joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407dea
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ebx, 0x12150
sub ebx, 0x2dec
xor ebx, 0x11d81
pop ebx
push ebx
or ebx, 0xca85
pop ebx
cmp dword [ebp - 0xec], 0
je 0x407d6c
cmp dword [ebp - 0x268], 0
jne 0x407db2
push ecx
add ecx, 0x3de1
or ecx, 0x10008
or ecx, 0xd06f
pop ecx
push ebx
push edi
add esp, 4
add ebx, 0x1c15
xor ebx, 0x8dff
and ebx, 0x82ff
sub ebx, 0xa521
pop ebx
mov ecx, dword [ebp - 0x1e0]
and dh, bh
invalid
dec dword [ecx - 0x70f73]
jmp [edx]
call dword [ebp - 0x710]
mov dword [ebp - 0x7a4], 0xa
push edi
xor edi, 0xe701
out 0, eax
add byte [ecx + 0x526dcf], al
add byte [ecx + 0xaef6ef], al
add byte [edi + 0x56], bl
or esi, 0x14ec6
sub esi, 0x12533
call 0x407dea
add byte [edi + ecx*2 + 0x35], al
inc ecx
dec ecx
dec ecx
dec esp
add esp, 4
pop esi
mov edx, dword [ebp - 0xec]
mov al, byte [edx + 0xa]
mov byte [ebp - 0xde], al
mov ecx, dword [ebp - 0x268]
sub ecx, dword [ebp - 0xec]
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x3f4], 0
push edi
push ebx
add esp, 4
or edi, 0x10063
jmp 0x407e2d
pop edi
push ebx
add ebx, 0xc968
and ebx, 0x11e27
call 0x407e47
add byte [esi + 0x40], cl
dec edx
cmp eax, dword [eax + 0x4f]
add esp, 4
pop ebx
mov byte [ebp - 0x254], 0x56
mov byte [ebp - 0x253], 0x69
mov byte [ebp - 0x252], 0x72
mov byte [ebp - 0x251], 0x74
mov byte [ebp - 0x250], 0x75
mov byte [ebp - 0x24f], 0x61
mov byte [ebp - 0x24e], 0x6c
mov byte [ebp - 0x24d], 0x50
mov byte [ebp - 0x24c], 0x72
mov byte [ebp - 0x24b], 0x6f
outsd dx, dword [esi]
mov byte [ebp - 0x24a], 0x74
mov byte [ebp - 0x249], 0x65
mov byte [ebp - 0x248], 0x63
mov byte [ebp - 0x247], 0x74
mov byte [ebp - 0x246], 0
push eax
push esi
add esp, 4
call 0x407ec8
add byte [ebp + ecx*2 + 0x37], al
dec ebp
dec ebx
inc ebp
cmp al, 0x40
xor eax, dword [ebx + 0x4eb04c4]
cmp ecx, dword [ebx + 0x32]
xor eax, 0x7662c081
add dword [eax], eax
pop eax
push edx
xor edx, 0x55e
xor edx, 0xcc67
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x714], edx
mov eax, dword [ebp - 0x714]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x718], ecx
mov edx, dword [ebp - 0x718]
mov dword [ebp - 0x4f0], edx
push ebx
or ebx, 0x11ca
call 0x407f22
add byte [edi], bh
cmp dl, byte [eax + 0x3e]
inc eax
inc eax
inc edx
add esp, 4
add ebx, 0xf6e3
pop ebx
push edi
and edi, 0xfcc7
xor edi, 0x10960
and edi, 0x9658
pop edi
cmp dword [ebp - 0x4f0], 0
jne 0x407f58
invalid
test dword [edi + edi*8 - 1], edx
inc dword [eax]
Function at 0x407e47
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Get process heap flags
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ebx, 0x12150
sub ebx, 0x2dec
xor ebx, 0x11d81
pop ebx
push ebx
or ebx, 0xca85
pop ebx
cmp dword [ebp - 0xec], 0
je 0x407d6c
cmp dword [ebp - 0x268], 0
jne 0x407db2
push ecx
add ecx, 0x3de1
or ecx, 0x10008
or ecx, 0xd06f
pop ecx
push ebx
push edi
add esp, 4
add ebx, 0x1c15
xor ebx, 0x8dff
and ebx, 0x82ff
sub ebx, 0xa521
pop ebx
mov ecx, dword [ebp - 0x1e0]
and dh, bh
invalid
dec dword [ecx - 0x70f73]
jmp [edx]
call dword [ebp - 0x710]
mov dword [ebp - 0x7a4], 0xa
push edi
xor edi, 0xe701
out 0, eax
add byte [ecx + 0x526dcf], al
add byte [ecx + 0xaef6ef], al
add byte [edi + 0x56], bl
or esi, 0x14ec6
sub esi, 0x12533
call 0x407dea
add byte [edi + ecx*2 + 0x35], al
inc ecx
dec ecx
dec ecx
dec esp
add esp, 4
pop esi
mov edx, dword [ebp - 0xec]
mov al, byte [edx + 0xa]
mov byte [ebp - 0xde], al
mov ecx, dword [ebp - 0x268]
sub ecx, dword [ebp - 0xec]
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x3f4], 0
push edi
push ebx
add esp, 4
or edi, 0x10063
jmp 0x407e2d
pop edi
push ebx
add ebx, 0xc968
and ebx, 0x11e27
call 0x407e47
add byte [esi + 0x40], cl
dec edx
cmp eax, dword [eax + 0x4f]
add esp, 4
pop ebx
mov byte [ebp - 0x254], 0x56
mov byte [ebp - 0x253], 0x69
mov byte [ebp - 0x252], 0x72
mov byte [ebp - 0x251], 0x74
mov byte [ebp - 0x250], 0x75
mov byte [ebp - 0x24f], 0x61
mov byte [ebp - 0x24e], 0x6c
mov byte [ebp - 0x24d], 0x50
mov byte [ebp - 0x24c], 0x72
mov byte [ebp - 0x24b], 0x6f
outsd dx, dword [esi]
mov byte [ebp - 0x24a], 0x74
mov byte [ebp - 0x249], 0x65
mov byte [ebp - 0x248], 0x63
mov byte [ebp - 0x247], 0x74
mov byte [ebp - 0x246], 0
push eax
push esi
add esp, 4
call 0x407ec8
add byte [ebp + ecx*2 + 0x37], al
dec ebp
dec ebx
inc ebp
cmp al, 0x40
xor eax, dword [ebx + 0x4eb04c4]
cmp ecx, dword [ebx + 0x32]
xor eax, 0x7662c081
add dword [eax], eax
pop eax
push edx
xor edx, 0x55e
xor edx, 0xcc67
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x714], edx
mov eax, dword [ebp - 0x714]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x718], ecx
mov edx, dword [ebp - 0x718]
mov dword [ebp - 0x4f0], edx
push ebx
or ebx, 0x11ca
call 0x407f22
add byte [edi], bh
cmp dl, byte [eax + 0x3e]
inc eax
inc eax
inc edx
add esp, 4
add ebx, 0xf6e3
pop ebx
push edi
and edi, 0xfcc7
xor edi, 0x10960
and edi, 0x9658
pop edi
cmp dword [ebp - 0x4f0], 0
jne 0x407f58
invalid
test dword [edi + edi*8 - 1], edx
inc dword [eax]
Function at 0x407ec8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ebx, 0x12150
sub ebx, 0x2dec
xor ebx, 0x11d81
pop ebx
push ebx
or ebx, 0xca85
pop ebx
cmp dword [ebp - 0xec], 0
je 0x407d6c
cmp dword [ebp - 0x268], 0
jne 0x407db2
push ecx
add ecx, 0x3de1
or ecx, 0x10008
or ecx, 0xd06f
pop ecx
push ebx
push edi
add esp, 4
add ebx, 0x1c15
xor ebx, 0x8dff
and ebx, 0x82ff
sub ebx, 0xa521
pop ebx
mov ecx, dword [ebp - 0x1e0]
and dh, bh
invalid
dec dword [ecx - 0x70f73]
jmp [edx]
call dword [ebp - 0x710]
mov dword [ebp - 0x7a4], 0xa
push edi
xor edi, 0xe701
out 0, eax
add byte [ecx + 0x526dcf], al
add byte [ecx + 0xaef6ef], al
add byte [edi + 0x56], bl
or esi, 0x14ec6
sub esi, 0x12533
call 0x407dea
add byte [edi + ecx*2 + 0x35], al
inc ecx
dec ecx
dec ecx
dec esp
add esp, 4
pop esi
mov edx, dword [ebp - 0xec]
mov al, byte [edx + 0xa]
mov byte [ebp - 0xde], al
mov ecx, dword [ebp - 0x268]
sub ecx, dword [ebp - 0xec]
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x3f4], 0
push edi
push ebx
add esp, 4
or edi, 0x10063
jmp 0x407e2d
pop edi
push ebx
add ebx, 0xc968
and ebx, 0x11e27
call 0x407e47
add byte [esi + 0x40], cl
dec edx
cmp eax, dword [eax + 0x4f]
add esp, 4
pop ebx
mov byte [ebp - 0x254], 0x56
mov byte [ebp - 0x253], 0x69
mov byte [ebp - 0x252], 0x72
mov byte [ebp - 0x251], 0x74
mov byte [ebp - 0x250], 0x75
mov byte [ebp - 0x24f], 0x61
mov byte [ebp - 0x24e], 0x6c
mov byte [ebp - 0x24d], 0x50
mov byte [ebp - 0x24c], 0x72
mov byte [ebp - 0x24b], 0x6f
outsd dx, dword [esi]
mov byte [ebp - 0x24a], 0x74
mov byte [ebp - 0x249], 0x65
mov byte [ebp - 0x248], 0x63
mov byte [ebp - 0x247], 0x74
mov byte [ebp - 0x246], 0
push eax
push esi
add esp, 4
call 0x407ec8
add byte [ebp + ecx*2 + 0x37], al
dec ebp
dec ebx
inc ebp
cmp al, 0x40
xor eax, dword [ebx + 0x4eb04c4]
cmp ecx, dword [ebx + 0x32]
xor eax, 0x7662c081
add dword [eax], eax
pop eax
push edx
xor edx, 0x55e
xor edx, 0xcc67
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x714], edx
mov eax, dword [ebp - 0x714]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x718], ecx
mov edx, dword [ebp - 0x718]
mov dword [ebp - 0x4f0], edx
push ebx
or ebx, 0x11ca
call 0x407f22
add byte [edi], bh
cmp dl, byte [eax + 0x3e]
inc eax
inc eax
inc edx
add esp, 4
add ebx, 0xf6e3
pop ebx
push edi
and edi, 0xfcc7
xor edi, 0x10960
and edi, 0x9658
pop edi
cmp dword [ebp - 0x4f0], 0
jne 0x407f58
invalid
test dword [edi + edi*8 - 1], edx
inc dword [eax]
Function at 0x407f22
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ebx, 0x12150
sub ebx, 0x2dec
xor ebx, 0x11d81
pop ebx
push ebx
or ebx, 0xca85
pop ebx
cmp dword [ebp - 0xec], 0
je 0x407d6c
cmp dword [ebp - 0x268], 0
jne 0x407db2
push ecx
add ecx, 0x3de1
or ecx, 0x10008
or ecx, 0xd06f
pop ecx
push ebx
push edi
add esp, 4
add ebx, 0x1c15
xor ebx, 0x8dff
and ebx, 0x82ff
sub ebx, 0xa521
pop ebx
mov ecx, dword [ebp - 0x1e0]
and dh, bh
invalid
dec dword [ecx - 0x70f73]
jmp [edx]
call dword [ebp - 0x710]
mov dword [ebp - 0x7a4], 0xa
push edi
xor edi, 0xe701
out 0, eax
add byte [ecx + 0x526dcf], al
add byte [ecx + 0xaef6ef], al
add byte [edi + 0x56], bl
or esi, 0x14ec6
sub esi, 0x12533
call 0x407dea
add byte [edi + ecx*2 + 0x35], al
inc ecx
dec ecx
dec ecx
dec esp
add esp, 4
pop esi
mov edx, dword [ebp - 0xec]
mov al, byte [edx + 0xa]
mov byte [ebp - 0xde], al
mov ecx, dword [ebp - 0x268]
sub ecx, dword [ebp - 0xec]
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x3f4], 0
push edi
push ebx
add esp, 4
or edi, 0x10063
jmp 0x407e2d
pop edi
push ebx
add ebx, 0xc968
and ebx, 0x11e27
call 0x407e47
add byte [esi + 0x40], cl
dec edx
cmp eax, dword [eax + 0x4f]
add esp, 4
pop ebx
mov byte [ebp - 0x254], 0x56
mov byte [ebp - 0x253], 0x69
mov byte [ebp - 0x252], 0x72
mov byte [ebp - 0x251], 0x74
mov byte [ebp - 0x250], 0x75
mov byte [ebp - 0x24f], 0x61
mov byte [ebp - 0x24e], 0x6c
mov byte [ebp - 0x24d], 0x50
mov byte [ebp - 0x24c], 0x72
mov byte [ebp - 0x24b], 0x6f
outsd dx, dword [esi]
mov byte [ebp - 0x24a], 0x74
mov byte [ebp - 0x249], 0x65
mov byte [ebp - 0x248], 0x63
mov byte [ebp - 0x247], 0x74
mov byte [ebp - 0x246], 0
push eax
push esi
add esp, 4
call 0x407ec8
add byte [ebp + ecx*2 + 0x37], al
dec ebp
dec ebx
inc ebp
cmp al, 0x40
xor eax, dword [ebx + 0x4eb04c4]
cmp ecx, dword [ebx + 0x32]
xor eax, 0x7662c081
add dword [eax], eax
pop eax
push edx
xor edx, 0x55e
xor edx, 0xcc67
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x714], edx
mov eax, dword [ebp - 0x714]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x718], ecx
mov edx, dword [ebp - 0x718]
mov dword [ebp - 0x4f0], edx
push ebx
or ebx, 0x11ca
call 0x407f22
add byte [edi], bh
cmp dl, byte [eax + 0x3e]
inc eax
inc eax
inc edx
add esp, 4
add ebx, 0xf6e3
pop ebx
push edi
and edi, 0xfcc7
xor edi, 0x10960
and edi, 0x9658
pop edi
cmp dword [ebp - 0x4f0], 0
jne 0x407f58
invalid
test dword [edi + edi*8 - 1], edx
inc dword [eax]

Function at 0x407f50
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add cl, ch
xchg ecx, eax
add al, byte [eax]
add byte [ebx - 0x4ef7b], cl
dec dword [ebx + 0x518b0c48]
or al, 0x89
xchg ebp, eax
add ch, bh
invalid
Function at 0x407fe2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebx
add esp, 4
jmp 0x407fcc
sub ebx, 0x12979
pop ebx
push ecx
call 0x407fe2
add byte [eax + 0x41], al
xor al, 0x38
cmp al, 0x3c
inc edx
push eax
add esp, 4
pop ecx
push esi
push edi
add esp, 4
and esi, 0x6c68
pop esi
lea ecx, [ebp - 0x55c]
mov dword [ebp - 0x2fc], ecx
mov edx, dword [ebp - 0x134]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x2f8], eax
xor ecx, ecx
mov word [ebp - 0x8c], cx
xor edx, edx
mov word [ebp - 0x50], dx
push esi
push edi
add esp, 4
add al, 0xeb
invalid
add esi, 0x3361
and esi, 0x137a
and esi, 0x6807
pop esi
push ecx
xor ecx, 0x8ee
xor ecx, 0x3752
jmp 0x40804d
pop ecx
mov eax, dword [ebp - 0x2f8]
mov cx, word [eax]
mov word [ebp - 0x396], cx
mov edx, dword [ebp - 0x2f8]
or ch, bh
invalid
inc dword [ebx - 0x6a76fd3e]
or ch, bh
invalid
jmp dword [esi - 0x75]
test dword [edx - 4], ebp
invalid
jmp dword [esi - 0x77]
test dword [edi + edi*8 - 1], esi
dec dword [ebx - 0x2fb73]
jmp dword [esi - 0x75]
adc dword [esi - 0x77], esp
xchg ebp, eax
push 0x8bfffffc
test dword [edi*8 - 0x3f7c0001], eax
add cl, byte [ecx - 0x2fb7b]
jmp dword [esi - 0x75]
lea ebp, [eax - 4]
invalid
jmp dword [esi - 0x77]
dec ebp
mov al, 0x57
push esi
add esp, 4
and edi, 0x6b3c
add edi, 0x195c
sub edi, 0x176fa
pop edi
push ebx
and ebx, 0xf2f4
xor ebx, 0x1682b
and ebx, 0x1664f
add ebx, 0xd9cb
pop ebx
movzx edx, word [ebp - 0x50]
test edx, edx
jne 0x4080f4
movzx eax, word [ebp - 0x8c]
movzx ecx, word [ebp - 0x50]
sub eax, ecx
mov dword [ebp - 0x528], eax
jmp 0x408138
movzx edx, word [ebp - 0x8c]
movzx eax, word [ebp - 0x50]
cmp edx, eax
je 0x40801c
movzx ecx, word [ebp - 0x8c]
movzx edx, word [ebp - 0x50]
cmp ecx, edx
jge 0x408122
mov dword [ebp - 0x524], 0xffffffff
jmp 0x40812c
mov dword [ebp - 0x524], 1
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0
jne 0x408181
inc eax
push ebx
xor ebx, 0x1757b
jmp 0x40814d
and ebx, 0x55bd
pop ebx
push ecx
xor ecx, 0x2f74
pop ecx
push eax
push edx
add esp, 4
sub eax, 0x12095
sub eax, 0x10005
jmp 0x408172
pop eax
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 0xac], ecx
jmp 0x4081e9
push ebx
and ebx, 0x8cf
sub ebx, 0xa539
add ebx, 0x13b0f
xor ebx, 0x13f91
pop ebx
push eax
push edi
add esp, 4
add eax, 0xc6e3
add eax, 0x11ada
xor eax, 0xa3ed
pop eax
mov edx, dword [ebp - 0x134]
mov eax, dword [edx]
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x134]
cmp ecx, dword [ebp - 0x300]
je 0x4081df
invalid
Function at 0x4080d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebx
add esp, 4
jmp 0x407fcc
sub ebx, 0x12979
pop ebx
push ecx
call 0x407fe2
add byte [eax + 0x41], al
xor al, 0x38
cmp al, 0x3c
inc edx
push eax
add esp, 4
pop ecx
push esi
push edi
add esp, 4
and esi, 0x6c68
pop esi
lea ecx, [ebp - 0x55c]
mov dword [ebp - 0x2fc], ecx
mov edx, dword [ebp - 0x134]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x2f8], eax
xor ecx, ecx
mov word [ebp - 0x8c], cx
xor edx, edx
mov word [ebp - 0x50], dx
push esi
push edi
add esp, 4
add al, 0xeb
invalid
add esi, 0x3361
and esi, 0x137a
and esi, 0x6807
pop esi
push ecx
xor ecx, 0x8ee
xor ecx, 0x3752
jmp 0x40804d
pop ecx
mov eax, dword [ebp - 0x2f8]
mov cx, word [eax]
mov word [ebp - 0x396], cx
mov edx, dword [ebp - 0x2f8]
or ch, bh
invalid
inc dword [ebx - 0x6a76fd3e]
or ch, bh
invalid
jmp dword [esi - 0x75]
test dword [edx - 4], ebp
invalid
jmp dword [esi - 0x77]
test dword [edi + edi*8 - 1], esi
dec dword [ebx - 0x2fb73]
jmp dword [esi - 0x75]
adc dword [esi - 0x77], esp
xchg ebp, eax
push 0x8bfffffc
test dword [edi*8 - 0x3f7c0001], eax
add cl, byte [ecx - 0x2fb7b]
jmp dword [esi - 0x75]
lea ebp, [eax - 4]
invalid
jmp dword [esi - 0x77]
dec ebp
mov al, 0x57
push esi
add esp, 4
and edi, 0x6b3c
add edi, 0x195c
sub edi, 0x176fa
pop edi
push ebx
and ebx, 0xf2f4
xor ebx, 0x1682b
and ebx, 0x1664f
add ebx, 0xd9cb
pop ebx
movzx edx, word [ebp - 0x50]
test edx, edx
jne 0x4080f4
movzx eax, word [ebp - 0x8c]
movzx ecx, word [ebp - 0x50]
sub eax, ecx
mov dword [ebp - 0x528], eax
jmp 0x408138
movzx edx, word [ebp - 0x8c]
movzx eax, word [ebp - 0x50]
cmp edx, eax
je 0x40801c
movzx ecx, word [ebp - 0x8c]
movzx edx, word [ebp - 0x50]
cmp ecx, edx
jge 0x408122
mov dword [ebp - 0x524], 0xffffffff
jmp 0x40812c
mov dword [ebp - 0x524], 1
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0
jne 0x408181
inc eax
push ebx
xor ebx, 0x1757b
jmp 0x40814d
and ebx, 0x55bd
pop ebx
push ecx
xor ecx, 0x2f74
pop ecx
push eax
push edx
add esp, 4
sub eax, 0x12095
sub eax, 0x10005
jmp 0x408172
pop eax
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 0xac], ecx
jmp 0x4081e9
push ebx
and ebx, 0x8cf
sub ebx, 0xa539
add ebx, 0x13b0f
xor ebx, 0x13f91
pop ebx
push eax
push edi
add esp, 4
add eax, 0xc6e3
add eax, 0x11ada
xor eax, 0xa3ed
pop eax
mov edx, dword [ebp - 0x134]
mov eax, dword [edx]
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x134]
cmp ecx, dword [ebp - 0x300]
je 0x4081df
invalid
Function at 0x4082de
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x4082e7
jmp 0x4082ec
xor eax, 0x9f9d
pop eax
mov byte [ebp - 0x224], 0x4c
mov byte [ebp - 0x223], 0x6f
mov byte [ebp - 0x222], 0x61
mov byte [ebp - 0x221], 0x64
mov byte [ebp - 0x220], 0x4c
mov byte [ebp - 0x21f], 0x69
mov byte [ebp - 0x21e], 0x62
mov byte [ebp - 0x21d], 0x72
mov byte [ebp - 0x21c], 0x61
mov byte [ebp - 0x21b], 0x72
mov byte [ebp - 0x21a], 0x79
mov byte [ebp - 0x219], 0x57
mov byte [ebp - 0x218], 0
mov ecx, dword fs:[0x18]
or eax, 0x18
mov dword [ebp - 0x71c], ecx
mov edx, dword [ebp - 0x71c]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x720], eax
mov ecx, dword [ebp - 0x720]
mov dword [ebp - 0x52c], ecx
push eax
push esi
add esp, 4
or eax, 0x42b4
pop eax
push edi
push ebx
add esp, 4
call 0x408393
add byte [edi + edi], bh
dec edx
cmp al, 0x32
inc edx
add esp, 4
or edi, 0x170da
sub edi, 0xe57b
jmp 0x4083a7
pop edi
cmp dword [ebp - 0x52c], 0
jne 0x4083c0
mov dword [ebp - 0x1b8], 0
jmp 0x408651
mov edx, dword [ebp - 0x52c]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x30c], ecx
push ebx
push ebx
add esp, 4
xor ebx, 0x17ad0
pop ebx
push edx
xor edx, 0x1223b
or edx, 0x622
pop edx
push edi
or edi, 0x5936
call fcn.00408400
add byte [ebx + esi + 0x4b], cl
dec edi
cmp byte [eax + 0x4a], cl
cmp dword [ebp - 0x1b8], 0
jne 0x40869b
push ebx
push eax
add esp, 4
xor ebx, 0x3c28
jmp 0x40866a
add ebx, 0x11efe
pop ebx
push edi
sub edi, 0x5b94
jmp 0x408680
jmp 0x408685
xor edi, 0x2faf
pop edi
mov dword [ebp - 0x26c], 0
jmp 0x4090f3
push esi
push ecx
add esp, 4
Function at 0x408393
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x4082e7
jmp 0x4082ec
xor eax, 0x9f9d
pop eax
mov byte [ebp - 0x224], 0x4c
mov byte [ebp - 0x223], 0x6f
mov byte [ebp - 0x222], 0x61
mov byte [ebp - 0x221], 0x64
mov byte [ebp - 0x220], 0x4c
mov byte [ebp - 0x21f], 0x69
mov byte [ebp - 0x21e], 0x62
mov byte [ebp - 0x21d], 0x72
mov byte [ebp - 0x21c], 0x61
mov byte [ebp - 0x21b], 0x72
mov byte [ebp - 0x21a], 0x79
mov byte [ebp - 0x219], 0x57
mov byte [ebp - 0x218], 0
mov ecx, dword fs:[0x18]
or eax, 0x18
mov dword [ebp - 0x71c], ecx
mov edx, dword [ebp - 0x71c]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x720], eax
mov ecx, dword [ebp - 0x720]
mov dword [ebp - 0x52c], ecx
push eax
push esi
add esp, 4
or eax, 0x42b4
pop eax
push edi
push ebx
add esp, 4
call 0x408393
add byte [edi + edi], bh
dec edx
cmp al, 0x32
inc edx
add esp, 4
or edi, 0x170da
sub edi, 0xe57b
jmp 0x4083a7
pop edi
cmp dword [ebp - 0x52c], 0
jne 0x4083c0
mov dword [ebp - 0x1b8], 0
jmp 0x408651
mov edx, dword [ebp - 0x52c]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x30c], ecx
push ebx
push ebx
add esp, 4
xor ebx, 0x17ad0
pop ebx
push edx
xor edx, 0x1223b
or edx, 0x622
pop edx
push edi
or edi, 0x5936
call fcn.00408400
add byte [ebx + esi + 0x4b], cl
dec edi
cmp byte [eax + 0x4a], cl
cmp dword [ebp - 0x1b8], 0
jne 0x40869b
push ebx
push eax
add esp, 4
xor ebx, 0x3c28
jmp 0x40866a
add ebx, 0x11efe
pop ebx
push edi
sub edi, 0x5b94
jmp 0x408680
jmp 0x408685
xor edi, 0x2faf
pop edi
mov dword [ebp - 0x26c], 0
jmp 0x4090f3
push esi
push ecx
add esp, 4

Function at 0x408400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
cmp dword [ebp - 0x30c], 0
jne 0x40841c
mov dword [ebp - 0x1b8], 0
jmp 0x408651
mov edx, dword [ebp - 0x30c]
mov dword [ebp - 0x11c], edx
push ecx
sub ecx, 0x106e2
call 0x40843b
add byte [esi + 0x3d], al
dec edx
cmp cl, byte [ebx + 0x34]
add esp, 4
pop ecx
push edx
or edx, 0x1192b
call 0x408456
add byte [edi + 0x3f], cl
inc ebx
dec edx
dec esi
cmp bh, byte ds:[ecx]
dec eax
dec ebx
add esp, 4
pop edx
lea eax, [ebp - 0x5e4]
mov dword [ebp - 0x308], eax
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x304], edx
xor eax, eax
mov word [ebp - 0x90], ax
xor ecx, ecx
mov word [ebp - 0x54], cx
push eax
call 0x408494
add byte [eax + 0x38], cl
cmp bh, byte [esi]
cmp dword [eax + 0x3c], eax
xor dh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
invalid
Function at 0x40843b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
cmp dword [ebp - 0x30c], 0
jne 0x40841c
mov dword [ebp - 0x1b8], 0
jmp 0x408651
mov edx, dword [ebp - 0x30c]
mov dword [ebp - 0x11c], edx
push ecx
sub ecx, 0x106e2
call 0x40843b
add byte [esi + 0x3d], al
dec edx
cmp cl, byte [ebx + 0x34]
add esp, 4
pop ecx
push edx
or edx, 0x1192b
call 0x408456
add byte [edi + 0x3f], cl
inc ebx
dec edx
dec esi
cmp bh, byte ds:[ecx]
dec eax
dec ebx
add esp, 4
pop edx
lea eax, [ebp - 0x5e4]
mov dword [ebp - 0x308], eax
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x304], edx
xor eax, eax
mov word [ebp - 0x90], ax
xor ecx, ecx
mov word [ebp - 0x54], cx
push eax
call 0x408494
add byte [eax + 0x38], cl
cmp bh, byte [esi]
cmp dword [eax + 0x3c], eax
xor dh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
invalid

Function at 0x408456
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
cmp dword [ebp - 0x30c], 0
jne 0x40841c
mov dword [ebp - 0x1b8], 0
jmp 0x408651
mov edx, dword [ebp - 0x30c]
mov dword [ebp - 0x11c], edx
push ecx
sub ecx, 0x106e2
call 0x40843b
add byte [esi + 0x3d], al
dec edx
cmp cl, byte [ebx + 0x34]
add esp, 4
pop ecx
push edx
or edx, 0x1192b
call 0x408456
add byte [edi + 0x3f], cl
inc ebx
dec edx
dec esi
cmp bh, byte ds:[ecx]
dec eax
dec ebx
add esp, 4
pop edx
lea eax, [ebp - 0x5e4]
mov dword [ebp - 0x308], eax
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x304], edx
xor eax, eax
mov word [ebp - 0x90], ax
xor ecx, ecx
mov word [ebp - 0x54], cx
push eax
call 0x408494
add byte [eax + 0x38], cl
cmp bh, byte [esi]
cmp dword [eax + 0x3c], eax
xor dh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
invalid

Function at 0x408494
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
cmp dword [ebp - 0x30c], 0
jne 0x40841c
mov dword [ebp - 0x1b8], 0
jmp 0x408651
mov edx, dword [ebp - 0x30c]
mov dword [ebp - 0x11c], edx
push ecx
sub ecx, 0x106e2
call 0x40843b
add byte [esi + 0x3d], al
dec edx
cmp cl, byte [ebx + 0x34]
add esp, 4
pop ecx
push edx
or edx, 0x1192b
call 0x408456
add byte [edi + 0x3f], cl
inc ebx
dec edx
dec esi
cmp bh, byte ds:[ecx]
dec eax
dec ebx
add esp, 4
pop edx
lea eax, [ebp - 0x5e4]
mov dword [ebp - 0x308], eax
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x304], edx
xor eax, eax
mov word [ebp - 0x90], ax
xor ecx, ecx
mov word [ebp - 0x54], cx
push eax
call 0x408494
add byte [eax + 0x38], cl
cmp bh, byte [esi]
cmp dword [eax + 0x3c], eax
xor dh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
invalid

Function at 0x4084ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor eax, 0x143bc
invalid
mov esp, 0x58000143