joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413f21
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
add esp, 4
call 0x413f21
add byte [edx], bh
dec ebx
inc ebx
inc ebp
aas
xor al, 0x4f
add esp, 4
add ebx, 0xbd7f
call 0x413f38
add byte [edx + 0x44], cl
dec esi
cmp eax, 0x4b4e413a
add esp, 4
jmp 0x413f40
pop ebx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x413f5e
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x413fb8
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x413e86
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x413e86
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x413fa2
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x413fac
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x414001
push ebx
add ebx, 0x1041d
add ebx, 0x4caf
and ebx, 0x6889
call 0x413fe3
add byte [ecx], bh
push eax
inc ebp
dec edx
cmp dword [esi + 0x4c], ecx
cmp esi, dword [ebx]
add esp, 4
pop ebx
push eax
push ecx
add esp, 4
and eax, 0x10d7d
pop eax
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x414069
push ecx
push eax
add esp, 4
and ecx, 0x9e6
add ecx, 0x34ba
sub ecx, 0x11fe9
and ecx, 0xe0ed
pop ecx
push edi
sub edi, 0x135ad
pop edi
push esi
push ebx
add esp, 4
or esi, 0x86c7
pop esi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
je 0x41405f
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x413e2a
mov dword [ebp - 0x31c], 0
Function at 0x413f38
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
add esp, 4
call 0x413f21
add byte [edx], bh
dec ebx
inc ebx
inc ebp
aas
xor al, 0x4f
add esp, 4
add ebx, 0xbd7f
call 0x413f38
add byte [edx + 0x44], cl
dec esi
cmp eax, 0x4b4e413a
add esp, 4
jmp 0x413f40
pop ebx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x413f5e
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x413fb8
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x413e86
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x413e86
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x413fa2
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x413fac
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x414001
push ebx
add ebx, 0x1041d
add ebx, 0x4caf
and ebx, 0x6889
call 0x413fe3
add byte [ecx], bh
push eax
inc ebp
dec edx
cmp dword [esi + 0x4c], ecx
cmp esi, dword [ebx]
add esp, 4
pop ebx
push eax
push ecx
add esp, 4
and eax, 0x10d7d
pop eax
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x414069
push ecx
push eax
add esp, 4
and ecx, 0x9e6
add ecx, 0x34ba
sub ecx, 0x11fe9
and ecx, 0xe0ed
pop ecx
push edi
sub edi, 0x135ad
pop edi
push esi
push ebx
add esp, 4
or esi, 0x86c7
pop esi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
je 0x41405f
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x413e2a
mov dword [ebp - 0x31c], 0
Function at 0x413fe3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
add esp, 4
call 0x413f21
add byte [edx], bh
dec ebx
inc ebx
inc ebp
aas
xor al, 0x4f
add esp, 4
add ebx, 0xbd7f
call 0x413f38
add byte [edx + 0x44], cl
dec esi
cmp eax, 0x4b4e413a
add esp, 4
jmp 0x413f40
pop ebx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x413f5e
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x413fb8
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x413e86
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x413e86
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x413fa2
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x413fac
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x414001
push ebx
add ebx, 0x1041d
add ebx, 0x4caf
and ebx, 0x6889
call 0x413fe3
add byte [ecx], bh
push eax
inc ebp
dec edx
cmp dword [esi + 0x4c], ecx
cmp esi, dword [ebx]
add esp, 4
pop ebx
push eax
push ecx
add esp, 4
and eax, 0x10d7d
pop eax
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x414069
push ecx
push eax
add esp, 4
and ecx, 0x9e6
add ecx, 0x34ba
sub ecx, 0x11fe9
and ecx, 0xe0ed
pop ecx
push edi
sub edi, 0x135ad
pop edi
push esi
push ebx
add esp, 4
or esi, 0x86c7
pop esi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
je 0x41405f
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x413e2a
mov dword [ebp - 0x31c], 0

Function at 0x414070
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or edx, 0x1023d
jmp 0x41407c
pop edx
push eax
push eax
add esp, 4
les eax, [eax + ebp*8]
or al, byte [eax]
add byte [eax], al
add byte [edx + 0x36], al
xor eax, 0x48353636
dec ebx
inc esp
add esp, 4
xor eax, 0x16fb
pop eax
invalid
test esp, esp
cld
invalid

Function at 0x414080
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or edx, 0x1023d
jmp 0x41407c
pop edx
push eax
push eax
add esp, 4
les eax, [eax + ebp*8]
or al, byte [eax]
add byte [eax], al
add byte [edx + 0x36], al
xor eax, 0x48353636
dec ebx
inc esp
add esp, 4
xor eax, 0x16fb
pop eax
invalid
test esp, esp
cld
invalid

Function at 0x414091
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or edx, 0x1023d
jmp 0x41407c
pop edx
push eax
push eax
add esp, 4
les eax, [eax + ebp*8]
or al, byte [eax]
add byte [eax], al
add byte [edx + 0x36], al
xor eax, 0x48353636
dec ebx
inc esp
add esp, 4
xor eax, 0x16fb
pop eax
invalid
test esp, esp
cld
invalid

Function at 0x4140d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
invalid
jecxz 0x41409f
sub dword [eax], eax
add byte [ecx + 0x1642cf3], al
add byte [ebx - 0x39], bl
test dword [eax + 0xfffff8], edx
add byte [eax], al
add byte [ebx - 0x3236b], cl
dec dword [ecx - 0x16076b]
inc dword [ebx - 0x160743]
inc dword [eax]
Function at 0x414327
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax + 0x18]
jae 0x4143f1
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1984]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1988]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d10]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x198c], eax
mov dword [ebp - 0x19c], 0
jmp 0x414255
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x414307
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
test edx, edx
je 0x414307
push ebx
or ebx, 0x14887
pop ebx
push edi
and edi, 0x10d0d
or edi, 0x17a34
xor edi, 0x1029e
add edi, 0xd7a0
pop edi
push ebx
add ebx, 0x52b7
pop ebx
push eax
or eax, 0x9852
pop eax
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
cmp ecx, eax
je 0x4142f9
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x414300
jmp 0x414246
jmp 0x414307
push ebx
push edx
add esp, 4
xor ebx, 0x4d3d
and ebx, 0xc2bf
call 0x414327
add byte [edx + 0x43], cl
inc esp
cmp eax, 0x4b3a4d42
dec eax
add esp, 4
pop ebx
push ebx
xor ebx, 0x8e9e
and ebx, 0x1628f
pop ebx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x414366
mov dword [ebp - 0xcb8], 0
add byte [eax], al
add byte [eax], al
jmp 0x4143d5
push ecx
xor ecx, 0x855f
add ecx, 0x14287
pop ecx
push ecx
push ebx
add esp, 4
or ecx, 0x4834
or ecx, 0x168f0
call 0x414394
add byte [edi + 0x37], al
aaa
inc ebp
push eax
inc esp
xor dh, byte [edi]
add esp, 4
pop ecx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x4143cb
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x4143d5
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x4143ec
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x4143fd
jmp 0x4141d6
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
push ecx
push eax
add esp, 4
or ecx, 0x1501a
sbb dl, byte [eax + 1]
add byte [ecx + 0xc9a7f1], al
add bl, ch
pop es
and ecx, 0x14a90
pop ecx
push edi
Function at 0x414360
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax + 0x18]
jae 0x4143f1
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1984]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1988]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d10]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x198c], eax
mov dword [ebp - 0x19c], 0
jmp 0x414255
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x414307
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
test edx, edx
je 0x414307
push ebx
or ebx, 0x14887
pop ebx
push edi
and edi, 0x10d0d
or edi, 0x17a34
xor edi, 0x1029e
add edi, 0xd7a0
pop edi
push ebx
add ebx, 0x52b7
pop ebx
push eax
or eax, 0x9852
pop eax
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
cmp ecx, eax
je 0x4142f9
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x414300
jmp 0x414246
jmp 0x414307
push ebx
push edx
add esp, 4
xor ebx, 0x4d3d
and ebx, 0xc2bf
call 0x414327
add byte [edx + 0x43], cl
inc esp
cmp eax, 0x4b3a4d42
dec eax
add esp, 4
pop ebx
push ebx
xor ebx, 0x8e9e
and ebx, 0x1628f
pop ebx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x414366
mov dword [ebp - 0xcb8], 0
add byte [eax], al
add byte [eax], al
jmp 0x4143d5
push ecx
xor ecx, 0x855f
add ecx, 0x14287
pop ecx
push ecx
push ebx
add esp, 4
or ecx, 0x4834
or ecx, 0x168f0
call 0x414394
add byte [edi + 0x37], al
aaa
inc ebp
push eax
inc esp
xor dh, byte [edi]
add esp, 4
pop ecx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x4143cb
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x4143d5
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x4143ec
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x4143fd
jmp 0x4141d6
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
push ecx
push eax
add esp, 4
or ecx, 0x1501a
sbb dl, byte [eax + 1]
add byte [ecx + 0xc9a7f1], al
add bl, ch
pop es
and ecx, 0x14a90
pop ecx
push edi
Function at 0x414394
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax + 0x18]
jae 0x4143f1
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1984]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1988]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d10]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x198c], eax
mov dword [ebp - 0x19c], 0
jmp 0x414255
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x414307
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
test edx, edx
je 0x414307
push ebx
or ebx, 0x14887
pop ebx
push edi
and edi, 0x10d0d
or edi, 0x17a34
xor edi, 0x1029e
add edi, 0xd7a0
pop edi
push ebx
add ebx, 0x52b7
pop ebx
push eax
or eax, 0x9852
pop eax
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
cmp ecx, eax
je 0x4142f9
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x414300
jmp 0x414246
jmp 0x414307
push ebx
push edx
add esp, 4
xor ebx, 0x4d3d
and ebx, 0xc2bf
call 0x414327
add byte [edx + 0x43], cl
inc esp
cmp eax, 0x4b3a4d42
dec eax
add esp, 4
pop ebx
push ebx
xor ebx, 0x8e9e
and ebx, 0x1628f
pop ebx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x414366
mov dword [ebp - 0xcb8], 0
add byte [eax], al
add byte [eax], al
jmp 0x4143d5
push ecx
xor ecx, 0x855f
add ecx, 0x14287
pop ecx
push ecx
push ebx
add esp, 4
or ecx, 0x4834
or ecx, 0x168f0
call 0x414394
add byte [edi + 0x37], al
aaa
inc ebp
push eax
inc esp
xor dh, byte [edi]
add esp, 4
pop ecx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x4143cb
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x4143d5
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x4143ec
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x4143fd
jmp 0x4141d6
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
push ecx
push eax
add esp, 4
or ecx, 0x1501a
sbb dl, byte [eax + 1]
add byte [ecx + 0xc9a7f1], al
add bl, ch
pop es
and ecx, 0x14a90
pop ecx
push edi
Function at 0x4149e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x6cfc49e4
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
xchg al, ch
invalid

Function at 0x414aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx - 0x199f73]
dec dword [ecx - 0x161f73]
call dword [ecx + 0x52]
invalid
Function at 0x414b25
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x414b16
pop ebx
push esi
call 0x414b25
add byte [esi + edi], bh
inc esp
cmp al, 0x35
inc esi
push eax
add esp, 4
pop esi
push ecx
push edi
add esp, 4
or ecx, 0xe0c1
shl eax, 0
add byte [ecx + 0x16604c1], al
add byte [ecx - 0x7d], bl
mov ebp, 0xfffff330
add byte [ebp + 0xf], dh
mov edx, dword [ebp - 0xcd0]
mov dword [ebp - 0x518], edx
push edi
or edi, 0xa57a
or edi, 0xda6
pop edi
push ebx
xor ebx, 0x163b6
pop ebx
push esi
and esi, 0x16741
and esi, 0xc282
add byte [eax], al
jmp 0x414b8a
and esi, 0xc634
pop esi
lea eax, [ebp - 0x1790]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push esi
jmp 0x414bc3
and esi, 0x80b7
or esi, 0x9b86
jmp 0x414bd4
pop esi
push edx
push eax
add esp, 4
sub edx, 0x960f
and edx, 0xadf9
or edx, 0x13ad5
pop edx
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push edi
jmp 0x414c4a
add edi, 0x17661
add edi, 0xc20
pop edi
push edi
push esi
add esp, 4
sub edi, 0xdd51
xor edi, 0x6e90
jmp 0x414c6d
pop edi
push edx
xor edx, 0x554
pop edx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x414c93
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1668], edx
jmp 0x414ced
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x414bbb
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x414bbb
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x414cd7
mov dword [ebp - 0x1624], 0xffffffff
jmp 0x414ce1
mov dword [ebp - 0x1624], 1
mov ecx, dword [ebp - 0x1624]
mov dword [ebp - 0x1668], ecx
cmp dword [ebp - 0x1668], 0
jne 0x414d36
push esi
xor esi, 0x10675
xor esi, 0xac90
sub esi, 0x1474c
pop esi
push edi
push edi
add esp, 4
sub edi, 0xf533
and edi, 0xf12c
sub edi, 0x127af
sub edi, 0x7592
pop edi
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x414d9e
push edx
call 0x414d45
add byte [edx + eax*2], dh
push eax
inc edi
cmp ecx, dword [ebx + 0x4d]
inc esi
add esp, 4
or edx, 0x14969
pop edx
push ebx
add ebx, 0x17b33
pop ebx
push eax
add eax, 0x72ee
jmp 0x414d67
pop eax
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x414d94
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x414b5f
mov dword [ebp - 0x774], 0
Function at 0x414d45
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x414b16
pop ebx
push esi
call 0x414b25
add byte [esi + edi], bh
inc esp
cmp al, 0x35
inc esi
push eax
add esp, 4
pop esi
push ecx
push edi
add esp, 4
or ecx, 0xe0c1
shl eax, 0
add byte [ecx + 0x16604c1], al
add byte [ecx - 0x7d], bl
mov ebp, 0xfffff330
add byte [ebp + 0xf], dh
mov edx, dword [ebp - 0xcd0]
mov dword [ebp - 0x518], edx
push edi
or edi, 0xa57a
or edi, 0xda6
pop edi
push ebx
xor ebx, 0x163b6
pop ebx
push esi
and esi, 0x16741
and esi, 0xc282
add byte [eax], al
jmp 0x414b8a
and esi, 0xc634
pop esi
lea eax, [ebp - 0x1790]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push esi
jmp 0x414bc3
and esi, 0x80b7
or esi, 0x9b86
jmp 0x414bd4
pop esi
push edx
push eax
add esp, 4
sub edx, 0x960f
and edx, 0xadf9
or edx, 0x13ad5
pop edx
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push edi
jmp 0x414c4a
add edi, 0x17661
add edi, 0xc20
pop edi
push edi
push esi
add esp, 4
sub edi, 0xdd51
xor edi, 0x6e90
jmp 0x414c6d
pop edi
push edx
xor edx, 0x554
pop edx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x414c93
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1668], edx
jmp 0x414ced
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x414bbb
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x414bbb
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x414cd7
mov dword [ebp - 0x1624], 0xffffffff
jmp 0x414ce1
mov dword [ebp - 0x1624], 1
mov ecx, dword [ebp - 0x1624]
mov dword [ebp - 0x1668], ecx
cmp dword [ebp - 0x1668], 0
jne 0x414d36
push esi
xor esi, 0x10675
xor esi, 0xac90
sub esi, 0x1474c
pop esi
push edi
push edi
add esp, 4
sub edi, 0xf533
and edi, 0xf12c
sub edi, 0x127af
sub edi, 0x7592
pop edi
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x414d9e
push edx
call 0x414d45
add byte [edx + eax*2], dh
push eax
inc edi
cmp ecx, dword [ebx + 0x4d]
inc esi
add esp, 4
or edx, 0x14969
pop edx
push ebx
add ebx, 0x17b33
pop ebx
push eax
add eax, 0x72ee
jmp 0x414d67
pop eax
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x414d94
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x414b5f
mov dword [ebp - 0x774], 0
Function at 0x414db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shl eax, 0
add byte [ecx + 0x16604c1], al
add byte [ecx - 0x7d], bl
mov ebp, 0xfffff330
add byte [ebp + 0xf], dh
mov dword [ebp - 0x774], 0
jmp 0x414d9e
push edi
push ebx
add esp, 4
call 0x414db0
add byte [edx + 0x33], al
inc edx
dec esp
dec eax
inc ebx
add esp, 4
pop edi
push eax
add eax, 0xd6fe
pop eax
push ecx
push edi
add esp, 4
or ecx, 0x123be
pop ecx
push esi
or esi, 0x15a9d
pop esi
cmp dword [ebp - 0x774], 0
jne 0x414e1a
push edi
call 0x414dea
add byte [esi + 0x42], al
dec ebx
dec eax
inc edi
xor eax, 0x354f384b
add esp, 4
jmp 0x414df3
jmp 0x414dfc
sub edi, 0x89f7
pop edi
push edi
sub edi, 0x7c7d
pop edi
mov dword [ebp - 0xab4], 0
jmp 0x415942
push esi
push ecx
add esp, 4
sub esi, 0x3920
pop esi
push edi
sub edi, 0xe398
add edi, 0xe97c
add edi, 0x3080
pop edi
push ebx
push edi
add esp, 4
add ebx, 0xb6ed
sub ebx, 0x11c63
pop ebx
mov ecx, dword [ebp - 0x774]
invalid
dec dword [ebx - 0x6a76e7af]
pop esp
cld
invalid
inc edi
test dword [eax + edi*8 - 1], edi
inc dword [eax]
add byte [eax], al
add byte [ebx - 0x3a37b], cl
dec dword [ecx - 0x166b7b]
inc dword [ebx - 0x166b43]
inc dword [eax]
jne 0x414e8b
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x41517c
mov edx, dword [ebp - 0x166c]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1670], eax
jne 0x414eb3
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x41517c
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1670]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1678], edx
cmp dword [ebp - 0x1678], 0
inc dword [eax]