joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x15], 0
mov ebx, ecx
mov esi, edi
jne 0x407390
mov eax, dword [esi + 8]
push eax
mov ecx, ebx
call fcn.00407340
mov eax, dword [edi + 0x55]
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
push edi
push edi
add esp, 4
add edi, 0x66a6
pop edi
push esi
jmp 0x407380
call 0x40738e
add byte [edx], bh
xor al, byte [ebx + 0x4e]
cmp esi, dword [ebx]
dec edi
aaa
add esp, 4
pop esi
add al, 0x5e
push ecx
push esi
add esp, 4
sub ecx, 0xbf40
pop ecx
invalid
invalid

Function at 0x407360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x15], 0
mov ebx, ecx
mov esi, edi
jne 0x407390
mov eax, dword [esi + 8]
push eax
mov ecx, ebx
call fcn.00407340
mov eax, dword [edi + 0x55]
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
push edi
push edi
add esp, 4
add edi, 0x66a6
pop edi
push esi
jmp 0x407380
call 0x40738e
add byte [edx], bh
xor al, byte [ebx + 0x4e]
cmp esi, dword [ebx]
dec edi
aaa
add esp, 4
pop esi
add al, 0x5e
push ecx
push esi
add esp, 4
sub ecx, 0xbf40
pop ecx
invalid
invalid

Function at 0x40738e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x15], 0
mov ebx, ecx
mov esi, edi
jne 0x407390
mov eax, dword [esi + 8]
push eax
mov ecx, ebx
call fcn.00407340
mov eax, dword [edi + 0x55]
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
push edi
push edi
add esp, 4
add edi, 0x66a6
pop edi
push esi
jmp 0x407380
call 0x40738e
add byte [edx], bh
xor al, byte [ebx + 0x4e]
cmp esi, dword [ebx]
dec edi
aaa
add esp, 4
pop esi
add al, 0x5e
push ecx
push esi
add esp, 4
sub ecx, 0xbf40
pop ecx
invalid
invalid

Function at 0x4073a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [esi - 0x77], ah
test dword [eax - 3], edx
invalid

Function at 0x407400
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
pushal
std
invalid
Function at 0x407460
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
stosb byte es:[edi], al
inc ecx
add dword [eax], eax
add edi, 0x8ae1
pop edi
push ebx
or ebx, 0x536b
pop ebx
mov byte [ebp - 0x198], 0x47
mov byte [ebp - 0x197], 0x65
mov byte gs:[ebp - 0x196], 0x74
mov byte [ebp - 0x195], 0x4d
mov byte [ebp - 0x194], 0x6f
mov byte [ebp - 0x193], 0x64
mov byte [ebp - 0x192], 0x75
mov byte [ebp - 0x191], 0x6c
mov byte [ebp - 0x190], 0x65
mov byte [ebp - 0x18f], 0x48
mov byte [ebp - 0x18e], 0x61
mov byte [ebp - 0x18d], 0x6e
mov byte [ebp - 0x18c], 0x64
mov byte [ebp - 0x18b], 0x6c
mov byte [ebp - 0x18a], 0x65
mov byte [ebp - 0x189], 0x45
mov byte [ebp - 0x188], 0x78
mov byte [ebp - 0x187], 0x57
mov byte [ebp - 0x186], 0
mov ecx, dword [ebp - 0x4b0]
mov dword [ebp - 0x1b4], ecx
push edx
push edi
add esp, 4
xor edx, 0x27f7
xor edx, 0x3b74
pop edx
push edi
push esi
add esp, 4
and edi, 0x254d
pop edi
push edi
or edi, 0x7f3f
xor edi, 0xeb35
add edi, 0x16ea5
pop edi
push edi
push edi
add esp, 4
sub edi, 0x7efd
and edi, 0xa0f9
add edi, 0x15a37
pop edi
push edi
add edi, 0xf5bc
and edi, 0x43d4
add edi, 0xefc5
xor edi, 0x4453
pop edi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x434], edx
push eax
and eax, 0xbd9b
pop eax
push ecx
push edx
add esp, 4
jmp 0x40758b
sub ecx, 0x97d1
jmp 0x407596
call 0x4075a3
add byte [ebx], dh
inc edi
inc ebp
xor al, byte [ebx + 0x44]
xor eax, dword [ebx - 0x74a6fb3c]
test esp, ecx
sti
invalid

Function at 0x407480
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
stosb byte es:[edi], al
inc ecx
add dword [eax], eax
add edi, 0x8ae1
pop edi
push ebx
or ebx, 0x536b
pop ebx
mov byte [ebp - 0x198], 0x47
mov byte [ebp - 0x197], 0x65
mov byte gs:[ebp - 0x196], 0x74
mov byte [ebp - 0x195], 0x4d
mov byte [ebp - 0x194], 0x6f
mov byte [ebp - 0x193], 0x64
mov byte [ebp - 0x192], 0x75
mov byte [ebp - 0x191], 0x6c
mov byte [ebp - 0x190], 0x65
mov byte [ebp - 0x18f], 0x48
mov byte [ebp - 0x18e], 0x61
mov byte [ebp - 0x18d], 0x6e
mov byte [ebp - 0x18c], 0x64
mov byte [ebp - 0x18b], 0x6c
mov byte [ebp - 0x18a], 0x65
mov byte [ebp - 0x189], 0x45
mov byte [ebp - 0x188], 0x78
mov byte [ebp - 0x187], 0x57
mov byte [ebp - 0x186], 0
mov ecx, dword [ebp - 0x4b0]
mov dword [ebp - 0x1b4], ecx
push edx
push edi
add esp, 4
xor edx, 0x27f7
xor edx, 0x3b74
pop edx
push edi
push esi
add esp, 4
and edi, 0x254d
pop edi
push edi
or edi, 0x7f3f
xor edi, 0xeb35
add edi, 0x16ea5
pop edi
push edi
push edi
add esp, 4
sub edi, 0x7efd
and edi, 0xa0f9
add edi, 0x15a37
pop edi
push edi
add edi, 0xf5bc
and edi, 0x43d4
add edi, 0xefc5
xor edi, 0x4453
pop edi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x434], edx
push eax
and eax, 0xbd9b
pop eax
push ecx
push edx
add esp, 4
jmp 0x40758b
sub ecx, 0x97d1
jmp 0x407596
call 0x4075a3
add byte [ebx], dh
inc edi
inc ebp
xor al, byte [ebx + 0x44]
xor eax, dword [ebx - 0x74a6fb3c]
test esp, ecx
sti
invalid
Function at 0x4075a3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
stosb byte es:[edi], al
inc ecx
add dword [eax], eax
add edi, 0x8ae1
pop edi
push ebx
or ebx, 0x536b
pop ebx
mov byte [ebp - 0x198], 0x47
mov byte [ebp - 0x197], 0x65
mov byte gs:[ebp - 0x196], 0x74
mov byte [ebp - 0x195], 0x4d
mov byte [ebp - 0x194], 0x6f
mov byte [ebp - 0x193], 0x64
mov byte [ebp - 0x192], 0x75
mov byte [ebp - 0x191], 0x6c
mov byte [ebp - 0x190], 0x65
mov byte [ebp - 0x18f], 0x48
mov byte [ebp - 0x18e], 0x61
mov byte [ebp - 0x18d], 0x6e
mov byte [ebp - 0x18c], 0x64
mov byte [ebp - 0x18b], 0x6c
mov byte [ebp - 0x18a], 0x65
mov byte [ebp - 0x189], 0x45
mov byte [ebp - 0x188], 0x78
mov byte [ebp - 0x187], 0x57
mov byte [ebp - 0x186], 0
mov ecx, dword [ebp - 0x4b0]
mov dword [ebp - 0x1b4], ecx
push edx
push edi
add esp, 4
xor edx, 0x27f7
xor edx, 0x3b74
pop edx
push edi
push esi
add esp, 4
and edi, 0x254d
pop edi
push edi
or edi, 0x7f3f
xor edi, 0xeb35
add edi, 0x16ea5
pop edi
push edi
push edi
add esp, 4
sub edi, 0x7efd
and edi, 0xa0f9
add edi, 0x15a37
pop edi
push edi
add edi, 0xf5bc
and edi, 0x43d4
add edi, 0xefc5
xor edi, 0x4453
pop edi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x434], edx
push eax
and eax, 0xbd9b
pop eax
push ecx
push edx
add esp, 4
jmp 0x40758b
sub ecx, 0x97d1
jmp 0x407596
call 0x4075a3
add byte [ebx], dh
inc edi
inc ebp
xor al, byte [ebx + 0x44]
xor eax, dword [ebx - 0x74a6fb3c]
test esp, ecx
sti
invalid
Function at 0x4079e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
call 0x4079f1
add byte [eax], bh
inc eax
xor eax, 0x43454c39
dec ebx
inc esp
add esp, 4
pop esi
push esi
xor esi, 0xf4f8
and esi, 0x862e
pop esi
mov edx, 0x6b
mov word [ebp - 0x3bc], dx
mov eax, 0x65
mov word [ebp - 0x3ba], ax
mov ecx, 0x72
mov word [ebp - 0x3b8], cx
mov edx, 0x6e
mov word [ebp - 0x3b6], dx
mov eax, 0x65
mov word [ebp - 0x3b4], ax
mov ecx, 0x6c
mov word [ebp - 0x3b2], cx
mov edx, 0x33
mov word [ebp - 0x3b0], dx
mov eax, 0x32
mov word [ebp - 0x3ae], ax
mov ecx, 0x2e
mov word [ebp - 0x3ac], cx
mov edx, 0x64
mov word [ebp - 0x3aa], dx
mov eax, 0x6c
mov word [ebp - 0x3a8], ax
mov ecx, 0x6c
mov word [ebp - 0x3a6], cx
xor edx, edx
mov word [ebp - 0x3a4], dx
push ebx
push eax
add esp, 4
xor ebx, 0x9555
sub ebx, 0x311d
jmp 0x407ab6
jmp 0x407abf
pop ebx
push ecx
and ecx, 0x14f9f
and ecx, 0x42ee
pop ecx
mov byte [ebp - 0x154], 0x4c
mov byte [ebp - 0x153], 0x6f
mov byte [ebp - 0x152], 0x61
mov byte [ebp - 0x151], 0x64
mov byte [ebp - 0x150], 0x4c
mov byte [ebp - 0x14f], 0x69
mov byte [ebp - 0x14e], 0x62
mov byte [ebp - 0x14d], 0x72
mov byte [ebp - 0x14c], 0x61
mov byte [ebp - 0x14b], 0x72
mov byte [ebp - 0x14a], 0x79
mov byte [ebp - 0x149], 0x57
mov byte [ebp - 0x148], 0
push esi
sub esi, 0x63b6
xor esi, 0x13833
sub esi, 0x18228
pop esi
push ebx
push esi
add esp, 4
or ebx, 0xef0e
add ebx, 0x14954
xor ebx, 0x12425
add ebx, 0xa550
pop ebx
push ebx
jmp 0x407b63
call 0x407b70
add byte [esi + 0x46], cl
inc esp
xor dh, byte [ebx]
cmp dword [eax], edi
add esp, 4
or ebx, 0x9720
pop ebx
push edx
push ebx
add esp, 4
jmp 0x407b86
or edx, 0x8c62
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x484], eax
push ebx
push esi
add esp, 4
or ebx, 0xd808
call 0x407bb3
add byte [edi], dh
cmp eax, dword [esi + 0x3b]
inc edx
inc eax
cmp dword [esi + 0x3a], eax
add esp, 4
xor ebx, 0xab0
add ebx, 0x91b1
pop ebx
push edx
or edx, 0x16a55
pop edx
mov ecx, dword [ebp - 0x484]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x488], edx
push edx
push eax
add esp, 4
or edx, 0x163b3
xor edx, 0x10017
sub edx, 0x461f
add edx, 0x10234
pop edx
push edi
call 0x407c08
add byte [ecx + edi + 0x3e], cl
inc edx
xor al, 0x3f
xor eax, dword [ebx - 0x74a0fb3c]
test dword [eax - 5], edi
invalid
Function at 0x4079f1
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
call 0x4079f1
add byte [eax], bh
inc eax
xor eax, 0x43454c39
dec ebx
inc esp
add esp, 4
pop esi
push esi
xor esi, 0xf4f8
and esi, 0x862e
pop esi
mov edx, 0x6b
mov word [ebp - 0x3bc], dx
mov eax, 0x65
mov word [ebp - 0x3ba], ax
mov ecx, 0x72
mov word [ebp - 0x3b8], cx
mov edx, 0x6e
mov word [ebp - 0x3b6], dx
mov eax, 0x65
mov word [ebp - 0x3b4], ax
mov ecx, 0x6c
mov word [ebp - 0x3b2], cx
mov edx, 0x33
mov word [ebp - 0x3b0], dx
mov eax, 0x32
mov word [ebp - 0x3ae], ax
mov ecx, 0x2e
mov word [ebp - 0x3ac], cx
mov edx, 0x64
mov word [ebp - 0x3aa], dx
mov eax, 0x6c
mov word [ebp - 0x3a8], ax
mov ecx, 0x6c
mov word [ebp - 0x3a6], cx
xor edx, edx
mov word [ebp - 0x3a4], dx
push ebx
push eax
add esp, 4
xor ebx, 0x9555
sub ebx, 0x311d
jmp 0x407ab6
jmp 0x407abf
pop ebx
push ecx
and ecx, 0x14f9f
and ecx, 0x42ee
pop ecx
mov byte [ebp - 0x154], 0x4c
mov byte [ebp - 0x153], 0x6f
mov byte [ebp - 0x152], 0x61
mov byte [ebp - 0x151], 0x64
mov byte [ebp - 0x150], 0x4c
mov byte [ebp - 0x14f], 0x69
mov byte [ebp - 0x14e], 0x62
mov byte [ebp - 0x14d], 0x72
mov byte [ebp - 0x14c], 0x61
mov byte [ebp - 0x14b], 0x72
mov byte [ebp - 0x14a], 0x79
mov byte [ebp - 0x149], 0x57
mov byte [ebp - 0x148], 0
push esi
sub esi, 0x63b6
xor esi, 0x13833
sub esi, 0x18228
pop esi
push ebx
push esi
add esp, 4
or ebx, 0xef0e
add ebx, 0x14954
xor ebx, 0x12425
add ebx, 0xa550
pop ebx
push ebx
jmp 0x407b63
call 0x407b70
add byte [esi + 0x46], cl
inc esp
xor dh, byte [ebx]
cmp dword [eax], edi
add esp, 4
or ebx, 0x9720
pop ebx
push edx
push ebx
add esp, 4
jmp 0x407b86
or edx, 0x8c62
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x484], eax
push ebx
push esi
add esp, 4
or ebx, 0xd808
call 0x407bb3
add byte [edi], dh
cmp eax, dword [esi + 0x3b]
inc edx
inc eax
cmp dword [esi + 0x3a], eax
add esp, 4
xor ebx, 0xab0
add ebx, 0x91b1
pop ebx
push edx
or edx, 0x16a55
pop edx
mov ecx, dword [ebp - 0x484]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x488], edx
push edx
push eax
add esp, 4
or edx, 0x163b3
xor edx, 0x10017
sub edx, 0x461f
add edx, 0x10234
pop edx
push edi
call 0x407c08
add byte [ecx + edi + 0x3e], cl
inc edx
xor al, 0x3f
xor eax, dword [ebx - 0x74a0fb3c]
test dword [eax - 5], edi
invalid
Function at 0x407b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
call 0x4079f1
add byte [eax], bh
inc eax
xor eax, 0x43454c39
dec ebx
inc esp
add esp, 4
pop esi
push esi
xor esi, 0xf4f8
and esi, 0x862e
pop esi
mov edx, 0x6b
mov word [ebp - 0x3bc], dx
mov eax, 0x65
mov word [ebp - 0x3ba], ax
mov ecx, 0x72
mov word [ebp - 0x3b8], cx
mov edx, 0x6e
mov word [ebp - 0x3b6], dx
mov eax, 0x65
mov word [ebp - 0x3b4], ax
mov ecx, 0x6c
mov word [ebp - 0x3b2], cx
mov edx, 0x33
mov word [ebp - 0x3b0], dx
mov eax, 0x32
mov word [ebp - 0x3ae], ax
mov ecx, 0x2e
mov word [ebp - 0x3ac], cx
mov edx, 0x64
mov word [ebp - 0x3aa], dx
mov eax, 0x6c
mov word [ebp - 0x3a8], ax
mov ecx, 0x6c
mov word [ebp - 0x3a6], cx
xor edx, edx
mov word [ebp - 0x3a4], dx
push ebx
push eax
add esp, 4
xor ebx, 0x9555
sub ebx, 0x311d
jmp 0x407ab6
jmp 0x407abf
pop ebx
push ecx
and ecx, 0x14f9f
and ecx, 0x42ee
pop ecx
mov byte [ebp - 0x154], 0x4c
mov byte [ebp - 0x153], 0x6f
mov byte [ebp - 0x152], 0x61
mov byte [ebp - 0x151], 0x64
mov byte [ebp - 0x150], 0x4c
mov byte [ebp - 0x14f], 0x69
mov byte [ebp - 0x14e], 0x62
mov byte [ebp - 0x14d], 0x72
mov byte [ebp - 0x14c], 0x61
mov byte [ebp - 0x14b], 0x72
mov byte [ebp - 0x14a], 0x79
mov byte [ebp - 0x149], 0x57
mov byte [ebp - 0x148], 0
push esi
sub esi, 0x63b6
xor esi, 0x13833
sub esi, 0x18228
pop esi
push ebx
push esi
add esp, 4
or ebx, 0xef0e
add ebx, 0x14954
xor ebx, 0x12425
add ebx, 0xa550
pop ebx
push ebx
jmp 0x407b63
call 0x407b70
add byte [esi + 0x46], cl
inc esp
xor dh, byte [ebx]
cmp dword [eax], edi
add esp, 4
or ebx, 0x9720
pop ebx
push edx
push ebx
add esp, 4
jmp 0x407b86
or edx, 0x8c62
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x484], eax
push ebx
push esi
add esp, 4
or ebx, 0xd808
call 0x407bb3
add byte [edi], dh
cmp eax, dword [esi + 0x3b]
inc edx
inc eax
cmp dword [esi + 0x3a], eax
add esp, 4
xor ebx, 0xab0
add ebx, 0x91b1
pop ebx
push edx
or edx, 0x16a55
pop edx
mov ecx, dword [ebp - 0x484]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x488], edx
push edx
push eax
add esp, 4
or edx, 0x163b3
xor edx, 0x10017
sub edx, 0x461f
add edx, 0x10234
pop edx
push edi
call 0x407c08
add byte [ecx + edi + 0x3e], cl
inc edx
xor al, 0x3f
xor eax, dword [ebx - 0x74a0fb3c]
test dword [eax - 5], edi
invalid
Function at 0x407bb3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
call 0x4079f1
add byte [eax], bh
inc eax
xor eax, 0x43454c39
dec ebx
inc esp
add esp, 4
pop esi
push esi
xor esi, 0xf4f8
and esi, 0x862e
pop esi
mov edx, 0x6b
mov word [ebp - 0x3bc], dx
mov eax, 0x65
mov word [ebp - 0x3ba], ax
mov ecx, 0x72
mov word [ebp - 0x3b8], cx
mov edx, 0x6e
mov word [ebp - 0x3b6], dx
mov eax, 0x65
mov word [ebp - 0x3b4], ax
mov ecx, 0x6c
mov word [ebp - 0x3b2], cx
mov edx, 0x33
mov word [ebp - 0x3b0], dx
mov eax, 0x32
mov word [ebp - 0x3ae], ax
mov ecx, 0x2e
mov word [ebp - 0x3ac], cx
mov edx, 0x64
mov word [ebp - 0x3aa], dx
mov eax, 0x6c
mov word [ebp - 0x3a8], ax
mov ecx, 0x6c
mov word [ebp - 0x3a6], cx
xor edx, edx
mov word [ebp - 0x3a4], dx
push ebx
push eax
add esp, 4
xor ebx, 0x9555
sub ebx, 0x311d
jmp 0x407ab6
jmp 0x407abf
pop ebx
push ecx
and ecx, 0x14f9f
and ecx, 0x42ee
pop ecx
mov byte [ebp - 0x154], 0x4c
mov byte [ebp - 0x153], 0x6f
mov byte [ebp - 0x152], 0x61
mov byte [ebp - 0x151], 0x64
mov byte [ebp - 0x150], 0x4c
mov byte [ebp - 0x14f], 0x69
mov byte [ebp - 0x14e], 0x62
mov byte [ebp - 0x14d], 0x72
mov byte [ebp - 0x14c], 0x61
mov byte [ebp - 0x14b], 0x72
mov byte [ebp - 0x14a], 0x79
mov byte [ebp - 0x149], 0x57
mov byte [ebp - 0x148], 0
push esi
sub esi, 0x63b6
xor esi, 0x13833
sub esi, 0x18228
pop esi
push ebx
push esi
add esp, 4
or ebx, 0xef0e
add ebx, 0x14954
xor ebx, 0x12425
add ebx, 0xa550
pop ebx
push ebx
jmp 0x407b63
call 0x407b70
add byte [esi + 0x46], cl
inc esp
xor dh, byte [ebx]
cmp dword [eax], edi
add esp, 4
or ebx, 0x9720
pop ebx
push edx
push ebx
add esp, 4
jmp 0x407b86
or edx, 0x8c62
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x484], eax
push ebx
push esi
add esp, 4
or ebx, 0xd808
call 0x407bb3
add byte [edi], dh
cmp eax, dword [esi + 0x3b]
inc edx
inc eax
cmp dword [esi + 0x3a], eax
add esp, 4
xor ebx, 0xab0
add ebx, 0x91b1
pop ebx
push edx
or edx, 0x16a55
pop edx
mov ecx, dword [ebp - 0x484]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x488], edx
push edx
push eax
add esp, 4
or edx, 0x163b3
xor edx, 0x10017
sub edx, 0x461f
add edx, 0x10234
pop edx
push edi
call 0x407c08
add byte [ecx + edi + 0x3e], cl
inc edx
xor al, 0x3f
xor eax, dword [ebx - 0x74a0fb3c]
test dword [eax - 5], edi
invalid
Function at 0x407c08
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
call 0x4079f1
add byte [eax], bh
inc eax
xor eax, 0x43454c39
dec ebx
inc esp
add esp, 4
pop esi
push esi
xor esi, 0xf4f8
and esi, 0x862e
pop esi
mov edx, 0x6b
mov word [ebp - 0x3bc], dx
mov eax, 0x65
mov word [ebp - 0x3ba], ax
mov ecx, 0x72
mov word [ebp - 0x3b8], cx
mov edx, 0x6e
mov word [ebp - 0x3b6], dx
mov eax, 0x65
mov word [ebp - 0x3b4], ax
mov ecx, 0x6c
mov word [ebp - 0x3b2], cx
mov edx, 0x33
mov word [ebp - 0x3b0], dx
mov eax, 0x32
mov word [ebp - 0x3ae], ax
mov ecx, 0x2e
mov word [ebp - 0x3ac], cx
mov edx, 0x64
mov word [ebp - 0x3aa], dx
mov eax, 0x6c
mov word [ebp - 0x3a8], ax
mov ecx, 0x6c
mov word [ebp - 0x3a6], cx
xor edx, edx
mov word [ebp - 0x3a4], dx
push ebx
push eax
add esp, 4
xor ebx, 0x9555
sub ebx, 0x311d
jmp 0x407ab6
jmp 0x407abf
pop ebx
push ecx
and ecx, 0x14f9f
and ecx, 0x42ee
pop ecx
mov byte [ebp - 0x154], 0x4c
mov byte [ebp - 0x153], 0x6f
mov byte [ebp - 0x152], 0x61
mov byte [ebp - 0x151], 0x64
mov byte [ebp - 0x150], 0x4c
mov byte [ebp - 0x14f], 0x69
mov byte [ebp - 0x14e], 0x62
mov byte [ebp - 0x14d], 0x72
mov byte [ebp - 0x14c], 0x61
mov byte [ebp - 0x14b], 0x72
mov byte [ebp - 0x14a], 0x79
mov byte [ebp - 0x149], 0x57
mov byte [ebp - 0x148], 0
push esi
sub esi, 0x63b6
xor esi, 0x13833
sub esi, 0x18228
pop esi
push ebx
push esi
add esp, 4
or ebx, 0xef0e
add ebx, 0x14954
xor ebx, 0x12425
add ebx, 0xa550
pop ebx
push ebx
jmp 0x407b63
call 0x407b70
add byte [esi + 0x46], cl
inc esp
xor dh, byte [ebx]
cmp dword [eax], edi
add esp, 4
or ebx, 0x9720
pop ebx
push edx
push ebx
add esp, 4
jmp 0x407b86
or edx, 0x8c62
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x484], eax
push ebx
push esi
add esp, 4
or ebx, 0xd808
call 0x407bb3
add byte [edi], dh
cmp eax, dword [esi + 0x3b]
inc edx
inc eax
cmp dword [esi + 0x3a], eax
add esp, 4
xor ebx, 0xab0
add ebx, 0x91b1
pop ebx
push edx
or edx, 0x16a55
pop edx
mov ecx, dword [ebp - 0x484]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x488], edx
push edx
push eax
add esp, 4
or edx, 0x163b3
xor edx, 0x10017
sub edx, 0x461f
add edx, 0x10234
pop edx
push edi
call 0x407c08
add byte [ecx + edi + 0x3e], cl
inc edx
xor al, 0x3f
xor eax, dword [ebx - 0x74a0fb3c]
test dword [eax - 5], edi
invalid
Function at 0x4083b6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x120]
add edx, 1
mov dword [ebp - 0x120], edx
add esp, 4
pop ebx
push ebx
and ebx, 0xb1e8
and ebx, 0x1084a
or ebx, 0xfe2e
and ebx, 0xcf25
pop ebx
mov dword [ebp - 0x2c], 0
jmp 0x4083e6
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x124]
add edx, dword [ebp - 0x2c]
movsx eax, byte [edx]
test eax, eax
je 0x408482
mov ecx, dword [ebp - 0x2c]
movsx edx, byte [ebp + ecx - 0x154]
test edx, edx
je 0x408482
push eax
push edi
add esp, 4
jmp 0x408416
jmp 0x40841f
sub eax, 0x2de2
pop eax
push ebx
add ebx, 0x15051
pop ebx
push edi
jmp 0x408434
sub edi, 0x7530
pop edi
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x2c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x2c]
movsx eax, byte [ebp + edx - 0x154]
cmp ecx, eax
je 0x408474
mov ecx, dword [ebp - 0x124]
add ecx, dword [ebp - 0x2c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x2c]
movsx ecx, byte [ebp + eax - 0x154]
cmp edx, ecx
jne 0x40847b
jmp 0x4083dd
jmp 0x408482
push ecx
push edx
add esp, 4
xor ecx, 0xb5cf
call 0x408499
add byte [eax], al
add byte [ebx], bh
inc ebx
inc edi
push eax
inc ebx
cmp eax, dword [ebx + 0x3eb04c4]
cmp dword [eax + edi + 0x59], eax
cmp byte [ecx + 0x51], bl
call method.CommandAppAuthSecuromGameRegistration.virtual_8
add byte [edx + ecx*2 + 0x32], al
inc esp
push eax
dec esi
dec ebp
add esp, 4
pop ecx
mov edx, dword [ebp - 0x124]
add edx, dword [ebp - 0x2c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x2c]
movsx edx, byte [ebp + ecx - 0x154]
cmp eax, edx
jne 0x4084de
mov dword [ebp - 0x1fc], 0
jmp 0x408579
push ebx
push ebx
add esp, 4
xor ebx, 0x7c88
and ebx, 0x113fe
xor ebx, 0x9fa4
pop ebx
push edx
push esi
add esp, 4
xor edx, 0xd095
jmp 0x408509
or edx, 0xf2d9
pop edx
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x2c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x2c]
movsx eax, byte [ebp + edx - 0x154]
or eax, 0x20
cmp ecx, eax
jge 0x40853d
mov dword [ebp - 0x1fc], 0xffffffff
jmp 0x408579
push eax
push ecx
add esp, 4
xor eax, 0xb28e
jmp 0x40854d
pop eax
push edi
push esi
add esp, 4
call 0x40855f
add byte [edi + esi], bh
dec edx
xor eax, 0xc4833749
add al, 0x81
invalid
cmp dword [ebp - 0x1fc], 0
jne 0x4085c2
push edx
xor edx, 0x11f82
pop edx
push ecx
jmp 0x408592
jmp 0x408599
jmp 0x40859f
pop ecx
push edi
add edi, 0xdab6
and edi, 0xa615
add edi, 0x3163
pop edi
mov ecx, dword [ebp - 0x498]
mov dword [ebp - 0x98], ecx
jmp 0x4085d3
jmp 0x4082da
Function at 0x408499
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x120]
add edx, 1
mov dword [ebp - 0x120], edx
add esp, 4
pop ebx
push ebx
and ebx, 0xb1e8
and ebx, 0x1084a
or ebx, 0xfe2e
and ebx, 0xcf25
pop ebx
mov dword [ebp - 0x2c], 0
jmp 0x4083e6
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x124]
add edx, dword [ebp - 0x2c]
movsx eax, byte [edx]
test eax, eax
je 0x408482
mov ecx, dword [ebp - 0x2c]
movsx edx, byte [ebp + ecx - 0x154]
test edx, edx
je 0x408482
push eax
push edi
add esp, 4
jmp 0x408416
jmp 0x40841f
sub eax, 0x2de2
pop eax
push ebx
add ebx, 0x15051
pop ebx
push edi
jmp 0x408434
sub edi, 0x7530
pop edi
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x2c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x2c]
movsx eax, byte [ebp + edx - 0x154]
cmp ecx, eax
je 0x408474
mov ecx, dword [ebp - 0x124]
add ecx, dword [ebp - 0x2c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x2c]
movsx ecx, byte [ebp + eax - 0x154]
cmp edx, ecx
jne 0x40847b
jmp 0x4083dd
jmp 0x408482
push ecx
push edx
add esp, 4
xor ecx, 0xb5cf
call 0x408499
add byte [eax], al
add byte [ebx], bh
inc ebx
inc edi
push eax
inc ebx
cmp eax, dword [ebx + 0x3eb04c4]
cmp dword [eax + edi + 0x59], eax
cmp byte [ecx + 0x51], bl
call method.CommandAppAuthSecuromGameRegistration.virtual_8
add byte [edx + ecx*2 + 0x32], al
inc esp
push eax
dec esi
dec ebp
add esp, 4
pop ecx
mov edx, dword [ebp - 0x124]
add edx, dword [ebp - 0x2c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x2c]
movsx edx, byte [ebp + ecx - 0x154]
cmp eax, edx
jne 0x4084de
mov dword [ebp - 0x1fc], 0
jmp 0x408579
push ebx
push ebx
add esp, 4
xor ebx, 0x7c88
and ebx, 0x113fe
xor ebx, 0x9fa4
pop ebx
push edx
push esi
add esp, 4
xor edx, 0xd095
jmp 0x408509
or edx, 0xf2d9
pop edx
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x2c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x2c]
movsx eax, byte [ebp + edx - 0x154]
or eax, 0x20
cmp ecx, eax
jge 0x40853d
mov dword [ebp - 0x1fc], 0xffffffff
jmp 0x408579
push eax
push ecx
add esp, 4
xor eax, 0xb28e
jmp 0x40854d
pop eax
push edi
push esi
add esp, 4
call 0x40855f
add byte [edi + esi], bh
dec edx
xor eax, 0xc4833749
add al, 0x81
invalid
cmp dword [ebp - 0x1fc], 0
jne 0x4085c2
push edx
xor edx, 0x11f82
pop edx
push ecx
jmp 0x408592
jmp 0x408599
jmp 0x40859f
pop ecx
push edi
add edi, 0xdab6
and edi, 0xa615
add edi, 0x3163
pop edi
mov ecx, dword [ebp - 0x498]
mov dword [ebp - 0x98], ecx
jmp 0x4085d3
jmp 0x4082da