joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fb02
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x40fb0e
pop edi
push ebx
push ebx
add esp, 4
jmp 0x40fb1a
pop ebx
push eax
or eax, 0xb78a
pop eax
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
loopne 0x40fb51
invalid
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push edx
push eax
add esp, 4
or edx, 0xc6fd
xor edx, 0x15a
pop edx
push edi
or edi, 0x14997
xor edi, 0x11a13
pop edi
push ecx
push ecx
add esp, 4
sub ecx, 0xf3d4
and ecx, 0x17ecb
pop ecx
imul edx, dword [ebp - 0x1060], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1060], 0xfe
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0xfe
sub edx, ecx
mov dword [ebp - 0x1064], edx
push esi
and esi, 0x1289c
xor esi, 0xf062
or esi, 0x78db
pop esi
push edi
push eax
add esp, 4
jmp 0x40fc5e
xor edi, 0xac7b
or edi, 0xdd8f
sub edi, 0x689b
pop edi
mov dword [ebp - 0x10], 1
push esi
push edi
add esp, 4
add esi, 0x1446e
pop esi
push eax
push esi
add esp, 4
add eax, 0xbdd4
sub eax, 0x21ac
xor eax, 0xe2b
pop eax
push eax
add eax, 0x7ad0
and eax, 0xbd60
pop eax
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
call 0x40fce7
add byte [ebx + 0x34], cl
inc esi
cmp byte [ebx], bh
dec edx
aas
inc ecx
xor al, 0x3c
add esp, 4
sub ecx, 0x5819
xor ecx, 0x9542
call 0x40fd04
add byte [esi + ecx*2 + 0x46], al
inc ebp
aas
dec ebx
xor al, byte [ebx + 0x505904c4]
xor eax, 0x4b73
and eax, 0x4b87
and eax, 0xd382
pop eax
push esi
push esi
add esp, 4
call 0x40fd30
add byte [ecx + 0x34], al
inc edx
inc edx
inc ebp
inc eax
inc edx
cmp eax, 0x8104c483
out dx, al
jbe 0x40fd61
add byte [eax], al
pop esi
mov dword [ebp - 0x2c], 1
push edi
xor edi, 0x17d4c
and edi, 0xf9ad
call 0x40fd5d
add byte [eax], bh
dec edi
dec ecx
dec edx
cmp dh, byte [0xc4834c32]
add al, 0x5f
push ebx
push ecx
add esp, 4
and ebx, 0x119ec
and ebx, 0x6d29
pop ebx
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40ff54
Function at 0x40fce7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x40fb0e
pop edi
push ebx
push ebx
add esp, 4
jmp 0x40fb1a
pop ebx
push eax
or eax, 0xb78a
pop eax
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
loopne 0x40fb51
invalid
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push edx
push eax
add esp, 4
or edx, 0xc6fd
xor edx, 0x15a
pop edx
push edi
or edi, 0x14997
xor edi, 0x11a13
pop edi
push ecx
push ecx
add esp, 4
sub ecx, 0xf3d4
and ecx, 0x17ecb
pop ecx
imul edx, dword [ebp - 0x1060], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1060], 0xfe
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0xfe
sub edx, ecx
mov dword [ebp - 0x1064], edx
push esi
and esi, 0x1289c
xor esi, 0xf062
or esi, 0x78db
pop esi
push edi
push eax
add esp, 4
jmp 0x40fc5e
xor edi, 0xac7b
or edi, 0xdd8f
sub edi, 0x689b
pop edi
mov dword [ebp - 0x10], 1
push esi
push edi
add esp, 4
add esi, 0x1446e
pop esi
push eax
push esi
add esp, 4
add eax, 0xbdd4
sub eax, 0x21ac
xor eax, 0xe2b
pop eax
push eax
add eax, 0x7ad0
and eax, 0xbd60
pop eax
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
call 0x40fce7
add byte [ebx + 0x34], cl
inc esi
cmp byte [ebx], bh
dec edx
aas
inc ecx
xor al, 0x3c
add esp, 4
sub ecx, 0x5819
xor ecx, 0x9542
call 0x40fd04
add byte [esi + ecx*2 + 0x46], al
inc ebp
aas
dec ebx
xor al, byte [ebx + 0x505904c4]
xor eax, 0x4b73
and eax, 0x4b87
and eax, 0xd382
pop eax
push esi
push esi
add esp, 4
call 0x40fd30
add byte [ecx + 0x34], al
inc edx
inc edx
inc ebp
inc eax
inc edx
cmp eax, 0x8104c483
out dx, al
jbe 0x40fd61
add byte [eax], al
pop esi
mov dword [ebp - 0x2c], 1
push edi
xor edi, 0x17d4c
and edi, 0xf9ad
call 0x40fd5d
add byte [eax], bh
dec edi
dec ecx
dec edx
cmp dh, byte [0xc4834c32]
add al, 0x5f
push ebx
push ecx
add esp, 4
and ebx, 0x119ec
and ebx, 0x6d29
pop ebx
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40ff54
Function at 0x40fd04
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x40fb0e
pop edi
push ebx
push ebx
add esp, 4
jmp 0x40fb1a
pop ebx
push eax
or eax, 0xb78a
pop eax
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
loopne 0x40fb51
invalid
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push edx
push eax
add esp, 4
or edx, 0xc6fd
xor edx, 0x15a
pop edx
push edi
or edi, 0x14997
xor edi, 0x11a13
pop edi
push ecx
push ecx
add esp, 4
sub ecx, 0xf3d4
and ecx, 0x17ecb
pop ecx
imul edx, dword [ebp - 0x1060], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1060], 0xfe
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0xfe
sub edx, ecx
mov dword [ebp - 0x1064], edx
push esi
and esi, 0x1289c
xor esi, 0xf062
or esi, 0x78db
pop esi
push edi
push eax
add esp, 4
jmp 0x40fc5e
xor edi, 0xac7b
or edi, 0xdd8f
sub edi, 0x689b
pop edi
mov dword [ebp - 0x10], 1
push esi
push edi
add esp, 4
add esi, 0x1446e
pop esi
push eax
push esi
add esp, 4
add eax, 0xbdd4
sub eax, 0x21ac
xor eax, 0xe2b
pop eax
push eax
add eax, 0x7ad0
and eax, 0xbd60
pop eax
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
call 0x40fce7
add byte [ebx + 0x34], cl
inc esi
cmp byte [ebx], bh
dec edx
aas
inc ecx
xor al, 0x3c
add esp, 4
sub ecx, 0x5819
xor ecx, 0x9542
call 0x40fd04
add byte [esi + ecx*2 + 0x46], al
inc ebp
aas
dec ebx
xor al, byte [ebx + 0x505904c4]
xor eax, 0x4b73
and eax, 0x4b87
and eax, 0xd382
pop eax
push esi
push esi
add esp, 4
call 0x40fd30
add byte [ecx + 0x34], al
inc edx
inc edx
inc ebp
inc eax
inc edx
cmp eax, 0x8104c483
out dx, al
jbe 0x40fd61
add byte [eax], al
pop esi
mov dword [ebp - 0x2c], 1
push edi
xor edi, 0x17d4c
and edi, 0xf9ad
call 0x40fd5d
add byte [eax], bh
dec edi
dec ecx
dec edx
cmp dh, byte [0xc4834c32]
add al, 0x5f
push ebx
push ecx
add esp, 4
and ebx, 0x119ec
and ebx, 0x6d29
pop ebx
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40ff54
Function at 0x40fd30
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x40fb0e
pop edi
push ebx
push ebx
add esp, 4
jmp 0x40fb1a
pop ebx
push eax
or eax, 0xb78a
pop eax
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
loopne 0x40fb51
invalid
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push edx
push eax
add esp, 4
or edx, 0xc6fd
xor edx, 0x15a
pop edx
push edi
or edi, 0x14997
xor edi, 0x11a13
pop edi
push ecx
push ecx
add esp, 4
sub ecx, 0xf3d4
and ecx, 0x17ecb
pop ecx
imul edx, dword [ebp - 0x1060], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1060], 0xfe
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0xfe
sub edx, ecx
mov dword [ebp - 0x1064], edx
push esi
and esi, 0x1289c
xor esi, 0xf062
or esi, 0x78db
pop esi
push edi
push eax
add esp, 4
jmp 0x40fc5e
xor edi, 0xac7b
or edi, 0xdd8f
sub edi, 0x689b
pop edi
mov dword [ebp - 0x10], 1
push esi
push edi
add esp, 4
add esi, 0x1446e
pop esi
push eax
push esi
add esp, 4
add eax, 0xbdd4
sub eax, 0x21ac
xor eax, 0xe2b
pop eax
push eax
add eax, 0x7ad0
and eax, 0xbd60
pop eax
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
call 0x40fce7
add byte [ebx + 0x34], cl
inc esi
cmp byte [ebx], bh
dec edx
aas
inc ecx
xor al, 0x3c
add esp, 4
sub ecx, 0x5819
xor ecx, 0x9542
call 0x40fd04
add byte [esi + ecx*2 + 0x46], al
inc ebp
aas
dec ebx
xor al, byte [ebx + 0x505904c4]
xor eax, 0x4b73
and eax, 0x4b87
and eax, 0xd382
pop eax
push esi
push esi
add esp, 4
call 0x40fd30
add byte [ecx + 0x34], al
inc edx
inc edx
inc ebp
inc eax
inc edx
cmp eax, 0x8104c483
out dx, al
jbe 0x40fd61
add byte [eax], al
pop esi
mov dword [ebp - 0x2c], 1
push edi
xor edi, 0x17d4c
and edi, 0xf9ad
call 0x40fd5d
add byte [eax], bh
dec edi
dec ecx
dec edx
cmp dh, byte [0xc4834c32]
add al, 0x5f
push ebx
push ecx
add esp, 4
and ebx, 0x119ec
and ebx, 0x6d29
pop ebx
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40ff54
Function at 0x40fd5d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x40fb0e
pop edi
push ebx
push ebx
add esp, 4
jmp 0x40fb1a
pop ebx
push eax
or eax, 0xb78a
pop eax
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
loopne 0x40fb51
invalid
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push edx
push eax
add esp, 4
or edx, 0xc6fd
xor edx, 0x15a
pop edx
push edi
or edi, 0x14997
xor edi, 0x11a13
pop edi
push ecx
push ecx
add esp, 4
sub ecx, 0xf3d4
and ecx, 0x17ecb
pop ecx
imul edx, dword [ebp - 0x1060], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1060], 0xfe
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0xfe
sub edx, ecx
mov dword [ebp - 0x1064], edx
push esi
and esi, 0x1289c
xor esi, 0xf062
or esi, 0x78db
pop esi
push edi
push eax
add esp, 4
jmp 0x40fc5e
xor edi, 0xac7b
or edi, 0xdd8f
sub edi, 0x689b
pop edi
mov dword [ebp - 0x10], 1
push esi
push edi
add esp, 4
add esi, 0x1446e
pop esi
push eax
push esi
add esp, 4
add eax, 0xbdd4
sub eax, 0x21ac
xor eax, 0xe2b
pop eax
push eax
add eax, 0x7ad0
and eax, 0xbd60
pop eax
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
call 0x40fce7
add byte [ebx + 0x34], cl
inc esi
cmp byte [ebx], bh
dec edx
aas
inc ecx
xor al, 0x3c
add esp, 4
sub ecx, 0x5819
xor ecx, 0x9542
call 0x40fd04
add byte [esi + ecx*2 + 0x46], al
inc ebp
aas
dec ebx
xor al, byte [ebx + 0x505904c4]
xor eax, 0x4b73
and eax, 0x4b87
and eax, 0xd382
pop eax
push esi
push esi
add esp, 4
call 0x40fd30
add byte [ecx + 0x34], al
inc edx
inc edx
inc ebp
inc eax
inc edx
cmp eax, 0x8104c483
out dx, al
jbe 0x40fd61
add byte [eax], al
pop esi
mov dword [ebp - 0x2c], 1
push edi
xor edi, 0x17d4c
and edi, 0xf9ad
call 0x40fd5d
add byte [eax], bh
dec edi
dec ecx
dec edx
cmp dh, byte [0xc4834c32]
add al, 0x5f
push ebx
push ecx
add esp, 4
and ebx, 0x119ec
and ebx, 0x6d29
pop ebx
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40ff54
Function at 0x41366e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add ecx, 0x66f0
jmp 0x41367f
xor ecx, 0x9c4b
pop ecx
mov dword [ebp - 0x3e8], 0
Function at 0x413d40
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
lea ebp, [ebx + esi*8 - 1]
dec dword [ebx - 0x5036b]
dec dword [ebx - 0x7a76cfbe]
jo 0x413d45
invalid
Function at 0x4141c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push edx
add esp, 4
jmp 0x4141a7
jmp 0x4141b0
jmp 0x4141b7
pop eax
push esi
call 0x4141c7
add byte [ebx], dh
cmp eax, 0x3a32413d
cmp byte [eax - 0x7d], dl
les eax, [esi + ebx*2]
lea edx, [ebp - 0x1774]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
push esi
sub esi, 0xc7c4
pop esi
push esi
push edx
add esp, 4
call 0x414214
add byte [eax + 0x36], dl
dec ebp
dec edi
cmp byte [ecx], bh
cmp byte ss:[edi], dh
add esp, 4
add esi, 0x16ce5
jmp 0x414223
sub esi, 0x3a26
pop esi
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push edi
push ebx
add esp, 4
xor edi, 0x15f48
or edi, 0x9b80
xor edi, 0x47ea
or edi, 0x4f07
pop edi
push edx
push eax
add esp, 4
jmp 0x4142af
and edx, 0x199e
pop edx
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x4142d9
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x41433c
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x4141f8
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x4141f8
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x414326
mov dword [ebp - 0x15e8], 0xffffffff
jmp fcn.00414330
mov dword [ebp - 0x15e8], 1
cmp dword [ebp - 0x15ec], 0
jne 0x414385
push edx
sub edx, 0x16ada
sub edx, 0x8834
jmp 0x414358
pop edx
push eax
call 0x414367
add byte [edi + eax*2], bh
inc edx
dec ebp
inc esi
inc esi
cmp byte [ebx - 0x1f7efb3c], al
rcl byte [eax + eax], 0
push eax
push ebx
add esp, 4
xor eax, 0x6f9e
call 0x41439f
add byte [esi], bh
xor cl, byte [esi + 0x4a]
cmp al, 0x3d
cmp al, 0x48
add esp, 4
pop eax
push esi
sub esi, 0xc7a5
xor esi, 0x18205
jmp 0x4143b6
pop esi
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x4143e3
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x414199
mov dword [ebp - 0x750], 0

Function at 0x4141e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0xc9c], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
Function at 0x414214
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push edx
add esp, 4
jmp 0x4141a7
jmp 0x4141b0
jmp 0x4141b7
pop eax
push esi
call 0x4141c7
add byte [ebx], dh
cmp eax, 0x3a32413d
cmp byte [eax - 0x7d], dl
les eax, [esi + ebx*2]
lea edx, [ebp - 0x1774]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
push esi
sub esi, 0xc7c4
pop esi
push esi
push edx
add esp, 4
call 0x414214
add byte [eax + 0x36], dl
dec ebp
dec edi
cmp byte [ecx], bh
cmp byte ss:[edi], dh
add esp, 4
add esi, 0x16ce5
jmp 0x414223
sub esi, 0x3a26
pop esi
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push edi
push ebx
add esp, 4
xor edi, 0x15f48
or edi, 0x9b80
xor edi, 0x47ea
or edi, 0x4f07
pop edi
push edx
push eax
add esp, 4
jmp 0x4142af
and edx, 0x199e
pop edx
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x4142d9
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x41433c
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x4141f8
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x4141f8
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x414326
mov dword [ebp - 0x15e8], 0xffffffff
jmp fcn.00414330
mov dword [ebp - 0x15e8], 1
cmp dword [ebp - 0x15ec], 0
jne 0x414385
push edx
sub edx, 0x16ada
sub edx, 0x8834
jmp 0x414358
pop edx
push eax
call 0x414367
add byte [edi + eax*2], bh
inc edx
dec ebp
inc esi
inc esi
cmp byte [ebx - 0x1f7efb3c], al
rcl byte [eax + eax], 0
push eax
push ebx
add esp, 4
xor eax, 0x6f9e
call 0x41439f
add byte [esi], bh
xor cl, byte [esi + 0x4a]
cmp al, 0x3d
cmp al, 0x48
add esp, 4
pop eax
push esi
sub esi, 0xc7a5
xor esi, 0x18205
jmp 0x4143b6
pop esi
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x4143e3
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x414199
mov dword [ebp - 0x750], 0
Function at 0x414230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push edx
add esp, 4
jmp 0x4141a7
jmp 0x4141b0
jmp 0x4141b7
pop eax
push esi
call 0x4141c7
add byte [ebx], dh
cmp eax, 0x3a32413d
cmp byte [eax - 0x7d], dl
les eax, [esi + ebx*2]
lea edx, [ebp - 0x1774]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
push esi
sub esi, 0xc7c4
pop esi
push esi
push edx
add esp, 4
call 0x414214
add byte [eax + 0x36], dl
dec ebp
dec edi
cmp byte [ecx], bh
cmp byte ss:[edi], dh
add esp, 4
add esi, 0x16ce5
jmp 0x414223
sub esi, 0x3a26
pop esi
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push edi
push ebx
add esp, 4
xor edi, 0x15f48
or edi, 0x9b80
xor edi, 0x47ea
or edi, 0x4f07
pop edi
push edx
push eax
add esp, 4
jmp 0x4142af
and edx, 0x199e
pop edx
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x4142d9
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x41433c
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x4141f8
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x4141f8
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x414326
mov dword [ebp - 0x15e8], 0xffffffff
jmp fcn.00414330
mov dword [ebp - 0x15e8], 1
cmp dword [ebp - 0x15ec], 0
jne 0x414385
push edx
sub edx, 0x16ada
sub edx, 0x8834
jmp 0x414358
pop edx
push eax
call 0x414367
add byte [edi + eax*2], bh
inc edx
dec ebp
inc esi
inc esi
cmp byte [ebx - 0x1f7efb3c], al
rcl byte [eax + eax], 0
push eax
push ebx
add esp, 4
xor eax, 0x6f9e
call 0x41439f
add byte [esi], bh
xor cl, byte [esi + 0x4a]
cmp al, 0x3d
cmp al, 0x48
add esp, 4
pop eax
push esi
sub esi, 0xc7a5
xor esi, 0x18205
jmp 0x4143b6
pop esi
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x4143e3
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x414199
mov dword [ebp - 0x750], 0

Function at 0x414330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax