joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a6b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ecx, 0x4298
pop ecx
cmp dword [ebp - 0xcd0], 0
jne 0x42a591
mov dword [ebp - 0x774], 0
jmp 0x42a7dc
mov edx, dword [ebp - 0xcd0]
mov dword [ebp - 0x518], edx
push edx
xor edx, 0x15d75
pop edx
push esi
and esi, 0x16f57
jmp 0x42a5b1
add esi, 0x1155f
jmp 0x42a5c0
pop esi
push ecx
and ecx, 0x10048
and ecx, 0xb4e8
pop ecx
lea eax, [ebp - 0x1790]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push esi
push edi
add esp, 4
or esi, 0xaec5
sub esi, 0x12cf4
or esi, 0x1949
pop esi
push ebx
sub ebx, 0x17015
sub ebx, 0x181c3
pop ebx
push edx
push eax
add esp, 4
add edx, 0xb7ca
pop edx
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push esi
jmp 0x42a68b
sub esi, 0x10b44
call 0x42a6a1
add byte [edx + edi], dh
cmp eax, 0x50403c33
aaa
inc esp
add esp, 4
call 0x42a6b0
add byte [ebx + esi + 0x40], al
cmp byte [0x4c48347], dh
pop esi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x42a6d1
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1668], edx
jmp 0x42a72b
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x42a5f9
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x42a5f9
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x42a715
mov dword [ebp - 0x1624], 0xffffffff
jmp 0x42a71f
mov dword [ebp - 0x1624], 1
mov ecx, dword [ebp - 0x1624]
mov dword [ebp - 0x1668], ecx
cmp dword [ebp - 0x1668], 0
jne 0x42a774
push edi
sub edi, 0x7bb2
sub edi, 0x13b6d
add edi, 0x126bd
and edi, 0x297b
pop edi
push eax
push edx
add esp, 4
add eax, 0x39be
xor eax, 0x46c6
add eax, 0x125fb
pop eax
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x42a7dc
push ecx
add ecx, 0x1f4f
pop ecx
push edi
push edx
add esp, 4
sub edi, 0xf92e
pop edi
push eax
push eax
add esp, 4
sub eax, 0x5e85
and eax, 0xd789
add eax, 0x255d
xor eax, 0x5bda
pop eax
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x42a7d2
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x42a59d
mov dword [ebp - 0x774], 0
Function at 0x42ae11
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
add esp, 4
jmp 0x42adae
sub eax, 0x217
add eax, 0x8d26
jmp 0x42adc0
pop eax
push ebx
push ebx
add esp, 4
or ebx, 0xc043
and ebx, 0xbf72
pop ebx
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ecx
push esi
add esp, 4
call 0x42ae11
add byte [ecx + ecx*2], bh
inc ebx
aaa
xor edi, dword [ebx]
inc ebx
cmp al, 0x4a
add esp, 4
pop ecx
push edx
and edx, 0x6ba8
or edx, 0x70e9
and edx, 0x819c
or edx, 0xeaa0
pop edx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push esi
or esi, 0x4067
call 0x42ae9d
add byte [edx + 0x36], al
inc edi
push eax
dec ebx
aaa
dec eax
cmp bh, byte [esi + eax*2]
add esp, 4
pop esi
push edi
jmp 0x42aeab
pop edi
push edi
push edx
add esp, 4
sub edi, 0xe43
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x42aed5
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x42af2f
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x42adfd
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x42adfd
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x42af19
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x42af23
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x42af78
push esi
or esi, 0x15756
and esi, 0xd1bd
or esi, 0x2cc5
sub esi, 0x136a5
pop esi
push esi
push edi
add esp, 4
xor esi, 0x15824
or esi, 0x15970
add esi, 0xf380
pop esi
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x42afe0
push ebx
sub ebx, 0xd726
call 0x42af8f
add byte [0x3d38494a], bh
cmp dword [esi + esi], esi
dec ebp
dec esp
add esp, 4
and ebx, 0xf98a
jmp 0x42af9d
pop ebx
push edi
push ecx
add esp, 4
or edi, 0x11b26
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x42afd6
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x42ada1
mov dword [ebp - 0x2fc], 0
push edi
jmp 0x42afe6
jmp 0x42afee
add edi, 0x105c6
and edi, 0x1640b
pop edi
push ecx
call 0x42b008
add byte [ecx + 0x41], al
cmp eax, dword [ebx + 0x45]
inc ecx
add esp, 4
xor ecx, 0xe1c3
pop ecx
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push ecx
or ecx, 0xf3da
call 0x42b034
add byte [ecx + 0x4e], al
Function at 0x42ae9d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
add esp, 4
jmp 0x42adae
sub eax, 0x217
add eax, 0x8d26
jmp 0x42adc0
pop eax
push ebx
push ebx
add esp, 4
or ebx, 0xc043
and ebx, 0xbf72
pop ebx
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ecx
push esi
add esp, 4
call 0x42ae11
add byte [ecx + ecx*2], bh
inc ebx
aaa
xor edi, dword [ebx]
inc ebx
cmp al, 0x4a
add esp, 4
pop ecx
push edx
and edx, 0x6ba8
or edx, 0x70e9
and edx, 0x819c
or edx, 0xeaa0
pop edx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push esi
or esi, 0x4067
call 0x42ae9d
add byte [edx + 0x36], al
inc edi
push eax
dec ebx
aaa
dec eax
cmp bh, byte [esi + eax*2]
add esp, 4
pop esi
push edi
jmp 0x42aeab
pop edi
push edi
push edx
add esp, 4
sub edi, 0xe43
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x42aed5
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x42af2f
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x42adfd
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x42adfd
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x42af19
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x42af23
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x42af78
push esi
or esi, 0x15756
and esi, 0xd1bd
or esi, 0x2cc5
sub esi, 0x136a5
pop esi
push esi
push edi
add esp, 4
xor esi, 0x15824
or esi, 0x15970
add esi, 0xf380
pop esi
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x42afe0
push ebx
sub ebx, 0xd726
call 0x42af8f
add byte [0x3d38494a], bh
cmp dword [esi + esi], esi
dec ebp
dec esp
add esp, 4
and ebx, 0xf98a
jmp 0x42af9d
pop ebx
push edi
push ecx
add esp, 4
or edi, 0x11b26
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x42afd6
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x42ada1
mov dword [ebp - 0x2fc], 0
push edi
jmp 0x42afe6
jmp 0x42afee
add edi, 0x105c6
and edi, 0x1640b
pop edi
push ecx
call 0x42b008
add byte [ecx + 0x41], al
cmp eax, dword [ebx + 0x45]
inc ecx
add esp, 4
xor ecx, 0xe1c3
pop ecx
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push ecx
or ecx, 0xf3da
call 0x42b034
add byte [ecx + 0x4e], al
Function at 0x42af8f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
add esp, 4
jmp 0x42adae
sub eax, 0x217
add eax, 0x8d26
jmp 0x42adc0
pop eax
push ebx
push ebx
add esp, 4
or ebx, 0xc043
and ebx, 0xbf72
pop ebx
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ecx
push esi
add esp, 4
call 0x42ae11
add byte [ecx + ecx*2], bh
inc ebx
aaa
xor edi, dword [ebx]
inc ebx
cmp al, 0x4a
add esp, 4
pop ecx
push edx
and edx, 0x6ba8
or edx, 0x70e9
and edx, 0x819c
or edx, 0xeaa0
pop edx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push esi
or esi, 0x4067
call 0x42ae9d
add byte [edx + 0x36], al
inc edi
push eax
dec ebx
aaa
dec eax
cmp bh, byte [esi + eax*2]
add esp, 4
pop esi
push edi
jmp 0x42aeab
pop edi
push edi
push edx
add esp, 4
sub edi, 0xe43
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x42aed5
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x42af2f
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x42adfd
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x42adfd
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x42af19
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x42af23
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x42af78
push esi
or esi, 0x15756
and esi, 0xd1bd
or esi, 0x2cc5
sub esi, 0x136a5
pop esi
push esi
push edi
add esp, 4
xor esi, 0x15824
or esi, 0x15970
add esi, 0xf380
pop esi
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x42afe0
push ebx
sub ebx, 0xd726
call 0x42af8f
add byte [0x3d38494a], bh
cmp dword [esi + esi], esi
dec ebp
dec esp
add esp, 4
and ebx, 0xf98a
jmp 0x42af9d
pop ebx
push edi
push ecx
add esp, 4
or edi, 0x11b26
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x42afd6
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x42ada1
mov dword [ebp - 0x2fc], 0
push edi
jmp 0x42afe6
jmp 0x42afee
add edi, 0x105c6
and edi, 0x1640b
pop edi
push ecx
call 0x42b008
add byte [ecx + 0x41], al
cmp eax, dword [ebx + 0x45]
inc ecx
add esp, 4
xor ecx, 0xe1c3
pop ecx
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push ecx
or ecx, 0xf3da
call 0x42b034
add byte [ecx + 0x4e], al
Function at 0x42afa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
add esp, 4
jmp 0x42adae
sub eax, 0x217
add eax, 0x8d26
jmp 0x42adc0
pop eax
push ebx
push ebx
add esp, 4
or ebx, 0xc043
and ebx, 0xbf72
pop ebx
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ecx
push esi
add esp, 4
call 0x42ae11
add byte [ecx + ecx*2], bh
inc ebx
aaa
xor edi, dword [ebx]
inc ebx
cmp al, 0x4a
add esp, 4
pop ecx
push edx
and edx, 0x6ba8
or edx, 0x70e9
and edx, 0x819c
or edx, 0xeaa0
pop edx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push esi
or esi, 0x4067
call 0x42ae9d
add byte [edx + 0x36], al
inc edi
push eax
dec ebx
aaa
dec eax
cmp bh, byte [esi + eax*2]
add esp, 4
pop esi
push edi
jmp 0x42aeab
pop edi
push edi
push edx
add esp, 4
sub edi, 0xe43
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x42aed5
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x42af2f
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x42adfd
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x42adfd
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x42af19
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x42af23
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x42af78
push esi
or esi, 0x15756
and esi, 0xd1bd
or esi, 0x2cc5
sub esi, 0x136a5
pop esi
push esi
push edi
add esp, 4
xor esi, 0x15824
or esi, 0x15970
add esi, 0xf380
pop esi
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x42afe0
push ebx
sub ebx, 0xd726
call 0x42af8f
add byte [0x3d38494a], bh
cmp dword [esi + esi], esi
dec ebp
dec esp
add esp, 4
and ebx, 0xf98a
jmp 0x42af9d
pop ebx
push edi
push ecx
add esp, 4
or edi, 0x11b26
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x42afd6
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x42ada1
mov dword [ebp - 0x2fc], 0
push edi
jmp 0x42afe6
jmp 0x42afee
add edi, 0x105c6
and edi, 0x1640b
pop edi
push ecx
call 0x42b008
add byte [ecx + 0x41], al
cmp eax, dword [ebx + 0x45]
inc ecx
add esp, 4
xor ecx, 0xe1c3
pop ecx
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push ecx
or ecx, 0xf3da
call 0x42b034
add byte [ecx + 0x4e], al
Function at 0x42b008
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
add esp, 4
jmp 0x42adae
sub eax, 0x217
add eax, 0x8d26
jmp 0x42adc0
pop eax
push ebx
push ebx
add esp, 4
or ebx, 0xc043
and ebx, 0xbf72
pop ebx
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ecx
push esi
add esp, 4
call 0x42ae11
add byte [ecx + ecx*2], bh
inc ebx
aaa
xor edi, dword [ebx]
inc ebx
cmp al, 0x4a
add esp, 4
pop ecx
push edx
and edx, 0x6ba8
or edx, 0x70e9
and edx, 0x819c
or edx, 0xeaa0
pop edx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push esi
or esi, 0x4067
call 0x42ae9d
add byte [edx + 0x36], al
inc edi
push eax
dec ebx
aaa
dec eax
cmp bh, byte [esi + eax*2]
add esp, 4
pop esi
push edi
jmp 0x42aeab
pop edi
push edi
push edx
add esp, 4
sub edi, 0xe43
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x42aed5
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x42af2f
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x42adfd
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x42adfd
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x42af19
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x42af23
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x42af78
push esi
or esi, 0x15756
and esi, 0xd1bd
or esi, 0x2cc5
sub esi, 0x136a5
pop esi
push esi
push edi
add esp, 4
xor esi, 0x15824
or esi, 0x15970
add esi, 0xf380
pop esi
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x42afe0
push ebx
sub ebx, 0xd726
call 0x42af8f
add byte [0x3d38494a], bh
cmp dword [esi + esi], esi
dec ebp
dec esp
add esp, 4
and ebx, 0xf98a
jmp 0x42af9d
pop ebx
push edi
push ecx
add esp, 4
or edi, 0x11b26
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x42afd6
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x42ada1
mov dword [ebp - 0x2fc], 0
push edi
jmp 0x42afe6
jmp 0x42afee
add edi, 0x105c6
and edi, 0x1640b
pop edi
push ecx
call 0x42b008
add byte [ecx + 0x41], al
cmp eax, dword [ebx + 0x45]
inc ecx
add esp, 4
xor ecx, 0xe1c3
pop ecx
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push ecx
or ecx, 0xf3da
call 0x42b034
add byte [ecx + 0x4e], al
Function at 0x42b030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc esp
inc eax
dec esp
dec ebx
add esp, 4
call 0x42b047
add byte [ebx], dh
xor al, 0x33
push eax
dec esi
dec ebp
xor al, 0x43
add esp, 4
pop ecx
push edx
add edx, 0xb14e
pop edx
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 0
jne 0x42b083
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x42b374
mov edx, dword [ebp - 0x1688]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x3c]
inc edx
cmp al, 0x89
test dword [ecx + ebp*8 - 1], esi
push dword [ebp + 0x11]
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x42b374
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x168c]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1690], edx
cmp dword [ebp - 0x1690], 0
jne 0x42b0dd
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x520], eax
jmp 0x42b374
mov ecx, dword [ebp - 0x338]
add ecx, dword [ebp - 0x1690]
mov dword [ebp - 0x788], ecx
jne 0x42b102
mov edx, dword [ebp - 0x794]
mov dword [ebp - 0x520], edx
jmp 0x42b374
mov eax, dword [ebp - 0x788]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19c4], ecx
mov edx, dword [ebp - 0x788]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19c8], eax
mov ecx, dword [ebp - 0x788]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19cc], edx
mov dword [ebp - 0x78c], 0
jmp 0x42b15c
mov ecx, dword [ebp - 0x788]
mov edx, dword [ebp - 0x78c]
cmp edx, dword [ecx + 0x18]
jae 0x42b368
mov eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x19c4]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x790], edx
mov eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x19c8]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19cc]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19d0], ecx
mov dword [ebp - 0x1a4], 0
jmp 0x42b1cc
mov eax, dword [ebp - 0x790]
add eax, dword [ebp - 0x1a4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x42b27e
mov edx, dword [ebp - 0x1a4]
movsx eax, byte [ebp + edx - 0x9d4]
test eax, eax
je 0x42b27e
push edi
call 0x42b209
add byte [esi + 0x39], al
cmp eax, 0x4a354742
inc ebx
inc eax
add esp, 4
pop edi
push eax
push ebx
add esp, 4
jmp 0x42b21b
call 0x42b227
add byte [edi], dh
cmp edi, dword [0x833a494f]
les eax, [eax + ebx*2]
invalid
lea esi, [eax - 8]
invalid
Function at 0x42b034
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc esp
inc eax
dec esp
dec ebx
add esp, 4
call 0x42b047
add byte [ebx], dh
xor al, 0x33
push eax
dec esi
dec ebp
xor al, 0x43
add esp, 4
pop ecx
push edx
add edx, 0xb14e
pop edx
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 0
jne 0x42b083
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x42b374
mov edx, dword [ebp - 0x1688]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x3c]
inc edx
cmp al, 0x89
test dword [ecx + ebp*8 - 1], esi
push dword [ebp + 0x11]
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x42b374
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x168c]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1690], edx
cmp dword [ebp - 0x1690], 0
jne 0x42b0dd
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x520], eax
jmp 0x42b374
mov ecx, dword [ebp - 0x338]
add ecx, dword [ebp - 0x1690]
mov dword [ebp - 0x788], ecx
jne 0x42b102
mov edx, dword [ebp - 0x794]
mov dword [ebp - 0x520], edx
jmp 0x42b374
mov eax, dword [ebp - 0x788]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19c4], ecx
mov edx, dword [ebp - 0x788]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19c8], eax
mov ecx, dword [ebp - 0x788]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19cc], edx
mov dword [ebp - 0x78c], 0
jmp 0x42b15c
mov ecx, dword [ebp - 0x788]
mov edx, dword [ebp - 0x78c]
cmp edx, dword [ecx + 0x18]
jae 0x42b368
mov eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x19c4]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x790], edx
mov eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x19c8]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19cc]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19d0], ecx
mov dword [ebp - 0x1a4], 0
jmp 0x42b1cc
mov eax, dword [ebp - 0x790]
add eax, dword [ebp - 0x1a4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x42b27e
mov edx, dword [ebp - 0x1a4]
movsx eax, byte [ebp + edx - 0x9d4]
test eax, eax
je 0x42b27e
push edi
call 0x42b209
add byte [esi + 0x39], al
cmp eax, 0x4a354742
inc ebx
inc eax
add esp, 4
pop edi
push eax
push ebx
add esp, 4
jmp 0x42b21b
call 0x42b227
add byte [edi], dh
cmp edi, dword [0x833a494f]
les eax, [eax + ebx*2]
invalid
lea esi, [eax - 8]
invalid