joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409367
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x409388
jl 0x40937f
test edi, edi
jne 0x409388
xor eax, eax
xor edx, edx
jmp 0x409449
cmp dword [ebx + 0x38], 0
je 0x40939d
push eax
push edi
push dword [ebp + 8]
call fcn.0040944f
jmp 0x409449
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4093e4
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x4093e4
cmp eax, edi
jb 0x4093be
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0040ad10
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x4093ea
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40943e
mov ecx, ebx
call fcn.00408bb9
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x409429
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00412a18
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40943e
jmp 0x4093fc
test edx, edx
je 0x40943e
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00412a18
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40a954
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40a993
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40a993
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40a993
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40a993
cmp dword [ecx + 0x74], 0xe
jbe 0x40a993
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x418cfa
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42b618
push 0x42b610
push str.FlsAlloc
push 0x1e
call fcn.00418b67
mov esi, eax
add esp, 0x10
test esi, esi
je 0x418d2e
push dword [ebp + 8]
mov ecx, esi
call dword [0x42716c]
call esi
jmp 0x418d34
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x418d78
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42b628
push 0x42b620
push str.FlsGetValue
push 0x20
call fcn.00418b67
mov esi, eax
add esp, 0x10
test esi, esi
je 0x418daf
push dword [ebp + 8]
mov ecx, esi
call dword [0x42716c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x41c32c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041c19d

Function at 0x41c726
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040acc0
mov eax, dword [0x484300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041a21e
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41c768
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41c8c4
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00425f30
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x486900]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041d4c5
mov ecx, dword [esi*4 + 0x486900]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41c8bd
cmp eax, dword [edi + ecx + 0x24]
jne 0x41c8bd
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c8bd
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041d4c5
add esp, 0x14
test edx, edx
jl 0x41c8bd
jg 0x41c833
test eax, eax
jb 0x41c8bd
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41c8bd
jl 0x41c84d
cmp dword [ebp - 0x1008], eax
ja 0x41c8bd
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41c86b
test ebx, ebx
je 0x41c8a4
cmp ecx, edi
jae 0x41c8a4
mov al, byte [ecx]
cmp al, 0xd
jne 0x41c885
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41c891
cmp byte [ecx + 1], 0xa
jne 0x41c891
inc ecx
jmp 0x41c891
movzx eax, al
movsx eax, byte [eax + 0x4845c8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41c86b
cmp edx, ebx
jne 0x41c86b
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41c8c2
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040a1ba
leave
ret
Function at 0x41c963
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x486900]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41c9a3
cmp byte [ebx], 0xa
jne 0x41c9a3
or byte [eax + edi + 0x28], 4
jmp 0x41c9a8
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41caa6
mov al, byte [edx]
cmp al, 0x1a
je 0x41ca88
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41c9d7
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41c9fc
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41ca06
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41c9b9
jmp 0x41caa6
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41ca83
cmp dword [ebp - 0xc], 0
je 0x41ca83
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x486900]
test byte [eax + edi + 0x28], 0x48
je 0x41ca5d
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41ca48
mov byte [esi], dl
jmp 0x41ca59
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x486900]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41caa6
cmp byte [ebp - 1], 0xa
jne 0x41ca6c
cmp esi, ebx
jne 0x41ca6c
mov byte [esi], 0xa
jmp 0x41caa5
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041d4e3
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41caa6
mov byte [esi], 0xd
jmp 0x41caa5
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x486900]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41caa2
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41caa6
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41caaf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x486900]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41caf2
cmp word [esi], dx
jne 0x41caf2
or byte [edi + eax + 0x28], 4
jmp 0x41caf7
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41cc4a
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41cc2a
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41cb39
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41cb6f
cmp eax, edx
jae 0x41cb7b
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41cb11
jmp 0x41cc4a
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41cc26
cmp dword [ebp - 0x14], 0
je 0x41cc26
mov eax, dword [ebx*4 + 0x486900]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41cbfe
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41cbc7
mov word [esi], cx
jmp 0x41cbfa
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x486900]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x486900]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x486900]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41cc4a
pop ebx
cmp word [ebp - 4], bx
jne 0x41cc0f
cmp esi, dword [ebp + 0xc]
jne 0x41cc0f
mov word [esi], bx
jmp 0x41cc47
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041d4e3
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41cc4a
push 0xd
jmp 0x41cc43
mov ecx, dword [ebx*4 + 0x486900]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41cc41
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41cc4a
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41eaaa
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41eb47
push ebx
push esi
call fcn.0041ea73
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041d6f8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41eaf4
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41eb46
push edi
push eax
call fcn.0041932d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41eb14
call fcn.00418586
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41eb45
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041d6f8
add esp, 0x20
test eax, eax
jne 0x41eb33
push edi
call fcn.00418586
jmp 0x41eb3b
push ebx
call fcn.00418586
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x425d30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x425d5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x425d5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x455008], 0x8088405
inc edx
mov dword [ebx + 0x455008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f05c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x43954a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ab
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
jmp 0x41f0ca
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f13c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f125
test esi, esi
jbe 0x41f13c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f117
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f13c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0f4
jmp 0x41f13c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f13c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439551
ret
Function at 0x420294
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x43a8af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202cf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202e8
lea eax, [ebp - 0x10]
mov edx, dword [0x45754c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202fb
lea eax, [ebp - 0x10]
mov edx, dword [0x45754c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x420307
adc edx, 0
mov edx, dword [edx*4 + 0x456378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420481
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420474
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420474
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420412
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420412
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420412
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420412
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420474
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420474
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420499
inc ebx
cmp ebx, 0x19
jne 0x4202c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a8b6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x422efd
Capabilities:
Encode data using xor

Disassembly:
inc ebp
mov eax, dword [ebp - 0x7f]
invalid
popfd
imul esp
push ss
mov dl, 0x32
je 0x422eb0
retf 0xffd2
stosb byte es:[edi], al
push es
mov al, byte [0x5ac011a7]
xchg ebp, eax
add byte [eax], al
clc
cmp dword [edi - 0x6c41fcb], ebp
jne 0x422f27
pop edi
js 0x422f74
call 0x2b5845
lea ecx, [esp + ecx*8 - 0x2e]
mov dh, 0xe2
sub dword [edi], eax
je 0x422edf
int3
pop ebx
sbb eax, 0x1d38833c
cmp dword [eax], 0x1d
aad 0x21
mov byte [ebx + edx*2], bh
push esi
push cs
xchg ebp, eax
xor eax, 0xd9b2567b
cvtdq2ps xmm1, xmmword [edi]
out dx, al
invalid
cdq
insd dword es:[edi], dx
mov dword [0x9f2b84f9], eax
and byte [esi - 0x48c6b7bb], al
pop edi
movsb byte es:[edi], byte ds:[esi]
mov byte [0x7cece196], al
cdq
xchg byte [ebp + 0x48], al
cmp dword [edi - 0x5d5bc1a1], esi
xchg esi, eax
loope 0x422f6c
jl 0x422f1b
sbb al, 0xac
invalid

Function at 0x426e03
Capabilities:
Parse pe header

Disassembly:
xor ebp, dword [ebx - 0x31a5b21e]
or byte [edx - 0x70], 0xe9
in eax, dx
div byte [edi]
test bl, bh
sub ebp, dword [edx]
jecxz 0x426e6c
fisttp dword [ecx - 0x32fd9f75]
test al, 2
rol ebx, cl
mov ecx, 0x4331acfb
cdq
pop edi
frstor dword [ecx]
out 0x5c, al
add byte [edx + 4], bl
pop edx
add al, 0x5a
pop edx
add al, 0x5a
sub esp, 0x14
fcomp dword [edx]
pop ss
xlatb
fmul st(7), st(0)
pop ecx
cmp al, 2
or esp, ebx
movsd dword es:[edi], dword [esi]
aam 0xb3
leave
salc
mov eax, 0x28fcafa1
arpl word [eax + 0x15], ax
mov dword [eax], ebx
loope 0x426e78
jle 0x426e29
insd dword es:[edi], dx
rol byte [eax], 1
jnp 0xb901d75
add byte [edi], cl
mov eax, dword [ebp - 0x51]
dec ebp
or edi, dword [edx + 0x6b]
jp 0x426e9d
add dh, ch
salc
xchg byte [edx - 0x51], al
cmp al, 0xdb
sbb al, 0x89
adc ah, bl
lodsd eax, dword [esi]
mov cl, 0x34
stosd dword es:[edi], eax
fistp dword [ebx + 0x1f061cfc]
js 0x426dda
jge 0x426eb3
imul edx, edx, 0x3900fba1
mov esi, 0xff11f83f
pop ecx
inc ecx
enter 0x31c, 0xffffffffffffffca
jecxz 0x426e7c
insd dword es:[edi], dx
dec ecx
jo 0x426e17
xchg edi, eax
xor dword [ebp + edi*4 + 0x1878564], ecx
xor bh, byte [edi + 0x61]
jg 0x426ecf
int 0x1a
pushal
les esp, [edx]
ja 0x426e58
and dh, byte [edi - 0x1e]
call 0x5066f945
mov ah, byte [eax + edx*2]
and al, 0x50
push es
jne 0x426e79
and al, 0xcc
fisttp dword [eax - 0x3f]
add dl, al
leave
in al, 3
push cs
mov eax, dword [0x4e835825]
inc edi
jge 0x426e9d
int3
inc esp
and al, 0xc5
and esi, dword [ebp + 0x14]
int3
mov edi, ecx
sub ah, ch
push edx
cmp ecx, dword [edx - 0x6a]
sbb eax, 0x7f7f067f
inc esp
and al, 0x45
mov dh, 0xed
jl 0x426e73
lahf
and al, 0x4d
adc al, 0xed
out dx, eax
push eax
nop
xchg esi, eax
lodsd eax, dword [esi]
inc ecx
adc byte [di - 0xf2a], ch
popal
out dx, eax
jmp 0x7ae9150d
Function at 0x461ab8
Capabilities:
Encode data using xor

Disassembly:
retf
or ecx, dword [ecx - 0x31]
call 0x7c5aee3d
jns 0x46196a
out dx, al
add byte [ebx - 0x2db52bd], cl
popfd
add ecx, dword [ecx - 0x547a4192]
add byte [ebx], al
clc
add eax, 0xe000000
salc
sbb byte [esi], bh
pop eax
push 0xa3ec8b46
adc edx, dword [ebp + 0x5b]
test eax, 0xc3061b42
dec ebp
enter 0xffffffffffff8b8d, 0xffffffffffffff8f
je 0x4619d0
mov bl, 0
mov word [ebp + 0x5a], ss
test eax, 0xce17dbf8
jbe 0x461a58
ljmp 0xef42:0x8b1e0f3b
sub dh, byte [edx - 0x6f941473]
cdq
mov ah, 0xfb
push ebp
mov eax, dword [0x10bd28e3]
out 0x81, eax
clc
cmp dword [ebx - 0x74ed8919], ebx
jno 0x461a3f
ficomp dword [esi]
push ebp
mov ecx, 0x9f8b7f93
fiadd dword [0x1c689ef7]
dec edx
sbb al, 0x4a
xor edi, dword [ebp - 0x35]
jb 0x461a7f
int1
push eax
push 0xd6d73def
imul edi, dword [edx - 0x1c], 0x8b04423f
enter 0xffffffffffffe471, 0xffffffffffffffa0
hlt
das
or eax, 0xbe4c683a
and dword [edi + 0x6c], 0x91c4cb08
mov ah, 0xe8
jno 0x461a4a
clc
jb 0x461ae2
sbb dword [esi], 0x85082b0
pop es
ljmp 0x50ee
retf 0xb088

Function at 0x462d36
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x6a
lodsb al, byte [esi]
int1
invalid
lea ecx, [ebx + 0x37]
aaa
pop ss
add dh, al
add byte [esi + eax + 1], bh
add byte [eax + 0x3f87b3], bh
xor eax, 0x13760872
add cl, byte [ebp + 0x37]
dec ebx
push edx
in al, dx
sub ah, al
insd dword es:[edi], dx
lodsb al, byte [esi]
je 0x462d34
test eax, 0x857d7ecd
aas
in eax, 0xda
clc
inc ecx
ja 0x462d00
arpl word [edx], bx
outsd dx, dword [esi]
jb 0x462d5d
popal
out dx, eax
pop esi
cmp byte [eax - 0x5c25169], ah
std
inc dword [ebp - 0x6b83d062]
xor dword [ebp + 0x59], 0
and ch, byte [ebx - 0x54]
jnp 0x462df2
mov edx, 0xbf831383
jno 0x462dfd
iretd
int1
mov al, byte [0x93588547]
test dword [eax - 0x6d], ebx
jge 0x462e36
inc esi
call 0xb55bf4d0
movsb byte es:[edi], byte [esi]
inc eax
stc
stosb byte es:[edi], al
loope 0x462def
push cs
mov eax, dword [0x248763c8]
lodsb al, byte [esi]
test eax, 0x894cc6dc
jbe 0x462e20
fldenv [ebp + 0x784e5d9]
push es
cmp eax, 0xa92b63f4
xchg ebx, esi
in eax, 0x1c
sub eax, 0x33c84572
movsd dword es:[edi], dword [esi]
dec edi
sbb al, 0x2d
jb 0x462e69
enter 0xffffffffffffa533, 0x4f
enter 0xffffffffffffe0a5, 0x22
out dx, al
push es
ret
sti
add edi, eax
xchg ebp, eax
mov al, ch
inc eax
pop dword [edx]
inc edi
lodsd eax, dword [esi]
xor byte [ebp + 0x662fbbf], bh
loope 0x462e54
inc ecx
or byte [ecx + 0xc00f838], cl
add bl, ch
les ebx, [ebp - 0x66db897f]
mov esi, ecx
or eax, dword [eax + eax]
xor dword [esi + 0x24], 0xbce8999
add al, 0
loopne 0x462e3a
test eax, 0x13bce530
pushal
mov eax, dword gs:[ebx - 0x46]
js 0x462e39
dec ecx
add esp, 0x9ba324d
imul byte [ebx]
push edx
hlt