joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412ff0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x593268
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5fdfec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x413113
cmp dword [ebp - 0x14], 2
jl 0x413096
push dword [edi + 4]
lea ecx, [ebp - 0x2c]
call fcn.00405a80
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00413130
mov dword [esi + 0x1d4], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x413080
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00408450
mov eax, dword [esi + 0x1d4]
mov ecx, 0xea60
cmp eax, ecx
cmovb ecx, eax
mov dword [esi + 0x1d4], ecx
cmp dword [ebp - 0x14], 3
jl 0x4130d8
push dword [edi + 8]
lea ecx, [ebp - 0x2c]
call fcn.00405a80
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.00413130
mov dword [esi + 0x1d8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x4130d8
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00408450
cmp dword [ebp - 0x14], 4
jl 0x413113
push dword [edi + 0xc]
lea ecx, [ebp - 0x44]
call fcn.00405a80
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 2
call fcn.00413130
mov dword [esi + 0x188], eax
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x413113
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00408450
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00551e13
mov esp, ebp
pop ebp
ret

Function at 0x418a30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00427e1f

Function at 0x418ea0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x418eb5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x418ef6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x418ef2
nop word [eax + eax]
cmp esi, edx
jae 0x418ef6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x418ee0
cmp esi, edx
jb 0x418efb
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4275b0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x427603
push esi
push dword [ebp + 8]
call fcn.004277a3
mov edi, eax
test edi, edi
jne 0x4275d3
mov eax, dword [ebp + 0x10]
jmp 0x427615
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4275ce
mov eax, dword [ebp - 8]
jmp 0x427615
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x427e84
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0041a572
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x427ebb
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00427edc
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42aa45
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x596d83
call fcn.00552637
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x42aa6b
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42aaca
call fcn.0042a5d1
push eax
lea ecx, [ebp - 0x10]
call fcn.004194e0
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.005525fa
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0056fd05
push eax
call fcn.004036e0
add esp, 0x14
test esi, esi
je 0x42aabd
push esi
call fcn.005786aa
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00411630
mov eax, ebx
call fcn.00552600
ret 8
Function at 0x42e357
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x42e39c
call fcn.0041a572
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42e39c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x42e3b8
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004a33cc
mov ebx, eax
test edi, edi
je 0x42e3b6
test esi, esi
je 0x42e3b6
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42eda5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x42ee63
cmp dword [esi + 0x20], 0
je 0x42ee63
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42ee63
cmp dword [ebp + 8], 0
je 0x42ee63
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.0041a572
push 0x5a53b0
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x42ee34
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42ee63
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.004a603f
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x42ee54
test edi, edi
je 0x42ee54
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x42ee5f
mov ecx, esi
call fcn.0042eb48
mov eax, ebx
jmp 0x42ee65
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4404ef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x440508
call fcn.0041a572
mov esi, dword [eax + 0xc]
push 0x5dd174
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x44055e
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x44055d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x44053e
xor esi, esi
jmp 0x440554
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00440566
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a7b1b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x4a7b35
mov edi, dword [esi + 0xc]
jmp 0x4a7b75
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4a7b4e
call fcn.0042b70e
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4a7b63
call fcn.0042b70e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4a7b75
call fcn.0042b70e
call fcn.0041a572
cmp dword [eax + 0x3c], 0
je 0x4a7b8a
push edi
mov ecx, ebx
call fcn.004a71af
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004a7d67
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4a7bb3
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4a7bbf
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4d0f2f
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x59b009
call fcn.0055266b
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.0041adfe
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x5a4340
call fcn.0041af86
cmp eax, 0xffffffff
jne 0x4d0ffa
push 0
push 0x5a5cec
lea ecx, [ebp - 0x4d0]
call fcn.0041af86
cmp eax, 0xffffffff
jne 0x4d0ffa
push 0
push 0x5a33b4
lea ecx, [ebp - 0x4d0]
call fcn.0041af86
cmp eax, 0xffffffff
jne 0x4d0ffa
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.0041adfe
mov edi, eax
pop ecx
mov dword [ebp - 0x4d4], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x4d8], ecx
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea eax, [ebp - 0x218]
push eax
push 0x104
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4d0fd7
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.005525fa
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.00411630
jmp 0x4d1032
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00419390
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00411630
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4d1020
mov edi, dword [ebp - 0x4cc]
jmp 0x4d1032
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.005525fa
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00411630
mov eax, edi
call fcn.00552615
ret
Function at 0x51701b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0042a972
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x517057
call fcn.0051723d
mov dword [esi + 0xc], 1
jmp 0x51705c
call fcn.0051723d
cmp dword [esi], 0
je 0x5170a5
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x51707f
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0042a7f2
jmp 0x517090
push 0xff
mov ecx, esi
call fcn.004191e0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004278df
jmp 0x5170c9
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x5170c9
push dword [esi]
push dword [ebp - 4]
call fcn.00436201
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x517192
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0051723d
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x5171da
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0042a7f2
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004278df
jmp 0x5171e5
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00436201
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x581cc1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
push edx
add esp, 4
add edx, 0x14e77
pop edx
push ecx
push ebx
add esp, 4
jmp 0x581b27
jmp 0x581b2f
pop ecx
push edi
or edi, 0x5cf2
pop edi
push edx
add edx, 0x9c6f
pop edx
lea edx, [ebp - 0xc50]
mov dword [ebp - 0x6ac], edx
mov eax, dword [ebp - 0x25c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x6a8], ecx
xor edx, edx
mov word [ebp - 0x114], dx
xor eax, eax
mov word [ebp - 0x28], ax
push ecx
jmp 0x581b72
add ecx, 0xed3
call fcn.00581b84
add byte [edi + 0x50], cl
dec edx
inc esp
inc eax
inc esp
add esp, 4
xor ecx, 0x4f5a
pop ecx
push esi
sub esi, 0xd0ca
sub esi, 0x5eca
pop esi
mov ecx, dword [ebp - 0x6a8]
mov dx, word [ecx]
mov word [ebp - 0x87a], dx
mov eax, dword [ebp - 0x6a8]
add eax, 2
mov dword [ebp - 0x6a8], eax
jmp dword [esi - 0x75]
lea eax, [esi + 0x66fffff7]
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x6ac]
mov ax, word [edx]
mov word [ebp - 0x92c], ax
mov ecx, dword [ebp - 0x6ac]
add ecx, 2
mov dword [ebp - 0x6ac], ecx
mov dx, word [ebp - 0x92c]
mov word [ebp - 0x28], dx
push esi
add esi, 0x7e17
call 0x581c0a
add byte [ebp + 0x4a], cl
inc eax
inc ebp
dec edi
push eax
dec esp
dec esp
cmp esi, dword [esi]
add esp, 4
jmp 0x581c15
call 0x581c21
add byte [ebx], dh
dec esp
dec edx
dec esp
inc esp
cmp eax, 0x5e04c483
movzx eax, word [ebp - 0x28]
test eax, eax
jne 0x581c42
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0xb5c], ecx
jmp 0x581c9c
movzx eax, word [ebp - 0x114]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x581b6a
movzx edx, word [ebp - 0x114]
xor edx, 0x20
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x581b6a
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
jge 0x581c86
mov dword [ebp - 0xb58], 0xffffffff
jmp 0x581c90
mov dword [ebp - 0xb58], 1
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0xb5c], 0
jne 0x581ce5
push edx
jmp 0x581cac
sub edx, 0x549f
pop edx
push edx
call 0x581cc1
add byte [edi + 0x36], al
inc ebp
inc edi
cmp ecx, dword [ebx + 0x47]
add esp, 4
add edx, 0x4f6b
add edx, 0x125a7
sub edx, 0x6439
pop edx
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x188], ecx
jmp 0x581d4d
push eax
and eax, 0x146cb
xor eax, 0x9d8a
call 0x581cff
add byte [esi], dh
cmp dword [edx + ecx*2 + 0x4f], ecx
inc ecx
cmp al, 0x83
les eax, [eax + ebx*2]
push esi
and esi, 0xf33b
and esi, 0x3a89
sub esi, 0x1681c
pop esi
mov edx, dword [ebp - 0x25c]
mov eax, dword [edx]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x25c]
cmp ecx, dword [ebp - 0x6b0]
je 0x581d43
mov edx, dword [ebp - 0x25c]
cmp dword [edx + 0x30], 0
jne 0x581b0e
mov dword [ebp - 0x188], 0
Function at 0x581cff
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
push edx
add esp, 4
add edx, 0x14e77
pop edx
push ecx
push ebx
add esp, 4
jmp 0x581b27
jmp 0x581b2f
pop ecx
push edi
or edi, 0x5cf2
pop edi
push edx
add edx, 0x9c6f
pop edx
lea edx, [ebp - 0xc50]
mov dword [ebp - 0x6ac], edx
mov eax, dword [ebp - 0x25c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x6a8], ecx
xor edx, edx
mov word [ebp - 0x114], dx
xor eax, eax
mov word [ebp - 0x28], ax
push ecx
jmp 0x581b72
add ecx, 0xed3
call fcn.00581b84
add byte [edi + 0x50], cl
dec edx
inc esp
inc eax
inc esp
add esp, 4
xor ecx, 0x4f5a
pop ecx
push esi
sub esi, 0xd0ca
sub esi, 0x5eca
pop esi
mov ecx, dword [ebp - 0x6a8]
mov dx, word [ecx]
mov word [ebp - 0x87a], dx
mov eax, dword [ebp - 0x6a8]
add eax, 2
mov dword [ebp - 0x6a8], eax
jmp dword [esi - 0x75]
lea eax, [esi + 0x66fffff7]
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x6ac]
mov ax, word [edx]
mov word [ebp - 0x92c], ax
mov ecx, dword [ebp - 0x6ac]
add ecx, 2
mov dword [ebp - 0x6ac], ecx
mov dx, word [ebp - 0x92c]
mov word [ebp - 0x28], dx
push esi
add esi, 0x7e17
call 0x581c0a
add byte [ebp + 0x4a], cl
inc eax
inc ebp
dec edi
push eax
dec esp
dec esp
cmp esi, dword [esi]
add esp, 4
jmp 0x581c15
call 0x581c21
add byte [ebx], dh
dec esp
dec edx
dec esp
inc esp
cmp eax, 0x5e04c483
movzx eax, word [ebp - 0x28]
test eax, eax
jne 0x581c42
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0xb5c], ecx
jmp 0x581c9c
movzx eax, word [ebp - 0x114]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x581b6a
movzx edx, word [ebp - 0x114]
xor edx, 0x20
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x581b6a
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
jge 0x581c86
mov dword [ebp - 0xb58], 0xffffffff
jmp 0x581c90
mov dword [ebp - 0xb58], 1
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0xb5c], 0
jne 0x581ce5
push edx
jmp 0x581cac
sub edx, 0x549f
pop edx
push edx
call 0x581cc1
add byte [edi + 0x36], al
inc ebp
inc edi
cmp ecx, dword [ebx + 0x47]
add esp, 4
add edx, 0x4f6b
add edx, 0x125a7
sub edx, 0x6439
pop edx
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x188], ecx
jmp 0x581d4d
push eax
and eax, 0x146cb
xor eax, 0x9d8a
call 0x581cff
add byte [esi], dh
cmp dword [edx + ecx*2 + 0x4f], ecx
inc ecx
cmp al, 0x83
les eax, [eax + ebx*2]
push esi
and esi, 0xf33b
and esi, 0x3a89
sub esi, 0x1681c
pop esi
mov edx, dword [ebp - 0x25c]
mov eax, dword [edx]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x25c]
cmp ecx, dword [ebp - 0x6b0]
je 0x581d43
mov edx, dword [ebp - 0x25c]
cmp dword [edx + 0x30], 0
jne 0x581b0e
mov dword [ebp - 0x188], 0
Function at 0x582243
Capabilities:
Resolve function by parsing pe exports

Disassembly:
aas
inc edx
inc eax
cmp dword [ebp - 0x3cc], 0
jne 0x582215
push eax
push edx
add esp, 4
add eax, 0x98c8
pop eax
push ecx
push ebx
add esp, 4
add ecx, 0xa184
pop ecx
push edx
push ecx
add esp, 4
call 0x5821fd
add byte [ebx + 0x32], cl
aas
xor bh, byte [edi]
aaa
add esp, 4
jmp 0x582205
pop edx
mov dword [ebp - 0x418], 0
jmp 0x582d3d
push ecx
or ecx, 0x1864a
and ecx, 0x13df3
pop ecx
push edi
sub edi, 0x13f8b
or edi, 0x6bfc
add edi, 0x1277f
call 0x582243
add byte [esi], bh
inc edx
cmp dword [eax + 0x43], ecx
cmp dword [esi - 0x7d], eax
les eax, [edi + ebx*2]
mov ecx, dword [ebp - 0x3cc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x1b4], edx
mov dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0xb6c], eax
cmp dword [ebp - 0xb6c], 0
jne 0x582286
mov ecx, dword [ebp - 0x3dc]
mov dword [ebp - 0x23c], ecx
jmp 0x582577
mov edx, dword [ebp - 0xb6c]
mov eax, dword [ebp - 0x1b4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0xb70], eax
jne 0x5822ae
mov ecx, dword [ebp - 0x3dc]
mov dword [ebp - 0x23c], ecx
jmp 0x582577
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0xb70]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xb74], edx
cmp dword [ebp - 0xb74], 0
jne 0x5822e0
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x23c], eax
jmp 0x582577
mov ecx, dword [ebp - 0x1b4]
add ecx, dword [ebp - 0xb74]
mov dword [ebp - 0x3d0], ecx
jne 0x582305
mov edx, dword [ebp - 0x3dc]
mov dword [ebp - 0x23c], edx
jmp 0x582577
mov eax, dword [ebp - 0x3d0]
mov ecx, dword [ebp - 0x1b4]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0xe38], ecx
mov edx, dword [ebp - 0x3d0]
mov eax, dword [ebp - 0x1b4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0xe3c], eax
mov ecx, dword [ebp - 0x3d0]
mov edx, dword [ebp - 0x1b4]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0xe40], edx
mov dword [ebp - 0x3d4], 0
jmp 0x58235f
Function at 0x582923
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push edx
or edx, 0x596a
pop edx
push ecx
call 0x582923
add byte [esi], dh
inc esp
dec esp
cmp eax, 0x4533473b
xor ecx, dword [eax - 0x7d]
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0x254]
mov dword [ebp - 0x188], edx
jmp 0x58299d
push ebx
and ebx, 0xa554
xor ebx, 0x175c2
pop ebx
push ecx
push edi
add esp, 4
and ecx, 0xb499
pop ecx
push edi
push esi
add esp, 4
xor edi, 0x311
and edi, 0x9dcd
xor edi, 0xc9c4
pop edi
mov ecx, dword [ebp - 0x188]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x1b8], edx
push edx
push edx
add esp, 4
and edx, 0x17e46
pop edx
push ebx
sub ebx, 0x9078
xor ebx, 0xe439
sub ebx, 0x1277f
pop ebx
push ebx
push ebx
add esp, 4
and ebx, 0x9bac
xor ebx, 0x93f6
pop ebx
mov dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0xb84], eax
cmp dword [ebp - 0xb84], 0
jne 0x582a40
mov ecx, dword [ebp - 0x3ec]
mov dword [ebp - 0x250], ecx
jmp 0x582d31
mov edx, dword [ebp - 0xb84]
mov eax, dword [ebp - 0x1b8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0xb88], eax
jne 0x582a68
mov ecx, dword [ebp - 0x3ec]
mov dword [ebp - 0x250], ecx
jmp 0x582d31
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0xb88]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xb8c], edx
cmp dword [ebp - 0xb8c], 0
jne 0x582a9a
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x250], eax
jmp 0x582d31
mov ecx, dword [ebp - 0x1b8]
add ecx, dword [ebp - 0xb8c]
mov dword [ebp - 0x3e0], ecx
push dword [ebp + 0x11]
mov eax, dword [ebp - 0x3e0]
mov ecx, dword [ebp - 0x1b8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0xe58], ecx
mov edx, dword [ebp - 0x3e0]
mov eax, dword [ebp - 0x1b8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0xe5c], eax
mov ecx, dword [ebp - 0x3e0]
mov edx, dword [ebp - 0x1b8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0xe60], edx
inc edi
test dword [esp + edi*8], ebx
invalid
inc dword [eax]
add byte [eax], al
add bl, ch
invalid

Function at 0x582963
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edx, 0x95b8
jmp 0x582957
call 0x582963
add byte [esi + 0x43], al
cmp eax, 0x83364940
les eax, [edx + ebx*2]
mov eax, dword [ebp - 0x254]
mov ecx, dword [eax]
mov dword [ebp - 0x254], ecx
mov edx, dword [ebp - 0x254]
cmp edx, dword [ebp - 0x6cc]
je 0x582993
mov eax, dword [ebp - 0x254]
cmp dword [eax + 0x30], 0
jne 0x58275e
mov dword [ebp - 0x188], 0