joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a770
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov byte [ebp - 0x82d], 0x64
mov byte [ebp - 0x82c], 0x4c
mov byte [ebp - 0x82b], 0x69
mov byte [ebp - 0x82a], 0x62
mov byte [ebp - 0x829], 0x72
mov byte [ebp - 0x828], 0x61
mov byte [ebp - 0x827], 0x72
mov byte [ebp - 0x826], 0x79
mov byte [ebp - 0x825], 0x57
mov byte [ebp - 0x824], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18d8], ecx
mov edx, dword [ebp - 0x18d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18dc], eax
mov ecx, dword [ebp - 0x18dc]
mov dword [ebp - 0x1518], ecx
push ebx
push ecx
add esp, 4
or ebx, 0x15dd
xor ebx, 0xc89a
add byte [eax], al
and ebx, 0x171ed
pop ebx
push ebx
xor ebx, 0x5f2e
sub ebx, 0x15b99
or ebx, 0x128c9
add ebx, 0x4032
pop ebx
cmp dword [ebp - 0x1518], 0
jne 0x41a828
mov dword [ebp - 0x710], 0
jmp 0x41aacf
mov edx, dword [ebp - 0x1518]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc58], ecx
push eax
sub eax, 0x4414
xor eax, 0xe118
sub eax, 0xa62b
xor eax, 0x1fc0
pop eax
push ebx
call 0x41a862
add byte [edi], dh
dec esp
inc ecx
cmp byte ss:[ebx + eax*4 - 0x3c], al
add al, 0x81
jmp 0x41a7ed
push edi
push ecx
add esp, 4
add edi, 0xe3dd
pop edi
push ebx
push ebx
add esp, 4
jmp 0x41aae8
pop ebx
push ebx
push eax
add esp, 4
xor ebx, 0x12009
add ebx, 0x12662
sub ebx, 0xb6c0
pop ebx
cmp dword [ebp - 0x710], 0
jne 0x41ab4b
push ecx
push ebx
add esp, 4
jmp 0x41ab15
call 0x41ab24
add byte [edx + 0x49], cl
aaa
xor cl, byte ss:[eax + 0x3f]
xor cl, byte [eax + 0x3f]
push eax
add esp, 4
pop ecx
push ebx
push edx
add esp, 4
jmp 0x41ab33
pop ebx
push esi
xor esi, 0xc597
pop esi
mov dword [ebp - 0xa58], 0
jmp 0x41b673
push esi
sub esi, 0x2d96
add esi, 0xbd64
pop esi
push esi
add esi, 0xa0fd
pop esi
push esi
push edx
add esp, 4
add esi, 0x388c
jmp 0x41ab71
and esi, 0xe55a
jmp 0x41ab7c
pop esi
mov ecx, dword [ebp - 0x710]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x300], edx
mov dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x1564], eax
cmp dword [ebp - 0x1564], 0
jne 0x41abbc
mov ecx, dword [ebp - 0x720]
mov dword [ebp - 0x3c8], ecx
jmp 0x41aead
mov edx, dword [ebp - 0x1564]
mov eax, dword [ebp - 0x300]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1568], eax
jne 0x41abe4
mov ecx, dword [ebp - 0x720]
mov dword [ebp - 0x3c8], ecx
jmp 0x41aead
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1568]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1570], edx
cmp dword [ebp - 0x1570], 0
jne 0x41ac16
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0x3c8], eax
jmp 0x41aead
mov ecx, dword [ebp - 0x300]
add ecx, dword [ebp - 0x1570]
mov dword [ebp - 0x714], ecx
jne 0x41ac3b
mov edx, dword [ebp - 0x720]
mov dword [ebp - 0x3c8], edx
jmp 0x41aead
mov eax, dword [ebp - 0x714]
mov ecx, dword [ebp - 0x300]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x18e0], ecx
Function at 0x41a862
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [ebp - 0x82d], 0x64
mov byte [ebp - 0x82c], 0x4c
mov byte [ebp - 0x82b], 0x69
mov byte [ebp - 0x82a], 0x62
mov byte [ebp - 0x829], 0x72
mov byte [ebp - 0x828], 0x61
mov byte [ebp - 0x827], 0x72
mov byte [ebp - 0x826], 0x79
mov byte [ebp - 0x825], 0x57
mov byte [ebp - 0x824], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18d8], ecx
mov edx, dword [ebp - 0x18d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18dc], eax
mov ecx, dword [ebp - 0x18dc]
mov dword [ebp - 0x1518], ecx
push ebx
push ecx
add esp, 4
or ebx, 0x15dd
xor ebx, 0xc89a
add byte [eax], al
and ebx, 0x171ed
pop ebx
push ebx
xor ebx, 0x5f2e
sub ebx, 0x15b99
or ebx, 0x128c9
add ebx, 0x4032
pop ebx
cmp dword [ebp - 0x1518], 0
jne 0x41a828
mov dword [ebp - 0x710], 0
jmp 0x41aacf
mov edx, dword [ebp - 0x1518]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc58], ecx
push eax
sub eax, 0x4414
xor eax, 0xe118
sub eax, 0xa62b
xor eax, 0x1fc0
pop eax
push ebx
call 0x41a862
add byte [edi], dh
dec esp
inc ecx
cmp byte ss:[ebx + eax*4 - 0x3c], al
add al, 0x81
jmp 0x41a7ed
push edi
push ecx
add esp, 4
add edi, 0xe3dd
pop edi
push ebx
push ebx
add esp, 4
jmp 0x41aae8
pop ebx
push ebx
push eax
add esp, 4
xor ebx, 0x12009
add ebx, 0x12662
sub ebx, 0xb6c0
pop ebx
cmp dword [ebp - 0x710], 0
jne 0x41ab4b
push ecx
push ebx
add esp, 4
jmp 0x41ab15
call 0x41ab24
add byte [edx + 0x49], cl
aaa
xor cl, byte ss:[eax + 0x3f]
xor cl, byte [eax + 0x3f]
push eax
add esp, 4
pop ecx
push ebx
push edx
add esp, 4
jmp 0x41ab33
pop ebx
push esi
xor esi, 0xc597
pop esi
mov dword [ebp - 0xa58], 0
jmp 0x41b673
push esi
sub esi, 0x2d96
add esi, 0xbd64
pop esi
push esi
add esi, 0xa0fd
pop esi
push esi
push edx
add esp, 4
add esi, 0x388c
jmp 0x41ab71
and esi, 0xe55a
jmp 0x41ab7c
pop esi
mov ecx, dword [ebp - 0x710]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x300], edx
mov dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x1564], eax
cmp dword [ebp - 0x1564], 0
jne 0x41abbc
mov ecx, dword [ebp - 0x720]
mov dword [ebp - 0x3c8], ecx
jmp 0x41aead
mov edx, dword [ebp - 0x1564]
mov eax, dword [ebp - 0x300]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1568], eax
jne 0x41abe4
mov ecx, dword [ebp - 0x720]
mov dword [ebp - 0x3c8], ecx
jmp 0x41aead
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1568]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1570], edx
cmp dword [ebp - 0x1570], 0
jne 0x41ac16
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0x3c8], eax
jmp 0x41aead
mov ecx, dword [ebp - 0x300]
add ecx, dword [ebp - 0x1570]
mov dword [ebp - 0x714], ecx
jne 0x41ac3b
mov edx, dword [ebp - 0x720]
mov dword [ebp - 0x3c8], edx
jmp 0x41aead
mov eax, dword [ebp - 0x714]
mov ecx, dword [ebp - 0x300]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x18e0], ecx
Function at 0x41a90c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
add esp, 4
add esi, 0x15d04
add esi, 0xcade
add byte [esi + 0x52], bl
add byte [esi + 0x52], bl
push ecx
add esp, 4
xor edx, 0x16056
sub edx, 0x123d6
sub edx, 0x3ad0
jmp 0x41a8c1
pop edx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
xor ebx, 0x132ea
xor ebx, 0x1408f
or ebx, 0xc748
call 0x41a90c
add byte [ecx + 0x4f], cl
dec esi
dec eax
dec ebp
dec esp
add esp, 4
pop ebx
push edi
xor edi, 0x14b2b
or edi, 0x184da
pop edi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push ebx
and ebx, 0x60b6
add ebx, 0x1038e
and ebx, 0xcbf
or ebx, 0x1803d
pop ebx
push ecx
push ecx
add esp, 4
add ecx, 0x17e70
xor ecx, 0x4c30
xor ecx, 0x16f13
pop ecx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x41a9c4
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x41aa1e
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
invalid

Function at 0x41aa41
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and esi, 0xeebd
and esi, 0x127da
pop esi
push edi
and edi, 0x1c62
pop edi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x41aacf

Function at 0x41af80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add cl, ch
jmp 0x41af8c
add al, 0xeb
add al, 0x4b
cmp eax, 0x565f3c43
or esi, 0x9e66
xor esi, 0xec73
sub esi, 0x1ca2
sub esi, 0xaf67
pop esi
push esi
push eax
add esp, 4
add esi, 0x181f9
pop esi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18f8], ecx
mov edx, dword [ebp - 0x18f8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18fc], eax
mov ecx, dword [ebp - 0x18fc]
mov dword [ebp - 0x1574], ecx
push esi
push edi
add esp, 4
jmp 0x41aff0
add esi, 0x7f07
and esi, 0xf1db
pop esi
push ebx
add ebx, 0x568b
pop ebx
push edx
sub edx, 0x111c9
jmp 0x41b013
pop edx
cmp dword [ebp - 0x1574], 0
jne 0x41b02c
mov dword [ebp - 0x2a8], 0
jmp 0x41b2d3
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push edi
add edi, 0xa015
call 0x41b052
add byte [ebp + 0x47], al
aas
xor eax, 0x833d3d47
les eax, [ecx + eax*4]
out 0xc7, eax
or byte [ecx], al
add byte [edi + 0x52], bl
xor edx, 0x1063f
sub edx, 0x916d
xor edx, 0x44b4
pop edx
cmp dword [ebp - 0xc68], 0
jne 0x41b088
mov dword [ebp - 0x2a8], 0
jmp 0x41b2d3
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
Function at 0x41b052
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add cl, ch
jmp 0x41af8c
add al, 0xeb
add al, 0x4b
cmp eax, 0x565f3c43
or esi, 0x9e66
xor esi, 0xec73
sub esi, 0x1ca2
sub esi, 0xaf67
pop esi
push esi
push eax
add esp, 4
add esi, 0x181f9
pop esi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18f8], ecx
mov edx, dword [ebp - 0x18f8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18fc], eax
mov ecx, dword [ebp - 0x18fc]
mov dword [ebp - 0x1574], ecx
push esi
push edi
add esp, 4
jmp 0x41aff0
add esi, 0x7f07
and esi, 0xf1db
pop esi
push ebx
add ebx, 0x568b
pop ebx
push edx
sub edx, 0x111c9
jmp 0x41b013
pop edx
cmp dword [ebp - 0x1574], 0
jne 0x41b02c
mov dword [ebp - 0x2a8], 0
jmp 0x41b2d3
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push edi
add edi, 0xa015
call 0x41b052
add byte [ebp + 0x47], al
aas
xor eax, 0x833d3d47
les eax, [ecx + eax*4]
out 0xc7, eax
or byte [ecx], al
add byte [edi + 0x52], bl
xor edx, 0x1063f
sub edx, 0x916d
xor edx, 0x44b4
pop edx
cmp dword [ebp - 0xc68], 0
jne 0x41b088
mov dword [ebp - 0x2a8], 0
jmp 0x41b2d3
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx

Function at 0x41b0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
push eax
and eax, 0x3ba0
jmp 0x41b0b1
or eax, 0x11a51
pop eax
push ebx
or ebx, 0x7f55
add ebx, 0x12bba
pop ebx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
Function at 0x41b0f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0x3f03
jmp fcn.0041b0a0
push eax
push esi
add esp, 4
sub eax, 0x16b4f
call 0x41b10b
add byte [eax + 0x3a], dl
dec edi
inc ebp
dec edx
cmp eax, 0x39503f3c
add esp, 4
call 0x41b11e
add byte [esi], dh
cmp dword [eax + 0x4d], edx
dec ebx
dec edx
inc esi
xor ecx, dword [ebx + 0x3a]
add esp, 4
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
call 0x41b189
add byte [ebx + 0x38], al
dec ebx
dec ebx
cmp al, 0x50
push eax
xor edi, dword [0xe804c483]
or dword [eax], eax
add byte [eax], al
add byte [edi + 0x44], al
inc ebx
inc esi
inc ecx
cmp al, byte [ebx + 0x4e]
add esp, 4
or eax, 0xff0a
jmp 0x41b1aa
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x41b1c8
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x41b222
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je fcn.0041b0f0
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je fcn.0041b0f0
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x41b20c
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x41b216
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x41b26b
push ecx
or ecx, 0x248f
call 0x41b241
add byte [ebx], dh
dec ebx
aas
inc esi
dec ebx
cmp dword [edi], edi
cmp dword [ecx], edi
add esp, 4
sub ecx, 0xf0f
xor ecx, 0xd86d
pop ecx
push ebx
push esi
add esp, 4
xor ebx, 0x3c6c
pop ebx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x41b2d3
push ebx
push edi
add esp, 4
call 0x41b27f
add byte [0x3b4b4034], dh
cmp edx, dword [eax + 0x45]
dec ebx
add esp, 4
jmp 0x41b28a
pop ebx
push eax
push eax
add esp, 4
sub eax, 0x18263
xor eax, 0x10a13
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x41b2c9
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x41b094
mov dword [ebp - 0x2a8], 0
push edx
push esi
add esp, 4
or edx, 0xde96
and edx, 0x17f6c
pop edx
push eax
push edi
add esp, 4
xor eax, 0x12626
xor eax, 0x12e09
xor eax, 0x127c
jmp 0x41b304
pop eax
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push ebx
or ebx, 0x94b1
and ebx, 0x1ce7
and ebx, 0xb7a2
add ebx, 0x1831
pop ebx
push eax
push ecx
Function at 0x41b10b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0x3f03
jmp fcn.0041b0a0
push eax
push esi
add esp, 4
sub eax, 0x16b4f
call 0x41b10b
add byte [eax + 0x3a], dl
dec edi
inc ebp
dec edx
cmp eax, 0x39503f3c
add esp, 4
call 0x41b11e
add byte [esi], dh
cmp dword [eax + 0x4d], edx
dec ebx
dec edx
inc esi
xor ecx, dword [ebx + 0x3a]
add esp, 4
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
call 0x41b189
add byte [ebx + 0x38], al
dec ebx
dec ebx
cmp al, 0x50
push eax
xor edi, dword [0xe804c483]
or dword [eax], eax
add byte [eax], al
add byte [edi + 0x44], al
inc ebx
inc esi
inc ecx
cmp al, byte [ebx + 0x4e]
add esp, 4
or eax, 0xff0a
jmp 0x41b1aa
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x41b1c8
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x41b222
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je fcn.0041b0f0
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je fcn.0041b0f0
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x41b20c
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x41b216
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x41b26b
push ecx
or ecx, 0x248f
call 0x41b241
add byte [ebx], dh
dec ebx
aas
inc esi
dec ebx
cmp dword [edi], edi
cmp dword [ecx], edi
add esp, 4
sub ecx, 0xf0f
xor ecx, 0xd86d
pop ecx
push ebx
push esi
add esp, 4
xor ebx, 0x3c6c
pop ebx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x41b2d3
push ebx
push edi
add esp, 4
call 0x41b27f
add byte [0x3b4b4034], dh
cmp edx, dword [eax + 0x45]
dec ebx
add esp, 4
jmp 0x41b28a
pop ebx
push eax
push eax
add esp, 4
sub eax, 0x18263
xor eax, 0x10a13
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x41b2c9
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x41b094
mov dword [ebp - 0x2a8], 0
push edx
push esi
add esp, 4
or edx, 0xde96
and edx, 0x17f6c
pop edx
push eax
push edi
add esp, 4
xor eax, 0x12626
xor eax, 0x12e09
xor eax, 0x127c
jmp 0x41b304
pop eax
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push ebx
or ebx, 0x94b1
and ebx, 0x1ce7
and ebx, 0xb7a2
add ebx, 0x1831
pop ebx
push eax
push ecx
Function at 0x41b11e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0x3f03
jmp fcn.0041b0a0
push eax
push esi
add esp, 4
sub eax, 0x16b4f
call 0x41b10b
add byte [eax + 0x3a], dl
dec edi
inc ebp
dec edx
cmp eax, 0x39503f3c
add esp, 4
call 0x41b11e
add byte [esi], dh
cmp dword [eax + 0x4d], edx
dec ebx
dec edx
inc esi
xor ecx, dword [ebx + 0x3a]
add esp, 4
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
call 0x41b189
add byte [ebx + 0x38], al
dec ebx
dec ebx
cmp al, 0x50
push eax
xor edi, dword [0xe804c483]
or dword [eax], eax
add byte [eax], al
add byte [edi + 0x44], al
inc ebx
inc esi
inc ecx
cmp al, byte [ebx + 0x4e]
add esp, 4
or eax, 0xff0a
jmp 0x41b1aa
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x41b1c8
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x41b222
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je fcn.0041b0f0
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je fcn.0041b0f0
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x41b20c
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x41b216
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x41b26b
push ecx
or ecx, 0x248f
call 0x41b241
add byte [ebx], dh
dec ebx
aas
inc esi
dec ebx
cmp dword [edi], edi
cmp dword [ecx], edi
add esp, 4
sub ecx, 0xf0f
xor ecx, 0xd86d
pop ecx
push ebx
push esi
add esp, 4
xor ebx, 0x3c6c
pop ebx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x41b2d3
push ebx
push edi
add esp, 4
call 0x41b27f
add byte [0x3b4b4034], dh
cmp edx, dword [eax + 0x45]
dec ebx
add esp, 4
jmp 0x41b28a
pop ebx
push eax
push eax
add esp, 4
sub eax, 0x18263
xor eax, 0x10a13
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x41b2c9
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x41b094
mov dword [ebp - 0x2a8], 0
push edx
push esi
add esp, 4
or edx, 0xde96
and edx, 0x17f6c
pop edx
push eax
push edi
add esp, 4
xor eax, 0x12626
xor eax, 0x12e09
xor eax, 0x127c
jmp 0x41b304
pop eax
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push ebx
or ebx, 0x94b1
and ebx, 0x1ce7
and ebx, 0xb7a2
add ebx, 0x1831
pop ebx
push eax
push ecx
Function at 0x41b189
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0x3f03
jmp fcn.0041b0a0
push eax
push esi
add esp, 4
sub eax, 0x16b4f
call 0x41b10b
add byte [eax + 0x3a], dl
dec edi
inc ebp
dec edx
cmp eax, 0x39503f3c
add esp, 4
call 0x41b11e
add byte [esi], dh
cmp dword [eax + 0x4d], edx
dec ebx
dec edx
inc esi
xor ecx, dword [ebx + 0x3a]
add esp, 4
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
call 0x41b189
add byte [ebx + 0x38], al
dec ebx
dec ebx
cmp al, 0x50
push eax
xor edi, dword [0xe804c483]
or dword [eax], eax
add byte [eax], al
add byte [edi + 0x44], al
inc ebx
inc esi
inc ecx
cmp al, byte [ebx + 0x4e]
add esp, 4
or eax, 0xff0a
jmp 0x41b1aa
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x41b1c8
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x41b222
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je fcn.0041b0f0
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je fcn.0041b0f0
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x41b20c
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x41b216
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x41b26b
push ecx
or ecx, 0x248f
call 0x41b241
add byte [ebx], dh
dec ebx
aas
inc esi
dec ebx
cmp dword [edi], edi
cmp dword [ecx], edi
add esp, 4
sub ecx, 0xf0f
xor ecx, 0xd86d
pop ecx
push ebx
push esi
add esp, 4
xor ebx, 0x3c6c
pop ebx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x41b2d3
push ebx
push edi
add esp, 4
call 0x41b27f
add byte [0x3b4b4034], dh
cmp edx, dword [eax + 0x45]
dec ebx
add esp, 4
jmp 0x41b28a
pop ebx
push eax
push eax
add esp, 4
sub eax, 0x18263
xor eax, 0x10a13
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x41b2c9
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x41b094
mov dword [ebp - 0x2a8], 0
push edx
push esi
add esp, 4
or edx, 0xde96
and edx, 0x17f6c
pop edx
push eax
push edi
add esp, 4
xor eax, 0x12626
xor eax, 0x12e09
xor eax, 0x127c
jmp 0x41b304
pop eax
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push ebx
or ebx, 0x94b1
and ebx, 0x1ce7
and ebx, 0xb7a2
add ebx, 0x1831
pop ebx
push eax
push ecx
Function at 0x41b19a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0x3f03
jmp fcn.0041b0a0
push eax
push esi
add esp, 4
sub eax, 0x16b4f
call 0x41b10b
add byte [eax + 0x3a], dl
dec edi
inc ebp
dec edx
cmp eax, 0x39503f3c
add esp, 4
call 0x41b11e
add byte [esi], dh
cmp dword [eax + 0x4d], edx
dec ebx
dec edx
inc esi
xor ecx, dword [ebx + 0x3a]
add esp, 4
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
call 0x41b189
add byte [ebx + 0x38], al
dec ebx
dec ebx
cmp al, 0x50
push eax
xor edi, dword [0xe804c483]
or dword [eax], eax
add byte [eax], al
add byte [edi + 0x44], al
inc ebx
inc esi
inc ecx
cmp al, byte [ebx + 0x4e]
add esp, 4
or eax, 0xff0a
jmp 0x41b1aa
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x41b1c8
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x41b222
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je fcn.0041b0f0
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je fcn.0041b0f0
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x41b20c
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x41b216
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x41b26b
push ecx
or ecx, 0x248f
call 0x41b241
add byte [ebx], dh
dec ebx
aas
inc esi
dec ebx
cmp dword [edi], edi
cmp dword [ecx], edi
add esp, 4
sub ecx, 0xf0f
xor ecx, 0xd86d
pop ecx
push ebx
push esi
add esp, 4
xor ebx, 0x3c6c
pop ebx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x41b2d3
push ebx
push edi
add esp, 4
call 0x41b27f
add byte [0x3b4b4034], dh
cmp edx, dword [eax + 0x45]
dec ebx
add esp, 4
jmp 0x41b28a
pop ebx
push eax
push eax
add esp, 4
sub eax, 0x18263
xor eax, 0x10a13
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x41b2c9
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x41b094
mov dword [ebp - 0x2a8], 0
push edx
push esi
add esp, 4
or edx, 0xde96
and edx, 0x17f6c
pop edx
push eax
push edi
add esp, 4
xor eax, 0x12626
xor eax, 0x12e09
xor eax, 0x127c
jmp 0x41b304
pop eax
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push ebx
or ebx, 0x94b1
and ebx, 0x1ce7
and ebx, 0xb7a2
add ebx, 0x1831
pop ebx
push eax
push ecx