joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1b670
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
push str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0xc], 0xc0000001
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea edx, [ebp - 0x2c]
push edx
xor edi, edi
push 0x20019
lea eax, [ebp - 8]
lea ecx, [ebp - 0x14]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, edi
jl 0x1b7de
mov edx, dword [ebp - 8]
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQueryKey]
lea ecx, [ebp - 4]
push ecx
push edi
push edi
push 2
push edx
call esi
mov eax, dword [ebp - 4]
add eax, 2
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ebx, eax
mov eax, dword [ebp - 8]
cmp ebx, edi
jne 0x1b70a
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop esi
pop ebx
mov eax, 0xc000009a
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push ebx
push 2
push eax
call esi
mov esi, eax
cmp esi, edi
jge 0x1b739
push edi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x14], edi
jbe 0x1b7c6
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0
push edi
push eax
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov eax, dword [ebp - 4]
add eax, 2
push eax
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov esi, eax
test esi, esi
je 0x1b7b7
mov ecx, dword [ebp - 4]
push ecx
push 0
push esi
call sub.ntoskrnl.exe_memset
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push esi
push 0
push edi
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
jl 0x1b7ae
mov eax, dword [ebp - 8]
push str.ServiceName
lea edx, [esi + 0x10]
push edx
push eax
call fcn.0001b4d0
test eax, eax
jge 0x1b7bf
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
inc edi
cmp edi, dword [ebx + 0x14]
jb 0x1b742
jmp 0x1b7c6
mov dword [ebp - 0xc], 0
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1e7b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1e7ec
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1e7ec
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jbe 0x1e7eb
lea esp, [esp]
movzx edx, byte [ecx]
xor edx, 0x9e
mov dl, byte [edx + 0x20e68]
xor dl, 0x34
mov byte [eax], dl
inc eax
inc ecx
sub esi, 1
jne 0x1e7d0
pop esi
pop ebp
ret 0xc
Function at 0x1e7f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x1e81d
mov edx, dword [ebp + 0xc]
push esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x20a68]
dec ecx
inc edx
test ecx, ecx
jne 0x1e801
pop esi
pop ebp
ret 0xc
Function at 0x26c63
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x30]
je 0x39449

Function at 0x275c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov eax, dword [0x22450]
movsx dx, cl
push edi
setge cl
lea edx, [ecx*2 + 0x4417e232]
mov eax, dword [eax + esi*8 + 4]
lea edx, [ebx + 0x63af3658]
pushal
lea edx, [eax + 1]
push 0x6f60f48b
sets cl
mov cl, byte [eax]
jmp 0x2e33f
push 0x439f6a59
inc eax
jmp 0x3125a
stc
mov byte [esp], dh
test cl, cl
mov byte [esp], bl
pushfd
lea esp, [esp + 0x34]
jne 0x44189
pushfd
sub eax, edx
jmp 0x39764
push ebx
mov dword [ebp - 0x10], eax
call fcn.0001168c

Function at 0x287f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp + 8], edi
push 0xe057fc64
pushfd
jmp 0x3a82a
lea esp, [esp + 0xc]
je 0x39449

Function at 0x2c354
Capabilities:
Execute anti-debugging instructions

Disassembly:
setbe ah
mov ecx, dword [ebp - 0x10]
seta dl
setge dl
setne dh
rdtsc
mov edx, dword [0x22450]
lea eax, [esp - 0x787b8b0b]
mov eax, dword [edx + esi*8 + 4]
pushfd
jmp 0x507e2
push dword [esp]
mov dword [esp + 4], 0
pushal
pushal
push 0x9798f768
pushfd
mov dword [esp + 0x48], eax
pushfd
mov dword [ebp - 8], eax
push dword [esp + 0xc]
jmp 0x30218
lea esp, [esp + 0x50]
call sub.ntoskrnl.exe_memset
jmp 0x3cca8
rdtsc
jmp 0x26d0b
xchg dword [esp], ecx
call fcn.000346f1

Function at 0x2fec6
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x39f18
pushfd
push ecx
lea esp, [esp + 0xc]
je 0x15d7d
pushal
mov dword [esp + 0x1c], ebx
jmp 0x4d5b5

Function at 0x31af7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x40]
je 0x39449
pushal
push dword [esp]
inc ebx
pushfd
add esi, 4
mov dword [esp + 4], 0xbd8ef66c
test ah, bl
cmp ebx, 0x40
call fcn.0003051d
pushal
jmp 0x2e9b8
lea esp, [esp + 8]
ja 0x2fad5
je 0x39449
call fcn.0003de64
mov ch, 0xc5
push esi
lea ecx, [ebx + 0x2d6e2176]
push esi
movzx cx, dl
movsx cx, cl
push 1
mov cx, sp
lea ecx, [eax + 0x17cf3a04]
lea ecx, [ebp - 0x20]
pushal
jmp 0x29848

Function at 0x3250b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x28]
je 0x26ea9
call fcn.0003dec3

Function at 0x34701
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x30]
je 0x262eb
btc dx, 5
mov ecx, dword [esi]
adc dl, 0x29
rcl dh, cl
btr dx, 0xa
mov dword [eax], ecx
das
btc eax, 0x19
not eax
mov edx, dword [esi + 4]
call fcn.00029255

Function at 0x35110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
je 0x2afd0
call fcn.00026585

Function at 0x3749e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], 0x34a18
call fcn.0003bbe3
Function at 0x381c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov edi, dword [ebp + 8]
push 0xd0e2797e
pushal
mov word [esp + 4], 0xe5ae
mov dword [esp + 0x24], edi
pushal
pushfd
lea esp, [esp + 0x48]
call section..text
pushfd
test al, al
pushfd
pushfd
pushal
pushfd
lea esp, [esp + 0x30]
jne 0x3b4c8
btc esi, eax
mov edi, dword [0x223f8]
cmp cl, cl
bt edx, ecx
mov esi, dword [0x223f4]
stc
test edi, edi
jmp fcn.00048d6f
push dword [esp]
lea esp, [esp + 0x2c]
call sub.ntoskrnl.exe_memcpy
shrd ax, sp, 8
aam 0x21
mov eax, dword [0x22428]
cmp bp, 0x583b
test eax, ebx
cmc
cmc
add esp, 0xc
jmp 0x3f589
lea esp, [esp + 0x28]
jne 0x4d5a8
bsf cx, bp
sub eax, edx
not cx
add edi, 0xfffffffe
stc
mov cx, word [edi + 2]
cmp ah, 4
jmp 0x3f342
test cx, cx
pushfd
mov byte [esp], al
lea esp, [esp + 4]
jne 0x2ef27
or si, bp
mov ecx, eax
bsf si, cx
xor si, bx
mov si, 0x9813
bswap si
shr ecx, 2
movzx esi, al
push edx
mov esi, edx
mov word [esp], bp
call fcn.00049b2d
mov dword [esp], 0x9b4d8c66
mov dword [esp + 0x18], 0x500ee
call fcn.000285a7
stc
pushfd
pushal
add eax, 2
mov byte [esp + 0xc], al
jmp 0x44a04
add edi, 2
jg 0x5152b
clc
test cx, cx
pushfd
lea esp, [esp + 4]
jne 0x2ef27
shr si, 5
mov ecx, eax
bsr si, bx
or esi, 0xa492e9ec
shr ecx, 2
movsx si, dl
call fcn.0002e52a
cmc
stc
cmc
test eax, eax
call fcn.00045dce
pushfd
push 0xcedfa45c
lea esp, [esp + 0x2c]
call fcn.0001c330
cmp dl, 0x77
mov dword [0x224b8], eax
test eax, edi
cmp dword [0x223a0], 0
push 0x4209072d
jmp 0x4648c
test cx, cx
jmp 0x2ef11
lea esp, [esp + 4]
je 0x3d7d5
je 0x15c3d
mov edi, dword [ebp + 8]
push 0xef97ef1c
mov byte [esp], al
mov dword [esp], edi
pushfd
call fcn.00028419
shrd cx, bx, 8
mov cx, word [eax]
call fcn.000381c2
push 0xb7f812e5
mov dword [esp + 0x1c], edi
push 0xf162fe16
pushfd
pushfd
mov dword [esp + 0x24], esi
push dword [esp + 4]
jmp 0x2e0d3
jmp 0x2f84a

Function at 0x381d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 2
mov byte [esp + 4], bl
pushal
test cx, cx
pushfd
jmp 0x4d580
lea esp, [esp + 0x2c]
jne 0x2ec15
xadd ch, dl
shld eax, esi, 0x1a
bts cx, 3
lea eax, [ebx + 0x10]
movzx edx, dl
xchg cl, dl
setnp cl
btr dx, 0xf
mov edx, eax

Function at 0x3c858
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
cmc
test eax, eax
pushfd
lea esp, [esp + 0xc]
je 0x3ea5c
call fcn.00028917
lea edx, [eax + 1]
call fcn.0004a239

Function at 0x3c879
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], al
lea esp, [esp + 8]
je 0x26ea9
not cl
rdtsc
setno al
rdtsc
mov ecx, dword [ebp - 0xc]
setge ah
call fcn.00046e3e
push dword [esp + 4]
lea esp, [esp + 0x3c]
call fcn.00016a80
pushal
movsx cx, cl
not cl
mov ecx, dword [ebp - 0x24]
mov word [esp], 0xaba
call fcn.00025416
ror dh, cl
rcr edx, cl
call fcn.00025a15
call fcn.0002ca22
clc
test edi, edi
jmp 0x44b81
jmp 0x32bec
Function at 0x3cd1b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jne 0x3748e
bsr edi, esi
sub eax, edx
pushal
movsx di, al
mov edi, eax
mov word [esp], 0xcf6b
lea esp, [esp + 0x20]
je 0x39fd2
push 0xe08a3246
push ecx
mov esi, edx
lea esi, [edi + 1]
pushal
mov dword [esp + 0x24], esi
call fcn.000421dc

Function at 0x3d8a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 8]
mov word [esp], dx
lea esp, [esp + 0x34]
jl 0x51339
test cl, cl
call fcn.00039588
inc eax
jmp 0x3a919
clc
cmp al, 0xee
test cl, cl
push ecx
lea esp, [esp + 4]
jne 0x3748e
shr di, cl
sub di, 0xe0b6
call fcn.0004d853
pushfd
push dword [esp + 4]
lea esp, [esp + 0x10]
jl 0x2dba2

Function at 0x4155f
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00033685
pushfd
cmp bl, 0x58
mov dword [0x223f8], eax
pushfd
cmp cl, ah
push esp
test eax, eax
pushfd
jmp 0x48a48
push 0x4eb130d
lea esp, [esp + 0x14]
je 0x4f9d4
movsx dx, bl
clc
mov ecx, dword [esi]
push 0x1904ac22
pushal
mov dword [eax], ecx
rcr cl, 7
mov edx, dword [esi + 4]
aas
mov eax, dword [0x223f8]
rcl di, cl
mov dword [eax + 4], edx
test cx, bp
bsr cx, cx
mov ecx, dword [esi + 8]
lea edi, [edx*4 - 0x3c764ae5]
mov edx, dword [0x223f8]
lea ebx, [ebp - 0x3080f1e]
aas
mov dword [edx + 8], ecx
daa
mov ax, word [esi + 0xc]
test ch, ch
neg ch
bt ecx, 0x18
mov ecx, dword [0x223f8]
btc edi, edi
rol bl, 5
xchg dl, bl
mov word [ecx + 0xc], ax
push 0x5b38582f
cwde
clc
mov dl, byte [esi + 0xe]
aaa
mov eax, dword [0x223f8]
sbb si, 0xf25
neg si
cmp ebx, 0xf3636c50
not si
mov byte [eax + 0xe], dl
rdtsc
or esi, 0x12c901e
mov esi, dword [0x223f8]
xor cx, 0x3a62
inc di
mov edi, dword [0x223f4]
setns dl
mov edx, 0xf
cmp bh, 0xaa
mov eax, esi
mov bh, 0x6b
mov ecx, edi
shl bl, 5
shl bx, 5
mov ebx, dword [ecx]
bt eax, edi
push dword [esp + 4]
cmp ebx, dword [eax]
call fcn.0004ec48

Function at 0x42ad7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
mov dword [ebp - 0x10], edi
cmc
cmp eax, edi
push dword [esp]
jmp 0x3860c

Function at 0x42f35
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x28]
je 0x32da5
pushfd
cmp byte [0x224b2], 0
mov byte [esp], cl
mov dword [esp], 0xf84cc01d
mov byte [esp], ch
lea esp, [esp + 4]
jne 0x32da5
call fcn.0002a0fd
or bl, al
mov dword [eax + 4], edx
or dl, 0x14
aam 0x31
mov ecx, dword [esi + 8]
rcr di, cl
mov edx, dword [0x223f8]
sub al, dh
stc
jl 0x3945c
mov dword [edx + 8], ecx
daa
and ch, bh
call fcn.0002a16a
push edi
jmp 0x32e82

Function at 0x43d8d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0x2ebe3
call fcn.000278cc
jmp 0x27a90

Function at 0x45462
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x10
pushal
test bl, 0xdf
push 0x28de11aa
sub eax, 0
mov byte [esp + 4], 0x10
lea esp, [esp + 0x24]
je 0x2ebe3
jmp 0x46786
Function at 0x45602
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 4]
je 0x2c58e
cmp dh, 0x28
cmc
bt cx, ax
bt ebx, esp
test eax, eax
jmp 0x3c54a
mov ecx, dword [ebp - 4]
cmc
test ecx, ecx
pushfd
mov byte [esp], bh
lea esp, [esp + 8]
jl 0x2c005
je 0x2c58e
push edx
test eax, eax
pushal
call fcn.0003e2ff

Function at 0x47275
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
jmp 0x34446
pushal
mov dword [esp + 0x40], ecx
mov byte [esp], 0xef
mov byte [esp], 0x7a
mov word [esp + 8], 0xe67b
jmp 0x3f57a
mov dword [esp + 0x3c], 0x2859a
push eax
pushfd
call fcn.0003c02b
lea ecx, [esi + 1]
jmp 0x2df5d

Function at 0x4a7a3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not di
not di
mov di, si
pushal
mov byte [ebp - 1], 1
call fcn.00036859
shl al, 6
daa
mov dword [edx + 8], ecx
adc ch, al
aam 0x48
shld ax, dx, 0xa
mov ax, word [esi + 0xc]
lea ecx, [ecx*4 + 0x31e1490c]
shr di, 0xa
rcr ecx, cl
shr cx, 3
mov ecx, dword [0x223f8]
bswap bx
pushfd
xor di, si
setb dl
mov word [ecx + 0xc], ax
ror dl, cl
neg ah
movsx cx, al
rcr dl, 5
mov dl, byte [esi + 0xe]
aam 0x34
xchg esi, eax
mov eax, dword [0x223f8]
and di, 0x382
mov byte [eax + 0xe], dl
sar si, cl
xadd si, di
mov esi, dword [0x223f8]
pushfd
mov edi, dword [0x223f4]
add ch, cl
mov edx, 0xf
clc
bsr ebx, edi
mov eax, esi
rcl ebx, cl
test si, 0x4cd9
add cl, bh
xor bx, 0x7f45
mov ecx, edi
or bx, 0x1ff6
not bl
sub bl, 0x48
mov ebx, dword [ecx]
pushal
bt esi, 9
cmp ebx, dword [eax]
pushfd
call fcn.00030418
pushfd
cmp dword [ebp + 8], edi
pushfd
mov byte [esp + 0xc], dl
pushfd
lea esp, [esp + 0x14]
je 0x39449
call fcn.000117c6
mov byte [esp], 0x78
push esp
mov dword [ebp - 8], eax
push ebp
call fcn.00043d52

Function at 0x4ad26
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x24]
je 0x39449
call fcn.00051604

Function at 0x4af38
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x30], edi
call fcn.0003e2cc

Function at 0x4af41
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
je 0x39449
pushfd
pushal
mov word [esp + 4], bp
inc ebx
push dword [esp]
bt sp, 2
bt ebx, ebx
add esi, 4
cmp dh, 0x44
cmp ebx, 0x40
call fcn.000392c3
push dword [esp]
jmp 0x3511f

Function at 0x4ef51
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea eax, [ebp - 0x18]
call fcn.0003f6ad

Function at 0x4f500
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx cx, dl
bswap ecx
mov dword [esp], eax
call fcn.0004955e
not dx
rdtsc
mov edx, dword [ebp - 0x1c]
movzx ax, cl
mov cx, bp
mov dword [esp + 4], edx
rdtsc
cdq
movzx ax, dl
mov eax, dword [ebp + 8]
jmp 0x392ce
Function at 0x50d11
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0001157c
pushal
lea esp, [esp + 0x20]
jg 0x275c2
call fcn.0004bfb6
inc ebx
push dword [esp]
jmp 0x4ed82
mov dword [esp + 0x1c], 0x11420
call fcn.0004a70e
mov bh, 0xdd
push 0x32315e02
pushfd
mov ebx, eax
pushfd
jmp 0x31582
mov dword [esp + 0xc], ebx
pushfd
push dword [esp + 8]
push ebp
lea esp, [esp + 0x18]
jmp 0x2df07
jmp 0x4dd83
mov dword [esp + 0x20], eax
jmp 0x4c69e

Function at 0x5172d
Capabilities:
Complete processing asynchronous io request

Disassembly:
pushfd
mov dword [esp + 8], esi
call fcn.0002f71c
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x479008], 0x8088405
inc edx
mov dword [ebx + 0x479008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d1c0
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d1f1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d1d9
add dl, dl
jne 0x41d1fc
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d24d
xor eax, eax
add dl, dl
jne 0x41d209
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d2ea
add dl, dl
jne 0x41d218
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d223
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d22e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d239
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d243
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d1e8
mov eax, 1
add dl, dl
jne 0x41d25b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d266
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d252
sub eax, ebx
mov ebx, 1
jne 0x41d299
mov ecx, 1
add dl, dl
jne 0x41d27f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d28a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d276
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d1e8
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d2b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d2bb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d2a7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d1e8
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d30b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d1e8
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f31c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x45c80a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f36b
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f38a
mov ecx, edx
add ecx, ebx
jmp 0x41f38a
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f38a
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f3fc
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f3e5
test esi, esi
jbe 0x41f3fc
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f3d7
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f3fc
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f3b4
jmp 0x41f3fc
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f3fc
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c811
ret
Function at 0x420568
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x45db83
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4205a3
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4205bc
lea eax, [ebp - 0x10]
mov edx, dword [0x47b5f0]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4205cf
lea eax, [ebp - 0x10]
mov edx, dword [0x47b5f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4205db
adc edx, 0
mov edx, dword [edx*4 + 0x47a3fc]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420755
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420748
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420748
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420748
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420748
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x4206e6
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x4206e6
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4206e6
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4206e6
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420748
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420748
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420748
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420748
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420748
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x42076d
inc ebx
cmp ebx, 0x19
jne 0x420595
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45db8a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret