joyce8/EMBER2024-capa huggingface dataset:
Function at 0xfd1fed
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0xc]
push eax
push 0x20119
push 0
push 0xfd2088
push 0x80000002
mov dword [0xffa0d8], 0x8000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xfd2059
and dword [ebp - 8], eax
push esi
push 4
pop esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xfd2060
push dword [ebp - 0xc]
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xfdae1f
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, dword [0xffa0d8]
leave
ret

Function at 0xfd23c1
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0xfd2418
call fcn.00fc1eb0
xor eax, eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0xfd2410
cmp ecx, 0xffffffff
je 0xfd2410
and dword [ebp - 4], eax
mov edx, 0x5a4d
cmp word [ecx], dx
jne 0xfd2409
mov edx, dword [ecx + 0x3c]
test edx, edx
jl 0xfd2409
cmp edx, 0x10000000
jae 0xfd2409
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0xfdacd6
mov dword [ebp - 4], 0xfffffffe
call fcn.00fc1f00
ret 4

Function at 0xfd31c6
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
lea ebx, [esi + 0x50]
push ebx
push 0
push esi
push 0xfc7526
push dword [esi + 0x58]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x4c], eax
test eax, eax
je 0xfd717e
push edi
push 1
mov edi, 0xffa10c
push edi
call fcn.00fc2af0
mov ecx, dword [0xffa050]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
mov dword [ebp - 4], esi
call fcn.00fd291b
push edi
mov esi, eax
call fcn.00fc2ab0
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x401150
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41cf5a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x427760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.004066fb
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x4011f6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.00406e45
push 0x4263cc
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.0040869b
push edi
push esi
call fcn.004054ed
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406dff
mov esp, ebp
pop ebp
ret 4

Function at 0x401840
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41cfe8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x427760]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00402760
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.00401770
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x4018b1
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.00406e45
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x4018da
push dword [esp + 0xc]
call fcn.004077af
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x417be1
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x427760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040b218
mov dword [ebp - 0x14], eax
cmp dword [0x429b98], esi
jne 0x417cd4
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x417c61
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x417db4
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x417db4
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417db4
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x429b98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x429b9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x429ba0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x429ba8], eax
test eax, eax
je 0x417cd1
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x429ba4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x417cf9
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x417cec
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x417d0e
push 4
pop eax
jmp 0x417db6
cmp dword [ebp - 0x14], esi
je 0x417d0e
push dword [0x429b98]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x417cf3
mov eax, dword [0x429ba4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x417d6c
cmp dword [0x429ba8], edi
je 0x417d6c
push eax
call ebx
push dword [0x429ba8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x417d6c
test eax, eax
je 0x417d6c
call ecx
test eax, eax
je 0x417d61
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x417d61
test byte [ebp - 8], 1
jne 0x417d6c
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x417d9c
mov eax, dword [0x429b9c]
cmp eax, edi
je 0x417d99
push eax
call ebx
test eax, eax
je 0x417d99
call eax
mov esi, eax
test esi, esi
je 0x417d99
mov eax, dword [0x429ba0]
cmp eax, edi
je 0x417d99
push eax
call ebx
test eax, eax
je 0x417d99
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x429b98]
call ebx
test eax, eax
je 0x417db4
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x417db6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406dff
mov esp, ebp
pop ebp
ret
Function at 0x1001e0b
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x1001e68
call fcn.01001e84
xor eax, eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1001e5a
cmp ecx, 0xffffffff
je 0x1001e5a
and dword [ebp - 4], eax
mov edx, 0x5a4d
cmp word [ecx], dx
jne 0x1001e53
mov edx, dword [ecx + 0x3c]
test edx, edx
jl 0x1001e53
cmp edx, 0x10000000
jae 0x1001e53
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0x1005401
mov dword [ebp - 4], 0xfffffffe
call fcn.01001bf9
ret 4

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x71242fd1
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4be511d8
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x4c5221cf
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x5d8a3697
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x405dbc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x405dc4
and ebx, 0x68c0
pop ebx
push esi
sub esi, 0x5264
pop esi
mov dword [ebp - 0xa7c], 0
push edi
push edi
add esp, 4
or edi, 0x2ef8
or edi, 0x474e
xor edi, 0xa987
pop edi
push edi
xor edi, 0x141ed
or edi, 0x100d3
and edi, 0x122ee
add edi, 0x165b9
pop edi
mov byte [ebp - 0x854], 0x45
mov byte [ebp - 0x853], 0x78
mov byte [ebp - 0x852], 0x69
mov byte [ebp - 0x851], 0x74
mov byte [ebp - 0x850], 0x50
mov byte [ebp - 0x84f], 0x72
mov byte [ebp - 0x84e], 0x6f
mov byte [ebp - 0x84d], 0x63
mov byte [ebp - 0x84c], 0x65
mov byte [ebp - 0x84b], 0x73
mov byte [ebp - 0x84a], 0x73
mov byte [ebp - 0x849], 0
push edi
jmp 0x405e6a
sub edi, 0xe4bb
sub edi, 0x1000f
add edi, 0x180e2
pop edi
push edi
call 0x405e8b
add byte [edi], dh
push eax
inc ecx
cmp byte ds:[ecx + 0x3b], al
add esp, 4
or edi, 0xb1ef
pop edi
mov ecx, 0x6b
mov word [ebp - 0x1670], cx
mov edx, 0x65
mov word [ebp - 0x166e], dx
mov eax, 0x72
mov word [ebp - 0x166c], ax
mov ecx, 0x6e
mov word [ebp - 0x166a], cx
mov edx, 0x65
mov word [ebp - 0x1668], dx
mov eax, 0x6c
mov word [ebp - 0x1666], ax
mov ecx, 0x33
mov word [ebp - 0x1664], cx
mov edx, 0x32
mov word [ebp - 0x1662], dx
mov eax, 0x2e
mov word [ebp - 0x1660], ax
mov ecx, 0x64
mov word [ebp - 0x165e], cx
mov edx, 0x6c
mov word [ebp - 0x165c], dx
mov eax, 0x6c
mov word [ebp - 0x165a], ax
xor ecx, ecx
mov word [ebp - 0x1658], cx
push edx
push eax
Function at 0x407812
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
add esp, 4
jmp 0x40775c
and edi, 0xbe40
pop edi
push edi
push eax
add esp, 4
jmp 0x40776e
or edi, 0x12180
and edi, 0x430b
sub edi, 0x444
pop edi
mov ecx, dword [ebp - 0x4e8]
mov dword [ebp - 0x2c0], ecx
jmp 0x4077f7
push eax
add eax, 0x10345
add eax, 0xd19a
call 0x407812
add byte [esp + edi], dh
aas
inc ecx
inc eax
add esp, 4
pop eax
push eax
push esi
add esp, 4
sub eax, 0x30e2
jmp 0x407828
pop eax
cmp dword [ebp - 0x2c0], 0
jne 0x40812e
mov eax, 0x6b
mov word [ebp - 0x16c8], ax
mov ecx, 0x65
mov word [ebp - 0x16c6], cx
mov edx, 0x72
mov word [ebp - 0x16c4], dx
mov eax, 0x6e
mov word [ebp - 0x16c2], ax
mov ecx, 0x65
mov word [ebp - 0x16c0], cx
mov edx, 0x6c
mov word [ebp - 0x16be], dx
invalid
invalid

Function at 0x407a20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
add cl, ch
dec ebx
add al, byte [eax]
add byte [ebx - 0xc836b], cl
dec dword [ecx - 0x4eb6b]
call dword [ebx + 0x52]

Function at 0x407a44
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x407a4e
or ecx, 0x1778b
jmp 0x407a59
add ecx, 0x731e
pop ecx
push edx
xor edx, 0xa280
pop edx

Function at 0x407a68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [ebp - 0x16c8]
mov dword [ebp - 0xc80], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
invalid
xchg ebp, eax
invalid

Function at 0x4081a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec edi
dec esi
dec eax
dec ebp
inc ecx
inc eax
cmp byte [ebx - 0x377efb3c], al
aaa
or eax, 0x50580000
push ecx
add esp, 4
sub eax, 0x13bdf
pop eax
cmp dword [ebp - 0x15e8], 0
add byte [ebp + 0xf], dh
mov edx, dword [ebp - 0x15e8]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc94], ecx
push edx
and edx, 0xc02e
sub edx, 0x1175c
and edx, 0x1556c
xor edx, 0xe8c7
pop edx
push edi
push edx
add esp, 4
or edi, 0x128a7
xor edi, 0x12dcf
sub edi, 0x1e04
pop edi
cmp dword [ebp - 0xc94], 0
jne 0x40822e
mov dword [ebp - 0x2c0], 0
jmp 0x408479
mov edx, dword [ebp - 0xc94]
mov dword [ebp - 0x4f0], edx

Function at 0x40834c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor al, 0x83
les eax, [eax + ebx*2]
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x40836e
movzx edx, word [ebp - 0x1d8]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x15f0], edx
jmp 0x4083c8
movzx ecx, word [ebp - 0x1d8]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x408296
movzx eax, word [ebp - 0x1d8]

Function at 0x40834d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor al, 0x83
les eax, [eax + ebx*2]
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x40836e
movzx edx, word [ebp - 0x1d8]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x15f0], edx
jmp 0x4083c8
movzx ecx, word [ebp - 0x1d8]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x408296
movzx eax, word [ebp - 0x1d8]
Function at 0x408388
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x408296
movzx edx, word [ebp - 0x1d8]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x4083b2
mov dword [ebp - 0x15ec], 0xffffffff
jmp fcn.004083bc
mov dword [ebp - 0x15ec], 1

Function at 0x4083a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x408296
movzx edx, word [ebp - 0x1d8]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x4083b2
mov dword [ebp - 0x15ec], 0xffffffff
jmp fcn.004083bc
mov dword [ebp - 0x15ec], 1
Function at 0x4083bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
or ebx, 0x2dfa
add al, ch
or al, byte [eax]
add byte [eax], al
add byte [eax], bh
push eax
xor al, byte [edi + 0x4c]
inc edx
cmp bh, byte ds:[ebx]
add esp, 4
and ebx, 0x17bed
jecxz 0x408243
jnp 0x408259
invalid
sub ebx, 0x20fd
pop ebx
push edx
push edx
add esp, 4
sub edx, 0x14a13
pop edx
lea eax, [ebp - 0x1670]
mov dword [ebp - 0xc90], eax
mov ecx, dword [ebp - 0x4f0]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc8c], edx
xor eax, eax
mov word [ebp - 0x1d8], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push edi
add esp, 4
add ebx, 0x39df
and ebx, 0x9787
xor ebx, 0x241f
pop ebx
push edi
push edx
add esp, 4
jmp 0x4082b9
jmp 0x4082c1
or edi, 0x1683d
pop edi
mov edx, dword [ebp - 0xc8c]
invalid
jmp dword [esi - 0x75]
add ah, byte [esi - 0x77]
test dword [esi], eax
invalid
invalid
dec dword [ebx - 0xc8b73]
inc dword [ebx - 0x7276fd3f]
je 0x4082d8
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
push es
invalid
invalid
jmp dword [esi - 0x77]
xchg ebp, eax
sub dh, bh
invalid
dec dword [ebx - 0xc8f7b]
jmp dword [esi - 0x75]
or byte [esi - 0x77], ah
lea eax, [eax + esi*8]
invalid
dec dword [ebx - 0xc8f6b]
inc dword [ebx - 0x6a76fd3e]
ret 0x8902
xchg ebp, eax
jo 0x408305
invalid
jmp dword [esi - 0x75]
test dword [eax + esi*8], eax
invalid
jmp dword [esi - 0x77]
mov dword [ebp - 0x3c], eax
push esi
jmp 0x408326
pop esi
push eax
push edi
add esp, 4
jmp 0x408331
add eax, 0xd072
xor eax, 0xf641
pop eax
push eax
call 0x40834d
add byte [edi], dh
inc esi
inc ecx
inc esp
xor eax, dword [edi + 0x39]
mov ecx, dword [ebp - 0x15ec]
mov dword [ebp - 0x15f0], ecx
cmp dword [ebp - 0x15f0], 0
jne 0x408411
push edi
jmp 0x4083d8
and edi, 0x5130
sub edi, 0x168eb
pop edi
push ecx
push esi
add esp, 4
or ecx, 0x15226
add ecx, 0x13288
xor ecx, 0x15d44
and ecx, 0x13350
pop ecx
mov edx, dword [ebp - 0x4f0]
mov dword [ebp - 0x2c0], edx
jmp 0x408479
push eax
jmp 0x408417
sub eax, 0xfb45
pop eax
push ecx
call 0x40842d
add byte [ebx + 0x3a], cl
push eax
cmp dword [0x833b4740], edi
les eax, [ecx + ebx*2]
push ecx
push esi
add esp, 4
xor ecx, 0xeeec
xor ecx, 0x67b5
add byte [eax], al
pop ecx
mov eax, dword [ebp - 0x4f0]
mov ecx, dword [eax]
mov dword [ebp - 0x4f0], ecx
mov edx, dword [ebp - 0x4f0]
cmp edx, dword [ebp - 0xc94]
je 0x40846f
mov eax, dword [ebp - 0x4f0]
cmp dword [eax + 0x30], 0
jne 0x40823a
mov dword [ebp - 0x2c0], 0
push edx
push edx
add esp, 4
sub edx, 0xc88a
or edx, 0x141bc
pop edx
push edx
jmp 0x408492
xor edx, 0x3310
pop edx
push ebx
push esi
add esp, 4
or ebx, 0x10606
and ebx, 0x9eb6
pop ebx
mov ecx, dword [ebp - 0x2c0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x320], edx
push edi
push ecx
add esp, 4
xor edi, 0xfa3d
sub edi, 0xe9e0
or edi, 0xef31
pop edi
push edi
and edi, 0x840f
add edi, 0x18220
and edi, 0x1c55
and edi, 0xc359
pop edi
Function at 0x40842d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
or ebx, 0x2dfa
add al, ch
or al, byte [eax]
add byte [eax], al
add byte [eax], bh
push eax
xor al, byte [edi + 0x4c]
inc edx
cmp bh, byte ds:[ebx]
add esp, 4
and ebx, 0x17bed
jecxz 0x408243
jnp 0x408259
invalid
sub ebx, 0x20fd
pop ebx
push edx
push edx
add esp, 4
sub edx, 0x14a13
pop edx
lea eax, [ebp - 0x1670]
mov dword [ebp - 0xc90], eax
mov ecx, dword [ebp - 0x4f0]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc8c], edx
xor eax, eax
mov word [ebp - 0x1d8], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push edi
add esp, 4
add ebx, 0x39df
and ebx, 0x9787
xor ebx, 0x241f
pop ebx
push edi
push edx
add esp, 4
jmp 0x4082b9
jmp 0x4082c1
or edi, 0x1683d
pop edi
mov edx, dword [ebp - 0xc8c]
invalid
jmp dword [esi - 0x75]
add ah, byte [esi - 0x77]
test dword [esi], eax
invalid
invalid
dec dword [ebx - 0xc8b73]
inc dword [ebx - 0x7276fd3f]
je 0x4082d8
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
push es
invalid
invalid
jmp dword [esi - 0x77]
xchg ebp, eax
sub dh, bh
invalid
dec dword [ebx - 0xc8f7b]
jmp dword [esi - 0x75]
or byte [esi - 0x77], ah
lea eax, [eax + esi*8]
invalid
dec dword [ebx - 0xc8f6b]
inc dword [ebx - 0x6a76fd3e]
ret 0x8902
xchg ebp, eax
jo 0x408305
invalid
jmp dword [esi - 0x75]
test dword [eax + esi*8], eax
invalid
jmp dword [esi - 0x77]
mov dword [ebp - 0x3c], eax
push esi
jmp 0x408326
pop esi
push eax
push edi
add esp, 4
jmp 0x408331
add eax, 0xd072
xor eax, 0xf641
pop eax
push eax
call 0x40834d
add byte [edi], dh
inc esi
inc ecx
inc esp
xor eax, dword [edi + 0x39]
mov ecx, dword [ebp - 0x15ec]
mov dword [ebp - 0x15f0], ecx
cmp dword [ebp - 0x15f0], 0
jne 0x408411
push edi
jmp 0x4083d8
and edi, 0x5130
sub edi, 0x168eb
pop edi
push ecx
push esi
add esp, 4
or ecx, 0x15226
add ecx, 0x13288
xor ecx, 0x15d44
and ecx, 0x13350
pop ecx
mov edx, dword [ebp - 0x4f0]
mov dword [ebp - 0x2c0], edx
jmp 0x408479
push eax
jmp 0x408417
sub eax, 0xfb45
pop eax
push ecx
call 0x40842d
add byte [ebx + 0x3a], cl
push eax
cmp dword [0x833b4740], edi
les eax, [ecx + ebx*2]
push ecx
push esi
add esp, 4
xor ecx, 0xeeec
xor ecx, 0x67b5
add byte [eax], al
pop ecx
mov eax, dword [ebp - 0x4f0]
mov ecx, dword [eax]
mov dword [ebp - 0x4f0], ecx
mov edx, dword [ebp - 0x4f0]
cmp edx, dword [ebp - 0xc94]
je 0x40846f
mov eax, dword [ebp - 0x4f0]
cmp dword [eax + 0x30], 0
jne 0x40823a
mov dword [ebp - 0x2c0], 0
push edx
push edx
add esp, 4
sub edx, 0xc88a
or edx, 0x141bc
pop edx
push edx
jmp 0x408492
xor edx, 0x3310
pop edx
push ebx
push esi
add esp, 4
or ebx, 0x10606
and ebx, 0x9eb6
pop ebx
mov ecx, dword [ebp - 0x2c0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x320], edx
push edi
push ecx
add esp, 4
xor edi, 0xfa3d
sub edi, 0xe9e0
or edi, 0xef31
pop edi
push edi
and edi, 0x840f
add edi, 0x18220
and edi, 0x1c55
and edi, 0xc359
pop edi
Function at 0x408440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
or ebx, 0x2dfa
add al, ch
or al, byte [eax]
add byte [eax], al
add byte [eax], bh
push eax
xor al, byte [edi + 0x4c]
inc edx
cmp bh, byte ds:[ebx]
add esp, 4
and ebx, 0x17bed
jecxz 0x408243
jnp 0x408259
invalid
sub ebx, 0x20fd
pop ebx
push edx
push edx
add esp, 4
sub edx, 0x14a13
pop edx
lea eax, [ebp - 0x1670]
mov dword [ebp - 0xc90], eax
mov ecx, dword [ebp - 0x4f0]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc8c], edx
xor eax, eax
mov word [ebp - 0x1d8], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push edi
add esp, 4
add ebx, 0x39df
and ebx, 0x9787
xor ebx, 0x241f
pop ebx
push edi
push edx
add esp, 4
jmp 0x4082b9
jmp 0x4082c1
or edi, 0x1683d
pop edi
mov edx, dword [ebp - 0xc8c]
invalid
jmp dword [esi - 0x75]
add ah, byte [esi - 0x77]
test dword [esi], eax
invalid
invalid
dec dword [ebx - 0xc8b73]
inc dword [ebx - 0x7276fd3f]
je 0x4082d8
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
push es
invalid
invalid
jmp dword [esi - 0x77]
xchg ebp, eax
sub dh, bh
invalid
dec dword [ebx - 0xc8f7b]
jmp dword [esi - 0x75]
or byte [esi - 0x77], ah
lea eax, [eax + esi*8]
invalid
dec dword [ebx - 0xc8f6b]
inc dword [ebx - 0x6a76fd3e]
ret 0x8902
xchg ebp, eax
jo 0x408305
invalid
jmp dword [esi - 0x75]
test dword [eax + esi*8], eax
invalid
jmp dword [esi - 0x77]
mov dword [ebp - 0x3c], eax
push esi
jmp 0x408326
pop esi
push eax
push edi
add esp, 4
jmp 0x408331
add eax, 0xd072
xor eax, 0xf641
pop eax
push eax
call 0x40834d
add byte [edi], dh
inc esi
inc ecx
inc esp
xor eax, dword [edi + 0x39]
mov ecx, dword [ebp - 0x15ec]
mov dword [ebp - 0x15f0], ecx
cmp dword [ebp - 0x15f0], 0
jne 0x408411
push edi
jmp 0x4083d8
and edi, 0x5130
sub edi, 0x168eb
pop edi
push ecx
push esi
add esp, 4
or ecx, 0x15226
add ecx, 0x13288
xor ecx, 0x15d44
and ecx, 0x13350
pop ecx
mov edx, dword [ebp - 0x4f0]
mov dword [ebp - 0x2c0], edx
jmp 0x408479
push eax
jmp 0x408417
sub eax, 0xfb45
pop eax
push ecx
call 0x40842d
add byte [ebx + 0x3a], cl
push eax
cmp dword [0x833b4740], edi
les eax, [ecx + ebx*2]
push ecx
push esi
add esp, 4
xor ecx, 0xeeec
xor ecx, 0x67b5
add byte [eax], al
pop ecx
mov eax, dword [ebp - 0x4f0]
mov ecx, dword [eax]
mov dword [ebp - 0x4f0], ecx
mov edx, dword [ebp - 0x4f0]
cmp edx, dword [ebp - 0xc94]
je 0x40846f
mov eax, dword [ebp - 0x4f0]
cmp dword [eax + 0x30], 0
jne 0x40823a
mov dword [ebp - 0x2c0], 0
push edx
push edx
add esp, 4
sub edx, 0xc88a
or edx, 0x141bc
pop edx
push edx
jmp 0x408492
xor edx, 0x3310
pop edx
push ebx
push esi
add esp, 4
or ebx, 0x10606
and ebx, 0x9eb6
pop ebx
mov ecx, dword [ebp - 0x2c0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x320], edx
push edi
push ecx
add esp, 4
xor edi, 0xfa3d
sub edi, 0xe9e0
or edi, 0xef31
pop edi
push edi
and edi, 0x840f
add edi, 0x18220
and edi, 0x1c55
and edi, 0xc359
pop edi

Function at 0x4084ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x15f4], eax
inc dword [ebx - 0x15f343]
inc dword [eax]
jne 0x40851c
invalid
invalid
cmp al, 0xff