joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4025c8
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0x99
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call 0x5ab106ed
pop edx
pop edx
mov dl, 0x31
mov cl, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp - 0x2ec16595], cl
pop edx
int1
loop 0x4024fd
pop edx
pop edx
pop edx
mov dl, 3
mov cl, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp - 0x5a48eb4e], cl
movsd dword es:[edi], dword [esi]
int1
loop 0x402530
pop edx
pop edx
pop edx
mov dl, 0x1d
mov cl, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp - 0x4df56595], cl
fbstp tbyte [ebp + 0x5be8f1a5]
rcr dword [ecx + 0x5a5a52e2], cl
pop edx
mov dl, 0x74
mov cl, 0xa5
movsd dword es:[edi], dword [esi]
shl dword [edx - 0x21], 1
movsd dword es:[edi], dword [esi]
das
pop eax
rol dword [edx - 0x1e], cl
push esp
pop edx
pop edx
pop edx
mov dl, 0x46
mov cl, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp - 0x5a48b84e], cl
movsd dword es:[edi], dword [esi]
int1
mov dl, 0x5c
pop edx
pop edx
pop edx
mov cl, 0x5b
inc ebp
mov cl, 0x59
add al, 0xe3
pop ecx
pop edx
pop edx
pop edx
mov dl, 0x5a
pop edx
pop edx
pop edx
add eax, 0xa95e9dd9
cmp al, 0xff
mov dl, 0x28
mov bh, 0xa5
movsd dword es:[edi], dword [esi]
mov dl, 0x27
test eax, 0x4eb2a5a5
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dl, 1
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dl, pe_nt_image_headers32
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
imul ebx, dword [edx + 0x5a5a4ab2], 0x5a
aad 0x5a
fstp dword [esi - 0x588d4d8a]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov bl, 0x81
mov dh, 0xa5
movsd dword es:[edi], dword [esi]
add dword [ecx], ecx
invalid
call 0x4025a1
pop eax
sub eax, 0x44663d
mov esi, 0x445298
mov ecx, 0x446634
sub ecx, esi
add esi, eax
mov edi, esi
cld
lodsb al, byte [esi]
xor al, 0x5a
stosb byte es:[edi], al
dec ecx
jne 0x4025b8
jmp 0x402488
pushal
pushfd
jmp 0x40259c

Function at 0x11c0107
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, dword [esp]
inc eax
cmp eax, 5
jge 0x11c0124
xor eax, eax
jmp 0x11c01ac
mov cl, byte [esi]
and cl, 0xff
and ecx, 0xff
mov eax, ecx
mov ebx, 9
cdq
idiv ebx
mov dword [esp + 4], edx
mov eax, ecx
mov ecx, 9
cdq
idiv ecx
mov ecx, eax
mov eax, ecx
mov ebx, 5
cdq
idiv ebx
mov dword [esp + 8], edx
mov eax, ecx
mov ecx, 5
cdq
idiv ecx
mov dword [esp + 0xc], eax
xor ebx, ebx
xor eax, eax
mov ecx, eax
shl ecx, 3
lea edx, [eax + 1]
mov dl, byte [esi + edx]
and dl, 0xff
and edx, 0xff
shl edx, cl
add ebx, edx
inc eax
cmp eax, 4
jne 0x11c0169
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, edi
call fcn.011bfc33
test al, al
jne 0x11c01a3
xor eax, eax
jmp 0x11c01ac
mov edx, ebx
mov eax, edi
call fcn.011bfbe3
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x402ee7
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x46b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0x1c]
push edi
mov dword [ebp - 0x23c], eax
xor eax, eax
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0042f710
xor eax, eax
lea edi, [ebp - 0x21c]
stosd dword es:[edi], eax
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0x230], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
or edi, 0xffffffff
test esi, esi
je 0x402f7b
cmp word [esi], cx
je 0x402f7b
lea eax, [ebp - 0x220]
push eax
push ebx
push esi
jmp 0x402fd3
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x402fc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x402fa8
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x402faf
mov esi, 0x80004005
push esi
push 0x284
push str.c:_agent_work138_s_srclibsdutilpathutil.cpp
call fcn.004038f5
jmp 0x40314d
lea eax, [ebp - 0x220]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.00402e80
mov esi, eax
test esi, esi
js 0x40314d
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x220]
call fcn.0040355e
test eax, eax
jne 0x40300e
push eax
push dword [ebp - 0x228]
call fcn.0040419a
mov esi, eax
test esi, esi
js 0x40314d
mov ebx, dword [ebp - 0x22c]
test ebx, ebx
jne 0x40301d
mov ebx, 0x44b524
and dword [ebp - 0x22c], 0
lea eax, [ebp - 0x21c]
inc dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x234]
push 0x2e
pop eax
cmp ax, word [ecx]
mov eax, 0x44b524
je 0x40304f
mov eax, 0x44b800
push ecx
push eax
movzx eax, word [ebp - 0x210]
push ebx
push eax
movzx eax, word [ebp - 0x212]
push eax
movzx eax, word [ebp - 0x214]
push eax
movzx eax, word [ebp - 0x216]
push eax
movzx eax, word [ebp - 0x21a]
push eax
movzx eax, word [ebp - 0x21c]
push eax
push dword [ebp - 0x220]
lea eax, [ebp - 0x224]
push str._ls__04u_02u_02u_02u_02u_02u_ls_ls_ls
push eax
call fcn.0040204d
mov esi, eax
add esp, 0x30
test esi, esi
js 0x403141
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403114
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x50
je 0x4030dd
cmp esi, 5
jne 0x4030f5
push 0x64
add byte [esi + 0x50], bl
Function at 0x403455
Capabilities:
Get number of processors

Disassembly:
add esp, 4
call 0x403455
add byte [ebp + 0x45], cl
dec eax
inc ecx
dec ecx
xor al, byte [ebp - 0x7d]
les eax, [ecx + eax*4]
int1
mov ebp, 0x810000b9
ror dword [eax + esi - 0x7ca70000], 0xbd
and cl, ch
invalid
Function at 0x4034b7
Capabilities:
Get number of processors

Disassembly:
add esp, 4
sub ebx, 0x630
pop ebx
cmp dword [ebp - 0xd70], 0
jne 0x4034d9
mov dword [ebp - 0x318], 0
jmp 0x403739
mov ecx, dword [ebp - 0xd70]
mov dword [ebp - 0x534], ecx
push edi
jmp 0x40373f
add edi, 0x1a01
jmp 0x40374c
pop edi
push ecx
push ebx
add esp, 4
and ecx, 0x14fb1
and ecx, 0xaccc
pop ecx
push esi
push esi
add esp, 4
sub esi, 0x970
pop esi
cmp dword [ebp - 0x318], 0
jne 0x404070
mov eax, 0x6b
mov word [ebp - 0x1900], ax
mov ecx, 0x65
mov word [ebp - 0x18fe], cx
mov edx, 0x72
mov word [ebp - 0x18fc], dx
mov eax, 0x6e
mov word [ebp - 0x18fa], ax
mov ecx, 0x65
mov word [ebp - 0x18f8], cx
mov edx, 0x6c
mov word [ebp - 0x18f6], dx
mov eax, 0x33
mov word [ebp - 0x18f4], ax
mov ecx, 0x32
mov word [ebp - 0x18f2], cx
mov edx, 0x2e
mov word [ebp - 0x18f0], dx
mov eax, 0x64
mov word [ebp - 0x18ee], ax
mov ecx, 0x6c
mov word [ebp - 0x18ec], cx
mov edx, 0x6c
mov word [ebp - 0x18ea], dx
xor eax, eax
mov word [ebp - 0x18e8], ax
push ecx
push eax
add esp, 4
call 0x403826
add byte [edi], dh
dec ebx
cmp bh, byte [edx]
inc ecx
dec ecx
xor al, 0x3f
inc eax
cmp al, byte [ebx + 0x5eb04c4]
aas
cmp byte [eax + 0x3a], dl
dec edx
pop ecx
push ecx
push ebx
add esp, 4
sub ecx, 0xa25a
xor ecx, 0x4245
pop ecx
mov byte [ebp - 0x91c], 0x4c
mov byte [ebp - 0x91b], 0x6f
mov byte [ebp - 0x91a], 0x61
mov byte [ebp - 0x919], 0x64
mov byte [ebp - 0x918], 0x4c
mov byte [ebp - 0x917], 0x69
mov byte [ebp - 0x916], 0x62
mov byte [ebp - 0x915], 0x72
mov byte [ebp - 0x914], 0x61
mov byte [ebp - 0x913], 0x72
mov byte [ebp - 0x912], 0x79
mov byte [ebp - 0x911], 0x57
mov byte [ebp - 0x910], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x2000], ecx
mov edx, dword [ebp - 0x2000]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x2004], eax
mov ecx, dword [ebp - 0x2004]
mov dword [ebp - 0x16ec], ecx
push edi
push esi
add esp, 4
sub edi, 0xb6c7
xor edi, 0x1681a
sub edi, 0x175f1
pop edi
push eax
or eax, 0xe013
sub eax, 0xf3cc
pop eax
push ebx
push edx
add esp, 4
and ebx, 0x8189
add byte [eax], al
pop ebx
push ecx
xor ecx, 0x39b4
or ecx, 0x15bb0
sub ecx, 0x88d3
sub ecx, 0xeb60
pop ecx
push eax
push ebx
add esp, 4
add eax, 0xe1fc
pop eax
push esi
push edx
add esp, 4
and esi, 0x1098c
pop esi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x2020], ecx
mov edx, dword [ebp - 0x2020]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x2024], eax
mov ecx, dword [ebp - 0x2024]
mov dword [ebp - 0x1704], ecx
push edi
push ebx
add esp, 4
and edi, 0xdca3
xor edi, 0x12bd2
pop edi
push eax
xor eax, 0xc25b
and eax, 0xbafc
add eax, 0x956f
pop eax
push edi
push eax
add esp, 4
xor edi, 0x5569
pop edi
cmp dword [ebp - 0x1704], 0
jne 0x404114
mov dword [ebp - 0x318], 0
jmp 0x4043bb
mov edx, dword [ebp - 0x1704]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xd8c], ecx
push esi
push edx
add esp, 4
add esi, 0x146a9
or esi, 0x59fc
pop esi
push eax
add eax, 0xa2ad
add eax, 0x8117
pop eax
push ecx
push esi
add esp, 4
xor ecx, 0x182b8
sub ecx, 0x9b59
pop ecx
cmp dword [ebp - 0xd8c], 0
jne 0x404170
mov dword [ebp - 0x318], 0
jmp 0x4043bb
mov edx, dword [ebp - 0xd8c]
mov dword [ebp - 0x53c], edx
Function at 0x4034ef
Capabilities:
Get number of processors

Disassembly:
push eax
push ebx
add esp, 4
and eax, 0xa97
add byte [eax + 0x52], bl
add byte [eax + 0x52], bl
push ebx
add esp, 4
or edx, 0x54a2
xor edx, 0x2a5d
xor edx, 0xcdb3
and edx, 0x152e7
pop edx
push ebx
add ebx, 0x1fe9
pop ebx
lea edx, [ebp - 0x18c4]
mov dword [ebp - 0xd6c], edx
mov eax, dword [ebp - 0x534]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd68], ecx
xor edx, edx
mov word [ebp - 0x1d0], dx
xor eax, eax
mov word [ebp - 0x11c], ax

Function at 0x40355e
Capabilities:
Get number of processors

Disassembly:
push esi
push edi
add esp, 4
xor esi, 0xc235
add esi, 0x16073
pop esi
push eax
add eax, 0x954c
pop eax
push ebx
push eax
add esp, 4
add ebx, 0x181a7
add ebx, 0xfa32
add ebx, 0x10acc
pop ebx
mov ecx, dword [ebp - 0xd68]
mov dx, word [ecx]
mov word [ebp - 0xd06], dx
mov eax, dword [ebp - 0xd68]
add eax, 2
mov dword [ebp - 0xd68], eax
mov cx, word [ebp - 0xd06]
mov word [ebp - 0x1d0], cx
mov edx, dword [ebp - 0xd6c]
mov ax, word [edx]
mov word [ebp - 0x1142], ax
mov ecx, dword [ebp - 0xd6c]
add ecx, 2
mov dword [ebp - 0xd6c], ecx
mov dx, word [ebp - 0x1142]
mov word [ebp - 0x11c], dx
push edx
push ecx
invalid

Function at 0x4036a7
Capabilities:
Get number of processors

Disassembly:
add esp, 4
or eax, 0x26fd
xor eax, 0x7f4c
pop eax
push eax
push esi
add esp, 4
xor eax, 0x182ca
pop eax
mov ecx, dword [ebp - 0x534]
mov dword [ebp - 0x318], ecx
jmp 0x403739
Function at 0x4038f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0x16ec], 0
jne 0x403910
mov dword [ebp - 0x7b8], 0
jmp fcn.00403bb7
cmpsd dword [esi], dword es:[edi]
add al, byte [eax]
invalid
mov edx, dword [ebp - 0x16ec]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xd7c], ecx
push edi
push ecx
add esp, 4
call 0x403937
add byte [eax + 0x4a], al
push eax
dec edi
dec eax
xor bh, byte ss:[edx]
dec ebp
dec edx
add esp, 4
pop edi
push eax
or eax, 0x15260
pop eax
push ecx
push ebx
add esp, 4
and ecx, 0xcbe6
jmp 0x403953
pop ecx
cmp dword [ebp - 0xd7c], 0
jne 0x40396c
mov dword [ebp - 0x7b8], 0
jmp fcn.00403bb7
mov edx, dword [ebp - 0xd7c]
mov dword [ebp - 0x538], edx

Function at 0x403937
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0x16ec], 0
jne 0x403910
mov dword [ebp - 0x7b8], 0
jmp fcn.00403bb7
cmpsd dword [esi], dword es:[edi]
add al, byte [eax]
invalid
mov edx, dword [ebp - 0x16ec]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xd7c], ecx
push edi
push ecx
add esp, 4
call 0x403937
add byte [eax + 0x4a], al
push eax
dec edi
dec eax
xor bh, byte ss:[edx]
dec ebp
dec edx
add esp, 4
pop edi
push eax
or eax, 0x15260
pop eax
push ecx
push ebx
add esp, 4
and ecx, 0xcbe6
jmp 0x403953
pop ecx
cmp dword [ebp - 0xd7c], 0
jne 0x40396c
mov dword [ebp - 0x7b8], 0
jmp fcn.00403bb7
mov edx, dword [ebp - 0xd7c]
mov dword [ebp - 0x538], edx
Function at 0x4039a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
or esi, 0xa84d
or esi, 0x897c
jmp 0x40398e
pop esi
push esi
xor esi, 0xa8d0
call 0x4039a6
add byte [ebp + 0x38], al
cmp dl, byte [eax + 0x47]
inc esi
dec ecx
dec edx
cmp byte [ebx - 0x7d], cl
les eax, [esi + ebx*2]
lea eax, [ebp - 0x1900]
mov dword [ebp - 0xd78], eax
mov ecx, dword [ebp - 0x538]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xd74], edx
xor eax, eax
mov word [ebp - 0x1d4], ax
xor ecx, ecx
mov word [ebp - 0x2c], cx
push edi
push esi
add esp, 4
or edi, 0xe3f6
or edi, 0x16780
pop edi
push esi
and esi, 0x18668
pop esi
push esi
push edx
add esp, 4
and esi, 0x7a53
push ebx
jp 0x4039f8
add byte [ecx + 0x3477c6], al
add byte [ecx + 0x12748ce], al
add byte [esi - 0x75], bl
xchg ebp, eax
invalid
invalid
invalid
jmp dword [esi - 0x75]
add ah, byte [esi - 0x77]
test dword [esi + ebp*8 - 0x72740001], edi
invalid
invalid
invalid
inc dword [ebx - 0x7276fd3f]
invalid
invalid
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
mov esp, 0x66ffffee
mov dword [ebp - 0x1d4], edx
mov eax, dword [ebp - 0xd78]
mov cx, word [eax]
mov word [ebp - 0x1146], cx
mov edx, dword [ebp - 0xd78]
add edx, 2
mov dword [ebp - 0xd78], edx
mov ax, word [ebp - 0x1146]
mov word [ebp - 0x2c], ax
push edi
push esi
add esp, 4
sub edi, 0x1111c
pop edi
push esi
push edx
add esp, 4
or esi, 0xf325
pop esi
push edi
sub edi, 0xde16
and edi, 0xd53c
or edi, 0x128d6
add edi, 0xff0b
pop edi
movzx ecx, word [ebp - 0x2c]
test ecx, ecx
jne 0x403aac
movzx edx, word [ebp - 0x1d4]
movzx eax, word [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0x16f4], edx
jmp 0x403b06
movzx ecx, word [ebp - 0x1d4]
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
je 0x4039d4
movzx eax, word [ebp - 0x1d4]
xor eax, 0x20
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
je 0x4039d4
movzx edx, word [ebp - 0x1d4]
movzx eax, word [ebp - 0x2c]
aam 0x3b
sar byte [ebp + 0xc], 1
mov dword [ebp - 0x16f0], 0xffffffff
jmp 0x403afa
mov dword [ebp - 0x16f0], 1
mov ecx, dword [ebp - 0x16f0]
mov dword [ebp - 0x16f4], ecx
cmp dword [ebp - 0x16f4], 0
jne 0x403b4f
push edx
push esi
add esp, 4
sub edx, 0x2df0
xor edx, 0x9c60
or edx, 0x5d92
jmp 0x403b2e
pop edx
push esi
push ebx
add esp, 4
xor esi, 0x1038
sub esi, 0x1285b
pop esi
mov edx, dword [ebp - 0x538]
mov dword [ebp - 0x7b8], edx
jmp fcn.00403bb7
push ebx
sub ebx, 0x23b4
jmp 0x403b5c
add ebx, 0xaa7b
pop ebx
push ebx
or ebx, 0xed7a
jmp 0x403b71
call 0x403b7d
add byte [edx + eax*2 + 0x3e], al
cmp dword [edi], esi
add esp, 4
pop ebx
mov eax, dword [ebp - 0x538]
mov ecx, dword [eax]
mov dword [ebp - 0x538], ecx
mov edx, dword [ebp - 0x538]
cmp edx, dword [ebp - 0xd7c]
je 0x403bad
mov eax, dword [ebp - 0x538]
cmp dword [eax + 0x30], 0
jne 0x403978
mov dword [ebp - 0x7b8], 0
Function at 0x4039f5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
or esi, 0xa84d
or esi, 0x897c
jmp 0x40398e
pop esi
push esi
xor esi, 0xa8d0
call 0x4039a6
add byte [ebp + 0x38], al
cmp dl, byte [eax + 0x47]
inc esi
dec ecx
dec edx
cmp byte [ebx - 0x7d], cl
les eax, [esi + ebx*2]
lea eax, [ebp - 0x1900]
mov dword [ebp - 0xd78], eax
mov ecx, dword [ebp - 0x538]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xd74], edx
xor eax, eax
mov word [ebp - 0x1d4], ax
xor ecx, ecx
mov word [ebp - 0x2c], cx
push edi
push esi
add esp, 4
or edi, 0xe3f6
or edi, 0x16780
pop edi
push esi
and esi, 0x18668
pop esi
push esi
push edx
add esp, 4
and esi, 0x7a53
push ebx
jp 0x4039f8
add byte [ecx + 0x3477c6], al
add byte [ecx + 0x12748ce], al
add byte [esi - 0x75], bl
xchg ebp, eax
invalid
invalid
invalid
jmp dword [esi - 0x75]
add ah, byte [esi - 0x77]
test dword [esi + ebp*8 - 0x72740001], edi
invalid
invalid
invalid
inc dword [ebx - 0x7276fd3f]
invalid
invalid
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
mov esp, 0x66ffffee
mov dword [ebp - 0x1d4], edx
mov eax, dword [ebp - 0xd78]
mov cx, word [eax]
mov word [ebp - 0x1146], cx
mov edx, dword [ebp - 0xd78]
add edx, 2
mov dword [ebp - 0xd78], edx
mov ax, word [ebp - 0x1146]
mov word [ebp - 0x2c], ax
push edi
push esi
add esp, 4
sub edi, 0x1111c
pop edi
push esi
push edx
add esp, 4
or esi, 0xf325
pop esi
push edi
sub edi, 0xde16
and edi, 0xd53c
or edi, 0x128d6
add edi, 0xff0b
pop edi
movzx ecx, word [ebp - 0x2c]
test ecx, ecx
jne 0x403aac
movzx edx, word [ebp - 0x1d4]
movzx eax, word [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0x16f4], edx
jmp 0x403b06
movzx ecx, word [ebp - 0x1d4]
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
je 0x4039d4
movzx eax, word [ebp - 0x1d4]
xor eax, 0x20
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
je 0x4039d4
movzx edx, word [ebp - 0x1d4]
movzx eax, word [ebp - 0x2c]
aam 0x3b
sar byte [ebp + 0xc], 1
mov dword [ebp - 0x16f0], 0xffffffff
jmp 0x403afa
mov dword [ebp - 0x16f0], 1
mov ecx, dword [ebp - 0x16f0]
mov dword [ebp - 0x16f4], ecx
cmp dword [ebp - 0x16f4], 0
jne 0x403b4f
push edx
push esi
add esp, 4
sub edx, 0x2df0
xor edx, 0x9c60
or edx, 0x5d92
jmp 0x403b2e
pop edx
push esi
push ebx
add esp, 4
xor esi, 0x1038
sub esi, 0x1285b
pop esi
mov edx, dword [ebp - 0x538]
mov dword [ebp - 0x7b8], edx
jmp fcn.00403bb7
push ebx
sub ebx, 0x23b4
jmp 0x403b5c
add ebx, 0xaa7b
pop ebx
push ebx
or ebx, 0xed7a
jmp 0x403b71
call 0x403b7d
add byte [edx + eax*2 + 0x3e], al
cmp dword [edi], esi
add esp, 4
pop ebx
mov eax, dword [ebp - 0x538]
mov ecx, dword [eax]
mov dword [ebp - 0x538], ecx
mov edx, dword [ebp - 0x538]
cmp edx, dword [ebp - 0xd7c]
je 0x403bad
mov eax, dword [ebp - 0x538]
cmp dword [eax + 0x30], 0
jne 0x403978
mov dword [ebp - 0x7b8], 0
Function at 0x403a3c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
or esi, 0xa84d
or esi, 0x897c
jmp 0x40398e
pop esi
push esi
xor esi, 0xa8d0
call 0x4039a6
add byte [ebp + 0x38], al
cmp dl, byte [eax + 0x47]
inc esi
dec ecx
dec edx
cmp byte [ebx - 0x7d], cl
les eax, [esi + ebx*2]
lea eax, [ebp - 0x1900]
mov dword [ebp - 0xd78], eax
mov ecx, dword [ebp - 0x538]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xd74], edx
xor eax, eax
mov word [ebp - 0x1d4], ax
xor ecx, ecx
mov word [ebp - 0x2c], cx
push edi
push esi
add esp, 4
or edi, 0xe3f6
or edi, 0x16780
pop edi
push esi
and esi, 0x18668
pop esi
push esi
push edx
add esp, 4
and esi, 0x7a53
push ebx
jp 0x4039f8
add byte [ecx + 0x3477c6], al
add byte [ecx + 0x12748ce], al
add byte [esi - 0x75], bl
xchg ebp, eax
invalid
invalid
invalid
jmp dword [esi - 0x75]
add ah, byte [esi - 0x77]
test dword [esi + ebp*8 - 0x72740001], edi
invalid
invalid
invalid
inc dword [ebx - 0x7276fd3f]
invalid
invalid
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
mov esp, 0x66ffffee
mov dword [ebp - 0x1d4], edx
mov eax, dword [ebp - 0xd78]
mov cx, word [eax]
mov word [ebp - 0x1146], cx
mov edx, dword [ebp - 0xd78]
add edx, 2
mov dword [ebp - 0xd78], edx
mov ax, word [ebp - 0x1146]
mov word [ebp - 0x2c], ax
push edi
push esi
add esp, 4
sub edi, 0x1111c
pop edi
push esi
push edx
add esp, 4
or esi, 0xf325
pop esi
push edi
sub edi, 0xde16
and edi, 0xd53c
or edi, 0x128d6
add edi, 0xff0b
pop edi
movzx ecx, word [ebp - 0x2c]
test ecx, ecx
jne 0x403aac
movzx edx, word [ebp - 0x1d4]
movzx eax, word [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0x16f4], edx
jmp 0x403b06
movzx ecx, word [ebp - 0x1d4]
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
je 0x4039d4
movzx eax, word [ebp - 0x1d4]
xor eax, 0x20
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
je 0x4039d4
movzx edx, word [ebp - 0x1d4]
movzx eax, word [ebp - 0x2c]
aam 0x3b
sar byte [ebp + 0xc], 1
mov dword [ebp - 0x16f0], 0xffffffff
jmp 0x403afa
mov dword [ebp - 0x16f0], 1
mov ecx, dword [ebp - 0x16f0]
mov dword [ebp - 0x16f4], ecx
cmp dword [ebp - 0x16f4], 0
jne 0x403b4f
push edx
push esi
add esp, 4
sub edx, 0x2df0
xor edx, 0x9c60
or edx, 0x5d92
jmp 0x403b2e
pop edx
push esi
push ebx
add esp, 4
xor esi, 0x1038
sub esi, 0x1285b
pop esi
mov edx, dword [ebp - 0x538]
mov dword [ebp - 0x7b8], edx
jmp fcn.00403bb7
push ebx
sub ebx, 0x23b4
jmp 0x403b5c
add ebx, 0xaa7b
pop ebx
push ebx
or ebx, 0xed7a
jmp 0x403b71
call 0x403b7d
add byte [edx + eax*2 + 0x3e], al
cmp dword [edi], esi
add esp, 4
pop ebx
mov eax, dword [ebp - 0x538]
mov ecx, dword [eax]
mov dword [ebp - 0x538], ecx
mov edx, dword [ebp - 0x538]
cmp edx, dword [ebp - 0xd7c]
je 0x403bad
mov eax, dword [ebp - 0x538]
cmp dword [eax + 0x30], 0
jne 0x403978
mov dword [ebp - 0x7b8], 0
Function at 0x403b7d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
or esi, 0xa84d
or esi, 0x897c
jmp 0x40398e
pop esi
push esi
xor esi, 0xa8d0
call 0x4039a6
add byte [ebp + 0x38], al
cmp dl, byte [eax + 0x47]
inc esi
dec ecx
dec edx
cmp byte [ebx - 0x7d], cl
les eax, [esi + ebx*2]
lea eax, [ebp - 0x1900]
mov dword [ebp - 0xd78], eax
mov ecx, dword [ebp - 0x538]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xd74], edx
xor eax, eax
mov word [ebp - 0x1d4], ax
xor ecx, ecx
mov word [ebp - 0x2c], cx
push edi
push esi
add esp, 4
or edi, 0xe3f6
or edi, 0x16780
pop edi
push esi
and esi, 0x18668
pop esi
push esi
push edx
add esp, 4
and esi, 0x7a53
push ebx
jp 0x4039f8
add byte [ecx + 0x3477c6], al
add byte [ecx + 0x12748ce], al
add byte [esi - 0x75], bl
xchg ebp, eax
invalid
invalid
invalid
jmp dword [esi - 0x75]
add ah, byte [esi - 0x77]
test dword [esi + ebp*8 - 0x72740001], edi
invalid
invalid
invalid
inc dword [ebx - 0x7276fd3f]
invalid
invalid
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
mov esp, 0x66ffffee
mov dword [ebp - 0x1d4], edx
mov eax, dword [ebp - 0xd78]
mov cx, word [eax]
mov word [ebp - 0x1146], cx
mov edx, dword [ebp - 0xd78]
add edx, 2
mov dword [ebp - 0xd78], edx
mov ax, word [ebp - 0x1146]
mov word [ebp - 0x2c], ax
push edi
push esi
add esp, 4
sub edi, 0x1111c
pop edi
push esi
push edx
add esp, 4
or esi, 0xf325
pop esi
push edi
sub edi, 0xde16
and edi, 0xd53c
or edi, 0x128d6
add edi, 0xff0b
pop edi
movzx ecx, word [ebp - 0x2c]
test ecx, ecx
jne 0x403aac
movzx edx, word [ebp - 0x1d4]
movzx eax, word [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0x16f4], edx
jmp 0x403b06
movzx ecx, word [ebp - 0x1d4]
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
je 0x4039d4
movzx eax, word [ebp - 0x1d4]
xor eax, 0x20
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
je 0x4039d4
movzx edx, word [ebp - 0x1d4]
movzx eax, word [ebp - 0x2c]
aam 0x3b
sar byte [ebp + 0xc], 1
mov dword [ebp - 0x16f0], 0xffffffff
jmp 0x403afa
mov dword [ebp - 0x16f0], 1
mov ecx, dword [ebp - 0x16f0]
mov dword [ebp - 0x16f4], ecx
cmp dword [ebp - 0x16f4], 0
jne 0x403b4f
push edx
push esi
add esp, 4
sub edx, 0x2df0
xor edx, 0x9c60
or edx, 0x5d92
jmp 0x403b2e
pop edx
push esi
push ebx
add esp, 4
xor esi, 0x1038
sub esi, 0x1285b
pop esi
mov edx, dword [ebp - 0x538]
mov dword [ebp - 0x7b8], edx
jmp fcn.00403bb7
push ebx
sub ebx, 0x23b4
jmp 0x403b5c
add ebx, 0xaa7b
pop ebx
push ebx
or ebx, 0xed7a
jmp 0x403b71
call 0x403b7d
add byte [edx + eax*2 + 0x3e], al
cmp dword [edi], esi
add esp, 4
pop ebx
mov eax, dword [ebp - 0x538]
mov ecx, dword [eax]
mov dword [ebp - 0x538], ecx
mov edx, dword [ebp - 0x538]
cmp edx, dword [ebp - 0xd7c]
je 0x403bad
mov eax, dword [ebp - 0x538]
cmp dword [eax + 0x30], 0
jne 0x403978
mov dword [ebp - 0x7b8], 0

Function at 0x403bb7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
add ecx, 0x1208e
or ecx, 0x10a7f
or ecx, 0x16b41
pop ecx
push edx
push ecx
add esp, 4
jmp 0x403bd6
xor edx, 0x5521
Function at 0x403bdc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and edx, 0x5c5e
sub edx, 0x17e35
pop edx
cmp dword [ebp - 0x7b8], 0
jne 0x403c33
push edi
xor edi, 0xf0d2
jmp 0x403c00
pop edi
push ebx
push eax
add esp, 4
call 0x403c14
add byte [eax + 0x47], cl
xor edi, dword ss:[eax]
dec esi
xor eax, 0x4c4833e
add ebx, 0x7151
xor ebx, 0x387
pop ebx
mov dword [ebp - 0xb6c], 0
jmp 0x40475b
push esi
push ecx
add esp, 4
xor esi, 0x43
sub esi, 0x1ebc
add esi, 0xe721
pop esi
push esi
push edi
add esp, 4
and esi, 0x44d9
or esi, 0x13b28
pop esi
push esi
or esi, 0x17c93
pop esi
mov ecx, dword [ebp - 0x7b8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3b4], edx
mov dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x16f8], eax
cmp dword [ebp - 0x16f8], 0
jne 0x403ca4
mov ecx, dword [ebp - 0x7c8]
invalid