joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414367
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push edx
add esp, 4
jmp 0x4141a7
jmp 0x4141b0
jmp 0x4141b7
pop eax
push esi
call 0x4141c7
add byte [ebx], dh
cmp eax, 0x3a32413d
cmp byte [eax - 0x7d], dl
les eax, [esi + ebx*2]
lea edx, [ebp - 0x1774]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
push esi
sub esi, 0xc7c4
pop esi
push esi
push edx
add esp, 4
call 0x414214
add byte [eax + 0x36], dl
dec ebp
dec edi
cmp byte [ecx], bh
cmp byte ss:[edi], dh
add esp, 4
add esi, 0x16ce5
jmp 0x414223
sub esi, 0x3a26
pop esi
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push edi
push ebx
add esp, 4
xor edi, 0x15f48
or edi, 0x9b80
xor edi, 0x47ea
or edi, 0x4f07
pop edi
push edx
push eax
add esp, 4
jmp 0x4142af
and edx, 0x199e
pop edx
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x4142d9
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x41433c
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x4141f8
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x4141f8
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x414326
mov dword [ebp - 0x15e8], 0xffffffff
jmp fcn.00414330
mov dword [ebp - 0x15e8], 1
cmp dword [ebp - 0x15ec], 0
jne 0x414385
push edx
sub edx, 0x16ada
sub edx, 0x8834
jmp 0x414358
pop edx
push eax
call 0x414367
add byte [edi + eax*2], bh
inc edx
dec ebp
inc esi
inc esi
cmp byte [ebx - 0x1f7efb3c], al
rcl byte [eax + eax], 0
push eax
push ebx
add esp, 4
xor eax, 0x6f9e
call 0x41439f
add byte [esi], bh
xor cl, byte [esi + 0x4a]
cmp al, 0x3d
cmp al, 0x48
add esp, 4
pop eax
push esi
sub esi, 0xc7a5
xor esi, 0x18205
jmp 0x4143b6
pop esi
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x4143e3
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x414199
mov dword [ebp - 0x750], 0

Function at 0x414370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or eax, 0x13a35
pop eax
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x4143ed
push edi
add edi, 0x12a53
pop edi
push edi
push edx
add esp, 4
xor edi, 0x10dfe
Function at 0x41439f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push edx
add esp, 4
jmp 0x4141a7
jmp 0x4141b0
jmp 0x4141b7
pop eax
push esi
call 0x4141c7
add byte [ebx], dh
cmp eax, 0x3a32413d
cmp byte [eax - 0x7d], dl
les eax, [esi + ebx*2]
lea edx, [ebp - 0x1774]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
push esi
sub esi, 0xc7c4
pop esi
push esi
push edx
add esp, 4
call 0x414214
add byte [eax + 0x36], dl
dec ebp
dec edi
cmp byte [ecx], bh
cmp byte ss:[edi], dh
add esp, 4
add esi, 0x16ce5
jmp 0x414223
sub esi, 0x3a26
pop esi
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push edi
push ebx
add esp, 4
xor edi, 0x15f48
or edi, 0x9b80
xor edi, 0x47ea
or edi, 0x4f07
pop edi
push edx
push eax
add esp, 4
jmp 0x4142af
and edx, 0x199e
pop edx
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x4142d9
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x41433c
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x4141f8
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x4141f8
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x414326
mov dword [ebp - 0x15e8], 0xffffffff
jmp fcn.00414330
mov dword [ebp - 0x15e8], 1
cmp dword [ebp - 0x15ec], 0
jne 0x414385
push edx
sub edx, 0x16ada
sub edx, 0x8834
jmp 0x414358
pop edx
push eax
call 0x414367
add byte [edi + eax*2], bh
inc edx
dec ebp
inc esi
inc esi
cmp byte [ebx - 0x1f7efb3c], al
rcl byte [eax + eax], 0
push eax
push ebx
add esp, 4
xor eax, 0x6f9e
call 0x41439f
add byte [esi], bh
xor cl, byte [esi + 0x4a]
cmp al, 0x3d
cmp al, 0x48
add esp, 4
pop eax
push esi
sub esi, 0xc7a5
xor esi, 0x18205
jmp 0x4143b6
pop esi
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x4143e3
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x414199
mov dword [ebp - 0x750], 0
Function at 0x414400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x41440c
add byte [esi], bh
inc ebp
dec edx
inc edi
xor al, 0x43
add esp, 4
call 0x41441b
add byte [eax + 0x4a], al
push eax
xor ecx, dword [ebp + 0x3b]
add esp, 4
pop edi
cmp dword [ebp - 0x750], 0
jne 0x414469
push edx
push edx
add esp, 4
xor edx, 0x7451
add edx, 0x1715a
add edx, 0xcd70
sub edx, 0xa121
pop edx
push ecx
and ecx, 0xfd16
or ecx, 0xaf26
and ecx, 0xe41a
pop ecx
mov dword [ebp - 0x79c], 0
jmp 0x414f90
push esi
push ecx
add esp, 4
sub esi, 0x16370
jmp 0x41447c
pop esi
push esi
push ecx
add esp, 4
and esi, 0xd7e7
pop esi
push ebx
push ebx
add esp, 4
or ebx, 0x5afa
sub ebx, 0x897c
pop ebx
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x4144da
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x4147cb
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x414502
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x4147cb
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x15f4]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x15f8], ecx
cmp dword [ebp - 0x15f8], 0
jne 0x414534
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], edx
jmp 0x4147cb
mov eax, dword [ebp - 0x320]
add eax, dword [ebp - 0x15f8]

Function at 0x41440c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x41440c
add byte [esi], bh
inc ebp
dec edx
inc edi
xor al, 0x43
add esp, 4
call 0x41441b
add byte [eax + 0x4a], al
push eax
xor ecx, dword [ebp + 0x3b]
add esp, 4
pop edi
cmp dword [ebp - 0x750], 0
jne 0x414469
push edx
push edx
add esp, 4
xor edx, 0x7451
add edx, 0x1715a
add edx, 0xcd70
sub edx, 0xa121
pop edx
push ecx
and ecx, 0xfd16
or ecx, 0xaf26
and ecx, 0xe41a
pop ecx
mov dword [ebp - 0x79c], 0
jmp 0x414f90
push esi
push ecx
add esp, 4
sub esi, 0x16370
jmp 0x41447c
pop esi
push esi
push ecx
add esp, 4
and esi, 0xd7e7
pop esi
push ebx
push ebx
add esp, 4
or ebx, 0x5afa
sub ebx, 0x897c
pop ebx
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x4144da
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x4147cb
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x414502
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x4147cb
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x15f4]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x15f8], ecx
cmp dword [ebp - 0x15f8], 0
jne 0x414534
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], edx
jmp 0x4147cb
mov eax, dword [ebp - 0x320]
add eax, dword [ebp - 0x15f8]
Function at 0x41441b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x41440c
add byte [esi], bh
inc ebp
dec edx
inc edi
xor al, 0x43
add esp, 4
call 0x41441b
add byte [eax + 0x4a], al
push eax
xor ecx, dword [ebp + 0x3b]
add esp, 4
pop edi
cmp dword [ebp - 0x750], 0
jne 0x414469
push edx
push edx
add esp, 4
xor edx, 0x7451
add edx, 0x1715a
add edx, 0xcd70
sub edx, 0xa121
pop edx
push ecx
and ecx, 0xfd16
or ecx, 0xaf26
and ecx, 0xe41a
pop ecx
mov dword [ebp - 0x79c], 0
jmp 0x414f90
push esi
push ecx
add esp, 4
sub esi, 0x16370
jmp 0x41447c
pop esi
push esi
push ecx
add esp, 4
and esi, 0xd7e7
pop esi
push ebx
push ebx
add esp, 4
or ebx, 0x5afa
sub ebx, 0x897c
pop ebx
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x4144da
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x4147cb
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x414502
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x4147cb
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x15f4]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x15f8], ecx
cmp dword [ebp - 0x15f8], 0
jne 0x414534
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], edx
jmp 0x4147cb
mov eax, dword [ebp - 0x320]
add eax, dword [ebp - 0x15f8]
Function at 0x41536d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edi, 0xb95b
jmp 0x41537e
pop edi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x41539c
movzx ecx, word [ebp - 0x21c]
invalid
invalid

Function at 0x41542d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp ecx, edx
jge 0x4153e0
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x4153ea
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x41543f
push edi
push edi
add esp, 4
sub edi, 0x17dc
and edi, 0x16890
sub edi, 0x12d1
xor edi, 0x16de9
pop edi
push ebx
call 0x41542d
add byte [ebp + 0x50], cl
cmp eax, 0x433b4f36
inc ebx
push eax
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x4154a7
push eax
push ecx
add esp, 4
or eax, 0x8f96
or eax, 0x9fe8
xor eax, 0xbddd
call 0x415466
add byte [0x473c4c3b], dh
dec edx
cmp dword [edi + 0x3d], eax
dec eax
add esp, 4
pop eax
push ebx
jmp 0x415470
pop ebx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x41549d
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x415268
mov dword [ebp - 0x2fc], 0

Function at 0x415466
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp ecx, edx
jge 0x4153e0
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x4153ea
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x41543f
push edi
push edi
add esp, 4
sub edi, 0x17dc
and edi, 0x16890
sub edi, 0x12d1
xor edi, 0x16de9
pop edi
push ebx
call 0x41542d
add byte [ebp + 0x50], cl
cmp eax, 0x433b4f36
inc ebx
push eax
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x4154a7
push eax
push ecx
add esp, 4
or eax, 0x8f96
or eax, 0x9fe8
xor eax, 0xbddd
call 0x415466
add byte [0x473c4c3b], dh
dec edx
cmp dword [edi + 0x3d], eax
dec eax
add esp, 4
pop eax
push ebx
jmp 0x415470
pop ebx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x41549d
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x415268
mov dword [ebp - 0x2fc], 0
Function at 0x415754
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x415764
add byte [ebp + 0x44], cl
inc esi

Function at 0x415760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc edi
cmp eax, dword [ebx + eax*4 - 0x3c]
add al, 0x5e
push esi
push ecx
add esp, 4
jmp 0x415773
pop esi
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx

Function at 0x415764
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc edi
cmp eax, dword [ebx + eax*4 - 0x3c]
add al, 0x5e
push esi
push ecx
add esp, 4
jmp 0x415773
pop esi
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx

Function at 0x4157c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edx
add esp, 4
call fcn.00415754
add byte [edi + ecx*2], dh
inc ecx
inc edx
xor ecx, dword [edx + 0x48]
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push ecx
add ecx, 0x55c1
and ecx, 0x4596
pop ecx
push edx
sub edx, 0xbae0
jmp 0x4157e7
pop edx
push ecx
and ecx, 0xd2cd
and ecx, 0x15f11
pop ecx
push ebx
jmp 0x4157fc
pop ebx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x41581a
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1668], edx
jmp 0x415874
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x415742
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x415742
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x41585e
mov dword [ebp - 0x1624], 0xffffffff
jmp 0x415868
mov dword [ebp - 0x1624], 1
mov ecx, dword [ebp - 0x1624]
mov dword [ebp - 0x1668], ecx
cmp dword [ebp - 0x1668], 0
jne 0x4158bd
push esi
xor esi, 0x13fe
pop esi
push ecx
push esi
add esp, 4
or ecx, 0x10751
or ecx, 0x2a75
pop ecx
push esi
push edx
add esp, 4
jmp 0x4158a2
xor esi, 0xbc94
add esi, 0x2f82
pop esi
invalid

Function at 0x415920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
add byte [edx - 0x7f], dl
ljmp 0x525a
Function at 0x415ebc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x19bc], ecx
mov edx, dword [ebp - 0x19bc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19c0], eax
mov ecx, dword [ebp - 0x19c0]
mov dword [ebp - 0x167c], ecx
push esi
sub esi, 0xaf14
or esi, 0x50dc
or esi, 0x1fe1
sub esi, 0x1104a
pop esi
push ebx
push edx
add esp, 4
and ebx, 0x18113
and ebx, 0xcee1
add ebx, 0x2e06
pop ebx
cmp dword [ebp - 0x167c], 0
jne 0x415e82
mov dword [ebp - 0x2fc], 0
jmp 0x416129
mov edx, dword [ebp - 0x167c]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xce0], ecx
push edi
or edi, 0xccee
pop edi
push ecx
push esi
add esp, 4
sub ecx, 0x8ee3
jmp 0x415ead
pop ecx
push esi
call 0x415ebc
add byte [ecx + 0x39], cl
dec esi
dec edi
inc ebp
dec ebp
add esp, 4
xor esi, 0x35ef
pop esi
cmp dword [ebp - 0xce0], 0
jne 0x415ede
mov dword [ebp - 0x2fc], 0
jmp 0x416129
mov edx, dword [ebp - 0xce0]
mov dword [ebp - 0x51c], edx
push edi
push ebx
add esp, 4
invalid

Function at 0x415f50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
sub ecx, 0xf994
jmp 0x415f53
aaa
xor eax, 0x4e04eb33
push eax
xor ebx, dword [ecx + 0x52]
jmp 0x415f59
pop ecx
push edx
push ebx
add esp, 4
sub edx, 0x15602
sub edx, 0x8301
and edx, 0x6378
and edx, 0xf773
pop edx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
invalid
invalid

Function at 0x415f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add cl, byte [ecx - 0xcd773]
jmp dword [esi - 0x75]

Function at 0x4160d1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0x6300
pop edi
push edi
push edx
add esp, 4
and edi, 0x745f
sub edi, 0x16e61
and edi, 0x8c87
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x41611f
invalid
Function at 0x416145
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor cl, byte [ebp + 0x3a]
dec ecx
inc ecx
add esp, 4
call 0x416157
add byte [edx], bh
cmp bh, byte [esi]
xor al, 0x44
cmp eax, 0x83494f3c
les eax, [eax + ebx*2]
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push esi
push esi
add esp, 4
add esi, 0x77d1
invalid
sal dword [edi], 1
add byte [ecx + 0xec5bc6], al
add byte [ecx + 0x11b69c6], al
add byte [ecx + 0x31ae6], al
add byte [esi + 0x53], bl
sub ebx, 0x7f36
sub ebx, 0x6b46
jmp 0x41619b
pop ebx
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 0
jne 0x4161cc
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x4164bd
mov edx, dword [ebp - 0x1688]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x168c], eax
jne 0x4161f4
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x4164bd
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x168c]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1690], edx
cmp dword [ebp - 0x1690], 0
jne 0x416226
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x520], eax
jmp 0x4164bd
mov ecx, dword [ebp - 0x338]
add ecx, dword [ebp - 0x1690]
mov dword [ebp - 0x788], ecx
jne 0x41624b
mov edx, dword [ebp - 0x794]
mov dword [ebp - 0x520], edx
jmp 0x4164bd
mov eax, dword [ebp - 0x788]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19c4], ecx
mov edx, dword [ebp - 0x788]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19c8], eax
mov ecx, dword [ebp - 0x788]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19cc], edx
mov dword [ebp - 0x78c], 0
jmp 0x4162a5
mov ecx, dword [ebp - 0x788]
mov edx, dword [ebp - 0x78c]
cmp edx, dword [ecx + 0x18]
jae 0x4164b1
mov eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x19c4]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x790], edx
mov eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x19c8]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19cc]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19d0], ecx
mov dword [ebp - 0x1a4], 0
jmp 0x416315
mov eax, dword [ebp - 0x790]
add eax, dword [ebp - 0x1a4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4163c7
mov edx, dword [ebp - 0x1a4]
movsx eax, byte [ebp + edx - 0x9d4]
test eax, eax
je 0x4163c7
push ecx
push ecx
add esp, 4
xor ecx, 0x747c
sub ecx, 0x2d3c
and ecx, 0x906b
pop ecx
push ebx
push edi
add esp, 4
xor ebx, 0x180a2
sub ebx, 0x11f25
jmp 0x416373
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x520], eax
Function at 0x416157
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor cl, byte [ebp + 0x3a]
dec ecx
inc ecx
add esp, 4
call 0x416157
add byte [edx], bh
cmp bh, byte [esi]
xor al, 0x44
cmp eax, 0x83494f3c
les eax, [eax + ebx*2]
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push esi
push esi
add esp, 4
add esi, 0x77d1
invalid
sal dword [edi], 1
add byte [ecx + 0xec5bc6], al
add byte [ecx + 0x11b69c6], al
add byte [ecx + 0x31ae6], al
add byte [esi + 0x53], bl
sub ebx, 0x7f36
sub ebx, 0x6b46
jmp 0x41619b
pop ebx
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 0
jne 0x4161cc
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x4164bd
mov edx, dword [ebp - 0x1688]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x168c], eax
jne 0x4161f4
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x4164bd
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x168c]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1690], edx
cmp dword [ebp - 0x1690], 0
jne 0x416226
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x520], eax
jmp 0x4164bd
mov ecx, dword [ebp - 0x338]
add ecx, dword [ebp - 0x1690]
mov dword [ebp - 0x788], ecx
jne 0x41624b
mov edx, dword [ebp - 0x794]
mov dword [ebp - 0x520], edx
jmp 0x4164bd
mov eax, dword [ebp - 0x788]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19c4], ecx
mov edx, dword [ebp - 0x788]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19c8], eax
mov ecx, dword [ebp - 0x788]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19cc], edx
mov dword [ebp - 0x78c], 0
jmp 0x4162a5
mov ecx, dword [ebp - 0x788]
mov edx, dword [ebp - 0x78c]
cmp edx, dword [ecx + 0x18]
jae 0x4164b1
mov eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x19c4]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x790], edx
mov eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x19c8]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19cc]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19d0], ecx
mov dword [ebp - 0x1a4], 0
jmp 0x416315
mov eax, dword [ebp - 0x790]
add eax, dword [ebp - 0x1a4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4163c7
mov edx, dword [ebp - 0x1a4]
movsx eax, byte [ebp + edx - 0x9d4]
test eax, eax
je 0x4163c7
push ecx
push ecx
add esp, 4
xor ecx, 0x747c
sub ecx, 0x2d3c
and ecx, 0x906b
pop ecx
push ebx
push edi
add esp, 4
xor ebx, 0x180a2
sub ebx, 0x11f25
jmp 0x416373
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x520], eax