joyce8/EMBER2024-capa huggingface dataset:
Function at 0xecd50
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11c563
mov eax, dword fs:[0]
push eax
sub esp, 0x1d0
mov eax, dword [0x13206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1d8], ebx
mov eax, dword [ebp + 8]
lea esi, [ebx + 0x14]
mov dword [ebp - 0x1d8], 0
lea ecx, [esi + 4]
mov byte [ebx], 0
xor edx, edx
mov dword [ebp - 0x1d8], esi
mov dword [esi], 0x129c14
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov dword [ebp - 0x1dc], ebx
mov word [ecx], dx
mov dword [ebp - 4], edx
add eax, 4
inc dword [0x134754]
cmp ecx, eax
je 0xecde4
cmp dword [eax + 0x14], 8
mov edx, eax
jb 0xecddb
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.000d1370
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 1
mov dword [ebx + 0x30], eax
lea eax, [ebp - 0x1d4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0xecead
mov eax, 2
mov word [ebx + 4], ax
movzx eax, word [ebx + 0x30]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, esi
mov word [ebx + 6], ax
lea ecx, [ebp - 0x44]
call fcn.000d3af0
mov byte [ebp - 4], 3
lea edx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x1d8], 2
call fcn.000cede0
add esp, 4
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov edx, dword [ebp - 0x14]
mov dword [ebx + 8], eax
cmp edx, 0x10
jb 0xecea5
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xece9b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xecf3b
push edx
push ecx
call fcn.000f17bc
add esp, 8
lea ecx, [ebp - 0x44]
call fcn.000ced70
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0xecf15
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 0x1d8]
push 4
push eax
push 0x1005
push 0xffff
push edi
mov dword [ebp - 0x1d8], 0x1388
call esi
push 4
lea eax, [ebp - 0x1d8]
push eax
push 0x1006
push 0xffff
push edi
call esi
push 0x10
lea eax, [ebx + 4]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0xecf18
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
or edi, 0xffffffff
mov dword [ebx + 0x34], edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.000f1776
mov esp, ebp
pop ebp
ret 8
call fcn.000f75a6
int3
Function at 0xecf70
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov ecx, dword [esi]
test ecx, ecx
je 0xecf93
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi], 0
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
xorps xmm0, xmm0
mov dword [esp + 0xc], 0
push eax
lea edx, [esp + 0x10]
movlpd qword [esp + 0x14], xmm0
call fcn.000e3ea0
add esp, 4
test al, al
jne 0xecfc8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esp + 0xc]
push 0
push dword [esp + 0x14]
push esi
push dword [ebx + 0x34]
call dword [sym.imp.WS2_32.dll_send]
push esi
test eax, eax
jg 0xecff7
call fcn.000f1787
add esp, 4
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.000f1787
add esp, 4
push 0x4b0
call fcn.000f17ca
add esp, 4
mov edi, eax
push 0x4b0
push 0
push edi
call fcn.000f3cb0
add esp, 0xc
xor esi, esi
push 0
push 0x4b0
push edi
push dword [ebx + 0x34]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0xed05d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 4
jl 0xed020
push edi
call fcn.000f1787
add esp, 4
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cdq
mov ecx, edi
push edx
push eax
call fcn.000e3fb0
mov ebx, dword [ebp + 0xc]
push edi
mov dword [ebx], eax
call fcn.000f1787
add esp, 0xc
xor eax, eax
cmp dword [ebx], eax
mov ecx, 0xfffffffc
cmove eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0xed090
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, ecx
cmp dword [edi + 0x20c], 0xffffffff
jne 0xed147
push esi
push dword [edi]
lea esi, [edi + 4]
push 0x12a570
push 0x104
push esi
call fcn.000cd670
add esp, 0x10
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x20]
movq qword [ebp - 0xc], xmm0
movups xmmword [ebp - 0x20], xmm0
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x2000
push 0x2000
push 1
push 6
push 3
push esi
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [edi + 0x20c], eax
pop esi
cmp eax, 0xffffffff
je 0xed140
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
nop dword [eax + eax]
cmp dword [edi + 0x20c], 0xffffffff
setne al
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0xeed00
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1530
call fcn.000f2760
mov eax, dword [0x13206c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 0x114
push ebx
mov dword [ebp - 0x152c], esi
mov eax, dword [esi + 0x210]
mov dword [esi + 0x214], eax
lea eax, [ebp - 0x518]
push eax
call fcn.000f3cb0
add esp, 0xc
mov dword [ebp - 0x518], 0x114
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x508], 2
jne 0xeed70
mov ecx, esi
call fcn.000ee570
jmp 0xeeea7
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov dword [ebp - 0x1528], ebx
push edi
nop dword [eax]
test ebx, ebx
jne 0xeeea0
push 0x100
mov dword [ebp - 0x1530], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0xeedb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x12a7ec
call fcn.000e5c00
add esp, 8
push 0x100c
lea eax, [ebp - 0x1524]
push 0
push eax
call fcn.000f3cb0
add esp, 0xc
push 0
push 0x4000000
push 0
push 0
push 0
push 0
push 0x12a820
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0xeee11
push 0
lea eax, [ebp - 0x1530]
push eax
push 4
lea eax, [ebp - 0x1524]
push eax
push 0
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
lea edi, [ebp - 0x1518]
nop dword [eax]
cmp byte [ebp + esi - 0x1520], 0
je 0xeee6d
mov eax, esi
shr eax, 1
cmp byte [ebp + eax - 0x1524], 0
je 0xeee6d
xor eax, eax
mov edx, edi
nop dword [eax]
movzx ecx, word [edx]
lea edx, [edx + 2]
mov dword [ebp + eax*4 - 0x404], ecx
inc eax
cmp eax, 0x100
jl 0xeee40
lea eax, [ebp - 0x404]
push eax
push ecx
mov ecx, dword [ebp - 0x152c]
call fcn.000ee9c0
mov ebx, 1
inc esi
add edi, 0x200
cmp esi, 8
jb 0xeee20
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push eax
call esi
mov eax, dword [ebp - 0x1528]
inc eax
mov dword [ebp - 0x1528], eax
cmp eax, 0xa
jl 0xeed80
mov esi, dword [ebp - 0x152c]
pop edi
mov ecx, dword [esi + 0x214]
mov eax, 0x4bda12f7
sub ecx, dword [esi + 0x210]
imul ecx
mov ecx, dword [ebp - 4]
sar edx, 7
xor ecx, ebp
mov eax, edx
shr eax, 0x1f
pop esi
add eax, edx
pop ebx
call fcn.000f1776
mov esp, ebp
pop ebp
ret
Function at 0xeeee0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
push ebx
lea ebx, [eax + 0x210]
mov dword [ebp - 0xc], eax
push esi
mov esi, dword [ebx]
push edi
mov dword [ebp - 0x10], ebx
cmp esi, dword [eax + 0x214]
je 0xeefdd
mov ecx, dword [ebp + 8]
lea edi, [esi + 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add ecx, 0xa8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
nop dword [eax]
push ecx
call ebx
push 0x12a848
call ebx
sub edi, 0xffffff80
push edi
call ebx
push 0x12a848
call ebx
mov ecx, dword [ebp + 8]
lea eax, [ecx + 0x28]
push eax
call ebx
push 0x12a848
call ebx
push dword [ebp - 4]
call ebx
push 0x12a848
call ebx
mov eax, dword [ebp - 8]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0xeef76
test cl, cl
je 0xeef72
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0xeef76
add eax, 2
add edi, 2
test cl, cl
jne 0xeef56
xor eax, eax
jmp 0xeef7b
sbb eax, eax
or eax, 1
mov edi, dword [ebp - 4]
test eax, eax
jne 0xeefb9
mov edx, dword [ebp + 8]
mov ecx, edi
lea eax, [edx + 0x28]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0xeefb0
test dl, dl
je 0xeefac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0xeefb0
add eax, 2
add ecx, 2
test dl, dl
jne 0xeef90
xor eax, eax
jmp 0xeefb5
sbb eax, eax
or eax, 1
test eax, eax
je 0xef032
mov eax, dword [ebp - 0xc]
add esi, 0x1b0
mov ecx, dword [ebp - 8]
add edi, 0x1b0
mov dword [ebp - 4], edi
cmp esi, dword [eax + 0x214]
jne 0xeef20
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
lea ecx, [esi + 0xa8]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xeeff0
sub ecx, edx
je 0xef032
mov eax, dword [ebx + 4]
cmp dword [ebx + 8], eax
je 0xef01e
mov edi, eax
mov ecx, 0x6c
rep movsd dword es:[edi], dword [esi]
add dword [ebx + 4], 0x1b0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push eax
mov ecx, ebx
call fcn.000ef040
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xf0035
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x11c6ce
call fcn.000f2050
mov edi, ecx
mov dword [ebp - 0x30], edi
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0xf016a
cmp byte [edi + 0x3e], bl
je 0xf016a
mov eax, dword [edi]
mov ecx, 0xffff
push ecx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [fcn.0011d2d4]
mov ecx, edi
call esi
mov ecx, 0xffff
cmp cx, ax
jne 0xf0082
xor al, al
jmp 0xf016c
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.000ca490
lea eax, [edi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
cmp ecx, 0x10
jb 0xf00b7
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0xf00c1
mov edx, eax
mov edi, dword [edi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov esi, dword [edi]
push eax
push edx
push dword [ebp - 0x34]
mov ecx, dword [esi + 0x20]
call dword [fcn.0011d2d4]
mov ecx, edi
call dword [esi + 0x20]
sub eax, ebx
je 0xf00f1
sub eax, 1
jne 0xf014f
mov edi, dword [ebp - 0x30]
jmp 0xf00f7
mov edi, dword [ebp - 0x30]
mov byte [edi + 0x3e], bl
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0xf0107
mov edx, eax
mov esi, dword [ebp - 0x38]
sub esi, edx
je 0xf0131
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0xf0118
mov edx, eax
push dword [edi + 0x4c]
push esi
push 1
push edx
call fcn.000fbaa2
add esp, 0x10
cmp esi, eax
jne 0xf015a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp byte [edi + 0x3e], 0
je 0xf0158
test esi, esi
jne 0xf00a9
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.000c3400
jmp 0xf00a3
dec eax
sub eax, 1
jne 0xf015e
inc eax
jmp 0xf015c
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.000c2fc0
mov al, bl
jmp 0xf016c
mov al, 1
call fcn.000f200b
ret

Function at 0x10bc50
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0010b913

Function at 0x10bc5b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0010ba94

Function at 0x11095c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0011061c
Function at 0x4078ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x40a77e
inc dword [ebx - 0x161f43]
inc dword [eax]
push ebx
push edi
add esp, 4
sub ebx, 0xe0ae
pop ebx
push eax
push ecx
add esp, 4
and eax, 0xc497
pop eax
push ecx
add ecx, 0xc39d
pop ecx
push ebx
push ebx
add esp, 4
xor ebx, 0x17ee4
add ebx, 0x101a0
pop ebx
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cli
invalid
invalid
cmp eax, dword [ebp - 0xcf0]
je 0x40a826
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x40a5f1
mov dword [ebp - 0x2bc], 0
push eax
push ebx
add esp, 4

Function at 0x407a12
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ecx], vtable.CVarAdapter.0
add ecx, 4
jmp fcn.0040797d

Function at 0x4096e6
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0xae80001
add byte [eax], al
add byte [eax], al
inc esp
inc eax
cmp dword [ebx], edi
dec eax
aas
xor al, 0x49
add esp, 4
and ecx, 0x2f26
pop ecx
mov edx, dword [ebp - 0x4f8]
mov dword [ebp - 0xad8], edx
jmp 0x4096cb
push eax
push ecx
add esp, 4
and eax, 0xe01e
call 0x4096e6
add byte [ecx + 0x43], al
inc eax
cmp eax, 0x4d344a3e
dec eax
xor al, 0x83
les eax, [ebx + ebp*8]
add eax, 0x4d3c474b
cmp al, 0x58
push edx
push eax
add esp, 4
xor edx, 0xcd84
pop edx
mov byte [ebp - 0x898], 0x45
mov byte [ebp - 0x897], 0x78
mov byte [ebp - 0x896], 0x69
mov byte [ebp - 0x895], 0x74
mov byte [ebp - 0x894], 0x50
mov byte [ebp - 0x893], 0x72
mov byte [ebp - 0x892], 0x6f
mov byte [ebp - 0x891], 0x63
mov byte [ebp - 0x890], 0x65
mov byte [ebp - 0x88f], 0x73
mov byte [ebp - 0x88e], 0x73

Function at 0x4098f7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx + 0x488b0c42]
or al, 0x89
lea ebp, [ebx + esi*8]
invalid

Function at 0x409916
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or eax, 0x5a000115
push ecx
or ecx, 0x15d6e
and ecx, 0x3cbf
or ecx, 0xac30
jmp 0x409935
pop ecx
cmp dword [ebp - 0xcd4], 0
jne 0x40994e
mov dword [ebp - 0x2bc], 0
jmp 0x409bae
mov edx, dword [ebp - 0xcd4]
invalid

Function at 0x40998b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push esi
add esp, 4
or esi, 0x15112
sub esi, 0x96ea
sub esi, 0x12a19
pop esi
push edi
add edi, 0x10a90
and edi, 0x1f06
and edi, 0xe02c
sub edi, 0x7a1f
pop edi
lea eax, [ebp - 0x16c0]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x4fc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x1c0], ax
xor ecx, ecx
mov word [ebp - 0x10c], cx
push edx
push ecx
add esp, 4
or edx, 0xb1ae
pop edx
push esi
sub esi, 0x12149
pop esi
push ebx
push edx
add esp, 4
and ebx, 0x399d
sub ebx, 0xee8c
and ebx, 0x5edd
jmp 0x4099ea
pop ebx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x109a], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x109a]
mov word [ebp - 0x1c0], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
invalid
invalid
Function at 0x409a23
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
lea esp, [edi + ebp*8 - 1]
dec dword [ebx - 0xccf6b]
inc dword [ebx - 0x6a76fd3e]
xor bl, dh
invalid
Function at 0x40a603
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
jmp 0x40a610
sub edi, 0x17a63
and edi, 0x17fd7
and edi, 0x5653
out 0x53, eax
push esi
add byte [eax], al
pop edi
lea ecx, [ebp - 0x16c0]
mov dword [ebp - 0xcec], ecx
mov edx, dword [ebp - 0x504]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xce8], eax
xor ecx, ecx
mov word [ebp - 0x1c8], cx
xor edx, edx
mov word [ebp - 0x28], dx
push edx
xor edx, 0x105d6
sub edx, 0x2941
pop edx
push eax
sub eax, 0x17c3e
jmp 0x40a66a
pop eax
push edi
xor edi, 0x13006
pop edi
push esi
push ecx
add esp, 4
sub esi, 0x2277
pop esi
mov eax, dword [ebp - 0xce8]
mov cx, word [eax]
mov word [ebp - 0x10a2], cx
mov edx, dword [ebp - 0xce8]
add edx, 2
mov dword [ebp - 0xce8], edx
mov ax, word [ebp - 0x10a2]
mov word [ebp - 0x1c8], ax
mov ecx, dword [ebp - 0xcec]
mov dx, word [ecx]
mov word [ebp - 0x10a4], dx
mov eax, dword [ebp - 0xcec]
add eax, 2
mov dword [ebp - 0xcec], eax
mov cx, word [ebp - 0x10a4]
mov word [ebp - 0x28], cx
push edx
push ecx
add esp, 4
call 0x40a6e7
add byte [eax + 0x46], al
dec ebx
cmp ecx, dword [esi + 0x4d]
add esp, 4
call 0x40a6f8
add byte [ecx + 0x34], al
push eax
inc eax
aas
aas
dec ecx
add esp, 4
xor edx, 0x12d8d
or edx, 0x4c4f
pop edx
movzx edx, word [ebp - 0x28]
test edx, edx
jne 0x40a725
movzx eax, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x1c8]
movzx eax, word [ebp - 0x28]
mov bh, 0x45
fdivr dword [ebx]
ror byte [edi], 1
invalid
invalid
invalid
invalid
invalid
movzx ecx, word [ebp - 0x1c8]
xor ecx, 0x20
movzx edx, word [ebp - 0x28]
push ebp
fdivr dword [ebx]
retf 0x840f
invalid
invalid
invalid
invalid
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
jge 0x40a769
mov dword [ebp - 0x161c], 0xffffffff
jmp 0x40a773
mov dword [ebp - 0x161c], 1
mov edx, dword [ebp - 0x161c]
mov dword [ebp - 0x1620], edx
cmp dword [ebp - 0x1620], 0
jne 0x40a7c8
push ecx
push ebx
add esp, 4
and ecx, 0x10063
sub ecx, 0x14c3c
sub ecx, 0x11eb7
and ecx, 0x4be8
pop ecx
push edx
invalid
Function at 0x40a6e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
jmp 0x40a610
sub edi, 0x17a63
and edi, 0x17fd7
and edi, 0x5653
out 0x53, eax
push esi
add byte [eax], al
pop edi
lea ecx, [ebp - 0x16c0]
mov dword [ebp - 0xcec], ecx
mov edx, dword [ebp - 0x504]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xce8], eax
xor ecx, ecx
mov word [ebp - 0x1c8], cx
xor edx, edx
mov word [ebp - 0x28], dx
push edx
xor edx, 0x105d6
sub edx, 0x2941
pop edx
push eax
sub eax, 0x17c3e
jmp 0x40a66a
pop eax
push edi
xor edi, 0x13006
pop edi
push esi
push ecx
add esp, 4
sub esi, 0x2277
pop esi
mov eax, dword [ebp - 0xce8]
mov cx, word [eax]
mov word [ebp - 0x10a2], cx
mov edx, dword [ebp - 0xce8]
add edx, 2
mov dword [ebp - 0xce8], edx
mov ax, word [ebp - 0x10a2]
mov word [ebp - 0x1c8], ax
mov ecx, dword [ebp - 0xcec]
mov dx, word [ecx]
mov word [ebp - 0x10a4], dx
mov eax, dword [ebp - 0xcec]
add eax, 2
mov dword [ebp - 0xcec], eax
mov cx, word [ebp - 0x10a4]
mov word [ebp - 0x28], cx
push edx
push ecx
add esp, 4
call 0x40a6e7
add byte [eax + 0x46], al
dec ebx
cmp ecx, dword [esi + 0x4d]
add esp, 4
call 0x40a6f8
add byte [ecx + 0x34], al
push eax
inc eax
aas
aas
dec ecx
add esp, 4
xor edx, 0x12d8d
or edx, 0x4c4f
pop edx
movzx edx, word [ebp - 0x28]
test edx, edx
jne 0x40a725
movzx eax, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x1c8]
movzx eax, word [ebp - 0x28]
mov bh, 0x45
fdivr dword [ebx]
ror byte [edi], 1
invalid
invalid
invalid
invalid
invalid
movzx ecx, word [ebp - 0x1c8]
xor ecx, 0x20
movzx edx, word [ebp - 0x28]
push ebp
fdivr dword [ebx]
retf 0x840f
invalid
invalid
invalid
invalid
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
jge 0x40a769
mov dword [ebp - 0x161c], 0xffffffff
jmp 0x40a773
mov dword [ebp - 0x161c], 1
mov edx, dword [ebp - 0x161c]
mov dword [ebp - 0x1620], edx
cmp dword [ebp - 0x1620], 0
jne 0x40a7c8
push ecx
push ebx
add esp, 4
and ecx, 0x10063
sub ecx, 0x14c3c
sub ecx, 0x11eb7
and ecx, 0x4be8
pop ecx
push edx
invalid
Function at 0x40a6f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
jmp 0x40a610
sub edi, 0x17a63
and edi, 0x17fd7
and edi, 0x5653
out 0x53, eax
push esi
add byte [eax], al
pop edi
lea ecx, [ebp - 0x16c0]
mov dword [ebp - 0xcec], ecx
mov edx, dword [ebp - 0x504]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xce8], eax
xor ecx, ecx
mov word [ebp - 0x1c8], cx
xor edx, edx
mov word [ebp - 0x28], dx
push edx
xor edx, 0x105d6
sub edx, 0x2941
pop edx
push eax
sub eax, 0x17c3e
jmp 0x40a66a
pop eax
push edi
xor edi, 0x13006
pop edi
push esi
push ecx
add esp, 4
sub esi, 0x2277
pop esi
mov eax, dword [ebp - 0xce8]
mov cx, word [eax]
mov word [ebp - 0x10a2], cx
mov edx, dword [ebp - 0xce8]
add edx, 2
mov dword [ebp - 0xce8], edx
mov ax, word [ebp - 0x10a2]
mov word [ebp - 0x1c8], ax
mov ecx, dword [ebp - 0xcec]
mov dx, word [ecx]
mov word [ebp - 0x10a4], dx
mov eax, dword [ebp - 0xcec]
add eax, 2
mov dword [ebp - 0xcec], eax
mov cx, word [ebp - 0x10a4]
mov word [ebp - 0x28], cx
push edx
push ecx
add esp, 4
call 0x40a6e7
add byte [eax + 0x46], al
dec ebx
cmp ecx, dword [esi + 0x4d]
add esp, 4
call 0x40a6f8
add byte [ecx + 0x34], al
push eax
inc eax
aas
aas
dec ecx
add esp, 4
xor edx, 0x12d8d
or edx, 0x4c4f
pop edx
movzx edx, word [ebp - 0x28]
test edx, edx
jne 0x40a725
movzx eax, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x1c8]
movzx eax, word [ebp - 0x28]
mov bh, 0x45
fdivr dword [ebx]
ror byte [edi], 1
invalid
invalid
invalid
invalid
invalid
movzx ecx, word [ebp - 0x1c8]
xor ecx, 0x20
movzx edx, word [ebp - 0x28]
push ebp
fdivr dword [ebx]
retf 0x840f
invalid
invalid
invalid
invalid
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
jge 0x40a769
mov dword [ebp - 0x161c], 0xffffffff
jmp 0x40a773
mov dword [ebp - 0x161c], 1
mov edx, dword [ebp - 0x161c]
mov dword [ebp - 0x1620], edx
cmp dword [ebp - 0x1620], 0
jne 0x40a7c8
push ecx
push ebx
add esp, 4
and ecx, 0x10063
sub ecx, 0x14c3c
sub ecx, 0x11eb7
and ecx, 0x4be8
pop ecx
push edx
invalid

Function at 0x40a717
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx ecx, word [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x1620], eax
jmp 0x40a77f