joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b882
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4e6680]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46b8c2
cmp byte [ebx], 0xa
jne 0x46b8c2
or byte [eax + edi + 0x28], 4
jmp 0x46b8c7
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x46b9c5
mov al, byte [edx]
cmp al, 0x1a
je 0x46b9a7
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x46b8f6
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x46b91b
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x46b925
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x46b8d8
jmp 0x46b9c5
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46b9a2
cmp dword [ebp - 0xc], 0
je 0x46b9a2
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4e6680]
test byte [eax + edi + 0x28], 0x48
je 0x46b97c
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x46b967
mov byte [esi], dl
jmp 0x46b978
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4e6680]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x46b9c5
cmp byte [ebp - 1], 0xa
jne 0x46b98b
cmp esi, ebx
jne 0x46b98b
mov byte [esi], 0xa
jmp 0x46b9c4
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0046c717
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x46b9c5
mov byte [esi], 0xd
jmp 0x46b9c4
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4e6680]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x46b9c1
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x46b9c5
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x46b9ce
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4e6680]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46ba11
cmp word [esi], dx
jne 0x46ba11
or byte [edi + eax + 0x28], 4
jmp 0x46ba16
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x46bb69
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x46bb49
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x46ba58
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x46ba8e
cmp eax, edx
jae 0x46ba9a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x46ba30
jmp 0x46bb69
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46bb45
cmp dword [ebp - 0x14], 0
je 0x46bb45
mov eax, dword [ebx*4 + 0x4e6680]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x46bb1d
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x46bae6
mov word [esi], cx
jmp 0x46bb19
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4e6680]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4e6680]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4e6680]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x46bb69
pop ebx
cmp word [ebp - 4], bx
jne 0x46bb2e
cmp esi, dword [ebp + 0xc]
jne 0x46bb2e
mov word [esi], bx
jmp 0x46bb66
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0046c717
add esp, 0x10
cmp word [ebp - 4], bx
je 0x46bb69
push 0xd
jmp 0x46bb62
mov ecx, dword [ebx*4 + 0x4e6680]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x46bb60
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x46bb69
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100028e0
Capabilities:
Get number of processors

Disassembly:
add esp, 4
call 0x100028f3
add byte [ecx + 0x34], cl
inc esi
inc edx
dec edx
cmp cl, byte [edx + 0x46]
inc edx
add esp, 4
or ecx, 0x18353
pop ecx
mov dword [ebp - 0x774], 0
jmp 0x10002ff7

Function at 0x100028f3
Capabilities:
Get number of processors

Disassembly:
add esp, 4
call 0x100028f3
add byte [ecx + 0x34], cl
inc esi
inc edx
dec edx
cmp cl, byte [edx + 0x46]
inc edx
add esp, 4
or ecx, 0x18353
pop ecx
mov dword [ebp - 0x774], 0
jmp 0x10002ff7
Function at 0x10003346
Capabilities:
Get number of processors

Disassembly:
add byte [edx + 0x50], bl
jmp 0x10003288
pop eax
push ebx
jmp 0x10003291
sub ebx, 0x977f
and ebx, 0xceff
and ebx, 0x135eb
pop ebx
push edi
sub edi, 0x16399
pop edi
cmp dword [ebp - 0xc48], 0
jne 0x100032c4
mov dword [ebp - 0x2a4], 0
jmp 0x1000350f
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0x4cc], eax
push edi
push eax
add esp, 4
sub edi, 0xd5e1
and edi, 0x10fee
sub edi, 0xd5a8
pop edi
push ecx
sub ecx, 0xea3d
add ecx, 0x155eb
and ecx, 0x157e3
xor ecx, 0x8162
pop ecx
lea ecx, [ebp - 0x15cc]
mov dword [ebp - 0xc44], ecx
mov edx, dword [ebp - 0x4cc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc40], eax
xor ecx, ecx
mov word [ebp - 0x1b8], cx
xor edx, edx
mov word [ebp - 0x2c], dx
push edx
and edx, 0x1733a
jmp 0x10003338
call 0x10003346
add byte [ecx], bh
inc eax
xor ecx, dword [edx + 0x46]
dec esi
aas
add esp, 4
and edx, 0xcd30
pop edx
push edx
xor edx, 0x15d85
xor edx, 0x1293
pop edx
mov eax, dword [ebp - 0xc40]
mov cx, word [eax]
mov word [ebp - 0xfc2], cx
mov edx, dword [ebp - 0xc40]
add edx, 2
mov dword [ebp - 0xc40], edx
mov ax, word [ebp - 0xfc2]
mov word [ebp - 0x1b8], ax
mov ecx, dword [ebp - 0xc44]
jmp dword [esi - 0x75]
adc dword [esi - 0x77], esp
xchg ebp, eax
cmp al, 0xf0
invalid
dec dword [ebx - 0xc437b]
inc dword [ebx - 0x7a76fd40]
mov esp, 0x66fffff3
mov ecx, dword [ebp - 0xfc4]
mov word [ebp - 0x2c], cx
push ecx
call 0x100033c5
add byte [edx], dh
aas
inc ebx
aaa
dec edi
inc ecx
inc eax
aas
xor eax, 0xe804c483
or byte [eax], al
add byte [eax], al
add byte [ecx + 0x32], al
xor al, 0x4b
dec ebx
inc edx
dec esp
add esp, 4
xor ecx, 0x10d30
pop ecx
push esi
or esi, 0x1be5
pop esi
movzx edx, word [ebp - 0x2c]
test edx, edx
jne 0x10003404
movzx eax, word [ebp - 0x1b8]
movzx ecx, word [ebp - 0x2c]
sub eax, ecx
mov dword [ebp - 0x1548], eax
jmp 0x1000345e
movzx edx, word [ebp - 0x1b8]
movzx eax, word [ebp - 0x2c]
cmp edx, eax
je 0x1000332c
movzx ecx, word [ebp - 0x1b8]
xor ecx, 0x20
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
je 0x1000332c
movzx eax, word [ebp - 0x1b8]
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
jge 0x10003448
mov dword [ebp - 0x1544], 0xffffffff
jmp 0x10003452
mov dword [ebp - 0x1544], 1
mov edx, dword [ebp - 0x1544]
mov dword [ebp - 0x1548], edx
cmp dword [ebp - 0x1548], 0
jne 0x100034a7
push edi
sub edi, 0x1f8b
add edi, 0xa0a2
pop edi
push esi
add esi, 0x2f48
jmp 0x10003484
or esi, 0x3a72
xor esi, 0x2ef
pop esi
push edx
add edx, 0xbff8
pop edx
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x2a4], eax
jmp 0x1000350f
push esi
xor esi, 0x12043
call 0x100034bb
add byte [0x39463b4b], bh
inc edx
dec edi
add esp, 4
pop esi
push edi
add edi, 0x13457
pop edi
push ecx
push ecx
add esp, 4
add ecx, 0x4793
and ecx, 0x8fcd
pop ecx
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ecx]
mov dword [ebp - 0x4cc], edx
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0xc48]
je 0x10003505
mov ecx, dword [ebp - 0x4cc]
cmp dword [ecx + 0x30], 0
jne 0x100032d0
mov dword [ebp - 0x2a4], 0
Function at 0x100033c5
Capabilities:
Get number of processors

Disassembly:
add byte [edx + 0x50], bl
jmp 0x10003288
pop eax
push ebx
jmp 0x10003291
sub ebx, 0x977f
and ebx, 0xceff
and ebx, 0x135eb
pop ebx
push edi
sub edi, 0x16399
pop edi
cmp dword [ebp - 0xc48], 0
jne 0x100032c4
mov dword [ebp - 0x2a4], 0
jmp 0x1000350f
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0x4cc], eax
push edi
push eax
add esp, 4
sub edi, 0xd5e1
and edi, 0x10fee
sub edi, 0xd5a8
pop edi
push ecx
sub ecx, 0xea3d
add ecx, 0x155eb
and ecx, 0x157e3
xor ecx, 0x8162
pop ecx
lea ecx, [ebp - 0x15cc]
mov dword [ebp - 0xc44], ecx
mov edx, dword [ebp - 0x4cc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc40], eax
xor ecx, ecx
mov word [ebp - 0x1b8], cx
xor edx, edx
mov word [ebp - 0x2c], dx
push edx
and edx, 0x1733a
jmp 0x10003338
call 0x10003346
add byte [ecx], bh
inc eax
xor ecx, dword [edx + 0x46]
dec esi
aas
add esp, 4
and edx, 0xcd30
pop edx
push edx
xor edx, 0x15d85
xor edx, 0x1293
pop edx
mov eax, dword [ebp - 0xc40]
mov cx, word [eax]
mov word [ebp - 0xfc2], cx
mov edx, dword [ebp - 0xc40]
add edx, 2
mov dword [ebp - 0xc40], edx
mov ax, word [ebp - 0xfc2]
mov word [ebp - 0x1b8], ax
mov ecx, dword [ebp - 0xc44]
jmp dword [esi - 0x75]
adc dword [esi - 0x77], esp
xchg ebp, eax
cmp al, 0xf0
invalid
dec dword [ebx - 0xc437b]
inc dword [ebx - 0x7a76fd40]
mov esp, 0x66fffff3
mov ecx, dword [ebp - 0xfc4]
mov word [ebp - 0x2c], cx
push ecx
call 0x100033c5
add byte [edx], dh
aas
inc ebx
aaa
dec edi
inc ecx
inc eax
aas
xor eax, 0xe804c483
or byte [eax], al
add byte [eax], al
add byte [ecx + 0x32], al
xor al, 0x4b
dec ebx
inc edx
dec esp
add esp, 4
xor ecx, 0x10d30
pop ecx
push esi
or esi, 0x1be5
pop esi
movzx edx, word [ebp - 0x2c]
test edx, edx
jne 0x10003404
movzx eax, word [ebp - 0x1b8]
movzx ecx, word [ebp - 0x2c]
sub eax, ecx
mov dword [ebp - 0x1548], eax
jmp 0x1000345e
movzx edx, word [ebp - 0x1b8]
movzx eax, word [ebp - 0x2c]
cmp edx, eax
je 0x1000332c
movzx ecx, word [ebp - 0x1b8]
xor ecx, 0x20
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
je 0x1000332c
movzx eax, word [ebp - 0x1b8]
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
jge 0x10003448
mov dword [ebp - 0x1544], 0xffffffff
jmp 0x10003452
mov dword [ebp - 0x1544], 1
mov edx, dword [ebp - 0x1544]
mov dword [ebp - 0x1548], edx
cmp dword [ebp - 0x1548], 0
jne 0x100034a7
push edi
sub edi, 0x1f8b
add edi, 0xa0a2
pop edi
push esi
add esi, 0x2f48
jmp 0x10003484
or esi, 0x3a72
xor esi, 0x2ef
pop esi
push edx
add edx, 0xbff8
pop edx
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x2a4], eax
jmp 0x1000350f
push esi
xor esi, 0x12043
call 0x100034bb
add byte [0x39463b4b], bh
inc edx
dec edi
add esp, 4
pop esi
push edi
add edi, 0x13457
pop edi
push ecx
push ecx
add esp, 4
add ecx, 0x4793
and ecx, 0x8fcd
pop ecx
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ecx]
mov dword [ebp - 0x4cc], edx
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0xc48]
je 0x10003505
mov ecx, dword [ebp - 0x4cc]
cmp dword [ecx + 0x30], 0
jne 0x100032d0
mov dword [ebp - 0x2a4], 0
Function at 0x100033d5
Capabilities:
Get number of processors

Disassembly:
add byte [edx + 0x50], bl
jmp 0x10003288
pop eax
push ebx
jmp 0x10003291
sub ebx, 0x977f
and ebx, 0xceff
and ebx, 0x135eb
pop ebx
push edi
sub edi, 0x16399
pop edi
cmp dword [ebp - 0xc48], 0
jne 0x100032c4
mov dword [ebp - 0x2a4], 0
jmp 0x1000350f
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0x4cc], eax
push edi
push eax
add esp, 4
sub edi, 0xd5e1
and edi, 0x10fee
sub edi, 0xd5a8
pop edi
push ecx
sub ecx, 0xea3d
add ecx, 0x155eb
and ecx, 0x157e3
xor ecx, 0x8162
pop ecx
lea ecx, [ebp - 0x15cc]
mov dword [ebp - 0xc44], ecx
mov edx, dword [ebp - 0x4cc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc40], eax
xor ecx, ecx
mov word [ebp - 0x1b8], cx
xor edx, edx
mov word [ebp - 0x2c], dx
push edx
and edx, 0x1733a
jmp 0x10003338
call 0x10003346
add byte [ecx], bh
inc eax
xor ecx, dword [edx + 0x46]
dec esi
aas
add esp, 4
and edx, 0xcd30
pop edx
push edx
xor edx, 0x15d85
xor edx, 0x1293
pop edx
mov eax, dword [ebp - 0xc40]
mov cx, word [eax]
mov word [ebp - 0xfc2], cx
mov edx, dword [ebp - 0xc40]
add edx, 2
mov dword [ebp - 0xc40], edx
mov ax, word [ebp - 0xfc2]
mov word [ebp - 0x1b8], ax
mov ecx, dword [ebp - 0xc44]
jmp dword [esi - 0x75]
adc dword [esi - 0x77], esp
xchg ebp, eax
cmp al, 0xf0
invalid
dec dword [ebx - 0xc437b]
inc dword [ebx - 0x7a76fd40]
mov esp, 0x66fffff3
mov ecx, dword [ebp - 0xfc4]
mov word [ebp - 0x2c], cx
push ecx
call 0x100033c5
add byte [edx], dh
aas
inc ebx
aaa
dec edi
inc ecx
inc eax
aas
xor eax, 0xe804c483
or byte [eax], al
add byte [eax], al
add byte [ecx + 0x32], al
xor al, 0x4b
dec ebx
inc edx
dec esp
add esp, 4
xor ecx, 0x10d30
pop ecx
push esi
or esi, 0x1be5
pop esi
movzx edx, word [ebp - 0x2c]
test edx, edx
jne 0x10003404
movzx eax, word [ebp - 0x1b8]
movzx ecx, word [ebp - 0x2c]
sub eax, ecx
mov dword [ebp - 0x1548], eax
jmp 0x1000345e
movzx edx, word [ebp - 0x1b8]
movzx eax, word [ebp - 0x2c]
cmp edx, eax
je 0x1000332c
movzx ecx, word [ebp - 0x1b8]
xor ecx, 0x20
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
je 0x1000332c
movzx eax, word [ebp - 0x1b8]
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
jge 0x10003448
mov dword [ebp - 0x1544], 0xffffffff
jmp 0x10003452
mov dword [ebp - 0x1544], 1
mov edx, dword [ebp - 0x1544]
mov dword [ebp - 0x1548], edx
cmp dword [ebp - 0x1548], 0
jne 0x100034a7
push edi
sub edi, 0x1f8b
add edi, 0xa0a2
pop edi
push esi
add esi, 0x2f48
jmp 0x10003484
or esi, 0x3a72
xor esi, 0x2ef
pop esi
push edx
add edx, 0xbff8
pop edx
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x2a4], eax
jmp 0x1000350f
push esi
xor esi, 0x12043
call 0x100034bb
add byte [0x39463b4b], bh
inc edx
dec edi
add esp, 4
pop esi
push edi
add edi, 0x13457
pop edi
push ecx
push ecx
add esp, 4
add ecx, 0x4793
and ecx, 0x8fcd
pop ecx
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ecx]
mov dword [ebp - 0x4cc], edx
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0xc48]
je 0x10003505
mov ecx, dword [ebp - 0x4cc]
cmp dword [ecx + 0x30], 0
jne 0x100032d0
mov dword [ebp - 0x2a4], 0
Function at 0x100034bb
Capabilities:
Get number of processors

Disassembly:
add byte [edx + 0x50], bl
jmp 0x10003288
pop eax
push ebx
jmp 0x10003291
sub ebx, 0x977f
and ebx, 0xceff
and ebx, 0x135eb
pop ebx
push edi
sub edi, 0x16399
pop edi
cmp dword [ebp - 0xc48], 0
jne 0x100032c4
mov dword [ebp - 0x2a4], 0
jmp 0x1000350f
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0x4cc], eax
push edi
push eax
add esp, 4
sub edi, 0xd5e1
and edi, 0x10fee
sub edi, 0xd5a8
pop edi
push ecx
sub ecx, 0xea3d
add ecx, 0x155eb
and ecx, 0x157e3
xor ecx, 0x8162
pop ecx
lea ecx, [ebp - 0x15cc]
mov dword [ebp - 0xc44], ecx
mov edx, dword [ebp - 0x4cc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc40], eax
xor ecx, ecx
mov word [ebp - 0x1b8], cx
xor edx, edx
mov word [ebp - 0x2c], dx
push edx
and edx, 0x1733a
jmp 0x10003338
call 0x10003346
add byte [ecx], bh
inc eax
xor ecx, dword [edx + 0x46]
dec esi
aas
add esp, 4
and edx, 0xcd30
pop edx
push edx
xor edx, 0x15d85
xor edx, 0x1293
pop edx
mov eax, dword [ebp - 0xc40]
mov cx, word [eax]
mov word [ebp - 0xfc2], cx
mov edx, dword [ebp - 0xc40]
add edx, 2
mov dword [ebp - 0xc40], edx
mov ax, word [ebp - 0xfc2]
mov word [ebp - 0x1b8], ax
mov ecx, dword [ebp - 0xc44]
jmp dword [esi - 0x75]
adc dword [esi - 0x77], esp
xchg ebp, eax
cmp al, 0xf0
invalid
dec dword [ebx - 0xc437b]
inc dword [ebx - 0x7a76fd40]
mov esp, 0x66fffff3
mov ecx, dword [ebp - 0xfc4]
mov word [ebp - 0x2c], cx
push ecx
call 0x100033c5
add byte [edx], dh
aas
inc ebx
aaa
dec edi
inc ecx
inc eax
aas
xor eax, 0xe804c483
or byte [eax], al
add byte [eax], al
add byte [ecx + 0x32], al
xor al, 0x4b
dec ebx
inc edx
dec esp
add esp, 4
xor ecx, 0x10d30
pop ecx
push esi
or esi, 0x1be5
pop esi
movzx edx, word [ebp - 0x2c]
test edx, edx
jne 0x10003404
movzx eax, word [ebp - 0x1b8]
movzx ecx, word [ebp - 0x2c]
sub eax, ecx
mov dword [ebp - 0x1548], eax
jmp 0x1000345e
movzx edx, word [ebp - 0x1b8]
movzx eax, word [ebp - 0x2c]
cmp edx, eax
je 0x1000332c
movzx ecx, word [ebp - 0x1b8]
xor ecx, 0x20
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
je 0x1000332c
movzx eax, word [ebp - 0x1b8]
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
jge 0x10003448
mov dword [ebp - 0x1544], 0xffffffff
jmp 0x10003452
mov dword [ebp - 0x1544], 1
mov edx, dword [ebp - 0x1544]
mov dword [ebp - 0x1548], edx
cmp dword [ebp - 0x1548], 0
jne 0x100034a7
push edi
sub edi, 0x1f8b
add edi, 0xa0a2
pop edi
push esi
add esi, 0x2f48
jmp 0x10003484
or esi, 0x3a72
xor esi, 0x2ef
pop esi
push edx
add edx, 0xbff8
pop edx
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x2a4], eax
jmp 0x1000350f
push esi
xor esi, 0x12043
call 0x100034bb
add byte [0x39463b4b], bh
inc edx
dec edi
add esp, 4
pop esi
push edi
add edi, 0x13457
pop edi
push ecx
push ecx
add esp, 4
add ecx, 0x4793
and ecx, 0x8fcd
pop ecx
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ecx]
mov dword [ebp - 0x4cc], edx
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0xc48]
je 0x10003505
mov ecx, dword [ebp - 0x4cc]
cmp dword [ecx + 0x30], 0
jne 0x100032d0
mov dword [ebp - 0x2a4], 0
Function at 0x10003a24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
cmp dword [ebp - 0x74c], 0
jne 0x10003a08
push ebx
push edx
add esp, 4
and ebx, 0x8027
pop ebx
push edx
push edi
add esp, 4
xor edx, 0x3c75
add edx, 0x13e6f
xor edx, 0xaa
or edx, 0x4eba
pop edx
push ebx
or ebx, 0x13a50
pop ebx
mov dword [ebp - 0xa44], 0
jmp fcn.1000452f
push eax
or eax, 0xf9ba
add eax, 0x1359e
pop eax
push edx
call 0x10003a24
add byte [edi], bh
aaa
inc edx
xor eax, 0xc4833d43
add al, 0x81
ret 0x2d75
Function at 0x10003fba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
add esp, 4
xor ecx, 0x181b9
and ecx, 0x154ed
jmp 0x10003f67
xor ecx, 0x17426
pop ecx
push esi
and esi, 0x392e
add esi, 0x14bd9
and esi, 0xb471
pop esi
lea edx, [ebp - 0x15cc]
mov dword [ebp - 0xc60], edx
mov eax, dword [ebp - 0x4d4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc5c], ecx
xor edx, edx
mov word [ebp - 0x1c0], dx
xor eax, eax
mov word [ebp - 0x34], ax
push esi
call fcn.10003fba
add byte [eax], al
add byte [esi + edi + 0x3f], cl
dec edi
inc edi
aaa
inc esi
add esp, 4
or esi, 0x102f6
jmp 0x10003fc9
xor esi, 0x1744c
pop esi
push edi
sub edi, 0x80ff
or edi, 0x16c09
pop edi
mov ecx, dword [ebp - 0xc5c]
mov dx, word [ecx]
mov word [ebp - 0xfca], dx
mov eax, dword [ebp - 0xc5c]
add eax, 2
mov dword [ebp - 0xc5c], eax
mov cx, word [ebp - 0xfca]
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xfcc], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xfcc]
mov word [ebp - 0x34], dx
push edi
push eax
add esp, 4
xor edi, 0x364d
add edi, 0x12de3
or edi, 0x17dd9
add edi, 0x10d79
add dword [eax], eax
pop edi
push edx
sub edx, 0x17bb
xor edx, 0xbf65
add edx, 0x5602
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x10004084
movzx ecx, word [ebp - 0x1c0]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x156c], ecx
jmp 0x100040de
movzx eax, word [ebp - 0x1c0]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x10003fac
movzx edx, word [ebp - 0x1c0]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x10003fac
movzx ecx, word [ebp - 0x1c0]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x100040c8
mov dword [ebp - 0x1568], 0xffffffff
jmp 0x100040d2
mov dword [ebp - 0x1568], 1
mov eax, dword [ebp - 0x1568]
mov dword [ebp - 0x156c], eax
cmp dword [ebp - 0x156c], 0
jne 0x10004127
push eax
push ecx
add esp, 4
jmp 0x100040f4
or eax, 0x17e50
pop eax
push ebx
push edi
add esp, 4
or ebx, 0xdca6
pop ebx
push ecx
call 0x10004115
add byte [esi + 0x3a], al
inc ebx
inc esp
inc ebp
cmp esi, dword [ebx + eax*4]
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0x4d4]
mov dword [ebp - 0x2a4], ecx
jmp 0x1000418f
push ecx
push esi
add esp, 4
sub ecx, 0xa573
or ecx, 0x83cd
and ecx, 0xa3c8
pop ecx
push edi
push edi
add esp, 4
sub edi, 0xdb79
sub edi, 0xa4fd
pop edi
push eax
xor eax, 0x15e
pop eax
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx]
mov dword [ebp - 0x4d4], eax
mov ecx, dword [ebp - 0x4d4]
cmp ecx, dword [ebp - 0xc64]
je 0x10004185
mov edx, dword [ebp - 0x4d4]
cmp dword [edx + 0x30], 0
jne method.ATL::CAtlStringMgr.virtual_8
mov dword [ebp - 0x2a4], 0
Function at 0x10004115
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
add esp, 4
xor ecx, 0x181b9
and ecx, 0x154ed
jmp 0x10003f67
xor ecx, 0x17426
pop ecx
push esi
and esi, 0x392e
add esi, 0x14bd9
and esi, 0xb471
pop esi
lea edx, [ebp - 0x15cc]
mov dword [ebp - 0xc60], edx
mov eax, dword [ebp - 0x4d4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc5c], ecx
xor edx, edx
mov word [ebp - 0x1c0], dx
xor eax, eax
mov word [ebp - 0x34], ax
push esi
call fcn.10003fba
add byte [eax], al
add byte [esi + edi + 0x3f], cl
dec edi
inc edi
aaa
inc esi
add esp, 4
or esi, 0x102f6
jmp 0x10003fc9
xor esi, 0x1744c
pop esi
push edi
sub edi, 0x80ff
or edi, 0x16c09
pop edi
mov ecx, dword [ebp - 0xc5c]
mov dx, word [ecx]
mov word [ebp - 0xfca], dx
mov eax, dword [ebp - 0xc5c]
add eax, 2
mov dword [ebp - 0xc5c], eax
mov cx, word [ebp - 0xfca]
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xfcc], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xfcc]
mov word [ebp - 0x34], dx
push edi
push eax
add esp, 4
xor edi, 0x364d
add edi, 0x12de3
or edi, 0x17dd9
add edi, 0x10d79
add dword [eax], eax
pop edi
push edx
sub edx, 0x17bb
xor edx, 0xbf65
add edx, 0x5602
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x10004084
movzx ecx, word [ebp - 0x1c0]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x156c], ecx
jmp 0x100040de
movzx eax, word [ebp - 0x1c0]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x10003fac
movzx edx, word [ebp - 0x1c0]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x10003fac
movzx ecx, word [ebp - 0x1c0]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x100040c8
mov dword [ebp - 0x1568], 0xffffffff
jmp 0x100040d2
mov dword [ebp - 0x1568], 1
mov eax, dword [ebp - 0x1568]
mov dword [ebp - 0x156c], eax
cmp dword [ebp - 0x156c], 0
jne 0x10004127
push eax
push ecx
add esp, 4
jmp 0x100040f4
or eax, 0x17e50
pop eax
push ebx
push edi
add esp, 4
or ebx, 0xdca6
pop ebx
push ecx
call 0x10004115
add byte [esi + 0x3a], al
inc ebx
inc esp
inc ebp
cmp esi, dword [ebx + eax*4]
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0x4d4]
mov dword [ebp - 0x2a4], ecx
jmp 0x1000418f
push ecx
push esi
add esp, 4
sub ecx, 0xa573
or ecx, 0x83cd
and ecx, 0xa3c8
pop ecx
push edi
push edi
add esp, 4
sub edi, 0xdb79
sub edi, 0xa4fd
pop edi
push eax
xor eax, 0x15e
pop eax
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx]
mov dword [ebp - 0x4d4], eax
mov ecx, dword [ebp - 0x4d4]
cmp ecx, dword [ebp - 0xc64]
je 0x10004185
mov edx, dword [ebp - 0x4d4]
cmp dword [edx + 0x30], 0
jne method.ATL::CAtlStringMgr.virtual_8
mov dword [ebp - 0x2a4], 0