joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4862e9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
or edi, 0x2323
pop edi
push esi
push eax
add esp, 4
sub esi, 0x4a19
pop esi
push ecx
add ecx, 0x20e2
xor ecx, 0x8d1b
and ecx, 0xc010
sub ecx, 0x1db5
pop ecx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push esi
xor esi, 0x4315
call fcn.004862d6
add byte [esi + 0x4a], al
aaa
cmp eax, 0xc4835044
add esp, 4
pop esi
add esp, 4
pop esi
push edx
call 0x4862e9
add byte [edi + ecx*2 + 0x4d], cl
dec esp
dec esi
xor cl, byte [edx + 0x41]
add esp, 4
jmp 0x4862f4
pop edx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push ebx
or ebx, 0x7d58
jmp 0x486358
call 0x486368
add byte [esp + eax*2 + 0x33], cl
cmp al, 0x4b
xor al, 0x32
inc ecx
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0x81
jecxz 0x48634d
loopne 0x486370
add byte [ebx + 0x56], bl
push edx
add esp, 4
xor esi, 0x4c45
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x48639b
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x4863f5
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x4862c3
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x4862c3
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x4863df
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x4863e9
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x48643e
push edi
sub edi, 0xdc24
add edi, 0x7387
xor edi, 0x428b
pop edi
push esi
call 0x486421
add byte [0x40383637], dh
xor edi, dword [0x4c48350]
add esi, 0x11582
jmp 0x48642f
pop esi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x4864a6
push esi
push ebx
add esp, 4
or esi, 0x143e1
pop esi
push esi
push ebx
add esp, 4
xor esi, 0x5421
call 0x486463
add byte [esi], bh
inc esp
cmp al, 0x42
cmp al, byte [edi + eax*2 + 0x45]
add esp, 4
jmp 0x48646f
pop esi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x48649c
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x486267
mov dword [ebp - 0x2a8], 0
Function at 0x486368
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
or edi, 0x2323
pop edi
push esi
push eax
add esp, 4
sub esi, 0x4a19
pop esi
push ecx
add ecx, 0x20e2
xor ecx, 0x8d1b
and ecx, 0xc010
sub ecx, 0x1db5
pop ecx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push esi
xor esi, 0x4315
call fcn.004862d6
add byte [esi + 0x4a], al
aaa
cmp eax, 0xc4835044
add esp, 4
pop esi
add esp, 4
pop esi
push edx
call 0x4862e9
add byte [edi + ecx*2 + 0x4d], cl
dec esp
dec esi
xor cl, byte [edx + 0x41]
add esp, 4
jmp 0x4862f4
pop edx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push ebx
or ebx, 0x7d58
jmp 0x486358
call 0x486368
add byte [esp + eax*2 + 0x33], cl
cmp al, 0x4b
xor al, 0x32
inc ecx
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0x81
jecxz 0x48634d
loopne 0x486370
add byte [ebx + 0x56], bl
push edx
add esp, 4
xor esi, 0x4c45
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x48639b
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x4863f5
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x4862c3
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x4862c3
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x4863df
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x4863e9
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x48643e
push edi
sub edi, 0xdc24
add edi, 0x7387
xor edi, 0x428b
pop edi
push esi
call 0x486421
add byte [0x40383637], dh
xor edi, dword [0x4c48350]
add esi, 0x11582
jmp 0x48642f
pop esi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x4864a6
push esi
push ebx
add esp, 4
or esi, 0x143e1
pop esi
push esi
push ebx
add esp, 4
xor esi, 0x5421
call 0x486463
add byte [esi], bh
inc esp
cmp al, 0x42
cmp al, byte [edi + eax*2 + 0x45]
add esp, 4
jmp 0x48646f
pop esi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x48649c
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x486267
mov dword [ebp - 0x2a8], 0
Function at 0x486421
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
or edi, 0x2323
pop edi
push esi
push eax
add esp, 4
sub esi, 0x4a19
pop esi
push ecx
add ecx, 0x20e2
xor ecx, 0x8d1b
and ecx, 0xc010
sub ecx, 0x1db5
pop ecx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push esi
xor esi, 0x4315
call fcn.004862d6
add byte [esi + 0x4a], al
aaa
cmp eax, 0xc4835044
add esp, 4
pop esi
add esp, 4
pop esi
push edx
call 0x4862e9
add byte [edi + ecx*2 + 0x4d], cl
dec esp
dec esi
xor cl, byte [edx + 0x41]
add esp, 4
jmp 0x4862f4
pop edx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push ebx
or ebx, 0x7d58
jmp 0x486358
call 0x486368
add byte [esp + eax*2 + 0x33], cl
cmp al, 0x4b
xor al, 0x32
inc ecx
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0x81
jecxz 0x48634d
loopne 0x486370
add byte [ebx + 0x56], bl
push edx
add esp, 4
xor esi, 0x4c45
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x48639b
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x4863f5
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x4862c3
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x4862c3
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x4863df
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x4863e9
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x48643e
push edi
sub edi, 0xdc24
add edi, 0x7387
xor edi, 0x428b
pop edi
push esi
call 0x486421
add byte [0x40383637], dh
xor edi, dword [0x4c48350]
add esi, 0x11582
jmp 0x48642f
pop esi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x4864a6
push esi
push ebx
add esp, 4
or esi, 0x143e1
pop esi
push esi
push ebx
add esp, 4
xor esi, 0x5421
call 0x486463
add byte [esi], bh
inc esp
cmp al, 0x42
cmp al, byte [edi + eax*2 + 0x45]
add esp, 4
jmp 0x48646f
pop esi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x48649c
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x486267
mov dword [ebp - 0x2a8], 0
Function at 0x486463
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
or edi, 0x2323
pop edi
push esi
push eax
add esp, 4
sub esi, 0x4a19
pop esi
push ecx
add ecx, 0x20e2
xor ecx, 0x8d1b
and ecx, 0xc010
sub ecx, 0x1db5
pop ecx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push esi
xor esi, 0x4315
call fcn.004862d6
add byte [esi + 0x4a], al
aaa
cmp eax, 0xc4835044
add esp, 4
pop esi
add esp, 4
pop esi
push edx
call 0x4862e9
add byte [edi + ecx*2 + 0x4d], cl
dec esp
dec esi
xor cl, byte [edx + 0x41]
add esp, 4
jmp 0x4862f4
pop edx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push ebx
or ebx, 0x7d58
jmp 0x486358
call 0x486368
add byte [esp + eax*2 + 0x33], cl
cmp al, 0x4b
xor al, 0x32
inc ecx
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0x81
jecxz 0x48634d
loopne 0x486370
add byte [ebx + 0x56], bl
push edx
add esp, 4
xor esi, 0x4c45
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x48639b
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x4863f5
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x4862c3
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x4862c3
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x4863df
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x4863e9
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x48643e
push edi
sub edi, 0xdc24
add edi, 0x7387
xor edi, 0x428b
pop edi
push esi
call 0x486421
add byte [0x40383637], dh
xor edi, dword [0x4c48350]
add esi, 0x11582
jmp 0x48642f
pop esi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x4864a6
push esi
push ebx
add esp, 4
or esi, 0x143e1
pop esi
push esi
push ebx
add esp, 4
xor esi, 0x5421
call 0x486463
add byte [esi], bh
inc esp
cmp al, 0x42
cmp al, byte [edi + eax*2 + 0x45]
add esp, 4
jmp 0x48646f
pop esi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x48649c
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x486267
mov dword [ebp - 0x2a8], 0
Function at 0x486f73
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
and edi, 0xabf3
add edi, 0x16e15
pop edi
push edx
push esi
add esp, 4
and edx, 0x1342
sub edx, 0xc85a
pop edx
push edx
xor edx, 0xc859
or edx, 0x2361
pop edx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
xor edx, 0xbc7d
jmp 0x486f51
or edx, 0xd638
add edx, 0x1616b
pop edx
push esi
push ebx
add esp, 4
call fcn.00486f73
add byte [edx], dh
inc esi
cmp dword [edx + 0x38], ecx
xor dh, byte [esi]
dec esi
inc esi
aaa
add esp, 4
pop esi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
jmp 0x486fd4
and eax, 0x1454b
pop eax
push ecx
push ecx
add esp, 4
add ecx, 0x2472
xor ecx, 0xb87d
call 0x486ffc
add byte [edx + 0x3c], al
cmp ecx, dword [ecx + 0x45]
cmp byte [ebx], dh
dec ebx
xor cl, byte [esi - 0x7d]
les eax, [ecx + ebx*2]
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x48701d
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x487077
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x486f45
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x486f45
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x487061
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x48706b
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x4870c0
push ebx
push ecx
add esp, 4
jmp 0x48708d
pop ebx
push ecx
add ecx, 0x9d2b
call 0x4870a2
add byte [edx + 0x39], al
inc edx
dec esp
cmp dword [ebx], edi
dec esp
add esp, 4
and ecx, 0x8181
sub ecx, 0x46a5
pop ecx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x487128
push ecx
jmp 0x4870c9
pop ecx
push edi
call 0x4870d8
add byte [ecx + 0x4a], cl
inc eax
xor al, 0x4a
push eax
push eax
add esp, 4
call 0x4870e8
add byte [ebx], bh
cmp byte [ebx], dh
inc edx
inc ecx
xor bh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
idiv dword [ebx + 0x5f000171]
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x48711e
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x486ee9
mov dword [ebp - 0x2a8], 0
Function at 0x486ffc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
and edi, 0xabf3
add edi, 0x16e15
pop edi
push edx
push esi
add esp, 4
and edx, 0x1342
sub edx, 0xc85a
pop edx
push edx
xor edx, 0xc859
or edx, 0x2361
pop edx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
xor edx, 0xbc7d
jmp 0x486f51
or edx, 0xd638
add edx, 0x1616b
pop edx
push esi
push ebx
add esp, 4
call fcn.00486f73
add byte [edx], dh
inc esi
cmp dword [edx + 0x38], ecx
xor dh, byte [esi]
dec esi
inc esi
aaa
add esp, 4
pop esi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
jmp 0x486fd4
and eax, 0x1454b
pop eax
push ecx
push ecx
add esp, 4
add ecx, 0x2472
xor ecx, 0xb87d
call 0x486ffc
add byte [edx + 0x3c], al
cmp ecx, dword [ecx + 0x45]
cmp byte [ebx], dh
dec ebx
xor cl, byte [esi - 0x7d]
les eax, [ecx + ebx*2]
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x48701d
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x487077
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x486f45
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x486f45
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x487061
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x48706b
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x4870c0
push ebx
push ecx
add esp, 4
jmp 0x48708d
pop ebx
push ecx
add ecx, 0x9d2b
call 0x4870a2
add byte [edx + 0x39], al
inc edx
dec esp
cmp dword [ebx], edi
dec esp
add esp, 4
and ecx, 0x8181
sub ecx, 0x46a5
pop ecx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x487128
push ecx
jmp 0x4870c9
pop ecx
push edi
call 0x4870d8
add byte [ecx + 0x4a], cl
inc eax
xor al, 0x4a
push eax
push eax
add esp, 4
call 0x4870e8
add byte [ebx], bh
cmp byte [ebx], dh
inc edx
inc ecx
xor bh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
idiv dword [ebx + 0x5f000171]
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x48711e
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x486ee9
mov dword [ebp - 0x2a8], 0
Function at 0x4870a2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
and edi, 0xabf3
add edi, 0x16e15
pop edi
push edx
push esi
add esp, 4
and edx, 0x1342
sub edx, 0xc85a
pop edx
push edx
xor edx, 0xc859
or edx, 0x2361
pop edx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
xor edx, 0xbc7d
jmp 0x486f51
or edx, 0xd638
add edx, 0x1616b
pop edx
push esi
push ebx
add esp, 4
call fcn.00486f73
add byte [edx], dh
inc esi
cmp dword [edx + 0x38], ecx
xor dh, byte [esi]
dec esi
inc esi
aaa
add esp, 4
pop esi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
jmp 0x486fd4
and eax, 0x1454b
pop eax
push ecx
push ecx
add esp, 4
add ecx, 0x2472
xor ecx, 0xb87d
call 0x486ffc
add byte [edx + 0x3c], al
cmp ecx, dword [ecx + 0x45]
cmp byte [ebx], dh
dec ebx
xor cl, byte [esi - 0x7d]
les eax, [ecx + ebx*2]
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x48701d
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x487077
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x486f45
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x486f45
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x487061
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x48706b
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x4870c0
push ebx
push ecx
add esp, 4
jmp 0x48708d
pop ebx
push ecx
add ecx, 0x9d2b
call 0x4870a2
add byte [edx + 0x39], al
inc edx
dec esp
cmp dword [ebx], edi
dec esp
add esp, 4
and ecx, 0x8181
sub ecx, 0x46a5
pop ecx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x487128
push ecx
jmp 0x4870c9
pop ecx
push edi
call 0x4870d8
add byte [ecx + 0x4a], cl
inc eax
xor al, 0x4a
push eax
push eax
add esp, 4
call 0x4870e8
add byte [ebx], bh
cmp byte [ebx], dh
inc edx
inc ecx
xor bh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
idiv dword [ebx + 0x5f000171]
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x48711e
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x486ee9
mov dword [ebp - 0x2a8], 0
Function at 0x4870d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
and edi, 0xabf3
add edi, 0x16e15
pop edi
push edx
push esi
add esp, 4
and edx, 0x1342
sub edx, 0xc85a
pop edx
push edx
xor edx, 0xc859
or edx, 0x2361
pop edx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
xor edx, 0xbc7d
jmp 0x486f51
or edx, 0xd638
add edx, 0x1616b
pop edx
push esi
push ebx
add esp, 4
call fcn.00486f73
add byte [edx], dh
inc esi
cmp dword [edx + 0x38], ecx
xor dh, byte [esi]
dec esi
inc esi
aaa
add esp, 4
pop esi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
jmp 0x486fd4
and eax, 0x1454b
pop eax
push ecx
push ecx
add esp, 4
add ecx, 0x2472
xor ecx, 0xb87d
call 0x486ffc
add byte [edx + 0x3c], al
cmp ecx, dword [ecx + 0x45]
cmp byte [ebx], dh
dec ebx
xor cl, byte [esi - 0x7d]
les eax, [ecx + ebx*2]
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x48701d
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x487077
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x486f45
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x486f45
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x487061
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x48706b
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x4870c0
push ebx
push ecx
add esp, 4
jmp 0x48708d
pop ebx
push ecx
add ecx, 0x9d2b
call 0x4870a2
add byte [edx + 0x39], al
inc edx
dec esp
cmp dword [ebx], edi
dec esp
add esp, 4
and ecx, 0x8181
sub ecx, 0x46a5
pop ecx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x487128
push ecx
jmp 0x4870c9
pop ecx
push edi
call 0x4870d8
add byte [ecx + 0x4a], cl
inc eax
xor al, 0x4a
push eax
push eax
add esp, 4
call 0x4870e8
add byte [ebx], bh
cmp byte [ebx], dh
inc edx
inc ecx
xor bh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
idiv dword [ebx + 0x5f000171]
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x48711e
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x486ee9
mov dword [ebp - 0x2a8], 0