc0
and eax, 0x12a3a
or eax, 0x26c4
pop eax
push edi
and edi, 0x7d72
xor edi, 0x50fe
sub edi, 0xb3b8
or edi, 0x14b04
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4696ff
push ebx
and ebx, 0x9db8
add ebx, 0xf027
xor ebx, 0x1da0
pop ebx
push edx
and edx, 0xa86f
add byte [eax], al
add byte [eax], al
or edx, 0xbd43
call 0x4696c5
add byte [esi + esi + 0x47], al
dec esi
cmp eax, 0xc483464d
add al, 0x5a
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x4696f5
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x4694c0
mov dword [ebp - 0x2a8], 0
push ebx
sub ebx, 0x11c0e
call 0x469713
add byte [ecx], bh
inc eax
dec esp
cmp cl, byte [ebx + esi - 0x7d]
les eax, [ecx + eax*4]
retf
Function at 0x4696b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0x903b
call 0x4694d5
add byte [edx], bh
inc esp
cmp edi, dword [edx]
cmp eax, 0x83413f40
les eax, [ecx + eax*4]
loopne 0x4694dc
xor byte [ecx], al
add byte [eax + 0x57], bl
add dword [eax], eax
pop eax
push edi
call 0x4694ee
add byte [edi + 0x46], cl
dec eax
inc eax
inc ebx
inc edx
inc edi
dec edx
add esp, 4
pop edi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
push edi
add esp, 4
add edx, 0x12fd5
or edx, 0x11924
add edx, 0xbe05
pop edx
push edi
add edi, 0x171a8
or edi, 0x118b1
sub edi, 0x5bb9
xor edi, 0x30d7
pop edi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edi
or edi, 0x1098c
jmp 0x4695b1
pop edi
push esi
push ebx
add esp, 4
call 0x4695c7
add byte [edi + 0x33], cl
inc ebx
inc edx
dec ebp
cmp dh, byte [esi + 0x4c48336]
add esi, 0x6a22
add esi, 0x47ba
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4695f4
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x46964e
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x46951c
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x46951c
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x469638
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x469642
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x469697
push eax
push eax
add esp, 4
and eax, 0x9fc0
and eax, 0x12a3a
or eax, 0x26c4
pop eax
push edi
and edi, 0x7d72
xor edi, 0x50fe
sub edi, 0xb3b8
or edi, 0x14b04
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4696ff
push ebx
and ebx, 0x9db8
add ebx, 0xf027
xor ebx, 0x1da0
pop ebx
push edx
and edx, 0xa86f
add byte [eax], al
add byte [eax], al
or edx, 0xbd43
call 0x4696c5
add byte [esi + esi + 0x47], al
dec esi
cmp eax, 0xc483464d
add al, 0x5a
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x4696f5
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x4694c0
mov dword [ebp - 0x2a8], 0
push ebx
sub ebx, 0x11c0e
call 0x469713
add byte [ecx], bh
inc eax
dec esp
cmp cl, byte [ebx + esi - 0x7d]
les eax, [ecx + eax*4]
retf
Function at 0x4696c5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0x903b
call 0x4694d5
add byte [edx], bh
inc esp
cmp edi, dword [edx]
cmp eax, 0x83413f40
les eax, [ecx + eax*4]
loopne 0x4694dc
xor byte [ecx], al
add byte [eax + 0x57], bl
add dword [eax], eax
pop eax
push edi
call 0x4694ee
add byte [edi + 0x46], cl
dec eax
inc eax
inc ebx
inc edx
inc edi
dec edx
add esp, 4
pop edi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
push edi
add esp, 4
add edx, 0x12fd5
or edx, 0x11924
add edx, 0xbe05
pop edx
push edi
add edi, 0x171a8
or edi, 0x118b1
sub edi, 0x5bb9
xor edi, 0x30d7
pop edi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edi
or edi, 0x1098c
jmp 0x4695b1
pop edi
push esi
push ebx
add esp, 4
call 0x4695c7
add byte [edi + 0x33], cl
inc ebx
inc edx
dec ebp
cmp dh, byte [esi + 0x4c48336]
add esi, 0x6a22
add esi, 0x47ba
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4695f4
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x46964e
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x46951c
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x46951c
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x469638
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x469642
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x469697
push eax
push eax
add esp, 4
and eax, 0x9fc0
and eax, 0x12a3a
or eax, 0x26c4
pop eax
push edi
and edi, 0x7d72
xor edi, 0x50fe
sub edi, 0xb3b8
or edi, 0x14b04
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4696ff
push ebx
and ebx, 0x9db8
add ebx, 0xf027
xor ebx, 0x1da0
pop ebx
push edx
and edx, 0xa86f
add byte [eax], al
add byte [eax], al
or edx, 0xbd43
call 0x4696c5
add byte [esi + esi + 0x47], al
dec esi
cmp eax, 0xc483464d
add al, 0x5a
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x4696f5
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x4694c0
mov dword [ebp - 0x2a8], 0
push ebx
sub ebx, 0x11c0e
call 0x469713
add byte [ecx], bh
inc eax
dec esp
cmp cl, byte [ebx + esi - 0x7d]
les eax, [ecx + eax*4]
retf