joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fbce8
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404954
xor eax, eax
push ebp
push 0x4fbe90
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 4]
call fcn.004fc028
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
call fcn.0040452c
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov byte [ebp - 9], 0
cmp dword [ebp - 4], 0
je 0x4fbe60
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 4]
call fcn.004049bc
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4fbe60
xor edx, edx
push ebp
push 0x4fbe59
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4fbe42
xor edx, edx
push ebp
push 0x4fbe3b
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x18]
push 2
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x4fbe1b
mov eax, ebx
cmp word [eax], 0x5a4d
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x4fbe1b
add ebx, dword [eax + 0x3c]
push 4
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x4fbe1b
cmp dword [ebx], 0x4550
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x4fbe1b
lea eax, [ebp - 0x110]
test eax, eax
je 0x4fbe1b
lea eax, [ebp - 0x110]
mov ecx, 0xf8
mov edx, ebx
call fcn.004079fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fbe42
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fbe60
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
cmp word [ebp - 0xf8], 0x20b
mov eax, dword [ebp - 8]
sete byte [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fbe97
lea eax, [ebp - 0x114]
call fcn.00404494
lea eax, [ebp - 4]
call fcn.00404494
ret
Function at 0x51f910
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404954
xor eax, eax
push ebp
push 0x51facd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004fc028
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0040452c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404964
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x51fa9d
mov eax, dword [ebp - 0x14]
call fcn.00402754
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x51fa96
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x51fa7d
mov esi, 8
mov ebx, 0x568b20
lea eax, [ebp - 0x20]
mov edx, dword [ebx]
call fcn.0040452c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x51fadc
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x51fa29
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
call fcn.004079e8
movzx eax, ax
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea edx, [ebp - 0x40]
mov ecx, 2
mov eax, 0x51fb00
call fcn.0040a4bc
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
call fcn.0040452c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
call fcn.004049bc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x51fa73
push dword [ebx]
push 0x51fb28
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x10]
call fcn.00409fcc
push dword [ebp - 0x48]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00404824
mov edx, dword [ebp - 0x44]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
add ebx, 4
dec esi
jne 0x51f9b9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51fa9d
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00402774
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51fad4
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004044b8
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004044b8
lea eax, [ebp - 4]
call fcn.00404494
ret
Function at 0x5249bc
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx]
add eax, 0x110
mov edx, 0x524a20
call fcn.004044e8
mov eax, dword [ebx]
mov edx, 0x524a34
call fcn.004f5c2c
mov eax, dword [ebx]
add eax, 0x114
mov edx, 0x524a40
call fcn.004044e8
mov eax, dword [ebx]
add eax, 0x118
mov edx, 0x524a94
call fcn.004044e8
mov eax, dword [ebx]
mov dword [eax + 0x3d4], 3
mov eax, dword [ebx]
mov byte [eax + 0x29b], 1
pop ebx
ret
Function at 0x52c8c8
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], edx
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x52c81c
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x52d6f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00404964
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x18]
push eax
push 0x52d60c
call sub.user32.dll_EnumWindows
cmp eax, 1
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x52e46c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.0052e428
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x52e4e0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [0x576328], eax
mov ebx, 0x52e3b4
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x52e4e0
xor eax, eax
push ebp
push 0x52e4d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52e4e0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x52e4e8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.0052e428
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x52e553
mov ebx, dword [0x576328]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x52e553
xor eax, eax
push ebp
push 0x52e54c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52e553
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5332d4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5332e6
add esp, 0xfffffff0
call fcn.004039a8
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404954
mov eax, dword [ebp + 0xc]
call fcn.00404954
xor eax, eax
push ebp
push 0x53336e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [esi + 0x4c], 0
xor eax, eax
mov dword [esi + 0x1c], eax
xor eax, eax
mov dword [esi + 0x30], eax
xor eax, eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x2c], 0xffffffff
lea eax, [esi + 4]
mov edx, dword [ebp - 4]
call fcn.004044e8
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
mov edx, dword [ebp + 0xc]
call fcn.004044e8
mov dl, 1
mov eax, dword [0x418b14]
call fcn.00403614
mov dword [esi + 0x28], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533375
lea eax, [ebp - 4]
call fcn.00404494
lea eax, [ebp + 0xc]
call fcn.00404494
ret

Function at 0x533664
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.005336ac
test al, al
je 0x53368f
cmp dword [ebx + 0x20], 0
jbe 0x533687
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x20]
cmp eax, 0x7530
jb 0x53368b
xor eax, eax
jmp 0x5336aa
mov al, 1
pop ebx
ret
cmp dword [ebx + 0x20], 0
jbe 0x5336a4
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x20]
cmp eax, 0x3e8
jb 0x5336a8
xor eax, eax
jmp 0x5336aa
mov al, 1
pop ebx
ret
Function at 0x533808
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404954
mov eax, dword [ebp - 8]
call fcn.00404954
xor eax, eax
push ebp
push 0x5339c5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0xc]
mov edx, dword [ebp - 4]
call fcn.004044e8
lea eax, [ebx + 0x10]
mov edx, dword [ebp - 8]
call fcn.004044e8
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x24], eax
mov eax, dword [ebx + 0x28]
call fcn.0041db4c
lea eax, [ebx + 0x2c]
call fcn.005249bc
mov esi, dword [ebx + 0x2c]
mov dword [esi + 0x3d4], 0xa
mov dword [esi + 0x344], ebx
mov dword [esi + 0x340], 0x533acc
cmp byte [ebx + 0x30], 0
je 0x5338eb
lea eax, [esi + 0x90]
mov edx, dword [ebx + 0x38]
call fcn.004044e8
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 0x34]
call fcn.004092a8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x2c]
add eax, 0x94
call fcn.004044e8
mov eax, dword [ebx + 0x2c]
add eax, 0xa8
mov edx, dword [ebx + 0x3c]
call fcn.004044e8
mov eax, dword [ebx + 0x2c]
add eax, 0xac
mov edx, dword [ebx + 0x40]
call fcn.004044e8
jmp 0x53391d
lea eax, [esi + 0x90]
call fcn.00404494
mov eax, dword [ebx + 0x2c]
add eax, 0x94
call fcn.00404494
mov eax, dword [ebx + 0x2c]
add eax, 0xa8
call fcn.00404494
mov eax, dword [ebx + 0x2c]
add eax, 0xac
call fcn.00404494
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0052490c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x2c]
add eax, 0xec
call fcn.004044e8
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0xec]
mov edx, dword [ebp - 4]
call fcn.00408f40
test al, al
jne 0x53395c
mov eax, dword [ebx + 8]
xor ecx, ecx
mov edx, 0x5339e0
call fcn.004f6600
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x2c]
mov dword [eax + 0x1a0], edx
mov dword [eax + 0x344], ebx
mov dword [eax + 0x340], 0x533acc
xor eax, eax
push ebp
push 0x5339a0
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x2c]
call fcn.004f5bd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5339aa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5339cc
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004044b8
ret
Function at 0x533f9c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
test dl, dl
je 0x533fb4
add esp, 0xfffffff0
call fcn.004039a8
mov ebx, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov dword [ebp - 0x9c], 0x94
test ebx, ebx
je 0x53409a
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x53409a
cmp dword [ebp - 0x98], 6
jb 0x53409a
xor edx, edx
push ebp
push 0x534085
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
add eax, 0x18
call fcn.00406308
push eax
push 0x5340bc
push 3
push 0
push 0x572004
call sub.ole32.dll_CoCreateInstance
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
je 0x534040
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x64
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0xa
mov edx, dword [ebp - 4]
mov al, 2
mov byte [edx + 0x14], al
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00533f3c
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x15]
mov eax, dword [ebp - 4]
call fcn.00533f70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53409a
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x5340b2
call fcn.00403a00
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x551c60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x551d61
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x43c]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x551d4b
cmp byte [ebx + 0x514], 0
jne 0x551d00
mov ecx, 2
mov edx, 0x551d78
mov eax, dword [ebx + 0x560]
call fcn.004f6600
mov eax, ebx
call fcn.0055bb28
inc dword [ebx + 0x558]
mov esi, dword [ebx + 0x558]
cmp esi, 1
jle 0x551d4b
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x551da8
call fcn.0040a4bc
mov edx, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebx + 0x560]
call fcn.004f6600
mov eax, 0x551dcc
call fcn.00433f5c
jmp 0x551d4b
xor eax, eax
mov dword [ebx + 0x558], eax
mov eax, ebx
call fcn.0055bb28
mov byte [ebx + 0x511], 1
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x22c]
call fcn.00443c38
test eax, eax
je 0x551d37
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x551d42
xor ecx, ecx
mov dl, 1
mov eax, ebx
call fcn.00554cdc
xor edx, edx
mov eax, ebx
call fcn.00553ab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x551d68
lea eax, [ebp - 4]
call fcn.00404494
ret

Function at 0x55b004
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x55b0a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0054c1b0
test al, al
jne 0x55b032
xor edx, edx
mov eax, ebx
call fcn.0055b0d0
jmp 0x55b088
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x55b064
lea edx, [ebp - 4]
mov eax, 0x55b0b8
call fcn.00532c20
mov eax, dword [ebp - 4]
mov edx, 0x55b0cc
call fcn.004048b0
setne dl
mov eax, ebx
call fcn.0055b0d0
jmp 0x55b088
lea edx, [ebp - 8]
mov eax, 0x55b0b8
call fcn.00532c20
mov eax, dword [ebp - 8]
mov edx, 0x55b0cc
call fcn.004048b0
sete dl
mov eax, ebx
call fcn.0055b0d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b0aa
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044b8
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x994008], 0x8088405
inc edx
mov dword [ebx + 0x994008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cae4
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cb15
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cafd
add dl, dl
jne 0x41cb20
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cb71
xor eax, eax
add dl, dl
jne 0x41cb2d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc0e
add dl, dl
jne 0x41cb3c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cb47
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cb52
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cb5d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cb67
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cb0c
mov eax, 1
add dl, dl
jne 0x41cb7f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cb8a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cb76
sub eax, ebx
mov ebx, 1
jne 0x41cbbd
mov ecx, 1
add dl, dl
jne 0x41cba3
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cbae
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cb9a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cb0c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cbd4
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cbdf
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cbcb
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cb0c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cc2f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cb0c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41d7a8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x41d7bb
add esp, 0xfffffff0
call fcn.00403da8
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00403b30
mov byte [ebx + 4], 0
cmp dword [esi + 0x5c], 0
jne 0x41d7e1
cmp dword [esi + 0x58], 0x40
jb 0x41d9c7
jmp 0x41d7e7
jl 0x41d9c7
lea eax, [ebx + 0xc]
mov edx, 0x40
call fcn.00406e80
push 0
push 0
push 0
push 0x40
lea edx, [ebx + 0xc]
mov eax, esi
call fcn.0041d364
cmp word [ebx + 0xc], 0x5a4d
jne 0x41d9c7
mov ecx, dword [ebx + 0x48]
test ecx, ecx
jle 0x41d9c7
cmp ecx, 0x10000
jge 0x41d9c7
mov eax, ecx
add eax, 4
add eax, 0x14
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d842
cmp eax, dword [esi + 0x58]
ja 0x41d9c7
jmp 0x41d848
jg 0x41d9c7
lea eax, [ebx + 0x4c]
mov edx, 4
call fcn.00406e80
mov eax, dword [ebx + 0x48]
cdq
push edx
push eax
push 0
push 4
lea edx, [ebx + 0x4c]
mov eax, esi
call fcn.0041d364
cmp dword [ebx + 0x4c], 0x4550
jne 0x41d9c7
lea eax, [ebx + 0x50]
mov edx, 0x14
call fcn.00406e80
mov eax, dword [ebx + 0x48]
add eax, 4
cdq
push edx
push eax
push 0
push 0x14
lea edx, [ebx + 0x50]
mov eax, esi
call fcn.0041d364
mov ax, word [ebx + 0x50]
cmp ax, 0x8664
jne 0x41d8ff
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xf0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d8c3
cmp eax, dword [esi + 0x58]
ja 0x41d950
jmp 0x41d8c9
jg 0x41d950
lea eax, [ebx + 0x144]
mov edx, 0xf0
call fcn.00406e80
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xf0
lea edx, [ebx + 0x144]
mov eax, esi
call fcn.0041d364
mov byte [ebx + 4], 1
jmp 0x41d950
cmp ax, 0x14c
jne 0x41d950
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xe0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d920
cmp eax, dword [esi + 0x58]
ja 0x41d950
jmp 0x41d922
jg 0x41d950
lea eax, [ebx + 0x64]
mov edx, 0xe0
call fcn.00406e80
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xe0
lea edx, [ebx + 0x64]
mov eax, esi
call fcn.0041d364
mov byte [ebx + 4], 1
cmp byte [ebx + 4], 0
je 0x41d9c7
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
mov di, word [ebx + 0x52]
movzx edx, di
shl edx, 3
lea edx, [edx + edx*4]
add eax, edx
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d981
cmp eax, dword [esi + 0x58]
ja 0x41d9c7
jmp 0x41d983
jg 0x41d9c7
movzx eax, di
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x97e27c]
call fcn.00405b74
add esp, 4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
cdq
push edx
push eax
movzx eax, word [ebx + 0x52]
shl eax, 3
lea eax, [eax + eax*4]
xor edx, edx
push edx
push eax
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.0041d364
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x41d9de
call fcn.00403e00
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x41e6d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x97fb97
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e789
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e772
test esi, esi
jbe 0x41e789
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088a4
test eax, eax
jne 0x41e764
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e789
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e741
jmp 0x41e789
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e789
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x97fb9e
ret