joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015cf
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov ebx, dword [sym.imp.MSVCRT.dll_wcsncpy]
push edi
mov edi, dword [esp + 0x18]
push 0x100
mov esi, 0x4030e4
push dword [edi]
push esi
call ebx
push 0x4030c0
push esi
call dword [sym.imp.MSVCRT.dll__wstat]
add esp, 0x14
call fcn.00401000
test al, al
jne 0x401668
push 0x4032e4
push esi
jmp loc.00408000
push edi
xor ebp, ebp
push dword [esp + 0x18]
mov word [0x4032e4], bp
call fcn.00401062
pop ecx
test eax, eax
pop ecx
je 0x4016cc
push 0x104
mov esi, 0x4034e4
push 0x4036e4
push esi
call ebx
push str._notepod.exe
push esi
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 0x14
jmp loc.00408723
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x40170f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402088
push 0x401850
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x403cf8], 0xffffffff
or dword [0x403cfc], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x403cf4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x403cf0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x403d00], eax
call fcn.00401841
cmp dword [0x4030b0], 0
jne 0x401792
push 0x40183e
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0040182c
push 0x40300c
push 0x403008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x403cec]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x403ce8]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___wgetmainargs]
push 0x403004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___winitenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.004015cf
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret

Function at 0x43b66c
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
or eax, eax
inc esi
call fcn.0043b6ba
and esi, eax
sub esi, esi
add eax, 0xd55c43ed
xor dword [ecx], ebx
add esi, 0x685a55a5
and esi, eax
inc ecx
add esi, 0x2bd2e1f5
dec eax
cmp ecx, edi
jne fcn.0043b66c
add esi, 0x3e12b517
and eax, esi
sub esi, esi
ret
Function at 0x405c8d
Capabilities:
Get number of processors

Disassembly:
add esp, 4
pop ecx
cmp dword [ebp - 0xc20], 0
jne 0x405b6e
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x4d4], eax
push edi
or edi, 0xfbe4
and edi, 0x8727
pop edi
push eax
add eax, 0x15039
jmp 0x405b97
pop eax
push edi
sub edi, 0x4f4d
out dx, eax
dec ebp
dec edi
add byte [eax], al
jmp 0x405ba5
xor edi, 0x12da1
pop edi
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push ebx
sub ebx, 0xee3c
pop ebx
push esi
push ecx
add esp, 4
sub esi, 0xd087
add esi, 0x14168
pop esi
push ebx
push ecx
add esp, 4
and ebx, 0x17491
sub ebx, 0x9d59
or ebx, 0x7f6e
pop ebx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push ecx
xor ecx, 0x1003a
pop ecx
push esi
call 0x405c7e
add byte [esi + ecx*2 + 0x3d], cl
inc esp
dec esp
dec esp
cmp eax, 0x83474547
les eax, [eax + ebp*8]
pop es
add byte [eax], al
add byte [eax], al
inc ebp
cmp eax, 0x3b43374d
add esp, 4
add esi, 0xfc17
pop esi
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x405cba
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x405d1d
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x405bd9
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x405bd9
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x405d07
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x405d11
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
invalid
cmp dword [ebp - 0x1498], 0
jne 0x405d66
push edi
push edx
add esp, 4
jmp 0x405d33
or edi, 0xd4e8
pop edi
push ebx
push esi
add esp, 4
and ebx, 0x7054
pop ebx
push ecx
push ebx
add esp, 4
and ecx, 0x1050
and ecx, 0x351
pop ecx
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x405dce
push edi
push edi
add esp, 4
jmp 0x405d72
sub edi, 0x952
pop edi
push edx
push edx
add esp, 4
or edx, 0x13827
call 0x405d94
add byte [ebx + 0x49], cl
dec edi
dec ecx
inc esi
inc edx
xor eax, 0xc4834433
add al, 0x5a
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x405dc4
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x405b7a
mov dword [ebp - 0x2e0], 0
Function at 0x405d94
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
add esp, 4
pop ecx
cmp dword [ebp - 0xc20], 0
jne 0x405b6e
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x4d4], eax
push edi
or edi, 0xfbe4
and edi, 0x8727
pop edi
push eax
add eax, 0x15039
jmp 0x405b97
pop eax
push edi
sub edi, 0x4f4d
out dx, eax
dec ebp
dec edi
add byte [eax], al
jmp 0x405ba5
xor edi, 0x12da1
pop edi
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push ebx
sub ebx, 0xee3c
pop ebx
push esi
push ecx
add esp, 4
sub esi, 0xd087
add esi, 0x14168
pop esi
push ebx
push ecx
add esp, 4
and ebx, 0x17491
sub ebx, 0x9d59
or ebx, 0x7f6e
pop ebx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push ecx
xor ecx, 0x1003a
pop ecx
push esi
call 0x405c7e
add byte [esi + ecx*2 + 0x3d], cl
inc esp
dec esp
dec esp
cmp eax, 0x83474547
les eax, [eax + ebp*8]
pop es
add byte [eax], al
add byte [eax], al
inc ebp
cmp eax, 0x3b43374d
add esp, 4
add esi, 0xfc17
pop esi
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x405cba
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x405d1d
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x405bd9
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x405bd9
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x405d07
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x405d11
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
invalid
cmp dword [ebp - 0x1498], 0
jne 0x405d66
push edi
push edx
add esp, 4
jmp 0x405d33
or edi, 0xd4e8
pop edi
push ebx
push esi
add esp, 4
and ebx, 0x7054
pop ebx
push ecx
push ebx
add esp, 4
and ecx, 0x1050
and ecx, 0x351
pop ecx
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x405dce
push edi
push edi
add esp, 4
jmp 0x405d72
sub edi, 0x952
pop edi
push edx
push edx
add esp, 4
or edx, 0x13827
call 0x405d94
add byte [ebx + 0x49], cl
dec edi
dec ecx
inc esi
inc edx
xor eax, 0xc4834433
add al, 0x5a
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x405dc4
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x405b7a
mov dword [ebp - 0x2e0], 0
Function at 0x406a73
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp esi, dword [edi]
or edi, 0xd1d2
add edi, 0x8c63
sub edi, 0x12014
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x18b8], eax
mov ecx, dword [ebp - 0x18b8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18bc], edx
mov eax, dword [ebp - 0x18bc]
mov dword [ebp - 0x14f4], eax
push esi
xor esi, 0xc88e
add esi, 0xc5d4
add esi, 0x172cb
pop esi
push ecx
push ebx
add esp, 4
sub ecx, 0x1df0
and ecx, 0xa9d4
and ecx, 0x1ff2
or ecx, 0x2acf
pop ecx
cmp dword [ebp - 0x14f4], 0
jne 0x4067bc
mov dword [ebp - 0x2e0], 0
jmp 0x406a63
mov ecx, dword [ebp - 0x14f4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc3c], eax
push esi
push edi
add esp, 4
and esi, 0x1588
xor esi, 0x855d
pop esi
push ebx
call 0x4067f0
add byte [eax + 0x3e], dl
dec ebx
cmp dword [ecx + 0x3e], eax
dec esi
cmp al, byte [ecx - 0x7d]
les eax, [ecx + eax*4]
xrelease xchg byte [edx], cl
add byte [ecx + 0xe72af3], al
add byte [ebx - 0x7d], bl
mov ebp, 0xfffff3c4
add byte [ebp + 0xf], dh
mov dword [ebp - 0x2e0], 0
jmp 0x406a63
push esi
call 0x406a73
add byte [eax + 0x43], cl
xor esi, dword [0x44354b3a]
aaa
add esp, 4
xor esi, 0x68ab
add esi, 0x10688
add esi, 0xec9
pop esi
push edi
push ebx
add esp, 4
or edi, 0x17e2d
pop edi
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2fc], ecx
push ebx
push edi
add esp, 4
sub ebx, 0x5eef
sub ebx, 0x12da
sub ebx, 0x10fc7
xor ebx, 0x1652e
pop ebx
push esi
sub esi, 0x115e4
xor esi, 0x1dea
sub esi, 0xcfdb
pop esi
mov dword [ebp - 0x70c], 0
mov edx, dword [ebp - 0x2fc]
mov dword [ebp - 0x1500], edx
cmp dword [ebp - 0x1500], 0
jne 0x406b06
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], eax
jmp 0x406df7
mov ecx, dword [ebp - 0x1500]
mov edx, dword [ebp - 0x2fc]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1504], edx
jne 0x406b2e
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], eax
jmp 0x406df7
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1504]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1508], ecx
cmp dword [ebp - 0x1508], 0
jne 0x406b60
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], edx
jmp 0x406df7
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x1508]
mov dword [ebp - 0x700], eax
jne 0x406b85
mov ecx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], ecx
jmp 0x406df7
mov edx, dword [ebp - 0x700]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x18c0], eax
mov ecx, dword [ebp - 0x700]
mov edx, dword [ebp - 0x2fc]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x18c4], edx
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x18c8], ecx
mov dword [ebp - 0x704], 0
jmp 0x406bdf
mov edx, dword [ebp - 0x704]
add edx, 1
mov dword [ebp - 0x704], edx
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0x704]
cmp ecx, dword [eax + 0x18]
jae 0x406deb
invalid
xchg ebp, eax
Function at 0x407103
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
add esp, 4
call fcn.004070ec
add byte [eax + 0x4f], cl
aaa
dec ecx
inc edi
add esp, 4
pop edi
push ebx
push edi
add esp, 4
call 0x407103
add byte [ebx], bh
dec ebx
dec ebx
aas
inc edx
inc esi
cmp eax, 0x4c48332
xor ebx, 0x15e89
pop ebx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
push edx
add esp, 4
sub ebx, 0x3656
pop ebx
push edx
push eax
add esp, 4
jmp 0x407150
pop edx
push edx
push ebx
add esp, 4
add edx, 0x13be4
or edx, 0x5272
xor edx, 0x12f7e
pop edx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push eax
push edi
add esp, 4
and eax, 0x668e
and eax, 0x10cee
and eax, 0x12d2
sub eax, 0x13b9e
pop eax
push ecx
sub ecx, 0x4053
xor ecx, 0x2637
xor ecx, 0xac
pop ecx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x40720f
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x407269
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x407137
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x407137
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x407253
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x40725d
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x4072b2
push ebx
push eax
add esp, 4
jmp 0x40727d
pop ebx
push ecx
push ecx
add esp, 4
xor ecx, 0x66a1
call 0x407295
add byte [eax], bh
dec ecx
cmp eax, 0xc4834a43
add al, 0xeb
add esi, dword [edi]
xor cl, byte [eax - 0x7f]
jmp 0x40e414
push esi
push eax
add esp, 4
add esi, 0x14b5e
xor esi, 0x3cfb
sub esi, 0xe23c
xor esi, 0xe507
pop esi
push edx
jmp 0x4072d7
xor edx, 0xeb1c
or edx, 0x161d
pop edx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x407310
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x4070db
mov dword [ebp - 0x2a8], 0
dec ebx
dec esp
dec edi
dec ebp
dec eax
test ah, ah
and al, 0xe1
add eax, dword [ebx]
pop esp
push esi
test dh, al
adc ebx, dword [esi + 4]
add eax, dword [esi + esi*8 + 0x3047d38]
pop esi
mov ss, word [eax + 0x202fdd3]
mov ss, word [esp + ecx*4]
cwde
sar ebp, cl
add al, byte [edx]
mov cs, word [eax + 0x202fdd3]
mov bh, bl
cmc
add al, byte [edx]
ja 0x40e45e
mov ss, word [eax + 0x202fdd3]
xchg byte [ebx + esi + 3], bh
adc cl, byte [eax + 0x20200ce]
retf 0x4f88
add byte [edx], al
add al, byte [ebx]
add eax, dword [ebx]
add edx, dword [ebp - 0x7c]
invalid
Function at 0x407295
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
add esp, 4
call fcn.004070ec
add byte [eax + 0x4f], cl
aaa
dec ecx
inc edi
add esp, 4
pop edi
push ebx
push edi
add esp, 4
call 0x407103
add byte [ebx], bh
dec ebx
dec ebx
aas
inc edx
inc esi
cmp eax, 0x4c48332
xor ebx, 0x15e89
pop ebx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
push edx
add esp, 4
sub ebx, 0x3656
pop ebx
push edx
push eax
add esp, 4
jmp 0x407150
pop edx
push edx
push ebx
add esp, 4
add edx, 0x13be4
or edx, 0x5272
xor edx, 0x12f7e
pop edx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push eax
push edi
add esp, 4
and eax, 0x668e
and eax, 0x10cee
and eax, 0x12d2
sub eax, 0x13b9e
pop eax
push ecx
sub ecx, 0x4053
xor ecx, 0x2637
xor ecx, 0xac
pop ecx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x40720f
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x407269
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x407137
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x407137
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x407253
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x40725d
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x4072b2
push ebx
push eax
add esp, 4
jmp 0x40727d
pop ebx
push ecx
push ecx
add esp, 4
xor ecx, 0x66a1
call 0x407295
add byte [eax], bh
dec ecx
cmp eax, 0xc4834a43
add al, 0xeb
add esi, dword [edi]
xor cl, byte [eax - 0x7f]
jmp 0x40e414
push esi
push eax
add esp, 4
add esi, 0x14b5e
xor esi, 0x3cfb
sub esi, 0xe23c
xor esi, 0xe507
pop esi
push edx
jmp 0x4072d7
xor edx, 0xeb1c
or edx, 0x161d
pop edx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x407310
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x4070db
mov dword [ebp - 0x2a8], 0
dec ebx
dec esp
dec edi
dec ebp
dec eax
test ah, ah
and al, 0xe1
add eax, dword [ebx]
pop esp
push esi
test dh, al
adc ebx, dword [esi + 4]
add eax, dword [esi + esi*8 + 0x3047d38]
pop esi
mov ss, word [eax + 0x202fdd3]
mov ss, word [esp + ecx*4]
cwde
sar ebp, cl
add al, byte [edx]
mov cs, word [eax + 0x202fdd3]
mov bh, bl
cmc
add al, byte [edx]
ja 0x40e45e
mov ss, word [eax + 0x202fdd3]
xchg byte [ebx + esi + 3], bh
adc cl, byte [eax + 0x20200ce]
retf 0x4f88
add byte [edx], al
add al, byte [ebx]
add eax, dword [ebx]
add edx, dword [ebp - 0x7c]
invalid
Function at 0x407a8d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop esi
push ebx
or ebx, 0xfef3
pop ebx
push eax
add eax, 0x290b
xor eax, 0x18409
pop eax
push ebx
push ecx
add esp, 4
jmp 0x407ab1
pop ebx
mov eax, dword [ebp - 0x71c]
add eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x188]
movsx eax, byte [ebp + edx - 0x830]
cmp ecx, eax
jne 0x407adf
mov dword [ebp - 0xc5c], 0
jmp 0x407b4e
push eax
jmp 0x407ae7
or eax, 0x8e01
call 0x407afb
add byte [ecx], bh
cmp dword [edx + esi], esi
xor ecx, dword [esp + ecx*2 + 0x34]
add esp, 4
add eax, 0x170af
pop eax
push ebx
push ebx
add esp, 4
xor ebx, 0xa418
pop ebx
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
or edx, 0x20
invalid
invalid
invalid

Function at 0x407afb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop esi
push ebx
or ebx, 0xfef3
pop ebx
push eax
add eax, 0x290b
xor eax, 0x18409
pop eax
push ebx
push ecx
add esp, 4
jmp 0x407ab1
pop ebx
mov eax, dword [ebp - 0x71c]
add eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x188]
movsx eax, byte [ebp + edx - 0x830]
cmp ecx, eax
jne 0x407adf
mov dword [ebp - 0xc5c], 0
jmp 0x407b4e
push eax
jmp 0x407ae7
or eax, 0x8e01
call 0x407afb
add byte [ecx], bh
cmp dword [edx + esi], esi
xor ecx, dword [esp + ecx*2 + 0x34]
add esp, 4
add eax, 0x170af
pop eax
push ebx
push ebx
add esp, 4
xor ebx, 0xa418
pop ebx
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
or edx, 0x20
invalid
invalid
invalid
Function at 0x407d29
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg ecx, eax
pop es
add byte [eax], al
add edi, 0x5f4f
pop edi
push edx
and edx, 0x12e4b
pop edx
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x407c51
push ecx
xor ecx, 0x8d82
or ecx, 0x17ece
and ecx, 0x4462
or ecx, 0xf6aa
pop ecx
push edi
push edi
add esp, 4
or edi, 0x67a0
add edi, 0x11c9d
and edi, 0x1354d
pop edi
mov dword [ebp - 0xa58], 0
jmp 0x40833c
push edx
push ecx
add esp, 4
xor edx, 0x6467
add edx, 0xf717
and edx, 0x44f1
and edx, 0x7c58
pop edx
push ebx
or ebx, 0x3823
pop ebx
push esi
push edx
add esp, 4
or esi, 0x7740
pop esi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18f8], ecx
mov edx, dword [ebp - 0x18f8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18fc], eax
mov ecx, dword [ebp - 0x18fc]
mov dword [ebp - 0x1574], ecx
push eax
or eax, 0x13183
and eax, 0xdd7b
add eax, 0xfb72
sub eax, 0xbbb0
pop eax
push eax
or eax, 0xc09b
pop eax
push edx
or edx, 0x3685
jmp 0x407cdc
pop edx
cmp dword [ebp - 0x1574], 0
jne 0x407cf5
mov dword [ebp - 0x2a8], 0
jmp 0x407f9c
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push esi
xor esi, 0x180de
and esi, 0x3e97
pop esi
push edi
push eax
add esp, 4
call 0x407d29
add byte [edx + 0x4c], al
dec ecx
dec esp
dec ebx
inc eax
push eax
inc edx
cmp eax, 0xeb04c483
add al, 0x50
cmp cl, byte [eax + 0x40]
or edi, 0xde9c
pop edi
cmp dword [ebp - 0xc68], 0
jne 0x407d51
mov dword [ebp - 0x2a8], 0
jmp 0x407f9c
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push esi
sub esi, 0xd99d
add esi, 0x12a59
sub esi, 0xc494
jmp 0x407d79
pop esi
push ebx
call 0x407d8b
add byte [ecx + 0x3b], cl
xor eax, 0x3b453f4c
dec ebx
inc esp
add esp, 4
pop ebx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ebx
xor ebx, 0x87e4
call 0x407dd0
add byte [esi + 0x3c3f3935], dh
inc esp
aas
push esi
push ebx
add esp, 4
Function at 0x407f14
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor eax, 0x30ba
add eax, 0x14bfd
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x407e91
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x407eeb
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x407db9
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x407db9
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x407ed5
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x407edf
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x407f34
push ecx
sub ecx, 0x12c7c
pop ecx
push esi
push ecx
add esp, 4
sub esi, 0x10d02
call 0x407f14
add byte [eax + ecx*2 + 0x34], al
dec edi
dec esp
dec edi
xor eax, 0x8104c483
out 0x4d, al
push ebp
add dword [eax], eax
pop esi
push edx
or edx, 0x10ee0
pop edx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x407f9c
push edi
and edi, 0x4cf
and edi, 0x14a68
call 0x407f4d
add byte [ebx], dh
cmp dword [edi + 0x33], ecx
xor al, 0x40
add esp, 4
jmp 0x407f59
pop edi
push edx
push edx
add esp, 4
and edx, 0x13172
pop edx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x407f92
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x407d5d
mov dword [ebp - 0x2a8], 0

Function at 0x407f4d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor eax, 0x30ba
add eax, 0x14bfd
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x407e91
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x407eeb
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x407db9
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x407db9
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x407ed5
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x407edf
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x407f34
push ecx
sub ecx, 0x12c7c
pop ecx
push esi
push ecx
add esp, 4
sub esi, 0x10d02
call 0x407f14
add byte [eax + ecx*2 + 0x34], al
dec edi
dec esp
dec edi
xor eax, 0x8104c483
out 0x4d, al
push ebp
add dword [eax], eax
pop esi
push edx
or edx, 0x10ee0
pop edx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x407f9c
push edi
and edi, 0x4cf
and edi, 0x14a68
call 0x407f4d
add byte [ebx], dh
cmp dword [edi + 0x33], ecx
xor al, 0x40
add esp, 4
jmp 0x407f59
pop edi
push edx
push edx
add esp, 4
and edx, 0x13172
pop edx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x407f92
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x407d5d
mov dword [ebp - 0x2a8], 0