joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40348a
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub esi, 0xd8f7
add esi, 0x596e
pop esi
push ebx
and ebx, 0x19a8
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
add byte gs:[eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
sbb al, 0xe1
invalid
invalid
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edx
push edx
add esp, 4
add edx, 0x14e36
and edx, 0xd0aa
xor edx, 0x10cc
pop edx
push edx
add edx, 0x15ef4
add edx, 0x1391f
add edx, 0x11a2f
xor edx, 0x5fa8
pop edx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ecx
add ecx, 0x17606
call 0x403455
add byte [ecx], bh
inc edx
inc edx
inc edi
dec eax
xor cl, byte [edi - 0x7d]
les eax, [ecx + ebx*2]
push esi
add esi, 0x15f99
and esi, 0x148f9
pop esi
push eax
push edi
add esp, 4
xor eax, 0x47bb
pop eax
mov dword [ebp - 0x10], 1
push eax
call 0x40348a
add byte [eax + 0x44], al
dec eax
inc esp
inc esp
dec ebx
dec ebp
cmp byte [edi - 0x7d], al
les eax, [eax + ebx*2]
push esi
push edi
add esp, 4
or esi, 0x13238
xor esi, 0x73d1
pop esi
push ecx
push ebx
add esp, 4
xor ecx, 0xbc9f
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push edx
add esp, 4
and ecx, 0xe8a9
sub ecx, 0x986f
and ecx, 0x12f9f
pop ecx
push eax
push edx
add esp, 4
or eax, 0x14766
pop eax
push edx
xor edx, 0x7a8c
add edx, 0x11919
pop edx
push ebx
call 0x403518
add byte [eax + ecx*2], bh
aas
dec edx
dec ebp
aas
inc ecx
add esp, 4
pop ebx
push edx
xor edx, 0x7d39
jmp 0x40352b
call 0x403538
add byte [esi + 0x3b], cl
dec ebp
aas
cmp eax, 0x4c48340
pop edx
mov dword [ebp - 0x2c], 1
push ecx
push ecx
add esp, 4
sub ecx, 0xb0a6
xor ecx, 0x81d3
xor ecx, 0x80da
sub ecx, 0x13c
pop ecx
push esi
or esi, 0x60e0
add esi, 0x2fef
and esi, 0xb089
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
push ebp
aam 0x69
dec ebp
aam 0x38
add dword [eax], eax
add byte [ebx], ch
ror dword [ecx - 0x4c162fab], 1
add dword [eax], eax
invalid
Function at 0x403518
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub esi, 0xd8f7
add esi, 0x596e
pop esi
push ebx
and ebx, 0x19a8
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
add byte gs:[eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
sbb al, 0xe1
invalid
invalid
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edx
push edx
add esp, 4
add edx, 0x14e36
and edx, 0xd0aa
xor edx, 0x10cc
pop edx
push edx
add edx, 0x15ef4
add edx, 0x1391f
add edx, 0x11a2f
xor edx, 0x5fa8
pop edx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ecx
add ecx, 0x17606
call 0x403455
add byte [ecx], bh
inc edx
inc edx
inc edi
dec eax
xor cl, byte [edi - 0x7d]
les eax, [ecx + ebx*2]
push esi
add esi, 0x15f99
and esi, 0x148f9
pop esi
push eax
push edi
add esp, 4
xor eax, 0x47bb
pop eax
mov dword [ebp - 0x10], 1
push eax
call 0x40348a
add byte [eax + 0x44], al
dec eax
inc esp
inc esp
dec ebx
dec ebp
cmp byte [edi - 0x7d], al
les eax, [eax + ebx*2]
push esi
push edi
add esp, 4
or esi, 0x13238
xor esi, 0x73d1
pop esi
push ecx
push ebx
add esp, 4
xor ecx, 0xbc9f
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push edx
add esp, 4
and ecx, 0xe8a9
sub ecx, 0x986f
and ecx, 0x12f9f
pop ecx
push eax
push edx
add esp, 4
or eax, 0x14766
pop eax
push edx
xor edx, 0x7a8c
add edx, 0x11919
pop edx
push ebx
call 0x403518
add byte [eax + ecx*2], bh
aas
dec edx
dec ebp
aas
inc ecx
add esp, 4
pop ebx
push edx
xor edx, 0x7d39
jmp 0x40352b
call 0x403538
add byte [esi + 0x3b], cl
dec ebp
aas
cmp eax, 0x4c48340
pop edx
mov dword [ebp - 0x2c], 1
push ecx
push ecx
add esp, 4
sub ecx, 0xb0a6
xor ecx, 0x81d3
xor ecx, 0x80da
sub ecx, 0x13c
pop ecx
push esi
or esi, 0x60e0
add esi, 0x2fef
and esi, 0xb089
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
push ebp
aam 0x69
dec ebp
aam 0x38
add dword [eax], eax
add byte [ebx], ch
ror dword [ecx - 0x4c162fab], 1
add dword [eax], eax
invalid
Function at 0x403538
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub esi, 0xd8f7
add esi, 0x596e
pop esi
push ebx
and ebx, 0x19a8
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
add byte gs:[eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
sbb al, 0xe1
invalid
invalid
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edx
push edx
add esp, 4
add edx, 0x14e36
and edx, 0xd0aa
xor edx, 0x10cc
pop edx
push edx
add edx, 0x15ef4
add edx, 0x1391f
add edx, 0x11a2f
xor edx, 0x5fa8
pop edx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ecx
add ecx, 0x17606
call 0x403455
add byte [ecx], bh
inc edx
inc edx
inc edi
dec eax
xor cl, byte [edi - 0x7d]
les eax, [ecx + ebx*2]
push esi
add esi, 0x15f99
and esi, 0x148f9
pop esi
push eax
push edi
add esp, 4
xor eax, 0x47bb
pop eax
mov dword [ebp - 0x10], 1
push eax
call 0x40348a
add byte [eax + 0x44], al
dec eax
inc esp
inc esp
dec ebx
dec ebp
cmp byte [edi - 0x7d], al
les eax, [eax + ebx*2]
push esi
push edi
add esp, 4
or esi, 0x13238
xor esi, 0x73d1
pop esi
push ecx
push ebx
add esp, 4
xor ecx, 0xbc9f
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push edx
add esp, 4
and ecx, 0xe8a9
sub ecx, 0x986f
and ecx, 0x12f9f
pop ecx
push eax
push edx
add esp, 4
or eax, 0x14766
pop eax
push edx
xor edx, 0x7a8c
add edx, 0x11919
pop edx
push ebx
call 0x403518
add byte [eax + ecx*2], bh
aas
dec edx
dec ebp
aas
inc ecx
add esp, 4
pop ebx
push edx
xor edx, 0x7d39
jmp 0x40352b
call 0x403538
add byte [esi + 0x3b], cl
dec ebp
aas
cmp eax, 0x4c48340
pop edx
mov dword [ebp - 0x2c], 1
push ecx
push ecx
add esp, 4
sub ecx, 0xb0a6
xor ecx, 0x81d3
xor ecx, 0x80da
sub ecx, 0x13c
pop ecx
push esi
or esi, 0x60e0
add esi, 0x2fef
and esi, 0xb089
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
push ebp
aam 0x69
dec ebp
aam 0x38
add dword [eax], eax
add byte [ebx], ch
ror dword [ecx - 0x4c162fab], 1
add dword [eax], eax
invalid
Function at 0x406b8d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call dword [edx - 0x3a]
test dword [ecx - 0x4600000c], ecx
mov byte [ebp - 0xb76], 0x10
mov byte [ebp - 0xb75], 0x10
mov byte [ebp - 0xb74], 0x10
mov byte [ebp - 0xb73], 0x10
mov byte [ebp - 0xb72], 0x5a
push ecx
push ecx
add esp, 4
xor ecx, 0xd3d1
sub ecx, 0xccd6
pop ecx
push ebx
push esi
add esp, 4
and ebx, 0xa3ac
xor ebx, 0xb434
add ebx, 0x12696
pop ebx
push esi
xor esi, 0x6a1c
pop esi
mov byte [ebp - 0xb80], 0x52
mov byte [ebp - 0xb7f], 0xb9
mov byte [ebp - 0xb7e], 0x20
mov byte [ebp - 0xb7d], 0x20
mov byte [ebp - 0xb7c], 0x20
jmp dword [eax]
mov byte [ebp - 0xb7b], 0x20
mov byte [ebp - 0xb7a], 0x5a
push ecx
or ecx, 0xfe89
or ecx, 0x8812
pop ecx
push ecx
xor ecx, 0x56d8
int1
fcom dword [esi]
add byte [ecx + 0xed13c1], al
add byte [ecx + 0x50], bl
xor eax, 0x69b1
jmp 0x406acb
or eax, 0xc1b9
pop eax
mov dword [ebp - 0x1fa4], 0xe
push ebx
push ebx
add esp, 4
xor ebx, 0x3f73
xor ebx, 0x420e
pop ebx
push edx
xor edx, 0x2dbb
mov ebx, 0x5a00002d
push eax
push esi
add esp, 4
sub eax, 0xe100
add eax, 0x1127f
or eax, 0x14456
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb78]
mov dword [ebp - 0x14bc], eax
push ebx
push eax
add esp, 4
add ebx, 0x64fc
xor ebx, 0x67eb
pop ebx
push esi
push edx
add esp, 4
and esi, 0x274
pop esi
push edi
and edi, 0xc140
or edi, 0xa295
and edi, 0x4881
pop edi
mov dword [ebp - 0x1fa8], 0xffffffff
push esi
push esi
add esp, 4
add esi, 0x12837
or esi, 0x141a0
pop esi
push eax
push ecx
add esp, 4
sub eax, 0x992e
jmp 0x406b81
call 0x406b8d
add byte [edx], dh
inc edi
inc edx
inc ebx
xor eax, 0x4c48333
pop eax
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4cc], ecx
jmp 0x406bae
Function at 0x407110
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp eax, edx
je 0x407180
push edx
call 0x407123
add byte [eax], bh
xor bh, byte [edx]
inc ecx
push eax
dec edx
add esp, 4
call 0x407132
add byte [eax + eax*2], bh
xor edi, dword [edi]
dec esp
xor al, byte [ebx + 0x505a04c4]
and eax, 0x1418
pop eax
push eax
jmp 0x407145
pop eax
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x407168
mov dword [ebp - 0x14cc], 1
jmp 0x407172
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x4071e4
push ebx
push esi
add esp, 4
jmp 0x40718e
and ebx, 0x9dd1
call 0x4071a2
add byte [ecx + 0x44], cl
inc ecx
inc edi
inc eax
dec ebp
inc esi
inc esp
add esp, 4
pop ebx
push edi
push edi
add esp, 4
add edi, 0x102ee
pop edi
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x4070bf

Function at 0x407123
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp eax, edx
je 0x407180
push edx
call 0x407123
add byte [eax], bh
xor bh, byte [edx]
inc ecx
push eax
dec edx
add esp, 4
call 0x407132
add byte [eax + eax*2], bh
xor edi, dword [edi]
dec esp
xor al, byte [ebx + 0x505a04c4]
and eax, 0x1418
pop eax
push eax
jmp 0x407145
pop eax
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x407168
mov dword [ebp - 0x14cc], 1
jmp 0x407172
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x4071e4
push ebx
push esi
add esp, 4
jmp 0x40718e
and ebx, 0x9dd1
call 0x4071a2
add byte [ecx + 0x44], cl
inc ecx
inc edi
inc eax
dec ebp
inc esi
inc esp
add esp, 4
pop ebx
push edi
push edi
add esp, 4
add edi, 0x102ee
pop edi
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x4070bf
Function at 0x407132
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp eax, edx
je 0x407180
push edx
call 0x407123
add byte [eax], bh
xor bh, byte [edx]
inc ecx
push eax
dec edx
add esp, 4
call 0x407132
add byte [eax + eax*2], bh
xor edi, dword [edi]
dec esp
xor al, byte [ebx + 0x505a04c4]
and eax, 0x1418
pop eax
push eax
jmp 0x407145
pop eax
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x407168
mov dword [ebp - 0x14cc], 1
jmp 0x407172
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x4071e4
push ebx
push esi
add esp, 4
jmp 0x40718e
and ebx, 0x9dd1
call 0x4071a2
add byte [ecx + 0x44], cl
inc ecx
inc edi
inc eax
dec ebp
inc esi
inc esp
add esp, 4
pop ebx
push edi
push edi
add esp, 4
add edi, 0x102ee
pop edi
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x4070bf

Function at 0x4071a2
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp eax, edx
je 0x407180
push edx
call 0x407123
add byte [eax], bh
xor bh, byte [edx]
inc ecx
push eax
dec edx
add esp, 4
call 0x407132
add byte [eax + eax*2], bh
xor edi, dword [edi]
dec esp
xor al, byte [ebx + 0x505a04c4]
and eax, 0x1418
pop eax
push eax
jmp 0x407145
pop eax
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x407168
mov dword [ebp - 0x14cc], 1
jmp 0x407172
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x4071e4
push ebx
push esi
add esp, 4
jmp 0x40718e
and ebx, 0x9dd1
call 0x4071a2
add byte [ecx + 0x44], cl
inc ecx
inc edi
inc eax
dec ebp
inc esi
inc esp
add esp, 4
pop ebx
push edi
push edi
add esp, 4
add edi, 0x102ee
pop edi
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x4070bf

Function at 0x4072a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
out dx, al
mov edx, 0x81000123
out dx, al
mov dl, 0
add byte [esi - 0x3a], bl
test esp, edi
idiv edi
inc dword [ebp - 0x3a]
test ebp, edi
idiv edi
invalid
Function at 0x408c10
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x408c23
add byte [edi], bh
inc esp
inc ebp
inc ecx
aas
inc ebx
dec edi
dec esi
xor eax, 0x4c48332
xor ebx, 0xf1e8
xor ebx, 0x10ee7
pop ebx
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x408ca9

Function at 0x408c23
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x408c23
add byte [edi], bh
inc esp
inc ebp
inc ecx
aas
inc ebx
dec edi
dec esi
xor eax, 0x4c48332
xor ebx, 0xf1e8
xor ebx, 0x10ee7
pop ebx
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x408ca9

Function at 0x408c55
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
push eax
and eax, 0xea9f
and eax, 0x282
sub eax, 0x1852c
add eax, 0xc449
pop eax
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x408c9f
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x408a6a
mov dword [ebp - 0x2a8], 0
Function at 0x408fe2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push edx
add esp, 4
or edi, 0x11527
add edi, 0x13957
add edi, 0x2e20
pop edi
push edx
and edx, 0x15354
xor edx, 0x174ac
or edx, 0xa2e9
and edx, 0x6aac
pop edx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push ecx
add esp, 4
or ebx, 0x13455
pop ebx
push esi
push eax
add esp, 4
sub esi, 0xc482
or esi, 0x11808
xor esi, 0xb3b8
sub esi, 0x11da3
pop esi
push ecx
xor ecx, 0x6509
pop ecx
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push eax
jmp 0x408fd6
call fcn.00408fe2
add byte [esi + 0x3e], cl
cmp eax, 0x83344f50
add esp, 4
pop eax
add esp, 4
pop eax
push esi
push ebx
add esp, 4
sub esi, 0x55f1
pop esi
push esi
push eax
add esp, 4
jmp 0x408ffe
pop esi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x40901c
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x409076
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x408f44
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x408f44
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x409060
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x40906a
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x4090bf
push ecx
xor ecx, 0x13263
add ecx, 0x1fb6
pop ecx
push eax
push esi
add esp, 4
and eax, 0x164a
xor eax, 0xb20
call 0x4090ad
add byte [ebx + 0x34], al
inc esi
xor al, 0x47
dec ebp
inc esi
cmp byte [ebx - 0x74a7fb3c], al
xchg ebp, eax
sbb bl, bh
invalid
push edx
sub edx, 0x31db
pop edx
push ecx
push esi
add esp, 4
sub ecx, 0x167bb
jmp 0x4090db
xor ecx, 0xc510
call 0x4090ed
add byte [edx + 0x44], al
inc eax
inc esp
dec ebx
inc ebx
add esp, 4
pop ecx
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x40911d
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x408ee8
mov dword [ebp - 0x710], 0
Function at 0x4090ad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push edx
add esp, 4
or edi, 0x11527
add edi, 0x13957
add edi, 0x2e20
pop edi
push edx
and edx, 0x15354
xor edx, 0x174ac
or edx, 0xa2e9
and edx, 0x6aac
pop edx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push ecx
add esp, 4
or ebx, 0x13455
pop ebx
push esi
push eax
add esp, 4
sub esi, 0xc482
or esi, 0x11808
xor esi, 0xb3b8
sub esi, 0x11da3
pop esi
push ecx
xor ecx, 0x6509
pop ecx
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push eax
jmp 0x408fd6
call fcn.00408fe2
add byte [esi + 0x3e], cl
cmp eax, 0x83344f50
add esp, 4
pop eax
add esp, 4
pop eax
push esi
push ebx
add esp, 4
sub esi, 0x55f1
pop esi
push esi
push eax
add esp, 4
jmp 0x408ffe
pop esi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x40901c
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x409076
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x408f44
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x408f44
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x409060
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x40906a
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x4090bf
push ecx
xor ecx, 0x13263
add ecx, 0x1fb6
pop ecx
push eax
push esi
add esp, 4
and eax, 0x164a
xor eax, 0xb20
call 0x4090ad
add byte [ebx + 0x34], al
inc esi
xor al, 0x47
dec ebp
inc esi
cmp byte [ebx - 0x74a7fb3c], al
xchg ebp, eax
sbb bl, bh
invalid
push edx
sub edx, 0x31db
pop edx
push ecx
push esi
add esp, 4
sub ecx, 0x167bb
jmp 0x4090db
xor ecx, 0xc510
call 0x4090ed
add byte [edx + 0x44], al
inc eax
inc esp
dec ebx
inc ebx
add esp, 4
pop ecx
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x40911d
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x408ee8
mov dword [ebp - 0x710], 0
Function at 0x4090ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push edx
add esp, 4
or edi, 0x11527
add edi, 0x13957
add edi, 0x2e20
pop edi
push edx
and edx, 0x15354
xor edx, 0x174ac
or edx, 0xa2e9
and edx, 0x6aac
pop edx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push ecx
add esp, 4
or ebx, 0x13455
pop ebx
push esi
push eax
add esp, 4
sub esi, 0xc482
or esi, 0x11808
xor esi, 0xb3b8
sub esi, 0x11da3
pop esi
push ecx
xor ecx, 0x6509
pop ecx
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push eax
jmp 0x408fd6
call fcn.00408fe2
add byte [esi + 0x3e], cl
cmp eax, 0x83344f50
add esp, 4
pop eax
add esp, 4
pop eax
push esi
push ebx
add esp, 4
sub esi, 0x55f1
pop esi
push esi
push eax
add esp, 4
jmp 0x408ffe
pop esi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x40901c
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x409076
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x408f44
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x408f44
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x409060
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x40906a
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x4090bf
push ecx
xor ecx, 0x13263
add ecx, 0x1fb6
pop ecx
push eax
push esi
add esp, 4
and eax, 0x164a
xor eax, 0xb20
call 0x4090ad
add byte [ebx + 0x34], al
inc esi
xor al, 0x47
dec ebp
inc esi
cmp byte [ebx - 0x74a7fb3c], al
xchg ebp, eax
sbb bl, bh
invalid
push edx
sub edx, 0x31db
pop edx
push ecx
push esi
add esp, 4
sub ecx, 0x167bb
jmp 0x4090db
xor ecx, 0xc510
call 0x4090ed
add byte [edx + 0x44], al
inc eax
inc esp
dec ebx
inc ebx
add esp, 4
pop ecx
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x40911d
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x408ee8
mov dword [ebp - 0x710], 0