joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4513e0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47e393
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00471d5c
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004773f5
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00478911
test eax, eax
je 0x4514fc
mov ecx, dword [esp + 0x3c]
call fcn.00477422
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4514c0
push edi
mov ecx, esi
call fcn.00474a8b
mov ecx, esi
call fcn.00451660
cmp dword [esp + 0x38], 1
jne 0x4514f5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00474bc6
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x453f10
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x453f43
push esi
call fcn.00457000
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x453f3c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x453fc9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x453fb2
mov eax, dword [esi + 8]
test eax, eax
je 0x453f67
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x453fae
cmp eax, 2
je 0x453fb2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x453f5a
cmp eax, 3
je 0x453f8d
cmp eax, 1
jne 0x453f5a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x453f5a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x453f5a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00453ff0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x453fd8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00453ff0
add esp, 4
pop esi
ret

Function at 0x472b52
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x472b8a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00470bdf
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00470bb7
jmp 0x472b96
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x474240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x474282
call fcn.00479d01
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x474282
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x474279
xor eax, eax
jmp 0x47428a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00474290
pop edi
pop esi
pop ebx
ret 4

Function at 0x47a231
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47a25f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47a27d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047a197
jmp 0x47a27d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47a27d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047a197
test edi, edi
mov eax, edi
jne 0x47a267
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x405bee
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push eax
add esp, 4
add ebx, 0x661b
sub ebx, 0x8d18
add ebx, 0x81a7
add byte [eax], al
pop ebx
push ecx
sub ecx, 0x704
or ecx, 0x8478
sub ecx, 0x16b23
jmp 0x405bac
pop ecx
lea ecx, [ebp - 0x1738]
mov dword [ebp - 0xc94], ecx
mov edx, dword [ebp - 0x504]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc90], eax
xor ecx, ecx
mov word [ebp - 0x210], cx
push dword [ebx]
shl byte [esi - 0x77], cl
xchg ebp, eax
hlt
invalid
invalid
invalid
push eax
push ebx
add esp, 4
call fcn.00405bee
add byte [eax*2 + 0x443f4842], dh
xor eax, 0xc483383d
add esp, 4
invalid
invalid
add esp, 4
xor eax, 0x5ecc
or eax, 0xd82
and eax, 0x3941
cmp dword [eax], eax
add byte [eax + 0x53], bl
and ebx, 0x6300
pop ebx
mov eax, dword [ebp - 0xc90]
mov cx, word [eax]
mov word [ebp - 0x1032], cx
mov edx, dword [ebp - 0xc90]
add edx, 2
mov dword [ebp - 0xc90], edx
mov ax, word [ebp - 0x1032]
mov word [ebp - 0x210], ax
mov ecx, dword [ebp - 0xc94]
mov dx, word [ecx]
mov word [ebp - 0x1034], dx
mov eax, dword [ebp - 0xc94]
add eax, 2
mov dword [ebp - 0xc94], eax
mov cx, word [ebp - 0x1034]
mov word [ebp - 0x10c], cx
push ecx
jmp 0x405c6f
xor ecx, 0x6ece
pop ecx
push ebx
jmp 0x405c7d
xor ebx, 0xa927
pop ebx
push ecx
and ecx, 0x54fc
sub ecx, 0xaa61
xor ecx, 0x15c85
pop ecx
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x405cbb
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e0], eax
jmp 0x405d1e
movzx edx, word [ebp - 0x210]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x405bda
movzx ecx, word [ebp - 0x210]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
invalid
invalid
cmp ecx, edx
je 0x405bda
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x405d08
mov dword [ebp - 0x15dc], 0xffffffff
jmp 0x405d12
mov dword [ebp - 0x15dc], 1
mov edx, dword [ebp - 0x15dc]
mov dword [ebp - 0x15e0], edx
cmp dword [ebp - 0x15e0], 0
jne 0x405d67
push eax
jmp 0x405d30
sub eax, 0xd4
or eax, 0x7769
pop eax
push ebx
and ebx, 0x11319
sbb dword [ebx], edx
add dword [eax], eax
xor ebx, 0x11fe0
pop ebx
push esi
add esi, 0xb687
and esi, 0x51c2
pop esi
mov eax, dword [ebp - 0x504]
invalid
Function at 0x405c00
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push eax
add esp, 4
add ebx, 0x661b
sub ebx, 0x8d18
add ebx, 0x81a7
add byte [eax], al
pop ebx
push ecx
sub ecx, 0x704
or ecx, 0x8478
sub ecx, 0x16b23
jmp 0x405bac
pop ecx
lea ecx, [ebp - 0x1738]
mov dword [ebp - 0xc94], ecx
mov edx, dword [ebp - 0x504]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc90], eax
xor ecx, ecx
mov word [ebp - 0x210], cx
push dword [ebx]
shl byte [esi - 0x77], cl
xchg ebp, eax
hlt
invalid
invalid
invalid
push eax
push ebx
add esp, 4
call fcn.00405bee
add byte [eax*2 + 0x443f4842], dh
xor eax, 0xc483383d
add esp, 4
invalid
invalid
add esp, 4
xor eax, 0x5ecc
or eax, 0xd82
and eax, 0x3941
cmp dword [eax], eax
add byte [eax + 0x53], bl
and ebx, 0x6300
pop ebx
mov eax, dword [ebp - 0xc90]
mov cx, word [eax]
mov word [ebp - 0x1032], cx
mov edx, dword [ebp - 0xc90]
add edx, 2
mov dword [ebp - 0xc90], edx
mov ax, word [ebp - 0x1032]
mov word [ebp - 0x210], ax
mov ecx, dword [ebp - 0xc94]
mov dx, word [ecx]
mov word [ebp - 0x1034], dx
mov eax, dword [ebp - 0xc94]
add eax, 2
mov dword [ebp - 0xc94], eax
mov cx, word [ebp - 0x1034]
mov word [ebp - 0x10c], cx
push ecx
jmp 0x405c6f
xor ecx, 0x6ece
pop ecx
push ebx
jmp 0x405c7d
xor ebx, 0xa927
pop ebx
push ecx
and ecx, 0x54fc
sub ecx, 0xaa61
xor ecx, 0x15c85
pop ecx
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x405cbb
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e0], eax
jmp 0x405d1e
movzx edx, word [ebp - 0x210]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x405bda
movzx ecx, word [ebp - 0x210]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
invalid
invalid
cmp ecx, edx
je 0x405bda
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x405d08
mov dword [ebp - 0x15dc], 0xffffffff
jmp 0x405d12
mov dword [ebp - 0x15dc], 1
mov edx, dword [ebp - 0x15dc]
mov dword [ebp - 0x15e0], edx
cmp dword [ebp - 0x15e0], 0
jne 0x405d67
push eax
jmp 0x405d30
sub eax, 0xd4
or eax, 0x7769
pop eax
push ebx
and ebx, 0x11319
sbb dword [ebx], edx
add dword [eax], eax
xor ebx, 0x11fe0
pop ebx
push esi
add esi, 0xb687
and esi, 0x51c2
pop esi
mov eax, dword [ebp - 0x504]
invalid
Function at 0x405ff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0x406001
mov dword [ebp - 0x750], 0
jmp 0x406261
mov ecx, dword [ebp - 0xca4]
mov dword [ebp - 0x508], ecx
push esi
sub esi, 0x2294
call 0x406023
add byte [edx], bh
aaa
xor eax, 0x36483b3b
inc edi
cmp al, byte [ebx - 0x97efb3c]
lcall 0xc2e6, 0x810000e2
out dx, eax
add byte [eax], al
pop esi
push edi
push eax
add esp, 4
and edi, 0xc28
pop edi
lea edx, [ebp - 0x1774]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc9c], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ecx
and ecx, 0x9717
xchg edi, eax
add byte [eax], al
add ecx, 0xbaed
xor ecx, 0xf6b
xor ecx, 0x16a7e
pop ecx
push ebx
push edx
add esp, 4
and ebx, 0xafc6
sub ebx, 0x14563
jmp 0x40609d
pop ebx
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push esi
push eax
add esp, 4
and esi, 0x1910
sub esi, 0xce95
sub esi, 0x8e5a
jmp 0x406117
pop esi
push ebx
call 0x406126
add byte [edx + 0x4f], cl
dec edi
dec esp
dec eax
inc eax
xor al, 0x46
add esp, 4
pop ebx
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x40614d
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x4061b0
invalid
mov bh, 0x85
Function at 0x406023
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0x406001
mov dword [ebp - 0x750], 0
jmp 0x406261
mov ecx, dword [ebp - 0xca4]
mov dword [ebp - 0x508], ecx
push esi
sub esi, 0x2294
call 0x406023
add byte [edx], bh
aaa
xor eax, 0x36483b3b
inc edi
cmp al, byte [ebx - 0x97efb3c]
lcall 0xc2e6, 0x810000e2
out dx, eax
add byte [eax], al
pop esi
push edi
push eax
add esp, 4
and edi, 0xc28
pop edi
lea edx, [ebp - 0x1774]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc9c], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ecx
and ecx, 0x9717
xchg edi, eax
add byte [eax], al
add ecx, 0xbaed
xor ecx, 0xf6b
xor ecx, 0x16a7e
pop ecx
push ebx
push edx
add esp, 4
and ebx, 0xafc6
sub ebx, 0x14563
jmp 0x40609d
pop ebx
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push esi
push eax
add esp, 4
and esi, 0x1910
sub esi, 0xce95
sub esi, 0x8e5a
jmp 0x406117
pop esi
push ebx
call 0x406126
add byte [edx + 0x4f], cl
dec edi
dec esp
dec eax
inc eax
xor al, 0x46
add esp, 4
pop ebx
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x40614d
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x4061b0
invalid
mov bh, 0x85
Function at 0x406126
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0x406001
mov dword [ebp - 0x750], 0
jmp 0x406261
mov ecx, dword [ebp - 0xca4]
mov dword [ebp - 0x508], ecx
push esi
sub esi, 0x2294
call 0x406023
add byte [edx], bh
aaa
xor eax, 0x36483b3b
inc edi
cmp al, byte [ebx - 0x97efb3c]
lcall 0xc2e6, 0x810000e2
out dx, eax
add byte [eax], al
pop esi
push edi
push eax
add esp, 4
and edi, 0xc28
pop edi
lea edx, [ebp - 0x1774]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc9c], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ecx
and ecx, 0x9717
xchg edi, eax
add byte [eax], al
add ecx, 0xbaed
xor ecx, 0xf6b
xor ecx, 0x16a7e
pop ecx
push ebx
push edx
add esp, 4
and ebx, 0xafc6
sub ebx, 0x14563
jmp 0x40609d
pop ebx
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push esi
push eax
add esp, 4
and esi, 0x1910
sub esi, 0xce95
sub esi, 0x8e5a
jmp 0x406117
pop esi
push ebx
call 0x406126
add byte [edx + 0x4f], cl
dec edi
dec esp
dec eax
inc eax
xor al, 0x46
add esp, 4
pop ebx
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x40614d
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x4061b0
invalid
mov bh, 0x85

Function at 0x4061e1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, 0x6180
pop edx
push ecx
add ecx, 0xa14b
jmp 0x4061d3
call 0x4061e1
add byte [ebx + eax*2], bh
dec esi
cmp bh, byte [edi]
cmp byte [edi], bh
add esp, 4
or ecx, 0x3002
pop ecx
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x406261
push eax
sub eax, 0x15756
jmp 0x406271
pop eax
push eax
push ecx
add esp, 4
add eax, 0x4958
and eax, 0x16aa3
jmp 0x40628c
or eax, 0x304a
pop eax
cmp dword [ebp - 0x750], 0
jne 0x4062dd
push edx
push edi
add esp, 4
or edx, 0x1321a
and edx, 0x9522
pop edx
push ecx
jmp 0x4062b5
invalid
xor ecx, 0xce0a
and ecx, 0x70bb
pop ecx
push esi
push eax
add esp, 4
or esi, 0x612b
pop esi
mov dword [ebp - 0x79c], 0
jmp 0x406e04
push esi
sub esi, 0xa444
sub esi, 0x169ce
pop esi
push ecx
push eax
add esp, 4
jmp 0x4062f7
jmp fcn.00406300
Function at 0x40620b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp edx, eax
je 0x40606c
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x40619a
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x4061a4
mov dword [ebp - 0x15e8], 1
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax
cmp dword [ebp - 0x15ec], 0
jne 0x4061f9
push edx
or edx, 0xb4c2
push esi
push edx
add esp, 4
call 0x40620b
add byte [eax + 0x4f], al
inc ebp
dec edi
cmp esi, dword [edi]
xor eax, 0xeb04c483
add ecx, dword [eax + eax*2 + 0x3e]
xor esi, 0x60c0
jmp 0x40621e
pop esi
push ebx
push edi
add esp, 4
or ebx, 0x10aca
pop ebx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x406257
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x40600d
mov dword [ebp - 0x750], 0
Function at 0x406300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x406309
jmp 0x40630e
pop ecx
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x40634e
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x40663f
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x406376
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x40663f
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x15f4]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x15f8], ecx
cmp dword [ebp - 0x15f8], 0
jne 0x4063a8
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], edx
jmp 0x40663f
mov eax, dword [ebp - 0x320]
add eax, dword [ebp - 0x15f8]
mov dword [ebp - 0x754], eax
jne 0x4063cd
mov ecx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], ecx
jmp 0x40663f
mov edx, dword [ebp - 0x754]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1964], eax
mov ecx, dword [ebp - 0x754]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x1968], edx
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 0x320]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x196c], ecx
mov dword [ebp - 0x758], 0
jmp 0x406427
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 0x758]
cmp ecx, dword [eax + 0x18]
jae 0x406633
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x1964]
mov ecx, dword [ebp - 0x320]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x75c], ecx
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x1968]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x196c]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1970], eax
mov dword [ebp - 0x198], 0
jmp 0x406497
mov edx, dword [ebp - 0x75c]
add edx, dword [ebp - 0x198]
movsx eax, byte [edx]
test eax, eax
je 0x406549
mov ecx, dword [ebp - 0x198]
movsx edx, byte [ebp + ecx - 0x894]
test edx, edx
je 0x406549
push eax
call 0x4064d2
add byte [esi], dh
dec edx
dec ebx
inc ecx
dec ebx
aaa
add esp, 4
xor eax, 0xe799
or eax, 0x84d7
pop eax
push ecx
add ecx, 0x53e3
sub ecx, 0x2b29
and ecx, 0x54de
pop ecx
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x198]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x198]
movsx eax, byte [ebp + edx - 0x894]
cmp ecx, eax
je 0x40653b
mov ecx, dword [ebp - 0x75c]
add ecx, dword [ebp - 0x198]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x198]
invalid
Function at 0x4064d2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x406309
jmp 0x40630e
pop ecx
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x40634e
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x40663f
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x406376
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x40663f
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x15f4]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x15f8], ecx
cmp dword [ebp - 0x15f8], 0
jne 0x4063a8
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], edx
jmp 0x40663f
mov eax, dword [ebp - 0x320]
add eax, dword [ebp - 0x15f8]
mov dword [ebp - 0x754], eax
jne 0x4063cd
mov ecx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], ecx
jmp 0x40663f
mov edx, dword [ebp - 0x754]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1964], eax
mov ecx, dword [ebp - 0x754]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x1968], edx
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 0x320]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x196c], ecx
mov dword [ebp - 0x758], 0
jmp 0x406427
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 0x758]
cmp ecx, dword [eax + 0x18]
jae 0x406633
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x1964]
mov ecx, dword [ebp - 0x320]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x75c], ecx
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x1968]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x196c]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1970], eax
mov dword [ebp - 0x198], 0
jmp 0x406497
mov edx, dword [ebp - 0x75c]
add edx, dword [ebp - 0x198]
movsx eax, byte [edx]
test eax, eax
je 0x406549
mov ecx, dword [ebp - 0x198]
movsx edx, byte [ebp + ecx - 0x894]
test edx, edx
je 0x406549
push eax
call 0x4064d2
add byte [esi], dh
dec edx
dec ebx
inc ecx
dec ebx
aaa
add esp, 4
xor eax, 0xe799
or eax, 0x84d7
pop eax
push ecx
add ecx, 0x53e3
sub ecx, 0x2b29
and ecx, 0x54de
pop ecx
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x198]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x198]
movsx eax, byte [ebp + edx - 0x894]
cmp ecx, eax
je 0x40653b
mov ecx, dword [ebp - 0x75c]
add ecx, dword [ebp - 0x198]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x198]
invalid

Function at 0x406580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [ebx]
xchg ebp, eax
push 0xffffffe
mov esi, 0x688d8b02
invalid

Function at 0x4065d6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
add bl, ch
outsd dx, dword [esi]
push esi
xor esi, 0x17c88
or esi, 0x10be7
or esi, 0x18510
jmp 0x4065c4
pop esi
push esi
call 0x4065d6
add byte [ecx + 0x35], cl
xor al, 0x47
dec edx
push eax
push eax
dec ebp
inc esp
inc ebx
add esp, 4
pop esi
mov eax, dword [ebp - 0x75c]