joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a140
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x58a710]
xor eax, ebp
mov dword [ebp + 0x39c], eax
mov eax, dword [ebp + 0x3a8]
push ebx
push esi
push edi
push 5
push 0
push 0
push eax
push str.open
push 0
mov dword [ebp - 0x7c], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, eax
mov dword [ebp - 0x80], ebx
cmp ebx, 0x20
ja 0x40a29a
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x78]
push eax
push 1
push 0
push str..htm
push 0x80000000
call esi
test eax, eax
jne 0x40a298
lea ecx, [ebp - 0x78]
push ecx
lea edi, [ebp - 0x74]
call fcn.00409e80
test eax, eax
jne 0x40a298
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str._shellopencommand
mov edx, edi
push edx
call ebx
lea eax, [ebp - 0x78]
push eax
push 1
push 0
mov ecx, edi
push ecx
push 0x80000000
call esi
test eax, eax
jne 0x40a293
lea edx, [ebp - 0x78]
push edx
call fcn.00409e80
test eax, eax
jne 0x40a293
mov eax, edi
push 0x564d44
push eax
call fcn.0050ebda
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a240
lea ecx, [ebp - 0x74]
push 0x564d50
push ecx
call fcn.0050ebda
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a239
lea edx, [ebp - 0x74]
push edx
call edi
lea esi, [ebp + eax*2 - 0x76]
jmp 0x40a245
xor eax, eax
mov word [esi], ax
jmp 0x40a245
xor ecx, ecx
mov word [esi], cx
push 0x564d58
push esi
call ebx
mov edx, dword [ebp - 0x7c]
push edx
push esi
call ebx
lea eax, [ebp - 0x74]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x40a26f
xor eax, eax
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x40a29a
lea esi, [eax + eax]
mov eax, esi
call fcn.00513cd0
mov eax, esp
push 3
push esi
lea ecx, [ebp - 0x74]
push ecx
push eax
call fcn.0040a2c0
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x40a29a
mov eax, dword [ebp - 0x80]
jmp 0x40a29a
mov eax, ebx
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
xor ecx, ebp
call fcn.0050e14c
add ebp, 0x3a0
mov esp, ebp
pop ebp
ret 4
Function at 0x40dc40
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5372cb
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0x58a710]
xor eax, esp
mov dword [esp + 0xd4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58a710]
xor eax, esp
push eax
lea eax, [esp + 0xec]
mov dword fs:[0], eax
mov edi, ecx
push 0xc6
xor ebp, ebp
lea ecx, [esp + 0x26]
xor eax, eax
push ebp
push ecx
mov dword [esp + 0x24], edi
mov esi, edx
mov word [esp + 0x2c], ax
call fcn.00510f20
mov edx, dword [esi]
mov eax, dword [esi + 0xc]
push edx
push 1
push eax
push edi
call fcn.0050fa1c
add esp, 0x1c
cmp eax, 1
mov eax, dword [esi + 0xc]
sete bl
cdq
idiv dword [esi + 0x10]
mov byte [esp + 0x16], bl
mov dword [esi + 0x14], eax
test bl, bl
je 0x40de24
push eax
push str.length__d
lea edx, [esp + 0x28]
call fcn.0040e3d0
lea ecx, [esi + 0x18]
lea eax, [esp + 0x28]
add esp, 8
mov dword [esp + 0x1c], ecx
lea ebx, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
cmp dx, bp
jne 0x40dcf0
sub eax, ebx
sar eax, 1
push eax
lea edx, [esp + 0x24]
push edx
call fcn.00404280
mov ecx, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
xor eax, eax
cmp ecx, 1
sete byte [esp + 0x17]
test ebx, ebx
je 0x40ddc1
xor edx, edx
dec ebx
cmp byte [esp + 0x17], dl
je 0x40dd2f
cmp byte [edi], dl
jmp 0x40dd33
cmp word [edi], 0
sete dl
test edx, edx
je 0x40dd5d
test eax, eax
je 0x40dd56
cmp edi, eax
je 0x40dd56
imul ecx, ebp
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call fcn.0050f020
add esp, 0xc
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
inc ebp
add edi, ecx
test ebx, ebx
jne 0x40dd22
test eax, eax
je 0x40dd80
cmp edi, eax
je 0x40dd80
mov ecx, dword [esi + 0x10]
imul ecx, ebp
sub edi, eax
push edi
push eax
sub eax, ecx
push eax
call fcn.0050f020
add esp, 0xc
test ebp, ebp
je 0x40ddc1
push ebp
push str.__d_nulls_removed_
lea edx, [esp + 0x28]
call fcn.0040e3d0
lea eax, [esp + 0x28]
add esp, 8
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40dda0
mov ecx, dword [esp + 0x1c]
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x24]
push edx
call fcn.0040a4e0
sub dword [esi + 0x14], ebp
cmp dword [esi + 0x10], 1
jle 0x40ddf8
test byte [esi + 4], 0x80
je 0x40ddf8
mov esi, dword [esi + 0x14]
test esi, esi
je 0x40ddea
mov ecx, dword [esp + 0x18]
movzx eax, word [ecx + esi*2 - 2]
dec esi
rol ax, 8
mov word [ecx + esi*2], ax
test esi, esi
jne 0x40ddd4
mov ecx, dword [esp + 0x1c]
push str.endian_swap
call fcn.0040a5f0
mov al, byte [esp + 0x16]
mov ecx, dword [esp + 0xec]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xd4]
xor ecx, esp
call fcn.0050e14c
add esp, 0xe4
ret
lea edi, [esp + 0x18]
call fcn.0040b340
lea ecx, [esi + 0x18]
push eax
mov dword [esp + 0xf8], ebp
call fcn.00405700
mov dword [esp + 0xf4], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40de68
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
jmp 0x40ddfc
Function at 0x40e2b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x536db3
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
mov eax, dword [0x58a710]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
call fcn.0041083a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40e2f1
push 0x80004005
call fcn.00404b00
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x18], 0
lea ebp, [esi + 4]
call fcn.0041083a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40e324
push 0x80004005
call fcn.00404b00
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp], eax
mov byte [esp + 0x18], 1
mov edx, dword [esp + 0x24]
test edx, edx
jne 0x40e344
xor eax, eax
jmp 0x40e35f
mov eax, edx
lea ebx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e350
sub eax, ebx
sar eax, 1
push eax
push edx
mov ecx, esi
call fcn.00404280
mov edx, dword [esp + 0x28]
test edx, edx
jne 0x40e374
xor eax, eax
jmp 0x40e38f
mov eax, edx
lea ebx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e380
sub eax, ebx
sar eax, 1
push eax
push edx
mov ecx, ebp
call fcn.00404280
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14

Function at 0x40f2b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x58a710]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.00510f20
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x40f384
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x40f342
mov eax, dword [esp + 8]
test eax, eax
jne 0x40f322
mov eax, 3
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0050e14c
add esp, 0x118
ret
jbe 0x40f3af
mov eax, 4
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0050e14c
add esp, 0x118
ret
cmp eax, 6
jne 0x40f368
cmp dword [esp + 8], 0
jne 0x40f36a
mov eax, 5
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0050e14c
add esp, 0x118
ret
jb 0x40f3af
mov eax, 6
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0050e14c
add esp, 0x118
ret
cmp eax, 1
jne 0x40f3af
cmp dword [esp + 4], 4
jne 0x40f3af
cmp dword [esp + 8], 0x5a
sbb eax, eax
add eax, 2
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0050e14c
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.0050e14c
add esp, 0x118
ret
Function at 0x40f7b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x510
mov eax, dword [0x58a710]
xor eax, esp
mov dword [esp + 0x50c], eax
push 0x104
lea eax, [esp + 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x30c]
push ecx
lea edx, [esp + 0x410]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x218]
push edx
call fcn.0050ff02
push 0x568fe8
push str.V6Setting
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x128]
push edx
call fcn.0050ff4e
add esp, 0x28
push 1
lea eax, [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x50c]
xor ecx, esp
call fcn.0050e14c
add esp, 0x510
ret

Function at 0x40fbf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 4]
push eax
push 0x2001f
push 0
push str.SoftwareRapooV6
push 0x80000001
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40fc53
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
add edx, 0x54
push edx
lea eax, [esp + 0x18]
push eax
push 0
push str.v6Setting
push esi
mov dword [esp + 0x20], 0x75dc
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x40fc53
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 8
ret 4

Function at 0x40fd00
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40fd31
mov eax, dword [esp + 0xc]
sub eax, 3
neg eax
sbb eax, eax
and eax, 0xd
ret 0xc

Function at 0x414a2c
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5345b4
call fcn.00510be8
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x414a51
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x414a97
lea ecx, [ebp - 0x10]
call fcn.00404b60
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045248d
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00404b20
mov eax, esi
call fcn.00510cc0
ret 8
Function at 0x4214f3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or eax, 0x111e4
add eax, 0x2ae0
pop eax
push eax
push esi
add esp, 4
and eax, 0x8edf
jmp 0x4211f0
pop eax
cmp dword [ebp - 0x14d4], 0
jne 0x421209
mov dword [ebp - 0x2e0], 0
jmp 0x4214c5
mov eax, dword [ebp - 0x14d4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc20], edx
push edx
push ecx
add esp, 4
add edx, 0x169e
pop edx
push eax
or eax, 0x16d03
pop eax
push eax
push ecx
add esp, 4
add eax, 0x16855
add eax, 0xd580
and eax, 0x145b2
sub eax, 0x105c4
pop eax
cmp dword [ebp - 0xc20], 0
jne 0x421265
mov dword [ebp - 0x2e0], 0
jmp 0x4214c5
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x4d4], eax
test dword [ebx + edi*8], ebp
invalid
invalid
push edx
jmp 0x42127b
jmp 0x421280
pop edx
push ecx
and ecx, 0x10804
pop ecx
push edi
xor edi, 0x230b
sub edi, 0x4145
sub edi, 0x8d22
or edi, 0x515
pop edi
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
push ecx
sub ecx, 0x626d
add ecx, 0x17b3c
sub ecx, 0x152f5
pop ecx
push eax
push ecx
add esp, 4
add eax, 0x124d
pop eax
push eax
call 0x4214f3
add byte [edi], dh
dec ecx
cmp al, 0x42
dec ebp
add esp, 4
pop eax
cmp dword [ebp - 0x2e0], 0
jne 0x421e10
mov edx, 0x6b
mov word [ebp - 0x16cc], dx
mov eax, 0x65
mov word [ebp - 0x16ca], ax
mov ecx, 0x72
mov word [ebp - 0x16c8], cx
mov edx, 0x6e
outsb dx, byte [esi]
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
cmp ch, cl
invalid
invalid
mov eax, 0x65
mov word [ebp - 0x16c4], ax
mov ecx, 0x6c
mov word [ebp - 0x16c2], cx
mov edx, 0x33
mov word [ebp - 0x16c0], dx
mov eax, 0x32
mov word [ebp - 0x16be], ax
mov ecx, 0x2e
mov word [ebp - 0x16bc], cx
mov edx, 0x64
invalid
invalid

Function at 0x4215e3
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
popal
mov byte [ebp - 0x81d], 0x64
mov byte [ebp - 0x81c], 0x4c
mov byte [ebp - 0x81b], 0x69
mov byte [ebp - 0x81a], 0x62
mov byte [ebp - 0x819], 0x72
mov byte [ebp - 0x818], 0x61
mov byte [ebp - 0x817], 0x72
mov byte [ebp - 0x816], 0x79
Function at 0x421bdc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6f4]
add edx, 1
mov dword [ebp - 0x6f4], edx
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x6f4]
cmp ecx, dword [eax + 0x18]
jae 0x421d29
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a0]
mov ecx, dword [ebp - 0x2f8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x6f8], ecx
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18a8]
mov eax, dword [ebp - 0x2f8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18ac], eax
mov dword [ebp - 0x180], 0
jmp 0x421b8d
mov ecx, dword [ebp - 0x180]
add ecx, 1
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
test eax, eax
je 0x421c3f
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
test edx, edx
je 0x421c3f
push edi
push ebx
add esp, 4
jmp 0x421bc6
sub edi, 0x18194
call 0x421bdc
add byte [esi], dh
inc ecx
cmp dword [ebp + edi + 0x3e], eax
inc ebp
dec edi
cmp dword [ebp - 0x7d], eax
les eax, [edi + ebx*2]
push ecx
push esi
add esp, 4
and ecx, 0x17e27
pop ecx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
cmp ecx, eax
je 0x421c31
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [ebp - 0x180]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x180]
movsx ecx, byte [ebp + eax - 0x820]
cmp edx, ecx
jne 0x421c38
jmp 0x421b7e
jmp 0x421c3f
push edx
push edx
add esp, 4
add edx, 0x13384
or edx, 0x17706
sub edx, 0xd295
pop edx
push edi
xor edi, 0x449
pop edi
push ecx
push ecx
add esp, 4
sub ecx, 0xb8fc
sub ecx, 0xdc27
pop ecx
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
cmp eax, edx
jne 0x421c9e
mov dword [ebp - 0xc30], 0
jmp 0x421d0d
push eax
push esi
add esp, 4
add eax, 0x14ba0
and eax, 0x14f27
xor eax, 0x40ae
pop eax
push edx
add edx, 0x12ec4
call 0x421ccc
add byte [ebx + esi], bh
inc edx
dec edx
dec ecx
dec ecx
xor dh, byte [eax + ecx*2]
add esp, 4
pop edx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
or eax, 0x20
cmp ecx, eax
jge 0x421d03
mov dword [ebp - 0xc30], 0xffffffff
jmp 0x421d0d
mov dword [ebp - 0xc30], 1
cmp dword [ebp - 0xc30], 0
jne 0x421d24
mov ecx, dword [ebp - 0x18ac]
mov dword [ebp - 0x3c4], ecx
jmp 0x421d35
jmp 0x421b0e
mov edx, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], edx
cmp dword [ebp - 0x3c4], 0
je 0x421e10
push ebx
push ebx
add esp, 4
add ebx, 0x2eb8
add ebx, 0xf917
and ebx, 0x10920
xor ebx, 0x12c1f
pop ebx
push eax
push ecx
add esp, 4
or eax, 0x57e8
pop eax
push edi
or edi, 0x130fd
pop edi
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x18b0], eax
call dword [ecx + 0x52]
add esp, 4
jmp 0x421d8d
pop ecx
push eax
push eax
add esp, 4
jmp 0x421d9c
and eax, 0xa4b2
jmp 0x421dab
sub eax, 0x1793
pop eax
mov ecx, dword [ebp - 0x18b0]
mov dword [ebp - 0x18b4], ecx
Function at 0x421ccc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6f4]
add edx, 1
mov dword [ebp - 0x6f4], edx
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x6f4]
cmp ecx, dword [eax + 0x18]
jae 0x421d29
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a0]
mov ecx, dword [ebp - 0x2f8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x6f8], ecx
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18a8]
mov eax, dword [ebp - 0x2f8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18ac], eax
mov dword [ebp - 0x180], 0
jmp 0x421b8d
mov ecx, dword [ebp - 0x180]
add ecx, 1
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
test eax, eax
je 0x421c3f
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
test edx, edx
je 0x421c3f
push edi
push ebx
add esp, 4
jmp 0x421bc6
sub edi, 0x18194
call 0x421bdc
add byte [esi], dh
inc ecx
cmp dword [ebp + edi + 0x3e], eax
inc ebp
dec edi
cmp dword [ebp - 0x7d], eax
les eax, [edi + ebx*2]
push ecx
push esi
add esp, 4
and ecx, 0x17e27
pop ecx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
cmp ecx, eax
je 0x421c31
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [ebp - 0x180]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x180]
movsx ecx, byte [ebp + eax - 0x820]
cmp edx, ecx
jne 0x421c38
jmp 0x421b7e
jmp 0x421c3f
push edx
push edx
add esp, 4
add edx, 0x13384
or edx, 0x17706
sub edx, 0xd295
pop edx
push edi
xor edi, 0x449
pop edi
push ecx
push ecx
add esp, 4
sub ecx, 0xb8fc
sub ecx, 0xdc27
pop ecx
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
cmp eax, edx
jne 0x421c9e
mov dword [ebp - 0xc30], 0
jmp 0x421d0d
push eax
push esi
add esp, 4
add eax, 0x14ba0
and eax, 0x14f27
xor eax, 0x40ae
pop eax
push edx
add edx, 0x12ec4
call 0x421ccc
add byte [ebx + esi], bh
inc edx
dec edx
dec ecx
dec ecx
xor dh, byte [eax + ecx*2]
add esp, 4
pop edx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
or eax, 0x20
cmp ecx, eax
jge 0x421d03
mov dword [ebp - 0xc30], 0xffffffff
jmp 0x421d0d
mov dword [ebp - 0xc30], 1
cmp dword [ebp - 0xc30], 0
jne 0x421d24
mov ecx, dword [ebp - 0x18ac]
mov dword [ebp - 0x3c4], ecx
jmp 0x421d35
jmp 0x421b0e
mov edx, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], edx
cmp dword [ebp - 0x3c4], 0
je 0x421e10
push ebx
push ebx
add esp, 4
add ebx, 0x2eb8
add ebx, 0xf917
and ebx, 0x10920
xor ebx, 0x12c1f
pop ebx
push eax
push ecx
add esp, 4
or eax, 0x57e8
pop eax
push edi
or edi, 0x130fd
pop edi
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x18b0], eax
call dword [ecx + 0x52]
add esp, 4
jmp 0x421d8d
pop ecx
push eax
push eax
add esp, 4
jmp 0x421d9c
and eax, 0xa4b2
jmp 0x421dab
sub eax, 0x1793
pop eax
mov ecx, dword [ebp - 0x18b0]
mov dword [ebp - 0x18b4], ecx
Function at 0x421d7f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6f4]
add edx, 1
mov dword [ebp - 0x6f4], edx
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x6f4]
cmp ecx, dword [eax + 0x18]
jae 0x421d29
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a0]
mov ecx, dword [ebp - 0x2f8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x6f8], ecx
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18a8]
mov eax, dword [ebp - 0x2f8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18ac], eax
mov dword [ebp - 0x180], 0
jmp 0x421b8d
mov ecx, dword [ebp - 0x180]
add ecx, 1
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
test eax, eax
je 0x421c3f
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
test edx, edx
je 0x421c3f
push edi
push ebx
add esp, 4
jmp 0x421bc6
sub edi, 0x18194
call 0x421bdc
add byte [esi], dh
inc ecx
cmp dword [ebp + edi + 0x3e], eax
inc ebp
dec edi
cmp dword [ebp - 0x7d], eax
les eax, [edi + ebx*2]
push ecx
push esi
add esp, 4
and ecx, 0x17e27
pop ecx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
cmp ecx, eax
je 0x421c31
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [ebp - 0x180]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x180]
movsx ecx, byte [ebp + eax - 0x820]
cmp edx, ecx
jne 0x421c38
jmp 0x421b7e
jmp 0x421c3f
push edx
push edx
add esp, 4
add edx, 0x13384
or edx, 0x17706
sub edx, 0xd295
pop edx
push edi
xor edi, 0x449
pop edi
push ecx
push ecx
add esp, 4
sub ecx, 0xb8fc
sub ecx, 0xdc27
pop ecx
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
cmp eax, edx
jne 0x421c9e
mov dword [ebp - 0xc30], 0
jmp 0x421d0d
push eax
push esi
add esp, 4
add eax, 0x14ba0
and eax, 0x14f27
xor eax, 0x40ae
pop eax
push edx
add edx, 0x12ec4
call 0x421ccc
add byte [ebx + esi], bh
inc edx
dec edx
dec ecx
dec ecx
xor dh, byte [eax + ecx*2]
add esp, 4
pop edx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
or eax, 0x20
cmp ecx, eax
jge 0x421d03
mov dword [ebp - 0xc30], 0xffffffff
jmp 0x421d0d
mov dword [ebp - 0xc30], 1
cmp dword [ebp - 0xc30], 0
jne 0x421d24
mov ecx, dword [ebp - 0x18ac]
mov dword [ebp - 0x3c4], ecx
jmp 0x421d35
jmp 0x421b0e
mov edx, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], edx
cmp dword [ebp - 0x3c4], 0
je 0x421e10
push ebx
push ebx
add esp, 4
add ebx, 0x2eb8
add ebx, 0xf917
and ebx, 0x10920
xor ebx, 0x12c1f
pop ebx
push eax
push ecx
add esp, 4
or eax, 0x57e8
pop eax
push edi
or edi, 0x130fd
pop edi
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x18b0], eax
call dword [ecx + 0x52]
add esp, 4
jmp 0x421d8d
pop ecx
push eax
push eax
add esp, 4
jmp 0x421d9c
and eax, 0xa4b2
jmp 0x421dab
sub eax, 0x1793
pop eax
mov ecx, dword [ebp - 0x18b0]
mov dword [ebp - 0x18b4], ecx