joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408e64
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x75c]
add eax, 1
mov dword [ebp - 0x75c], eax
mov ecx, dword [ebp - 0x758]
mov edx, dword [ebp - 0x75c]
cmp edx, dword [ecx + 0x18]
jae 0x408f26
mov eax, dword [ebp - 0x75c]
mov ecx, dword [ebp - 0x198c]
mov edx, dword [ebp - 0x3a8]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x760], edx
mov eax, dword [ebp - 0x75c]
mov ecx, dword [ebp - 0x1990]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x1994]
mov ecx, dword [ebp - 0x3a8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x1998], ecx
mov dword [ebp - 0x1c8], 0
jmp 0x408d8a
mov edx, dword [ebp - 0x1c8]
add edx, 1
mov dword [ebp - 0x1c8], edx
mov eax, dword [ebp - 0x760]
add eax, dword [ebp - 0x1c8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x408e3c
mov edx, dword [ebp - 0x1c8]
movsx eax, byte [ebp + edx - 0x898]
test eax, eax
je 0x408e3c
push eax
jmp 0x408dbf
or eax, 0x14678
sub eax, 0x7d0c
add eax, 0x10f27
pop eax
push eax
add eax, 0x17cc0
call 0x408de5
add byte [edi], dh
cmp eax, 0x434f3e35
add esp, 4
pop eax
mov ecx, dword [ebp - 0x760]
add ecx, dword [ebp - 0x1c8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1c8]
movsx ecx, byte [ebp + eax - 0x898]
cmp edx, ecx
je 0x408e2e
mov edx, dword [ebp - 0x760]
add edx, dword [ebp - 0x1c8]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1c8]
movsx edx, byte [ebp + ecx - 0x898]
xchg esp, eax
or eax, 0xfffff768
xchg esp, eax
or eax, 0xfffff768
cmp eax, edx
jne 0x408e35
jmp 0x408d7b
jmp 0x408e3c
push edi
sub edi, 0xc85a
xor edi, 0x5b3f
sub edi, 0x9fef
pop edi
push edx
push esi
add esp, 4
call 0x408e64
add byte [esi + 0x3a], cl
cmp al, byte [eax + 0x34]
inc esp
cmp esi, dword [esi]
dec esp
add esp, 4
or edx, 0x174d3
pop edx
mov eax, dword [ebp - 0x760]
add eax, dword [ebp - 0x1c8]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1c8]
movsx eax, byte [ebp + edx - 0x898]
cmp ecx, eax
jne 0x408e9b
mov dword [ebp - 0xcbc], 0
jmp 0x408f0a
push ebx
xor ebx, 0x17e4d
jmp 0x408eaa
pop ebx
push ecx
jmp 0x408eb2
pop ecx
push ecx
and ecx, 0x10c6a
add ecx, 0x58ce
xor ecx, 0x14509
or ecx, 0x12ee0
pop ecx
mov ecx, dword [ebp - 0x760]
add ecx, dword [ebp - 0x1c8]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1c8]
movsx ecx, byte [ebp + eax - 0x898]
or ecx, 0x20
cmp edx, ecx
jge 0x408f00
mov dword [ebp - 0xcbc], 0xffffffff
jmp 0x408f0a
mov dword [ebp - 0xcbc], 1
cmp dword [ebp - 0xcbc], 0
jne 0x408f21
mov edx, dword [ebp - 0x1998]
mov dword [ebp - 0x3e0], edx
jmp 0x408f32
jmp 0x408d0b
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x3e0], eax
Function at 0x409958
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jne 0x409969
mov dword [ebp - 0x300], 0
jmp 0x409c10
mov edx, dword [ebp - 0x1624]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd8], ecx
push ecx
or ecx, 0xc938
jmp 0x409989
sub ecx, 0x166a8
pop ecx
push ebx
push esi
add esp, 4
xor ebx, 0x8140
sub ebx, 0xde60
xor ebx, 0x11411
jmp 0x4099ac
pop ebx
cmp dword [ebp - 0xcd8], 0
jne 0x4099c5
mov dword [ebp - 0x300], 0
jmp 0x409c10
mov edx, dword [ebp - 0xcd8]
mov dword [ebp - 0x510], edx
push ecx
add ecx, 0x12b58
pop ecx
push eax
push ebx
add esp, 4
or eax, 0x7bcf
or eax, 0x16424
xor eax, 0xd0b3
call 0x4099ff
add byte [edi], bh
cmp byte [ecx + ecx*2 + 0x50], al
dec ecx
inc edx
inc eax
inc edi
add esp, 4
pop eax
lea eax, [ebp - 0x1754]
mov dword [ebp - 0xcd4], eax
mov ecx, dword [ebp - 0x510]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd0], edx
xor eax, eax
mov word [ebp - 0x238], ax
xor ecx, ecx
mov word [ebp - 0x4c], cx
push eax
call 0x409a3c
add byte [edx + 0x4c], al
cmp byte [0x484d3d3e], bh
add esp, 4
xor eax, 0xfd2f
and eax, 0xba73
call 0x409a5b
add byte [ebx], bh
cmp dl, byte [eax + 0x35]
dec edx
inc ebp
aaa
inc ecx
dec ebp
cmp dword [ebx - 0x74a7fb3c], eax
xchg ebp, eax
xor bl, dh
invalid

Function at 0x4099ff
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jne 0x409969
mov dword [ebp - 0x300], 0
jmp 0x409c10
mov edx, dword [ebp - 0x1624]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd8], ecx
push ecx
or ecx, 0xc938
jmp 0x409989
sub ecx, 0x166a8
pop ecx
push ebx
push esi
add esp, 4
xor ebx, 0x8140
sub ebx, 0xde60
xor ebx, 0x11411
jmp 0x4099ac
pop ebx
cmp dword [ebp - 0xcd8], 0
jne 0x4099c5
mov dword [ebp - 0x300], 0
jmp 0x409c10
mov edx, dword [ebp - 0xcd8]
mov dword [ebp - 0x510], edx
push ecx
add ecx, 0x12b58
pop ecx
push eax
push ebx
add esp, 4
or eax, 0x7bcf
or eax, 0x16424
xor eax, 0xd0b3
call 0x4099ff
add byte [edi], bh
cmp byte [ecx + ecx*2 + 0x50], al
dec ecx
inc edx
inc eax
inc edi
add esp, 4
pop eax
lea eax, [ebp - 0x1754]
mov dword [ebp - 0xcd4], eax
mov ecx, dword [ebp - 0x510]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd0], edx
xor eax, eax
mov word [ebp - 0x238], ax
xor ecx, ecx
mov word [ebp - 0x4c], cx
push eax
call 0x409a3c
add byte [edx + 0x4c], al
cmp byte [0x484d3d3e], bh
add esp, 4
xor eax, 0xfd2f
and eax, 0xba73
call 0x409a5b
add byte [ebx], bh
cmp dl, byte [eax + 0x35]
dec edx
inc ebp
aaa
inc ecx
dec ebp
cmp dword [ebx - 0x74a7fb3c], eax
xchg ebp, eax
xor bl, dh
invalid
Function at 0x409a3c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jne 0x409969
mov dword [ebp - 0x300], 0
jmp 0x409c10
mov edx, dword [ebp - 0x1624]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd8], ecx
push ecx
or ecx, 0xc938
jmp 0x409989
sub ecx, 0x166a8
pop ecx
push ebx
push esi
add esp, 4
xor ebx, 0x8140
sub ebx, 0xde60
xor ebx, 0x11411
jmp 0x4099ac
pop ebx
cmp dword [ebp - 0xcd8], 0
jne 0x4099c5
mov dword [ebp - 0x300], 0
jmp 0x409c10
mov edx, dword [ebp - 0xcd8]
mov dword [ebp - 0x510], edx
push ecx
add ecx, 0x12b58
pop ecx
push eax
push ebx
add esp, 4
or eax, 0x7bcf
or eax, 0x16424
xor eax, 0xd0b3
call 0x4099ff
add byte [edi], bh
cmp byte [ecx + ecx*2 + 0x50], al
dec ecx
inc edx
inc eax
inc edi
add esp, 4
pop eax
lea eax, [ebp - 0x1754]
mov dword [ebp - 0xcd4], eax
mov ecx, dword [ebp - 0x510]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd0], edx
xor eax, eax
mov word [ebp - 0x238], ax
xor ecx, ecx
mov word [ebp - 0x4c], cx
push eax
call 0x409a3c
add byte [edx + 0x4c], al
cmp byte [0x484d3d3e], bh
add esp, 4
xor eax, 0xfd2f
and eax, 0xba73
call 0x409a5b
add byte [ebx], bh
cmp dl, byte [eax + 0x35]
dec edx
inc ebp
aaa
inc ecx
dec ebp
cmp dword [ebx - 0x74a7fb3c], eax
xchg ebp, eax
xor bl, dh
invalid

Function at 0x409a5b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jne 0x409969
mov dword [ebp - 0x300], 0
jmp 0x409c10
mov edx, dword [ebp - 0x1624]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd8], ecx
push ecx
or ecx, 0xc938
jmp 0x409989
sub ecx, 0x166a8
pop ecx
push ebx
push esi
add esp, 4
xor ebx, 0x8140
sub ebx, 0xde60
xor ebx, 0x11411
jmp 0x4099ac
pop ebx
cmp dword [ebp - 0xcd8], 0
jne 0x4099c5
mov dword [ebp - 0x300], 0
jmp 0x409c10
mov edx, dword [ebp - 0xcd8]
mov dword [ebp - 0x510], edx
push ecx
add ecx, 0x12b58
pop ecx
push eax
push ebx
add esp, 4
or eax, 0x7bcf
or eax, 0x16424
xor eax, 0xd0b3
call 0x4099ff
add byte [edi], bh
cmp byte [ecx + ecx*2 + 0x50], al
dec ecx
inc edx
inc eax
inc edi
add esp, 4
pop eax
lea eax, [ebp - 0x1754]
mov dword [ebp - 0xcd4], eax
mov ecx, dword [ebp - 0x510]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd0], edx
xor eax, eax
mov word [ebp - 0x238], ax
xor ecx, ecx
mov word [ebp - 0x4c], cx
push eax
call 0x409a3c
add byte [edx + 0x4c], al
cmp byte [0x484d3d3e], bh
add esp, 4
xor eax, 0xfd2f
and eax, 0xba73
call 0x409a5b
add byte [ebx], bh
cmp dl, byte [eax + 0x35]
dec edx
inc ebp
aaa
inc ecx
dec ebp
cmp dword [ebx - 0x74a7fb3c], eax
xchg ebp, eax
xor bl, dh
invalid

Function at 0x409b79
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor eax, 0x9937
jmp 0x409b87
xor eax, 0x511e
pop eax
push eax
push edx
add esp, 4
sub eax, 0x929d
pop eax
mov edx, dword [ebp - 0x510]
mov dword [ebp - 0x300], edx
jmp 0x409c10
Function at 0x409bb6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ecx, 0xc4d3
pop ecx
push ebx
push esi
add esp, 4
or ebx, 0x1216d
xor ebx, 0x13d21
pop ebx
push eax
and eax, 0x13623
pop eax
mov eax, dword [ebp - 0x510]
mov ecx, dword [eax]
mov dword [ebp - 0x510], ecx
mov edx, dword [ebp - 0x510]
cmp edx, dword [ebp - 0xcd8]
je 0x409c06
mov eax, dword [ebp - 0x510]
cmp dword [eax + 0x30], 0

Function at 0x409c00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jne 0x4099d1
mov dword [ebp - 0x300], 0
push eax
xor eax, 0xd4a1
pop eax
push esi
push esi
add esp, 4
and esi, 0x8e9c
pop esi
push edx
push ecx
add esp, 4
xor edx, 0x80bf
invalid

Function at 0x409c0c
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jne 0x4099d1
mov dword [ebp - 0x300], 0
push eax
xor eax, 0xd4a1
pop eax
push esi
push esi
add esp, 4
and esi, 0x8e9c
pop esi
push edx
push ecx
add esp, 4
xor edx, 0x80bf
invalid

Function at 0x409da4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub ebx, 0x5a2c
pop ebx
push eax
xor eax, 0x4a18
pop eax
push ebx

Function at 0x409db4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub ebx, 0x3562
or ebx, 0xec6c
sub ebx, 0x4481
jmp 0x409dce
pop ebx
cmp dword [ebp - 0x1630], 0
jne 0x409de7
mov dword [ebp - 0x778], 0
jmp 0x40a08e
mov eax, dword [ebp - 0x1630]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xce4], edx
push edx
push edx
add esp, 4
add edx, 0x11eeb
sub edx, 0x3a79
pop edx
push ecx
add ecx, 0x11213
add ecx, 0x4b85
add ecx, 0x1bdc
pop ecx
push esi
push eax
add esp, 4
or esi, 0x11e24
pop esi
cmp dword [ebp - 0xce4], 0
jne 0x409e43
mov dword [ebp - 0x778], 0
jmp 0x40a08e
mov eax, dword [ebp - 0xce4]
mov dword [ebp - 0x514], eax
Function at 0x40a250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, 0xff
dec dword [ebx - 0x77b6b]
dec dword [ebx - 0x77f7b]
invalid

Function at 0x40a6cd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
xor eax, 0x3ba5
jmp 0x40a662
add eax, 0x181ab
and eax, 0x7aba
pop eax
push esi
xor esi, 0x12fe3
and esi, 0xba31
jmp 0x40a684
pop esi
lea ecx, [ebp - 0x1754]
mov dword [ebp - 0xcf0], ecx
mov edx, dword [ebp - 0x518]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xcec], eax
xor ecx, ecx
mov word [ebp - 0x240], cx
xor edx, edx
mov word [ebp - 0x54], dx
push edi
push edx
add esp, 4
sub edi, 0x670e
sub edi, 0x105af
call fcn.0040a6cd
add byte [ecx], bh
dec ebx
inc edx
cmp esi, dword [edx]
aas
dec edx
add esp, 4
pop edi
push eax
jmp 0x40a6d8
jmp 0x40a6e0
pop eax
mov eax, dword [ebp - 0xcec]
mov cx, word [eax]
mov word [ebp - 0x105a], cx
mov edx, dword [ebp - 0xcec]
add edx, 2
mov dword [ebp - 0xcec], edx
mov ax, word [ebp - 0x105a]
mov word [ebp - 0x240], ax
mov ecx, dword [ebp - 0xcf0]
mov dx, word [ecx]
mov word [ebp - 0x105c], dx
mov eax, dword [ebp - 0xcf0]
add eax, 2
mov dword [ebp - 0xcf0], eax
mov cx, word [ebp - 0x105c]
mov word [ebp - 0x54], cx
push edi
push esi
add esp, 4
xor edi, 0x121ac
and edi, 0x2037
call 0x40a758
add byte [edi + 0x3d], cl
cmp eax, 0x43493838
inc ebx
aaa
add esp, 4
add edi, 0x1e1c
pop edi
push esi
or esi, 0x1822
pop esi
movzx edx, word [ebp - 0x54]
test edx, edx
jne 0x40a787
movzx eax, word [ebp - 0x240]
movzx ecx, word [ebp - 0x54]
sub eax, ecx
mov dword [ebp - 0x1694], eax
jmp 0x40a7e1
movzx edx, word [ebp - 0x240]
movzx eax, word [ebp - 0x54]
cmp edx, eax
je 0x40a6af
movzx ecx, word [ebp - 0x240]
xor ecx, 0x20
movzx edx, word [ebp - 0x54]
cmp ecx, edx
je 0x40a6af
movzx eax, word [ebp - 0x240]
movzx ecx, word [ebp - 0x54]
cmp eax, ecx
jge 0x40a7cb
mov dword [ebp - 0x168c], 0xffffffff
jmp 0x40a7d5
mov dword [ebp - 0x168c], 1
mov edx, dword [ebp - 0x168c]
mov dword [ebp - 0x1694], edx
cmp dword [ebp - 0x1694], 0
jne 0x40a82a
push eax
sub eax, 0x10e32
and eax, 0x3693
add eax, 0xca5e
pop eax
push ebx
xor ebx, 0x4e3a
call 0x40a812
add byte [eax], bh
dec edi
inc edi
inc ebx
dec ebp
push eax
add esp, 4
and ebx, 0x182e3
pop ebx
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x300], eax
jmp 0x40a892
push ecx
call 0x40a838
add byte [edi + edi], dh
dec edi
push eax
dec edi
xor al, 0x40
add esp, 4
add ecx, 0x86c7
xor ecx, 0xb02a
pop ecx
push esi
call 0x40a858
add byte [eax + 0x4d], cl
dec esp
dec edx
push eax
inc ebp
xor cl, byte [edi + 0x3f]
add esp, 4
pop esi
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx]
mov dword [ebp - 0x518], edx
mov eax, dword [ebp - 0x518]
cmp eax, dword [ebp - 0xcf4]
je 0x40a888
mov ecx, dword [ebp - 0x518]
cmp dword [ecx + 0x30], 0
jne 0x40a653
mov dword [ebp - 0x300], 0
Function at 0x40a758
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
xor eax, 0x3ba5
jmp 0x40a662
add eax, 0x181ab
and eax, 0x7aba
pop eax
push esi
xor esi, 0x12fe3
and esi, 0xba31
jmp 0x40a684
pop esi
lea ecx, [ebp - 0x1754]
mov dword [ebp - 0xcf0], ecx
mov edx, dword [ebp - 0x518]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xcec], eax
xor ecx, ecx
mov word [ebp - 0x240], cx
xor edx, edx
mov word [ebp - 0x54], dx
push edi
push edx
add esp, 4
sub edi, 0x670e
sub edi, 0x105af
call fcn.0040a6cd
add byte [ecx], bh
dec ebx
inc edx
cmp esi, dword [edx]
aas
dec edx
add esp, 4
pop edi
push eax
jmp 0x40a6d8
jmp 0x40a6e0
pop eax
mov eax, dword [ebp - 0xcec]
mov cx, word [eax]
mov word [ebp - 0x105a], cx
mov edx, dword [ebp - 0xcec]
add edx, 2
mov dword [ebp - 0xcec], edx
mov ax, word [ebp - 0x105a]
mov word [ebp - 0x240], ax
mov ecx, dword [ebp - 0xcf0]
mov dx, word [ecx]
mov word [ebp - 0x105c], dx
mov eax, dword [ebp - 0xcf0]
add eax, 2
mov dword [ebp - 0xcf0], eax
mov cx, word [ebp - 0x105c]
mov word [ebp - 0x54], cx
push edi
push esi
add esp, 4
xor edi, 0x121ac
and edi, 0x2037
call 0x40a758
add byte [edi + 0x3d], cl
cmp eax, 0x43493838
inc ebx
aaa
add esp, 4
add edi, 0x1e1c
pop edi
push esi
or esi, 0x1822
pop esi
movzx edx, word [ebp - 0x54]
test edx, edx
jne 0x40a787
movzx eax, word [ebp - 0x240]
movzx ecx, word [ebp - 0x54]
sub eax, ecx
mov dword [ebp - 0x1694], eax
jmp 0x40a7e1
movzx edx, word [ebp - 0x240]
movzx eax, word [ebp - 0x54]
cmp edx, eax
je 0x40a6af
movzx ecx, word [ebp - 0x240]
xor ecx, 0x20
movzx edx, word [ebp - 0x54]
cmp ecx, edx
je 0x40a6af
movzx eax, word [ebp - 0x240]
movzx ecx, word [ebp - 0x54]
cmp eax, ecx
jge 0x40a7cb
mov dword [ebp - 0x168c], 0xffffffff
jmp 0x40a7d5
mov dword [ebp - 0x168c], 1
mov edx, dword [ebp - 0x168c]
mov dword [ebp - 0x1694], edx
cmp dword [ebp - 0x1694], 0
jne 0x40a82a
push eax
sub eax, 0x10e32
and eax, 0x3693
add eax, 0xca5e
pop eax
push ebx
xor ebx, 0x4e3a
call 0x40a812
add byte [eax], bh
dec edi
inc edi
inc ebx
dec ebp
push eax
add esp, 4
and ebx, 0x182e3
pop ebx
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x300], eax
jmp 0x40a892
push ecx
call 0x40a838
add byte [edi + edi], dh
dec edi
push eax
dec edi
xor al, 0x40
add esp, 4
add ecx, 0x86c7
xor ecx, 0xb02a
pop ecx
push esi
call 0x40a858
add byte [eax + 0x4d], cl
dec esp
dec edx
push eax
inc ebp
xor cl, byte [edi + 0x3f]
add esp, 4
pop esi
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx]
mov dword [ebp - 0x518], edx
mov eax, dword [ebp - 0x518]
cmp eax, dword [ebp - 0xcf4]
je 0x40a888
mov ecx, dword [ebp - 0x518]
cmp dword [ecx + 0x30], 0
jne 0x40a653
mov dword [ebp - 0x300], 0
Function at 0x40a812
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
xor eax, 0x3ba5
jmp 0x40a662
add eax, 0x181ab
and eax, 0x7aba
pop eax
push esi
xor esi, 0x12fe3
and esi, 0xba31
jmp 0x40a684
pop esi
lea ecx, [ebp - 0x1754]
mov dword [ebp - 0xcf0], ecx
mov edx, dword [ebp - 0x518]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xcec], eax
xor ecx, ecx
mov word [ebp - 0x240], cx
xor edx, edx
mov word [ebp - 0x54], dx
push edi
push edx
add esp, 4
sub edi, 0x670e
sub edi, 0x105af
call fcn.0040a6cd
add byte [ecx], bh
dec ebx
inc edx
cmp esi, dword [edx]
aas
dec edx
add esp, 4
pop edi
push eax
jmp 0x40a6d8
jmp 0x40a6e0
pop eax
mov eax, dword [ebp - 0xcec]
mov cx, word [eax]
mov word [ebp - 0x105a], cx
mov edx, dword [ebp - 0xcec]
add edx, 2
mov dword [ebp - 0xcec], edx
mov ax, word [ebp - 0x105a]
mov word [ebp - 0x240], ax
mov ecx, dword [ebp - 0xcf0]
mov dx, word [ecx]
mov word [ebp - 0x105c], dx
mov eax, dword [ebp - 0xcf0]
add eax, 2
mov dword [ebp - 0xcf0], eax
mov cx, word [ebp - 0x105c]
mov word [ebp - 0x54], cx
push edi
push esi
add esp, 4
xor edi, 0x121ac
and edi, 0x2037
call 0x40a758
add byte [edi + 0x3d], cl
cmp eax, 0x43493838
inc ebx
aaa
add esp, 4
add edi, 0x1e1c
pop edi
push esi
or esi, 0x1822
pop esi
movzx edx, word [ebp - 0x54]
test edx, edx
jne 0x40a787
movzx eax, word [ebp - 0x240]
movzx ecx, word [ebp - 0x54]
sub eax, ecx
mov dword [ebp - 0x1694], eax
jmp 0x40a7e1
movzx edx, word [ebp - 0x240]
movzx eax, word [ebp - 0x54]
cmp edx, eax
je 0x40a6af
movzx ecx, word [ebp - 0x240]
xor ecx, 0x20
movzx edx, word [ebp - 0x54]
cmp ecx, edx
je 0x40a6af
movzx eax, word [ebp - 0x240]
movzx ecx, word [ebp - 0x54]
cmp eax, ecx
jge 0x40a7cb
mov dword [ebp - 0x168c], 0xffffffff
jmp 0x40a7d5
mov dword [ebp - 0x168c], 1
mov edx, dword [ebp - 0x168c]
mov dword [ebp - 0x1694], edx
cmp dword [ebp - 0x1694], 0
jne 0x40a82a
push eax
sub eax, 0x10e32
and eax, 0x3693
add eax, 0xca5e
pop eax
push ebx
xor ebx, 0x4e3a
call 0x40a812
add byte [eax], bh
dec edi
inc edi
inc ebx
dec ebp
push eax
add esp, 4
and ebx, 0x182e3
pop ebx
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x300], eax
jmp 0x40a892
push ecx
call 0x40a838
add byte [edi + edi], dh
dec edi
push eax
dec edi
xor al, 0x40
add esp, 4
add ecx, 0x86c7
xor ecx, 0xb02a
pop ecx
push esi
call 0x40a858
add byte [eax + 0x4d], cl
dec esp
dec edx
push eax
inc ebp
xor cl, byte [edi + 0x3f]
add esp, 4
pop esi
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx]
mov dword [ebp - 0x518], edx
mov eax, dword [ebp - 0x518]
cmp eax, dword [ebp - 0xcf4]
je 0x40a888
mov ecx, dword [ebp - 0x518]
cmp dword [ecx + 0x30], 0
jne 0x40a653
mov dword [ebp - 0x300], 0
Function at 0x40a838
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
xor eax, 0x3ba5
jmp 0x40a662
add eax, 0x181ab
and eax, 0x7aba
pop eax
push esi
xor esi, 0x12fe3
and esi, 0xba31
jmp 0x40a684
pop esi
lea ecx, [ebp - 0x1754]
mov dword [ebp - 0xcf0], ecx
mov edx, dword [ebp - 0x518]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xcec], eax
xor ecx, ecx
mov word [ebp - 0x240], cx
xor edx, edx
mov word [ebp - 0x54], dx
push edi
push edx
add esp, 4
sub edi, 0x670e
sub edi, 0x105af
call fcn.0040a6cd
add byte [ecx], bh
dec ebx
inc edx
cmp esi, dword [edx]
aas
dec edx
add esp, 4
pop edi
push eax
jmp 0x40a6d8
jmp 0x40a6e0
pop eax
mov eax, dword [ebp - 0xcec]
mov cx, word [eax]
mov word [ebp - 0x105a], cx
mov edx, dword [ebp - 0xcec]
add edx, 2
mov dword [ebp - 0xcec], edx
mov ax, word [ebp - 0x105a]
mov word [ebp - 0x240], ax
mov ecx, dword [ebp - 0xcf0]
mov dx, word [ecx]
mov word [ebp - 0x105c], dx
mov eax, dword [ebp - 0xcf0]
add eax, 2
mov dword [ebp - 0xcf0], eax
mov cx, word [ebp - 0x105c]
mov word [ebp - 0x54], cx
push edi
push esi
add esp, 4
xor edi, 0x121ac
and edi, 0x2037
call 0x40a758
add byte [edi + 0x3d], cl
cmp eax, 0x43493838
inc ebx
aaa
add esp, 4
add edi, 0x1e1c
pop edi
push esi
or esi, 0x1822
pop esi
movzx edx, word [ebp - 0x54]
test edx, edx
jne 0x40a787
movzx eax, word [ebp - 0x240]
movzx ecx, word [ebp - 0x54]
sub eax, ecx
mov dword [ebp - 0x1694], eax
jmp 0x40a7e1
movzx edx, word [ebp - 0x240]
movzx eax, word [ebp - 0x54]
cmp edx, eax
je 0x40a6af
movzx ecx, word [ebp - 0x240]
xor ecx, 0x20
movzx edx, word [ebp - 0x54]
cmp ecx, edx
je 0x40a6af
movzx eax, word [ebp - 0x240]
movzx ecx, word [ebp - 0x54]
cmp eax, ecx
jge 0x40a7cb
mov dword [ebp - 0x168c], 0xffffffff
jmp 0x40a7d5
mov dword [ebp - 0x168c], 1
mov edx, dword [ebp - 0x168c]
mov dword [ebp - 0x1694], edx
cmp dword [ebp - 0x1694], 0
jne 0x40a82a
push eax
sub eax, 0x10e32
and eax, 0x3693
add eax, 0xca5e
pop eax
push ebx
xor ebx, 0x4e3a
call 0x40a812
add byte [eax], bh
dec edi
inc edi
inc ebx
dec ebp
push eax
add esp, 4
and ebx, 0x182e3
pop ebx
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x300], eax
jmp 0x40a892
push ecx
call 0x40a838
add byte [edi + edi], dh
dec edi
push eax
dec edi
xor al, 0x40
add esp, 4
add ecx, 0x86c7
xor ecx, 0xb02a
pop ecx
push esi
call 0x40a858
add byte [eax + 0x4d], cl
dec esp
dec edx
push eax
inc ebp
xor cl, byte [edi + 0x3f]
add esp, 4
pop esi
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx]
mov dword [ebp - 0x518], edx
mov eax, dword [ebp - 0x518]
cmp eax, dword [ebp - 0xcf4]
je 0x40a888
mov ecx, dword [ebp - 0x518]
cmp dword [ecx + 0x30], 0
jne 0x40a653
mov dword [ebp - 0x300], 0
Function at 0x40a858
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
xor eax, 0x3ba5
jmp 0x40a662
add eax, 0x181ab
and eax, 0x7aba
pop eax
push esi
xor esi, 0x12fe3
and esi, 0xba31
jmp 0x40a684
pop esi
lea ecx, [ebp - 0x1754]
mov dword [ebp - 0xcf0], ecx
mov edx, dword [ebp - 0x518]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xcec], eax
xor ecx, ecx
mov word [ebp - 0x240], cx
xor edx, edx
mov word [ebp - 0x54], dx
push edi
push edx
add esp, 4
sub edi, 0x670e
sub edi, 0x105af
call fcn.0040a6cd
add byte [ecx], bh
dec ebx
inc edx
cmp esi, dword [edx]
aas
dec edx
add esp, 4
pop edi
push eax
jmp 0x40a6d8
jmp 0x40a6e0
pop eax
mov eax, dword [ebp - 0xcec]
mov cx, word [eax]
mov word [ebp - 0x105a], cx
mov edx, dword [ebp - 0xcec]
add edx, 2
mov dword [ebp - 0xcec], edx
mov ax, word [ebp - 0x105a]
mov word [ebp - 0x240], ax
mov ecx, dword [ebp - 0xcf0]
mov dx, word [ecx]
mov word [ebp - 0x105c], dx
mov eax, dword [ebp - 0xcf0]
add eax, 2
mov dword [ebp - 0xcf0], eax
mov cx, word [ebp - 0x105c]
mov word [ebp - 0x54], cx
push edi
push esi
add esp, 4
xor edi, 0x121ac
and edi, 0x2037
call 0x40a758
add byte [edi + 0x3d], cl
cmp eax, 0x43493838
inc ebx
aaa
add esp, 4
add edi, 0x1e1c
pop edi
push esi
or esi, 0x1822
pop esi
movzx edx, word [ebp - 0x54]
test edx, edx
jne 0x40a787
movzx eax, word [ebp - 0x240]
movzx ecx, word [ebp - 0x54]
sub eax, ecx
mov dword [ebp - 0x1694], eax
jmp 0x40a7e1
movzx edx, word [ebp - 0x240]
movzx eax, word [ebp - 0x54]
cmp edx, eax
je 0x40a6af
movzx ecx, word [ebp - 0x240]
xor ecx, 0x20
movzx edx, word [ebp - 0x54]
cmp ecx, edx
je 0x40a6af
movzx eax, word [ebp - 0x240]
movzx ecx, word [ebp - 0x54]
cmp eax, ecx
jge 0x40a7cb
mov dword [ebp - 0x168c], 0xffffffff
jmp 0x40a7d5
mov dword [ebp - 0x168c], 1
mov edx, dword [ebp - 0x168c]
mov dword [ebp - 0x1694], edx
cmp dword [ebp - 0x1694], 0
jne 0x40a82a
push eax
sub eax, 0x10e32
and eax, 0x3693
add eax, 0xca5e
pop eax
push ebx
xor ebx, 0x4e3a
call 0x40a812
add byte [eax], bh
dec edi
inc edi
inc ebx
dec ebp
push eax
add esp, 4
and ebx, 0x182e3
pop ebx
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x300], eax
jmp 0x40a892
push ecx
call 0x40a838
add byte [edi + edi], dh
dec edi
push eax
dec edi
xor al, 0x40
add esp, 4
add ecx, 0x86c7
xor ecx, 0xb02a
pop ecx
push esi
call 0x40a858
add byte [eax + 0x4d], cl
dec esp
dec edx
push eax
inc ebp
xor cl, byte [edi + 0x3f]
add esp, 4
pop esi
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx]
mov dword [ebp - 0x518], edx
mov eax, dword [ebp - 0x518]
cmp eax, dword [ebp - 0xcf4]
je 0x40a888
mov ecx, dword [ebp - 0x518]
cmp dword [ecx + 0x30], 0
jne 0x40a653
mov dword [ebp - 0x300], 0