joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410153
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor eax, 0x3815
and eax, 0xd09a
add eax, 0x1610c
pop eax
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
and edx, 0x13aa
pop edx
push edi
jmp 0x4101a5
sub edi, 0x7459
jmp 0x4101b2
pop edi
push esi
push edx
add esp, 4
sub esi, 0xf7d9
or esi, 0x9ad7
pop esi
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push esi
push ebx
add esp, 4
xor esi, 0x8dc7
pop esi
push ecx
add ecx, 0x8e5e
xor ecx, 0xddc6
pop ecx
push ebx
push ebx
add esp, 4
jmp 0x410241
and ebx, 0x292d
or ebx, 0x1de1
pop ebx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x41026b
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x4102c5
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x410193
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x410193
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x4102af
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x4102b9
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x41030e
push eax
sub eax, 0x80a0
call 0x4102e1
add byte [edi + 0x35], al
dec ebx
inc esp
cmp ecx, dword [ebx - 0x7d]
les eax, [ebx + ebp*8]
pop es
dec edi
dec ebp
dec esp
inc ebx
dec ebp
dec edi
xor ch, al
or al, byte [eax]
add byte [eax], al
add byte [ebx], bh
aaa
dec edx
cmp eax, 0x46424142
inc eax
add esp, 4
pop eax
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x410376
push esi
xor esi, 0x84e4
pop esi
push ecx
sub ecx, 0xb0ff
and ecx, 0x179e5
jmp 0x41032c
call 0x41033c
add byte [ebx + 0x4c], al
dec esi
inc esp
dec ebp
inc ebp
dec eax
xor al, 0x3e
cmp dword [ebx - 0x74a6fb3c], eax
xchg ebp, eax
hlt
Function at 0x4102e1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor eax, 0x3815
and eax, 0xd09a
add eax, 0x1610c
pop eax
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
and edx, 0x13aa
pop edx
push edi
jmp 0x4101a5
sub edi, 0x7459
jmp 0x4101b2
pop edi
push esi
push edx
add esp, 4
sub esi, 0xf7d9
or esi, 0x9ad7
pop esi
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push esi
push ebx
add esp, 4
xor esi, 0x8dc7
pop esi
push ecx
add ecx, 0x8e5e
xor ecx, 0xddc6
pop ecx
push ebx
push ebx
add esp, 4
jmp 0x410241
and ebx, 0x292d
or ebx, 0x1de1
pop ebx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x41026b
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x4102c5
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x410193
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x410193
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x4102af
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x4102b9
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x41030e
push eax
sub eax, 0x80a0
call 0x4102e1
add byte [edi + 0x35], al
dec ebx
inc esp
cmp ecx, dword [ebx - 0x7d]
les eax, [ebx + ebp*8]
pop es
dec edi
dec ebp
dec esp
inc ebx
dec ebp
dec edi
xor ch, al
or al, byte [eax]
add byte [eax], al
add byte [ebx], bh
aaa
dec edx
cmp eax, 0x46424142
inc eax
add esp, 4
pop eax
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x410376
push esi
xor esi, 0x84e4
pop esi
push ecx
sub ecx, 0xb0ff
and ecx, 0x179e5
jmp 0x41032c
call 0x41033c
add byte [ebx + 0x4c], al
dec esi
inc esp
dec ebp
inc ebp
dec eax
xor al, 0x3e
cmp dword [ebx - 0x74a6fb3c], eax
xchg ebp, eax
hlt
Function at 0x4102fc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor eax, 0x3815
and eax, 0xd09a
add eax, 0x1610c
pop eax
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
and edx, 0x13aa
pop edx
push edi
jmp 0x4101a5
sub edi, 0x7459
jmp 0x4101b2
pop edi
push esi
push edx
add esp, 4
sub esi, 0xf7d9
or esi, 0x9ad7
pop esi
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push esi
push ebx
add esp, 4
xor esi, 0x8dc7
pop esi
push ecx
add ecx, 0x8e5e
xor ecx, 0xddc6
pop ecx
push ebx
push ebx
add esp, 4
jmp 0x410241
and ebx, 0x292d
or ebx, 0x1de1
pop ebx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x41026b
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x4102c5
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x410193
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x410193
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x4102af
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x4102b9
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x41030e
push eax
sub eax, 0x80a0
call 0x4102e1
add byte [edi + 0x35], al
dec ebx
inc esp
cmp ecx, dword [ebx - 0x7d]
les eax, [ebx + ebp*8]
pop es
dec edi
dec ebp
dec esp
inc ebx
dec ebp
dec edi
xor ch, al
or al, byte [eax]
add byte [eax], al
add byte [ebx], bh
aaa
dec edx
cmp eax, 0x46424142
inc eax
add esp, 4
pop eax
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x410376
push esi
xor esi, 0x84e4
pop esi
push ecx
sub ecx, 0xb0ff
and ecx, 0x179e5
jmp 0x41032c
call 0x41033c
add byte [ebx + 0x4c], al
dec esi
inc esp
dec ebp
inc ebp
dec eax
xor al, 0x3e
cmp dword [ebx - 0x74a6fb3c], eax
xchg ebp, eax
hlt
Function at 0x41033c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor eax, 0x3815
and eax, 0xd09a
add eax, 0x1610c
pop eax
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
and edx, 0x13aa
pop edx
push edi
jmp 0x4101a5
sub edi, 0x7459
jmp 0x4101b2
pop edi
push esi
push edx
add esp, 4
sub esi, 0xf7d9
or esi, 0x9ad7
pop esi
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push esi
push ebx
add esp, 4
xor esi, 0x8dc7
pop esi
push ecx
add ecx, 0x8e5e
xor ecx, 0xddc6
pop ecx
push ebx
push ebx
add esp, 4
jmp 0x410241
and ebx, 0x292d
or ebx, 0x1de1
pop ebx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x41026b
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x4102c5
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x410193
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x410193
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x4102af
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x4102b9
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x41030e
push eax
sub eax, 0x80a0
call 0x4102e1
add byte [edi + 0x35], al
dec ebx
inc esp
cmp ecx, dword [ebx - 0x7d]
les eax, [ebx + ebp*8]
pop es
dec edi
dec ebp
dec esp
inc ebx
dec ebp
dec edi
xor ch, al
or al, byte [eax]
add byte [eax], al
add byte [ebx], bh
aaa
dec edx
cmp eax, 0x46424142
inc eax
add esp, 4
pop eax
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x410376
push esi
xor esi, 0x84e4
pop esi
push ecx
sub ecx, 0xb0ff
and ecx, 0x179e5
jmp 0x41032c
call 0x41033c
add byte [ebx + 0x4c], al
dec esi
inc esp
dec ebp
inc ebp
dec eax
xor al, 0x3e
cmp dword [ebx - 0x74a6fb3c], eax
xchg ebp, eax
hlt
Function at 0x410bed
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ecx, 0x15996
pop ecx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x410c23
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x4109ee
mov dword [ebp - 0x2fc], 0
Function at 0x41158c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
or esi, 0x1043e
pop esi
push esi
or esi, 0x5188
call 0x41158c
add byte [edx + 0x34], al
cmp dh, byte ss:[ebx]
inc edx
aaa
add esp, 4
or esi, 0x5be7
pop esi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x19bc], ecx
mov edx, dword [ebp - 0x19bc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19c0], eax
mov ecx, dword [ebp - 0x19c0]
mov dword [ebp - 0x167c], ecx
push esi
push esi
add esp, 4
and esi, 0x9ee6
pop esi
push edi
call 0x4115d9
add byte [esi], bh
inc ecx
xor bh, byte [eax]
cmp byte [edx + 0x4f], cl
cmp dword [ebx + 0xbe804c4], eax
add byte [eax], al
add byte [eax], al
inc esp
dec edx
dec ecx
dec edi
cmp dword [ecx], edi
inc edi
inc edx
xor edi, dword [esi]
add esp, 4
pop edi
cmp dword [ebp - 0x167c], 0
jne 0x411608
mov dword [ebp - 0x2fc], 0
jmp 0x4118af
mov edx, dword [ebp - 0x167c]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xce0], ecx
push ecx
push ebx
add esp, 4
xor ecx, 0x9a95
or ecx, 0xe4b3
xor ecx, 0xbef
pop ecx
push esi
push esi
add esp, 4
add esi, 0x10b78
or esi, 0x230f
pop esi
push edx
add edx, 0x5a22
pop edx
cmp dword [ebp - 0xce0], 0
jne 0x411664
mov dword [ebp - 0x2fc], 0
jmp 0x4118af
mov edx, dword [ebp - 0xce0]
mov dword [ebp - 0x51c], edx
push eax
push edi
add esp, 4
xor eax, 0x22c2
add eax, 0x11092
xor eax, 0x182dc
xor eax, 0x4941
pop eax
push ebx
and ebx, 0x1725e
or ebx, 0x3d6d
add ebx, 0x6b64
pop ebx
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
jmp 0x4116d6
jmp 0x4116df
pop edx
push ecx
jmp 0x4116ea
call 0x4116fa
add byte [ebp + 0x40], al
push eax
xor esi, dword [edx]
inc edx
xor edi, dword [esi]
xor dh, byte [ebx + eax*4]
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push edi
sub edi, 0x109c6
pop edi
push esi
push esi
invalid
Function at 0x4115d9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
or esi, 0x1043e
pop esi
push esi
or esi, 0x5188
call 0x41158c
add byte [edx + 0x34], al
cmp dh, byte ss:[ebx]
inc edx
aaa
add esp, 4
or esi, 0x5be7
pop esi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x19bc], ecx
mov edx, dword [ebp - 0x19bc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19c0], eax
mov ecx, dword [ebp - 0x19c0]
mov dword [ebp - 0x167c], ecx
push esi
push esi
add esp, 4
and esi, 0x9ee6
pop esi
push edi
call 0x4115d9
add byte [esi], bh
inc ecx
xor bh, byte [eax]
cmp byte [edx + 0x4f], cl
cmp dword [ebx + 0xbe804c4], eax
add byte [eax], al
add byte [eax], al
inc esp
dec edx
dec ecx
dec edi
cmp dword [ecx], edi
inc edi
inc edx
xor edi, dword [esi]
add esp, 4
pop edi
cmp dword [ebp - 0x167c], 0
jne 0x411608
mov dword [ebp - 0x2fc], 0
jmp 0x4118af
mov edx, dword [ebp - 0x167c]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xce0], ecx
push ecx
push ebx
add esp, 4
xor ecx, 0x9a95
or ecx, 0xe4b3
xor ecx, 0xbef
pop ecx
push esi
push esi
add esp, 4
add esi, 0x10b78
or esi, 0x230f
pop esi
push edx
add edx, 0x5a22
pop edx
cmp dword [ebp - 0xce0], 0
jne 0x411664
mov dword [ebp - 0x2fc], 0
jmp 0x4118af
mov edx, dword [ebp - 0xce0]
mov dword [ebp - 0x51c], edx
push eax
push edi
add esp, 4
xor eax, 0x22c2
add eax, 0x11092
xor eax, 0x182dc
xor eax, 0x4941
pop eax
push ebx
and ebx, 0x1725e
or ebx, 0x3d6d
add ebx, 0x6b64
pop ebx
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
jmp 0x4116d6
jmp 0x4116df
pop edx
push ecx
jmp 0x4116ea
call 0x4116fa
add byte [ebp + 0x40], al
push eax
xor esi, dword [edx]
inc edx
xor edi, dword [esi]
xor dh, byte [ebx + eax*4]
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push edi
sub edi, 0x109c6
pop edi
push esi
push esi
invalid
Function at 0x4115ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
or esi, 0x1043e
pop esi
push esi
or esi, 0x5188
call 0x41158c
add byte [edx + 0x34], al
cmp dh, byte ss:[ebx]
inc edx
aaa
add esp, 4
or esi, 0x5be7
pop esi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x19bc], ecx
mov edx, dword [ebp - 0x19bc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19c0], eax
mov ecx, dword [ebp - 0x19c0]
mov dword [ebp - 0x167c], ecx
push esi
push esi
add esp, 4
and esi, 0x9ee6
pop esi
push edi
call 0x4115d9
add byte [esi], bh
inc ecx
xor bh, byte [eax]
cmp byte [edx + 0x4f], cl
cmp dword [ebx + 0xbe804c4], eax
add byte [eax], al
add byte [eax], al
inc esp
dec edx
dec ecx
dec edi
cmp dword [ecx], edi
inc edi
inc edx
xor edi, dword [esi]
add esp, 4
pop edi
cmp dword [ebp - 0x167c], 0
jne 0x411608
mov dword [ebp - 0x2fc], 0
jmp 0x4118af
mov edx, dword [ebp - 0x167c]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xce0], ecx
push ecx
push ebx
add esp, 4
xor ecx, 0x9a95
or ecx, 0xe4b3
xor ecx, 0xbef
pop ecx
push esi
push esi
add esp, 4
add esi, 0x10b78
or esi, 0x230f
pop esi
push edx
add edx, 0x5a22
pop edx
cmp dword [ebp - 0xce0], 0
jne 0x411664
mov dword [ebp - 0x2fc], 0
jmp 0x4118af
mov edx, dword [ebp - 0xce0]
mov dword [ebp - 0x51c], edx
push eax
push edi
add esp, 4
xor eax, 0x22c2
add eax, 0x11092
xor eax, 0x182dc
xor eax, 0x4941
pop eax
push ebx
and ebx, 0x1725e
or ebx, 0x3d6d
add ebx, 0x6b64
pop ebx
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
jmp 0x4116d6
jmp 0x4116df
pop edx
push ecx
jmp 0x4116ea
call 0x4116fa
add byte [ebp + 0x40], al
push eax
xor esi, dword [edx]
inc edx
xor edi, dword [esi]
xor dh, byte [ebx + eax*4]
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push edi
sub edi, 0x109c6
pop edi
push esi
push esi
invalid
Function at 0x4116fa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
or esi, 0x1043e
pop esi
push esi
or esi, 0x5188
call 0x41158c
add byte [edx + 0x34], al
cmp dh, byte ss:[ebx]
inc edx
aaa
add esp, 4
or esi, 0x5be7
pop esi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x19bc], ecx
mov edx, dword [ebp - 0x19bc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19c0], eax
mov ecx, dword [ebp - 0x19c0]
mov dword [ebp - 0x167c], ecx
push esi
push esi
add esp, 4
and esi, 0x9ee6
pop esi
push edi
call 0x4115d9
add byte [esi], bh
inc ecx
xor bh, byte [eax]
cmp byte [edx + 0x4f], cl
cmp dword [ebx + 0xbe804c4], eax
add byte [eax], al
add byte [eax], al
inc esp
dec edx
dec ecx
dec edi
cmp dword [ecx], edi
inc edi
inc edx
xor edi, dword [esi]
add esp, 4
pop edi
cmp dword [ebp - 0x167c], 0
jne 0x411608
mov dword [ebp - 0x2fc], 0
jmp 0x4118af
mov edx, dword [ebp - 0x167c]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xce0], ecx
push ecx
push ebx
add esp, 4
xor ecx, 0x9a95
or ecx, 0xe4b3
xor ecx, 0xbef
pop ecx
push esi
push esi
add esp, 4
add esi, 0x10b78
or esi, 0x230f
pop esi
push edx
add edx, 0x5a22
pop edx
cmp dword [ebp - 0xce0], 0
jne 0x411664
mov dword [ebp - 0x2fc], 0
jmp 0x4118af
mov edx, dword [ebp - 0xce0]
mov dword [ebp - 0x51c], edx
push eax
push edi
add esp, 4
xor eax, 0x22c2
add eax, 0x11092
xor eax, 0x182dc
xor eax, 0x4941
pop eax
push ebx
and ebx, 0x1725e
or ebx, 0x3d6d
add ebx, 0x6b64
pop ebx
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
jmp 0x4116d6
jmp 0x4116df
pop edx
push ecx
jmp 0x4116ea
call 0x4116fa
add byte [ebp + 0x40], al
push eax
xor esi, dword [edx]
inc edx
xor edi, dword [esi]
xor dh, byte [ebx + eax*4]
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push edi
sub edi, 0x109c6
pop edi
push esi
push esi
invalid
Function at 0x411777
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x89b5
sub esi, 0xa08b
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4117a4
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x4117fe
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4116cc
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4116cc
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4117e8
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x4117f2
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x411847
push ecx
push edx
add esp, 4
jmp 0x411814
and ecx, 0x154b4
sub ecx, 0xaa67
add ecx, 0x13c86
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0x16d1
or ecx, 0x5a83
pop ecx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x4118af
push eax
push eax
add esp, 4
xor eax, 0x1c8e
and eax, 0x41c3
jmp 0x411861
pop eax
push ebx
push eax
add esp, 4
jmp 0x41186c
jmp 0x411872
add ebx, 0x11c56
pop ebx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x4118a5
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x411670
mov dword [ebp - 0x2fc], 0
push eax
push esi
add esp, 4
call 0x4118c0
add byte [edi + 0x3a], cl
cmp al, 0x38
dec ebp
add esp, 4
call 0x4118d1
add byte [edx + 0x4f], cl
cmp eax, 0x474a3c3c
dec esp
add esp, 4
and eax, 0x145ee
or eax, 0x5333
pop eax
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push edx
jmp 0x4118f9
add edx, 0x17664
or edx, 0x1963
add edx, 0x34a8
pop edx
push eax
push ebx
add esp, 4
call 0x41191e
add byte [edx + 0x45], al
xor dh, byte [edi]
xor al, 0x32
inc ebx
add esp, 4
pop eax
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 0
jne 0x411952
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x411c43
add byte [eax], al
mov ecx, dword [ebp - 0x520]
mov dword [ebp - 0xab4], ecx
Function at 0x4118c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x89b5
sub esi, 0xa08b
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4117a4
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x4117fe
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4116cc
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4116cc
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4117e8
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x4117f2
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x411847
push ecx
push edx
add esp, 4
jmp 0x411814
and ecx, 0x154b4
sub ecx, 0xaa67
add ecx, 0x13c86
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0x16d1
or ecx, 0x5a83
pop ecx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x4118af
push eax
push eax
add esp, 4
xor eax, 0x1c8e
and eax, 0x41c3
jmp 0x411861
pop eax
push ebx
push eax
add esp, 4
jmp 0x41186c
jmp 0x411872
add ebx, 0x11c56
pop ebx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x4118a5
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x411670
mov dword [ebp - 0x2fc], 0
push eax
push esi
add esp, 4
call 0x4118c0
add byte [edi + 0x3a], cl
cmp al, 0x38
dec ebp
add esp, 4
call 0x4118d1
add byte [edx + 0x4f], cl
cmp eax, 0x474a3c3c
dec esp
add esp, 4
and eax, 0x145ee
or eax, 0x5333
pop eax
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push edx
jmp 0x4118f9
add edx, 0x17664
or edx, 0x1963
add edx, 0x34a8
pop edx
push eax
push ebx
add esp, 4
call 0x41191e
add byte [edx + 0x45], al
xor dh, byte [edi]
xor al, 0x32
inc ebx
add esp, 4
pop eax
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 0
jne 0x411952
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x411c43
add byte [eax], al
mov ecx, dword [ebp - 0x520]
mov dword [ebp - 0xab4], ecx