joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a11f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor al, 0x83
les eax, [ebx + ebp*8]
push es
cmp eax, 0x483b4e47
aas
pop eax
cmp dword [ebp - 0xc4c], 0
jne 0x40a143
mov dword [ebp - 0x2a8], 0
jmp 0x40a38e
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edx
push ecx
add esp, 4
xor edx, 0xfe7b
or edx, 0x8aa7
pop edx
push edi
call 0x40a171
add byte [eax + 0x4b], al
inc ecx
dec edx
aaa
push eax
cmp ecx, dword [esi + 0x34]
add esp, 4
xor edi, 0xdd33
add edi, 0x12b15
pop edi
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edx
add edx, 0xbf31
and edx, 0xb788
sub edx, 0x2275
sub edx, 0xe149
pop edx
push esi
push ecx
add esp, 4
and esi, 0x57ea
sub esi, 0x14d84
or esi, 0x11cde
pop esi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push ebx
or ebx, 0x407b
jmp 0x40a242
sub ebx, 0x591c
jmp 0x40a24e
pop ebx
push edi
xor edi, 0x8568
call fcn.0040a262
add byte [ecx + 0x3d], al
xor eax, dword [ebx + 0x4d]
xor al, 0x83
add esp, 4
pop edi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x40a283
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x40a2dd
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x40a1ab
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x40a1ab
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x40a2c7
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x40a2d1
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x40a326
push ebx
push ecx
add esp, 4
or ebx, 0x92c5
and ebx, 0xc0db
pop ebx
push edx
push ebx
add esp, 4
add edx, 0xc476
pop edx
push edi
push edi
sub edi, 0x4c13
and edi, 0x2dfb
and edi, 0x127a6
pop edi
push edx
push eax
add esp, 4
xor edx, 0x3689
or edx, 0xf95a
sub edx, 0xb1a5
sub edx, 0x1c97
pop edx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x40a384
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x40a14f
mov dword [ebp - 0x2a8], 0
Function at 0x40a171
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor al, 0x83
les eax, [ebx + ebp*8]
push es
cmp eax, 0x483b4e47
aas
pop eax
cmp dword [ebp - 0xc4c], 0
jne 0x40a143
mov dword [ebp - 0x2a8], 0
jmp 0x40a38e
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edx
push ecx
add esp, 4
xor edx, 0xfe7b
or edx, 0x8aa7
pop edx
push edi
call 0x40a171
add byte [eax + 0x4b], al
inc ecx
dec edx
aaa
push eax
cmp ecx, dword [esi + 0x34]
add esp, 4
xor edi, 0xdd33
add edi, 0x12b15
pop edi
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edx
add edx, 0xbf31
and edx, 0xb788
sub edx, 0x2275
sub edx, 0xe149
pop edx
push esi
push ecx
add esp, 4
and esi, 0x57ea
sub esi, 0x14d84
or esi, 0x11cde
pop esi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push ebx
or ebx, 0x407b
jmp 0x40a242
sub ebx, 0x591c
jmp 0x40a24e
pop ebx
push edi
xor edi, 0x8568
call fcn.0040a262
add byte [ecx + 0x3d], al
xor eax, dword [ebx + 0x4d]
xor al, 0x83
add esp, 4
pop edi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x40a283
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x40a2dd
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x40a1ab
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x40a1ab
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x40a2c7
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x40a2d1
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x40a326
push ebx
push ecx
add esp, 4
or ebx, 0x92c5
and ebx, 0xc0db
pop ebx
push edx
push ebx
add esp, 4
add edx, 0xc476
pop edx
push edi
push edi
sub edi, 0x4c13
and edi, 0x2dfb
and edi, 0x127a6
pop edi
push edx
push eax
add esp, 4
xor edx, 0x3689
or edx, 0xf95a
sub edx, 0xb1a5
sub edx, 0x1c97
pop edx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x40a384
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x40a14f
mov dword [ebp - 0x2a8], 0
Function at 0x40a262
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor al, 0x83
les eax, [ebx + ebp*8]
push es
cmp eax, 0x483b4e47
aas
pop eax
cmp dword [ebp - 0xc4c], 0
jne 0x40a143
mov dword [ebp - 0x2a8], 0
jmp 0x40a38e
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edx
push ecx
add esp, 4
xor edx, 0xfe7b
or edx, 0x8aa7
pop edx
push edi
call 0x40a171
add byte [eax + 0x4b], al
inc ecx
dec edx
aaa
push eax
cmp ecx, dword [esi + 0x34]
add esp, 4
xor edi, 0xdd33
add edi, 0x12b15
pop edi
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edx
add edx, 0xbf31
and edx, 0xb788
sub edx, 0x2275
sub edx, 0xe149
pop edx
push esi
push ecx
add esp, 4
and esi, 0x57ea
sub esi, 0x14d84
or esi, 0x11cde
pop esi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push ebx
or ebx, 0x407b
jmp 0x40a242
sub ebx, 0x591c
jmp 0x40a24e
pop ebx
push edi
xor edi, 0x8568
call fcn.0040a262
add byte [ecx + 0x3d], al
xor eax, dword [ebx + 0x4d]
xor al, 0x83
add esp, 4
pop edi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x40a283
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x40a2dd
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x40a1ab
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x40a1ab
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x40a2c7
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x40a2d1
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x40a326
push ebx
push ecx
add esp, 4
or ebx, 0x92c5
and ebx, 0xc0db
pop ebx
push edx
push ebx
add esp, 4
add edx, 0xc476
pop edx
push edi
push edi
sub edi, 0x4c13
and edi, 0x2dfb
and edi, 0x127a6
pop edi
push edx
push eax
add esp, 4
xor edx, 0x3689
or edx, 0xf95a
sub edx, 0xb1a5
sub edx, 0x1c97
pop edx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x40a384
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x40a14f
mov dword [ebp - 0x2a8], 0
Function at 0x40a495
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add dword [eax], eax
pop edx
mov byte [ebp - 0x830], 0x4c
mov byte [ebp - 0x82f], 0x6f
mov byte [ebp - 0x82e], 0x61
mov byte [ebp - 0x82d], 0x64
mov byte [ebp - 0x82c], 0x4c
mov byte [ebp - 0x82b], 0x69
mov byte [ebp - 0x82a], 0x62
mov byte [ebp - 0x829], 0x72
mov byte [ebp - 0x828], 0x61
mov byte [ebp - 0x827], 0x72
mov byte [ebp - 0x826], 0x79
mov byte [ebp - 0x825], 0x57
mov byte [ebp - 0x824], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18d8], ecx
mov edx, dword [ebp - 0x18d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18dc], eax
mov ecx, dword [ebp - 0x18dc]
mov dword [ebp - 0x1518], ecx
push esi
push eax
add esp, 4
sub esi, 0x12de
call 0x40a534
add byte [edi + 0x50], al
inc eax
inc edx
cmp esi, dword [0xc4834145]
add al, 0x5e
push ebx
or ebx, 0x1d07
pop ebx
push esi
jmp 0x40a546
and esi, 0x4c85
pop esi
cmp dword [ebp - 0x1518], 0
call 0x140a53e
jne 0x40a565
mov dword [ebp - 0x710], 0
jmp 0x40a80c
mov edx, dword [ebp - 0x1518]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc58], ecx
push esi
sub esi, 0x10054
xor esi, 0x8ad0
sub esi, 0x2ba5
pop esi
push eax
push edi
add esp, 4
and eax, 0x164e1
pop eax
push edx
push ecx
add esp, 4
and edx, 0x7bed
or edx, 0x8075
pop edx
cmp dword [ebp - 0xc58], 0
jne 0x40a5c1
mov dword [ebp - 0x710], 0
jmp 0x40a80c
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx

Function at 0x40a534
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [eax], eax
pop edx
mov byte [ebp - 0x830], 0x4c
mov byte [ebp - 0x82f], 0x6f
mov byte [ebp - 0x82e], 0x61
mov byte [ebp - 0x82d], 0x64
mov byte [ebp - 0x82c], 0x4c
mov byte [ebp - 0x82b], 0x69
mov byte [ebp - 0x82a], 0x62
mov byte [ebp - 0x829], 0x72
mov byte [ebp - 0x828], 0x61
mov byte [ebp - 0x827], 0x72
mov byte [ebp - 0x826], 0x79
mov byte [ebp - 0x825], 0x57
mov byte [ebp - 0x824], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18d8], ecx
mov edx, dword [ebp - 0x18d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18dc], eax
mov ecx, dword [ebp - 0x18dc]
mov dword [ebp - 0x1518], ecx
push esi
push eax
add esp, 4
sub esi, 0x12de
call 0x40a534
add byte [edi + 0x50], al
inc eax
inc edx
cmp esi, dword [0xc4834145]
add al, 0x5e
push ebx
or ebx, 0x1d07
pop ebx
push esi
jmp 0x40a546
and esi, 0x4c85
pop esi
cmp dword [ebp - 0x1518], 0
call 0x140a53e
jne 0x40a565
mov dword [ebp - 0x710], 0
jmp 0x40a80c
mov edx, dword [ebp - 0x1518]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc58], ecx
push esi
sub esi, 0x10054
xor esi, 0x8ad0
sub esi, 0x2ba5
pop esi
push eax
push edi
add esp, 4
and eax, 0x164e1
pop eax
push edx
push ecx
add esp, 4
and edx, 0x7bed
or edx, 0x8075
pop edx
cmp dword [ebp - 0xc58], 0
jne 0x40a5c1
mov dword [ebp - 0x710], 0
jmp 0x40a80c
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx
Function at 0x40a54f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [eax], eax
pop edx
mov byte [ebp - 0x830], 0x4c
mov byte [ebp - 0x82f], 0x6f
mov byte [ebp - 0x82e], 0x61
mov byte [ebp - 0x82d], 0x64
mov byte [ebp - 0x82c], 0x4c
mov byte [ebp - 0x82b], 0x69
mov byte [ebp - 0x82a], 0x62
mov byte [ebp - 0x829], 0x72
mov byte [ebp - 0x828], 0x61
mov byte [ebp - 0x827], 0x72
mov byte [ebp - 0x826], 0x79
mov byte [ebp - 0x825], 0x57
mov byte [ebp - 0x824], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18d8], ecx
mov edx, dword [ebp - 0x18d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18dc], eax
mov ecx, dword [ebp - 0x18dc]
mov dword [ebp - 0x1518], ecx
push esi
push eax
add esp, 4
sub esi, 0x12de
call 0x40a534
add byte [edi + 0x50], al
inc eax
inc edx
cmp esi, dword [0xc4834145]
add al, 0x5e
push ebx
or ebx, 0x1d07
pop ebx
push esi
jmp 0x40a546
and esi, 0x4c85
pop esi
cmp dword [ebp - 0x1518], 0
call 0x140a53e
jne 0x40a565
mov dword [ebp - 0x710], 0
jmp 0x40a80c
mov edx, dword [ebp - 0x1518]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc58], ecx
push esi
sub esi, 0x10054
xor esi, 0x8ad0
sub esi, 0x2ba5
pop esi
push eax
push edi
add esp, 4
and eax, 0x164e1
pop eax
push edx
push ecx
add esp, 4
and edx, 0x7bed
or edx, 0x8075
pop edx
cmp dword [ebp - 0xc58], 0
jne 0x40a5c1
mov dword [ebp - 0x710], 0
jmp 0x40a80c
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx
Function at 0x40aa97
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebx - 0x3d7efb3c], eax
xor dword [esi - 0x74a60000], esp
invalid

Function at 0x40aa9a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebx - 0x3d7efb3c], eax
xor dword [esi - 0x74a60000], esp
invalid
Function at 0x40ae3e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
call fcn.0040ae3e
add byte [edi], dh
cmp dword [eax + 0x33], ecx
cmp al, 0x46
cmp edi, dword [edx]
aas
cmp al, byte [ebx + 0x9e804c4]
add esp, 4
call 0x40ae4f
add byte [esi + 0x4f], al
add esp, 4
call 0x40ae4f
add byte [esi + 0x4f], al
inc ebx
dec esp
inc edx
inc esp
aaa
dec edi
add esp, 4
and eax, 0x31af
add eax, 0x7576
add byte [eax - 0x75], bl
xchg ebp, eax
mov al, byte [0x66fffff3]
mov eax, dword [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push ecx
jmp 0x40aebd
sub ecx, 0xd16
call 0x40aed2
add byte [edx], bh
inc edx
dec eax
cmp dword [0x4f353240], esi
add esp, 4
pop ecx
push ecx
push esi
add esp, 4
and ecx, 0x134cb
sub ecx, 0x3b0a
pop ecx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x40af05
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x40af5f
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x40ae2d
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x40ae2d
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x40af49
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x40af53
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x40afa8
push ebx
and ebx, 0x13320
pop ebx
push eax
push ecx
add esp, 4
xor eax, 0x7c6c
add eax, 0x143b2
add byte [eax + 0x51], bl
push edx
add esp, 4
and ecx, 0xa95c
or ecx, 0x14de9
and ecx, 0x9519
pop ecx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x40b010
push edi
push esi
add esp, 4
jmp 0x40afb3
pop edi
push edi
push ecx
add esp, 4
sub edi, 0x10d57
xor edi, 0xefd9
or edi, 0x8a3c
or edi, 0x1281d
pop edi
push ecx
sub ecx, 0x591f
pop ecx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x40b006
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x40add1
mov dword [ebp - 0x2a8], 0
Function at 0x40ae4f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
call fcn.0040ae3e
add byte [edi], dh
cmp dword [eax + 0x33], ecx
cmp al, 0x46
cmp edi, dword [edx]
aas
cmp al, byte [ebx + 0x9e804c4]
add esp, 4
call 0x40ae4f
add byte [esi + 0x4f], al
add esp, 4
call 0x40ae4f
add byte [esi + 0x4f], al
inc ebx
dec esp
inc edx
inc esp
aaa
dec edi
add esp, 4
and eax, 0x31af
add eax, 0x7576
add byte [eax - 0x75], bl
xchg ebp, eax
mov al, byte [0x66fffff3]
mov eax, dword [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push ecx
jmp 0x40aebd
sub ecx, 0xd16
call 0x40aed2
add byte [edx], bh
inc edx
dec eax
cmp dword [0x4f353240], esi
add esp, 4
pop ecx
push ecx
push esi
add esp, 4
and ecx, 0x134cb
sub ecx, 0x3b0a
pop ecx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x40af05
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x40af5f
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x40ae2d
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x40ae2d
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x40af49
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x40af53
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x40afa8
push ebx
and ebx, 0x13320
pop ebx
push eax
push ecx
add esp, 4
xor eax, 0x7c6c
add eax, 0x143b2
add byte [eax + 0x51], bl
push edx
add esp, 4
and ecx, 0xa95c
or ecx, 0x14de9
and ecx, 0x9519
pop ecx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x40b010
push edi
push esi
add esp, 4
jmp 0x40afb3
pop edi
push edi
push ecx
add esp, 4
sub edi, 0x10d57
xor edi, 0xefd9
or edi, 0x8a3c
or edi, 0x1281d
pop edi
push ecx
sub ecx, 0x591f
pop ecx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x40b006
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x40add1
mov dword [ebp - 0x2a8], 0
Function at 0x40aed2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
call fcn.0040ae3e
add byte [edi], dh
cmp dword [eax + 0x33], ecx
cmp al, 0x46
cmp edi, dword [edx]
aas
cmp al, byte [ebx + 0x9e804c4]
add esp, 4
call 0x40ae4f
add byte [esi + 0x4f], al
add esp, 4
call 0x40ae4f
add byte [esi + 0x4f], al
inc ebx
dec esp
inc edx
inc esp
aaa
dec edi
add esp, 4
and eax, 0x31af
add eax, 0x7576
add byte [eax - 0x75], bl
xchg ebp, eax
mov al, byte [0x66fffff3]
mov eax, dword [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push ecx
jmp 0x40aebd
sub ecx, 0xd16
call 0x40aed2
add byte [edx], bh
inc edx
dec eax
cmp dword [0x4f353240], esi
add esp, 4
pop ecx
push ecx
push esi
add esp, 4
and ecx, 0x134cb
sub ecx, 0x3b0a
pop ecx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x40af05
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x40af5f
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x40ae2d
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x40ae2d
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x40af49
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x40af53
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x40afa8
push ebx
and ebx, 0x13320
pop ebx
push eax
push ecx
add esp, 4
xor eax, 0x7c6c
add eax, 0x143b2
add byte [eax + 0x51], bl
push edx
add esp, 4
and ecx, 0xa95c
or ecx, 0x14de9
and ecx, 0x9519
pop ecx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x40b010
push edi
push esi
add esp, 4
jmp 0x40afb3
pop edi
push edi
push ecx
add esp, 4
sub edi, 0x10d57
xor edi, 0xefd9
or edi, 0x8a3c
or edi, 0x1281d
pop edi
push ecx
sub ecx, 0x591f
pop ecx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x40b006
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x40add1
mov dword [ebp - 0x2a8], 0
Function at 0x41a208
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x490d40]
jne 0x41a212
repz ret
jmp fcn.00421f06

Function at 0x42009c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x490d40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041787c
and dword [ebp - 0x14], 0
cmp dword [0x497154], 0
mov dword [ebp - 0x18], eax
jne 0x42014f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4201f7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4843b0
push ebx
call edi
test eax, eax
je 0x4201f7
mov esi, dword [section..data]
push eax
call esi
push 0x4843a0
push ebx
mov dword [0x497154], eax
call edi
push eax
call esi
push 0x48438c
push ebx
mov dword [0x497158], eax
call edi
push eax
call esi
push 0x484370
push ebx
mov dword [0x49715c], eax
call edi
push eax
call esi
mov dword [0x497164], eax
test eax, eax
je 0x42014f
push 0x484358
push ebx
call edi
push eax
call esi
mov dword [0x497160], eax
mov eax, dword [0x497160]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x490004]
cmp eax, ecx
je 0x4201a8
cmp dword [0x497164], ecx
je 0x4201a8
push eax
call esi
push dword [0x497164]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4201a8
test ebx, ebx
je 0x4201a8
call edi
test eax, eax
je 0x42019f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42019f
test byte [ebp - 8], 1
jne 0x4201a8
or dword [ebp + 0x10], 0x200000
jmp 0x4201db
mov eax, dword [0x497158]
cmp eax, dword [ebp - 0x18]
je 0x4201db
push eax
call esi
test eax, eax
je 0x4201db
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4201db
mov eax, dword [0x49715c]
cmp eax, dword [ebp - 0x18]
je 0x4201db
push eax
call esi
test eax, eax
je 0x4201db
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x497154]
call esi
test eax, eax
je 0x4201f7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4201f9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a208
leave
ret