joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4111c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40c0ae
lea edi, [esi - 0xb0ae]
push edi
or ebp, 0xffffffff
jmp 0x4111e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4111e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4111d8
mov eax, 1
add ebx, ebx
jne 0x4111fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4111f0
jne 0x41120c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4111f0
xor ecx, ecx
sub eax, 3
jb 0x411220
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411292
mov ebp, eax
add ebx, ebx
jne 0x41122b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411238
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41125c
inc ecx
add ebx, ebx
jne 0x411248
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41123d
jne 0x411259
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41123d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41127c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41126d
jmp 0x4111de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41127c
add edi, ecx
jmp 0x4111de
pop esi
mov edi, esi
mov ecx, 0x81e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41129a
cmp byte [edi], 4
jne 0x41129a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41129f
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x41130e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x110b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4112cc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x110b8]
or eax, eax
je 0x411308
mov dword [ebx], eax
add ebx, 4
jmp 0x4112e9
call dword [esi + 0x110bc]
popal
jmp 0x405fb0
Function at 0x4021566a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 0x28], 0x32
mov byte [ebp - 0x27], 0x31
mov byte [ebp - 0x26], 0x66
mov byte [ebp - 0x25], 0x63
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x38
mov byte [ebp - 0x22], 0x32
mov byte [ebp - 0x21], 0x32
mov byte [ebp - 0x20], 0x32
mov byte [ebp - 0x1f], 0x33
mov byte [ebp - 0x1e], 0x30
mov byte [ebp - 0x1d], 0x35
mov byte [ebp - 0x1c], 0x34
mov byte [ebp - 0x1b], 0x37
mov byte [ebp - 0x1a], 0x32
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x37
mov byte [ebp - 0x15], 0x33
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x39
mov byte [ebp - 0x12], 0x30
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xf], 0x38
mov byte [ebp - 0xe], 0x32
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x30
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x63
mov byte [ebp - 8], 0
lea eax, [ebp - 0x28]
push eax
push 0
push 0x1f0003
mov eax, dword [ebp + 8]
call dword [eax + 0x24]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40215713
xor eax, eax
inc eax
jmp 0x4021572b
cmp dword [ebp + 0xc], 0
je 0x40215729
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
mov eax, dword [ebp + 8]
call dword [eax + 0x28]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40215965
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0xc], edx
push edi
mov dword [ebp - 4], eax
push eax
mov eax, dword [ebp + 0xc]
call dword [eax + 0x14]
mov ecx, eax
xor esi, esi
mov dword [ebp - 8], ecx
mov eax, esi
mov byte [ebp + eax - 0x10c], al
inc eax
cmp eax, 0x100
jb 0x40215989
mov edi, esi
xor edx, edx
mov bl, byte [ebp + edi - 0x10c]
mov eax, edi
div ecx
mov eax, dword [ebp - 4]
movzx ecx, bl
movzx eax, byte [edx + eax]
add eax, esi
add ecx, eax
movzx esi, cl
mov ecx, dword [ebp - 8]
mov al, byte [ebp + esi - 0x10c]
mov byte [ebp + edi - 0x10c], al
inc edi
mov byte [ebp + esi - 0x10c], bl
cmp edi, 0x100
jb 0x4021599a
xor esi, esi
mov edx, esi
mov edi, esi
cmp dword [ebp + 8], edx
jle 0x40215a31
mov ebx, dword [ebp - 0xc]
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x10c]
movzx eax, cl
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x10c]
mov byte [ebp + edi - 0x10c], al
mov byte [ebp + esi - 0x10c], cl
movzx eax, byte [ebp + edi - 0x10c]
movzx ecx, cl
add ecx, eax
movzx eax, cl
mov al, byte [ebp + eax - 0x10c]
xor byte [edx + ebx], al
inc edx
cmp edx, dword [ebp + 8]
jl 0x402159e7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40215a9f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ecx + 0x3c]
push edi
mov dword [ebp - 0xc], edx
mov eax, dword [esi + ecx + 0x78]
test eax, eax
je 0x40215b23
cmp dword [esi + ecx + 0x7c], 0
je 0x40215b23
mov ebx, dword [eax + ecx + 0x18]
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x40215b23
mov edx, dword [eax + ecx + 0x1c]
mov esi, dword [eax + ecx + 0x20]
add edx, ecx
mov eax, dword [eax + ecx + 0x24]
add esi, ecx
mov dword [ebp - 0x18], edx
add eax, ecx
xor edx, edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
test ebx, ebx
je 0x40215b23
mov edi, dword [esi + edx*4]
xor esi, esi
add edi, ecx
mov dword [ebp - 4], edi
mov al, byte [edi]
test al, al
je 0x40215b10
mov ebx, edi
imul esi, esi, 0x83
movsx eax, al
add esi, eax
inc ebx
mov al, byte [ebx]
test al, al
jne 0x40215afb
mov ebx, dword [ebp - 8]
and esi, 0x7fffffff
cmp esi, dword [ebp - 0xc]
je 0x40215b2c
mov esi, dword [ebp - 0x10]
inc edx
cmp edx, ebx
jb 0x40215ae9
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 0
jne 0x40215b43
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + edx*2]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + eax*4]
add eax, ecx
jmp 0x40215b25
push edi
push ecx
call dword [ebp + 8]
jmp 0x40215b25
Function at 0x40a765
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040a765
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0
mov edx, 0x4219c0
call fcn.0041ef8b
lea ebx, [esp]
call fcn.0041e498
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041c82d
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x40a7b9
jmp 0x40a99b
push 0
mov edx, 0x421a2c
call fcn.0041ef8b
lea ebx, [esp]
call fcn.0041e498
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041c82d
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x421844], eax
push 0
mov edx, 0x421a3c
call fcn.0041ef8b
lea ebx, [esp]
call fcn.0041e498
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041c82d
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x421848], eax
push 0
mov edx, 0x421a54
call fcn.0041ef8b
lea ebx, [esp]
call fcn.0041e498
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041c82d
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x42184c], eax
push 0
mov edx, 0x421a64
call fcn.0041ef8b
lea ebx, [esp]
call fcn.0041e498
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041c82d
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x421850], eax
push 0
mov edx, 0x421a78
call fcn.0041ef8b
lea ebx, [esp]
call fcn.0041e498
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041c82d
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x421854], eax
push 0
mov edx, 0x421a88
call fcn.0041ef8b
lea ebx, [esp]
call fcn.0041e498
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041c82d
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x421858], eax
push 0
mov edx, 0x421a94
call fcn.0041ef8b
lea ebx, [esp]
call fcn.0041e498
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041c82d
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x42185c], eax
cmp dword [0x421844], 0
jne 0x40a941
jmp 0x40a99b
cmp dword [0x421848], 0
jne 0x40a94f
jmp 0x40a99b
cmp dword [0x42184c], 0
jne 0x40a95d
jmp 0x40a99b
cmp dword [0x421850], 0
jne 0x40a96b
jmp 0x40a99b
cmp dword [0x421854], 0
jne 0x40a979
jmp 0x40a99b
cmp dword [0x421858], 0
jne 0x40a987
jmp 0x40a99b
cmp dword [0x42185c], 0
jne 0x40a995
jmp 0x40a99b
mov dword [ebp - 0x98], esi
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40ada9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040ada9
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov byte [0x421838], 0
mov esi, 0
mov eax, dword [0x421840]
test eax, eax
je 0x40ae7e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 1
mov ebx, dword [ebp + 0xc]
movsx ecx, word [ebx]
add eax, ecx
push eax
call dword [0x42185c]
mov byte [ebp - 0xa0], al
mov eax, pe_nt_image_headers32
movzx ecx, byte [ebp - 0xa0]
xor eax, ecx
mov byte [ebp - 0xa0], al
movzx eax, byte [ebp - 0xa0]
mov byte [ebp - 0x9c], al
mov ecx, 7
mov eax, 1
lea ebx, [ebp - 0x9c]
call fcn.0041e5c5
inc esi
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
movzx ecx, byte [ebp - 0x9c]
cmp ecx, eax
je 0x40ae5b
cmp esi, 0x186a0
jle 0x40adf0
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
movzx ecx, byte [ebp - 0x9c]
cmp ecx, eax
je 0x40ae73
mov byte [0x421838], 1
movzx eax, byte [0x421838]
test eax, eax
je 0x40ae7e
movzx eax, byte [ebp - 0xa0]
mov byte [ebp - 0x98], al
movzx eax, byte [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40bbf6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040bbf6
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
fild dword [0x424340]
mov eax, dword [ebp + 8]
call fcn.0041e3a8
fcompp
fnstsw ax
sahf
jne 0x40bc39
fild qword [0x423fd8]
call fcn.0041e3cf
mov dword [ebp + 8], eax
mov edi, dword [ebp + 0x14]
push 0
push 0
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
push 0x20019
push 0
mov edx, dword [ebp + 0xc]
call fcn.0041ef74
mov edx, 0x421ac4
call fcn.0041ef8b
call fcn.0041cca4
mov edx, 0x421ac4
call fcn.0041ef8b
call fcn.0041cd12
lea ebx, [esp + 0xc]
call fcn.0041e498
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041c82d
pop eax
add esp, 4
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x40bd1a
mov dword [ebp - 0xa4], 4
mov eax, 4
mov dword [ebp - 0xa8], eax
push 0
lea ebx, [ebp - 0xa8]
push ebx
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
lea ebx, [ebp - 0xa4]
push ebx
push 0
mov edx, dword [ebp + 0x10]
call fcn.0041ef74
lea ebx, [esp + 0x10]
call fcn.0041e498
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041c82d
pop eax
add esp, 4
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x98], edi
call fcn.0041ee65
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x414d49
Capabilities:
Get file version info
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00414d49
xor esi, esi
xor edi, edi
mov ecx, 0x3e
push esi
dec ecx
jne 0x414d65
push 0
push 0x64
lea ebx, [ebp - 0x118]
push ebx
mov edx, 0x422e68
call fcn.0041ef8b
lea ebx, [esp + 8]
call fcn.0041e498
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041c82d
pop eax
add esp, 4
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x118]
call fcn.0041edc6
mov edx, 0x422e7c
call fcn.0041ef8b
call fcn.0041e69a
lea ebx, [ebp - 0x17c]
mov ecx, 0x64
call fcn.0041ee0f
lea ebx, [ebp - 0x17c]
call fcn.0041edc6
xor eax, eax
xor ebx, ebx
call fcn.00415f40
mov edx, 0x421af8
call fcn.0041ef8b
call fcn.0041e72f
jne 0x414df7
jmp 0x414fa3
mov esi, 0
mov edi, 0
mov dword [ebp - 0xa0], 0
lea ebx, [ebp - 0xb0]
push ebx
lea ebx, [ebp - 0x17c]
push ebx
call dword [sym.imp.VERSION.DLL_GetFileVersionInfoSizeA]
fldcw word [ebp - 0x10]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jne 0x414e38
jmp 0x414fa3
mov eax, dword [ebp - 0xa8]
call fcn.0041bc9d
lea ebx, [ebp - 0xb4]
call fcn.0041e3d6
lea ebx, [ebp - 0xb4]
call fcn.0041f036
push ebx
push dword [ebp - 0xa8]
push 0
lea ebx, [ebp - 0x17c]
push ebx
call dword [sym.imp.VERSION.DLL_GetFileVersionInfoA]
fldcw word [ebp - 0x10]
mov dword [ebp - 0xb0], eax
push 0
push 0
mov eax, 0x34
lea ebx, [esp + 4]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0xac]
push ebx
mov edx, 0x421ac4
call fcn.0041ef8b
lea ebx, [esp + 8]
call fcn.0041e498
lea ebx, [ebp - 0xb4]
call fcn.0041f036
push ebx
call dword [sym.imp.VERSION.DLL_VerQueryValueA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041c82d
pop eax
add esp, 8
fldcw word [ebp - 0x10]
fild dword [0x42435c]
mov ebx, dword [ebp - 0xac]
mov eax, dword [ebx + 0x10]
call fcn.0041e3a8
call fcn.0041e360
fistp qword [ebp - 0x6c]
mov esi, dword [ebp - 0x6c]
fild dword [0x42435c]
mov ebx, dword [ebp - 0xac]
mov eax, dword [ebx + 0x10]
call fcn.0041e3a8
call fcn.0041e377
fistp qword [ebp - 0x6c]
mov edi, dword [ebp - 0x6c]
fild dword [0x42435c]
mov ebx, dword [ebp - 0xac]
mov eax, dword [ebx + 0x14]
call fcn.0041e3a8
call fcn.0041e377
fistp dword [ebp - 0xa0]
fild dword [0x42435c]
mov ebx, dword [ebp - 0xac]
mov eax, dword [ebx + 0x14]
call fcn.0041e3a8
call fcn.0041e360
fistp dword [ebp - 0xa4]
cmp esi, 6
jl 0x414f67
cmp esi, 6
mov eax, 0xffffffff
je 0x414f52
inc eax
cmp edi, 5
mov ecx, 0xffffffff
jl 0x414f5d
inc ecx
and eax, ecx
test eax, eax
je 0x414fa3
mov edx, 0x422eb4
call fcn.0041ef8b
mov edx, 0x421988
call fcn.0041ef8b
call fcn.0041e69a
mov edx, 0x422ef4
call fcn.0041ef8b
call fcn.0041e69a
mov eax, 0x40
mov edx, 0x42236c
call fcn.0041ef8b
call fcn.00416284
call fcn.0041ee65
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x415058
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word [0x41503a], 4
jne 0x415073
jmp 0x4154a2
jmp fcn.004152a5
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.004151a1
mov dword [ebx + 0x3f0], 1
lea eax, [ebx + 0x5c4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x4154f3
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x3e4], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00415247
mov dword [ebx + 0x3e0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebx + 0x3ec], eax
call fcn.00415078
push 0xff
jb 0x415572
pop eax
movzx ecx, word [0x415038]
jecxz 0x41553d
push ecx
push 8
push esp
call dword [sym.imp.COMCTL32.DLL_InitCommonControlsEx]
pop eax
pop eax
call fcn.004150ed
push eax
mov ebx, section..data
mov ecx, dword [ebx + 0xd8]
call fcn.0041557e
mov ecx, dword [ebx + 0xb4]
jecxz 0x415562
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov edi, dword [ebx + 0x428]
call fcn.004150f2
call fcn.004150d9
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x415078
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x4150d8
mov dword [ebx + 0x3d0], eax
mov dword [ebx + 0x3d8], 0
mov dword [ebx + 0x3d4], 0
call fcn.00415384
jb 0x4150d8
mov dword [ebx + 0x3d4], eax
mov word [eax + 0xac], 8
call fcn.004150c7
dec ebp
push ebx
and byte [ebx + 0x61], dl
outsb dx, byte [esi]
jae 0x4150e1
push ebx
jb 0x41512e
add byte [esi - 4], bl
mov bl, 0xd0
add eax, dword [eax]
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_TlsFree
ret

Function at 0x4155ba
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
sub esp, 0x20
call fcn.004156a1
mov edi, esp
mov cl, 4
call fcn.004155db
call fcn.004155db
mov edx, 8
jmp 0x415634
or esi, esi
jne 0x41563c
mov byte [edi], 0x30
inc esi
mov ecx, dword [esp + 0x2c]
jecxz 0x41564a
cmp ecx, edx
jbe 0x41564c
mov ecx, edx
jmp 0x41564c
mov ecx, esi
cmp ecx, esi
ja 0x415656
add esi, esp
sub esi, ecx
jmp 0x415674
mov edx, esi
lea edi, [esp + ecx - 1]
lea esi, [esp + esi - 1]
push ecx
mov ebx, ecx
sub ebx, edx
mov ecx, edx
std
rep movsb byte es:[edi], byte [esi]
mov al, 0x30
mov ecx, ebx
rep stosb byte es:[edi], al
cld
pop ecx
mov esi, esp
call fcn.0041f005
jb 0x415683
add esp, 0x20
pop edi
pop esi
pop ebx
pop eax
ret
add esp, 0x20
pop edi
pop esi
pop ebx
pop edx
jmp fcn.004152bc
Function at 0x4156a9
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
lea esi, [esp + 0x18]
mov ecx, dword [esi - 4]
push ecx
call fcn.0041bfe7
jb 0x4156df
jecxz 0x4156cc
lea esi, [esi + ecx*4 - 4]
mov eax, dword [esi]
mov byte [edi], al
sub esi, 4
inc edi
loop 0x4156c2
call fcn.0041efbe
pop edx
pop edi
pop esi
pop ecx
pop eax
shl edx, 2
pop dword [esp + edx]
add esp, edx
ret
call fcn.0041efbc
pop edx
pop edi
pop esi
pop ecx
add esp, 4
shl edx, 2
pop dword [esp + edx]
add esp, edx
jmp fcn.004152bc

Function at 0x415ad0
Capabilities:
Terminate process

Disassembly:
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], edi
pop dword [ebp - 0x6c]
pop edx
pop ax
test byte [ebx + 4], 4
je 0x415af2
pop cx
movzx ecx, ch
add esp, 4
add esp, 8
loop 0x415aea
jmp dword [ebp - 0x6c]
mov byte [ebx + 5], 2
mov byte [ebx + 4], al
mov dword [ebx], edx
pop word [ebx + 6]
pop dword [ebx + 0x14]
movzx ecx, byte [ebx + 7]
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
pop dword [ebx + esi + 0x10]
pop dword [ebx + esi + 0xc]
sub esi, 0xc
jne 0x415b0f
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x415b84
inc eax
dec ecx
je 0x415b47
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x415b84
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x415b2a
je 0x415b47
jb 0x415b84
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x415b84
test byte [ebx + 4], 1
je 0x415b5a
mov dword [ebx + 0xc], eax
jmp 0x415b77
push eax
call fcn.0041526d
pop ecx
jb 0x415b86
mov dword [ebx], eax
mov dword [ebx + 0xc], ecx
mov edi, eax
cld
xor eax, eax
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
or byte [ebx + 4], 4
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp dword [ebp - 0x6c]
mov al, 9
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
push dword [ebp - 0x6c]
jmp fcn.004152bc
Function at 0x415bfa
Capabilities:
Terminate process

Disassembly:
test byte [ebx + 4], 4
jne 0x415c05
jmp fcn.00415ad0
mov dword ds:[ebp - 0x68], esi
mov dword ds:[ebp - 0x64], edi
pop dword ds:[ebp - 0x6c]
pop eax
pop ax
xor ah, ah
pop cx
cmp cl, byte [ebx + 6]
call fcn.00415d21
pop edx
cmp edx, dword [ebx + 0x14]
call fcn.00415d21
movzx ecx, ch
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
lea edi, [ebx + esi + 0x10]
pop dword ds:[ebp - 0x60]
push dword [edi]
pop edx
cmp edx, dword [ebx + esi + 0x10]
call fcn.00415d21
pop edx
cmp edx, dword [ebx + esi + 0xc]
call fcn.00415d21
sub esi, 0xc
jne 0x415c3f
or ah, ah
jne 0x415d0e
cmp cl, byte [ebx + 7]
jne 0x415d0e
mov edx, dword ds:[ebp - 0x60]
cmp edx, dword [edi - 4]
jl 0x415d0e
mov byte [ebx + 4], al
mov ecx, dword [edi]
sub ecx, edx
jle 0x415ca4
cmp byte [ebx + 7], 1
je 0x415c89
imul ecx, dword [edi - 8]
push edi
mov al, byte [ebx + 6]
mov esi, ecx
mov edi, dword [ebx]
push dword [ebx + 8]
sub dword [esp], ecx
pop ecx
imul ecx, dword [ebx + 0x14]
add edi, ecx
call fcn.00415e12
pop edi
push dword [ebx + 8]
push dword [ebx + 0xc]
movzx ecx, byte [ebx + 7]
xor esi, esi
mov dword [edi], edx
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
inc eax
dec ecx
je 0x415cd7
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x415cbe
jb 0x415d04
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x415d04
mov ecx, eax
xchg dword [ebx + 0xc], eax
mov edx, eax
mov eax, dword [ebx]
call fcn.00415d26
jb 0x415d06
add esp, 8
mov dword [ebx], eax
or byte [ebx + 4], 4
mov esi, dword ds:[ebp - 0x68]
mov edi, dword ds:[ebp - 0x64]
notrack jmp dword ds:[ebp - 0x6c]
mov al, 9
pop dword [ebx + 0xc]
pop dword [ebx + 8]
mov dx, 0x9b0
mov al, 9
mov esi, dword ds:[ebp - 0x68]
mov edi, dword ds:[ebp - 0x64]
push dword ds:[ebp - 0x6c]
jmp fcn.004152bc

Function at 0x415d9a
Capabilities:
Terminate process

Disassembly:
call fcn.00415da7
jb 0x415da2
ret
jmp fcn.004152bc