joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419aff
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x419b46
call fcn.0041b010
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x419b46
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x419b62
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00419679
mov esi, eax
test edi, edi
je 0x419b60
test ebx, ebx
je 0x419b60
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41eff4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44bcd0]
jne 0x41effe
repz ret
jmp fcn.00424d28

Function at 0x430e20
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00425c29
and dword [ebp - 4], 0
cmp dword [0x44fc5c], 0
mov ebx, eax
jne 0x430ed1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x430f82
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x441eec
push edi
call esi
test eax, eax
je 0x430f82
push eax
call fcn.00425bb7
mov dword [esp], 0x441edc
push edi
mov dword [0x44fc5c], eax
call esi
push eax
call fcn.00425bb7
mov dword [esp], 0x441ec8
push edi
mov dword [0x44fc60], eax
call esi
push eax
call fcn.00425bb7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44fc64], eax
call esi
push eax
call fcn.00425bb7
pop ecx
mov dword [0x44fc6c], eax
test eax, eax
je 0x430ed1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00425bb7
pop ecx
mov dword [0x44fc68], eax
mov eax, dword [0x44fc68]
cmp eax, ebx
je 0x430f29
cmp dword [0x44fc6c], ebx
je 0x430f29
push eax
call fcn.00425c32
push dword [0x44fc6c]
mov esi, eax
call fcn.00425c32
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x430f29
test edi, edi
je 0x430f29
call esi
test eax, eax
je 0x430f20
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x430f20
test byte [ebp - 0xc], 1
jne 0x430f29
or dword [ebp + 0x10], 0x200000
jmp 0x430f62
mov eax, dword [0x44fc60]
cmp eax, ebx
je 0x430f62
push eax
call fcn.00425c32
pop ecx
test eax, eax
je 0x430f62
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x430f62
mov eax, dword [0x44fc64]
cmp eax, ebx
je 0x430f62
push eax
call fcn.00425c32
pop ecx
test eax, eax
je 0x430f62
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44fc5c]
call fcn.00425c32
pop ecx
test eax, eax
je 0x430f82
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x430f84
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x435cf0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esi + 4]
cmp edi, 2
jae 0x435d64
test edi, edi
je 0x435d0c
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov dl, byte [eax]
mov byte [ecx], dl
call fcn.0042259e
mov edx, 0x4000
mov ecx, edi
mov dword [eax], 0
mov eax, dword [esi + 0x40]
sar edx, cl
push eax
mov eax, dword [esi + 0x44]
add eax, edi
push edx
push 1
push eax
call fcn.0042057c
add esp, 0x10
test eax, eax
jne 0x435d49
mov ecx, dword [esi + 0x40]
test byte [ecx + 0xc], 0x20
je 0x435d49
mov dword [esi + 0x38], 0xffffffff
mov edx, dword [esi + 4]
add edx, eax
mov dword [esi + 4], edx
mov eax, edx
mov edx, dword [esi + 0x44]
cmp eax, 2
mov dword [esi], edx
jae 0x435d64
mov dword [esi + 0x58], eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi]
mov edx, dword [0x441ff8]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, edx
jne 0x435e80
mov ecx, dword [0x441ffc]
xor edx, edx
mov dl, byte [eax + 1]
cmp edx, ecx
jne 0x435e80
mov ecx, dword [esi + 4]
add eax, 2
add ecx, 0xfffffffe
push esi
mov dword [esi + 4], ecx
mov dword [esi], eax
call fcn.00435e90
push esi
mov edi, eax
call fcn.00435e90
add esp, 8
cmp edi, 8
mov ebx, eax
jne 0x435e75
test bl, 0xe0
jne 0x435e75
mov edi, 6
push esi
call fcn.00435e90
add esp, 4
dec edi
jne 0x435dc3
test bl, 4
je 0x435e06
push esi
call fcn.00435e90
push esi
mov edi, eax
call fcn.00435e90
shl eax, 8
add edi, eax
add esp, 8
mov eax, edi
dec edi
test eax, eax
je 0x435e06
push esi
call fcn.00435e90
add esp, 4
cmp eax, 0xffffffff
je 0x435e06
mov ecx, edi
dec edi
test ecx, ecx
jne 0x435df1
test bl, 8
je 0x435e2a
push esi
call fcn.00435e90
add esp, 4
test eax, eax
je 0x435e2a
cmp eax, 0xffffffff
je 0x435e2a
push esi
call fcn.00435e90
add esp, 4
test eax, eax
jne 0x435e18
test bl, 0x10
je 0x435e4e
push esi
call fcn.00435e90
add esp, 4
test eax, eax
je 0x435e4e
cmp eax, 0xffffffff
je 0x435e4e
push esi
call fcn.00435e90
add esp, 4
test eax, eax
jne 0x435e3c
test bl, 2
je 0x435e64
mov edi, 2
push esi
call fcn.00435e90
add esp, 4
dec edi
jne 0x435e58
mov edx, dword [esi + 0x3c]
pop edi
neg edx
sbb edx, edx
and edx, 0xfffffffd
mov dword [esi + 0x38], edx
pop esi
pop ebx
ret
mov dword [esi + 0x38], 0xfffffffd
pop edi
pop esi
pop ebx
ret
mov dword [esi + 0x58], 1
pop edi
pop esi
pop ebx
ret

Function at 0x435e90
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x435ea1
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 4]
test eax, eax
jne 0x435eee
call fcn.0042259e
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call fcn.0042057c
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x435ee9
mov edx, dword [esi + 0x40]
mov dword [esi + 0x3c], 1
or eax, 0xffffffff
test byte [edx + 0xc], 0x20
je 0x435f00
mov dword [esi + 0x38], eax
pop esi
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi + 4]
xor ecx, ecx
dec eax
mov dword [esi + 4], eax
mov eax, dword [esi]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
mov eax, ecx
pop esi
ret
Function at 0x436260
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x436317
cmp byte [esi + 0x5c], 0x77
jne 0x436317
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
test edi, edi
mov dword [esi], ebp
mov dword [esi + 4], edi
je 0x4362fb
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x4362b5
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call fcn.004201f2
add esp, 0x10
cmp eax, 0x4000
jne 0x4362f4
mov dword [esi + 0x10], eax
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x68]
add eax, edx
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x10]
add ecx, eax
push 0
push esi
mov dword [esi + 0x68], ecx
call fcn.004346e0
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x64]
sub edx, ecx
add esp, 8
mov dword [esi + 0x64], edx
mov edx, dword [esi + 0x10]
sub dword [esi + 0x68], edx
mov dword [esi + 0x38], eax
test eax, eax
jne 0x4362fb
test ecx, ecx
jne 0x43628a
jmp 0x4362fb
mov dword [esi + 0x38], 0xffffffff
mov eax, dword [esi + 0x4c]
push edi
push ebp
push eax
call fcn.004399f0
mov ecx, dword [esi + 4]
add esp, 0xc
mov dword [esi + 0x4c], eax
mov eax, edi
pop edi
pop ebp
sub eax, ecx
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x436320
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x4363e6
cmp byte [esi + 0x5c], 0x77
jne 0x4363e6
mov ebp, dword [esp + 0x18]
mov dword [esi + 4], ebx
mov eax, dword [esi + 0x10]
mov edi, 0x4000
sub edi, eax
je 0x436373
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call fcn.004201f2
add esp, 0x10
cmp eax, edi
jne 0x4363ca
mov edx, dword [esi + 0x48]
mov dword [esi + 0x10], 0x4000
mov dword [esi + 0xc], edx
test ebx, ebx
jne 0x4363d5
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x68]
add ecx, eax
push ebp
push esi
mov dword [esi + 0x68], ecx
call fcn.004346e0
mov ecx, dword [esi + 0x10]
mov ebx, dword [esi + 0x68]
add esp, 8
sub ebx, ecx
test edi, edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x68], ebx
jne 0x4363a6
cmp eax, 0xfffffffb
jne 0x4363a6
mov dword [esi + 0x38], edi
test ecx, ecx
jne 0x4363b4
cmp dword [esi + 0x38], 1
je 0x4363b4
xor ebx, ebx
jmp 0x4363b9
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x436343
cmp eax, 1
jne 0x4363d5
jmp 0x436343
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebp
pop ebx
ret
mov esi, dword [esi + 0x38]
pop edi
mov eax, esi
dec eax
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x543ed8
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0x8b
int3
fld xword [ebx - 0x3abb89b]
inc edi
push esp
cld
lodsb al, byte [esi]
scasb al, byte es:[edi]
pop edx
sub al, 0x64
cmp eax, ecx
pop ebp
xor al, 0x2b
loop 0x543ed5
imul eax, dword [edi], 0x95444766
xchg ebp, eax
jecxz 0x543e7e
je 0x543eec
push esi
leave
adc bh, ah
in eax, 0x41
mov edx, 0x85808bde
cmc
push esp
jmp [eax]

Function at 0x54437c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x5443eb
stosb byte es:[edi], al
dec edi
sub edx, dword [ecx + 0x30618f30]
and byte [edi], ch
xor byte [eax], ah
das
stc
add byte [esi + 0x37], dl
mov eax, 0x1cdf11cd
add dword [ebp - 0x39f46973], esp
mov al, 0xc6
mov eax, dword [0xcb842185]
lodsd eax, dword [esi]
cmc
out 0x95, eax
loop 0x5443f2
inc esp
lahf
mov ah, 0x8f
lea esi, [eax]
dec eax
lodsb al, byte [esi]
mov al, 4
iretd

Function at 0x5d8014
Capabilities:
Encode data using xor

Disassembly:
imul ecx, dword [edi - 0x1a], 1
mov eax, 0xa57361dc
adc dword [eax + edx*2], 0xa24ee15
fcom dword [ecx - 0x3d]
sub dword [eax], ebp
pop es
and bh, byte [ebp - 0x39ae5f3c]
add eax, 0x763e3648
push es
mov al, byte [0x4805c651]
jbe 0x5d7ff8
movsd dword es:[edi], dword [esi]
pop esp
xor al, 4
jge 0x5d7fe9
xor al, 0x75
or eax, 0x6460ee84
loopne fcn.005d8014
invalid
cmp eax, 0x27e744ea
or eax, 0xae56adc4
mov eax, dword [0x11a8e320]
jle 0x5d8036
call 0xf4af1b95
ror bl, 0xbc
int1
pushfd
add al, 0x9b
inc esp
add dword [ebp + 0x1e], ecx
movsb byte es:[edi], byte [esi]
sub eax, 0xd172b48a
pushal
out 8, eax
cwde
fcomp dword [edi - 0x35]
add eax, 0xbdbab03f
pop ebx
jno 0x5d7fd0
or eax, 0x1579f49a
ljmp 0x7b15

Function at 0x5d8400
Capabilities:
Encode data using xor

Disassembly:
test dword [ebx - 0x41d0bbfc], eax
sub dword [ecx + 0x7d14dee1], 0x48
jge 0x5d8455
test al, 2
sti
popfd
sbb edx, dword [esi + 0x367eba20]
push 0xffffffffffffff84
adc eax, 0x84d120c4
adc al, 0x9d
cmpsb byte [esi], byte es:[edi]
inc edi
aam 0x72
cmp dword [ebx], ebp
xor al, 0x79
movsb byte es:[edi], byte [esi]
ja 0x5d840b
ficom word [0xc743da8]
mov eax, dword [eax + edx*4]
add byte [ebp - 0xf], dl
retf
xor ebp, dword [edx]
inc dword [esi + ebp*4 + 0x667fb06b]
fisub word [eax]
invalid
Function at 0x5d9484
Capabilities:
Encode data using xor

Disassembly:
out 0xc8, al
sub dword [esi + esi + 0x7542c6a2], edx
fmul dword [ebp + 0x7c]
add edi, dword ss:[ecx - 0x64c8b800]
mov ah, 0x23
add dword [ecx], ebx
adc dword [ecx], ebp
pushfd
out dx, al
dec edx
sahf
lahf
pop es
inc eax
aad 0x7e
sub bl, byte [ecx + 0x7fb4ccd8]
xor dword [ebp - 0x5c], esp
pushfd
mov eax, dword [0x5047789]
mov dl, byte [eax]
mov dl, 0x1e
xchg esp, eax
mov ch, 0x49
nop
imul ebx, dword [edi - 0x7e3a11b5], 0x556d85b6
push edi
sub al, 0xc5
mov al, byte [0x641b750e]
loopne 0x5d94a6
pop ds
fidivr word [0xc248d2b5]
or ecx, dword [edx]
js 0x5d9507
pop edx
xchg edi, eax
adc dword [ebp + 0x4537a00b], 0x50
push ecx
add bh, byte [ecx - 0xf]
xor dword [ecx - 0x7c], esi
push ebx
mov ah, 0x6b
loope 0x5d955b
inc ebx
adc ah, byte [eax]
rol dword [ebx - 0x5c], 0x63
sahf
pop esi
sbb byte [edi - 0x5afdae5d], dl
cmc
invalid
sub al, 0x45
push ecx
nop
vpackssdw xmm0, xmm0, xmmword [ebp - 0x76d77a10]
aaa
mov al, 0xb0
xor eax, 0x95ba257
inc edi
ret
popal
cmc

Function at 0x5ea61c
Capabilities:
Encode data using xor

Disassembly:
push ds
lahf
bound esi, qword [ebx + ebp*8 + 0x74f65ceb]
fsub qword [edi + 0x2d]
invalid
sbb bl, 0xab
pop esp
loopne 0x5ea5e0
inc ecx
mov ecx, 0x41b681cc
pop ebp
jne 0x5ea544
popal
and al, 0xba
outsb dx, byte [esi]
cmp edx, ebx
sahf
mov dword [0x8bce056f], eax
sahf
clc
movsd dword es:[edi], dword [esi]
add ax, dx
popal
and al, 0x72
mov ecx, 0x883c9731
mov esi, 0x3dac98f1
test byte [ebp + ebp*2 - 0x2c], dh
retf
push esp
or byte [edx + 0x50], ch
or al, 0x55
pop ebp
xchg edx, eax
jb 0x5ea5b2
adc dword [edi + 0x63dc8a12], 0xd640c0df
cdq
or dword [eax + 0x172ae201], eax
daa
pop ss
dec ebx
inc ebp
rcl byte [ebx], 0x81
xchg edx, esi
mov ch, 0x96
push eax
cdq
aam 0x70
mov byte [edi + 0x1cf46d7], dh
or al, 0x67
add dword [edi], ecx
sbb al, 0x9c
adc edx, eax
daa
or bl, byte [ebp - 0x5f]
popfd
cmp al, 0xf1
mov eax, 0xdb169550
xor eax, 0xee3a2030
pop ebx
mov ch, 0xcb
adc al, 0x48
salc
mov dl, ch
add eax, 0x2bebe967
mov edi, 0xbc44c937
adc dword [eax + 0x73], edi
fisttp qword [edi - 0x4a]
dec ebp
and dword [ebx - 1], 0x6221d68e
dec ecx
mov word [eax + 0x55ecc0c7], cs
add dword [edx - 0x30], edx
leave
jle 0x5ea64c
sub al, 0xb
sub dword [ebp + 0x67ce5039], esi
retf
Function at 0x5b039c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x3484eeb1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPCHealthErrorReportingDWInstalled
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3484ef09
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0
push 0
push str.DW0200
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x3484ef09
mov al, 1
jmp 0x3484ef0b
xor al, al
leave
ret 8

Function at 0x3484ef60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x3484ef6f
pop dword [ebp - 0x10]
mov eax, 0xf23c4cd9
add eax, 0x4248a296
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x53604c28
sub dword [ebp - 0x20], 0x50e06dd
mov dword [ebp - 0x1c], 0xab81cb23
add dword [ebp - 0x1c], 0x86b18122
mov dword [ebp - 0x18], 0xd19ab2d3
sub dword [ebp - 0x18], 0x854e6ea5
mov dword [ebp - 0x14], 0xb22e906e
add dword [ebp - 0x14], 0x4dd16f92
lea eax, [ebp - 0x20]
push eax
mov eax, 0xbda76dc6
add eax, 0x76ddb342
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xe4dd187f
add dword [ebp - 0x20], 0x8f9550d7
mov dword [ebp - 0x1c], 0xdd04d0d
add dword [ebp - 0x1c], 0x339c1468
mov dword [ebp - 0x18], 0xe5fdf074
sub dword [ebp - 0x18], 0x828e8408
mov dword [ebp - 0x14], 0x2b83c5cb
sub dword [ebp - 0x14], 0x2b83c5cb
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x5c185a7a
sub eax, 0x27933952
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x34c8a
push 0
call eax
mov ecx, 0x4026
xor edx, edx
add edx, eax
mov esi, 0xa6af947c
sub esi, 0x7228c47c
add esi, dword [ebp - 0x10]
mov ebx, 0x2b89dae
sub ebx, 0x93e64ddd
add dword [ebp - 4], edi
mov edi, dword [esi]
add dword [ebp - 4], eax
xor edi, ebx
sub dword [ebp - 4], 0xb52b4fd3
mov dword [edx], edi
mov dword [ebp - 0xc], 0x55edde51
add edx, 4
add esi, 0x949cf329
add esi, 0x6b630cdb
loop 0x3484f08d
add eax, 0xc1dd5c31
add eax, 0x3e23973a
mov ebx, eax
add eax, 5
mov ecx, 0xbe45966e
add ecx, 0x763b6992
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xb13008], 0x8088405
inc edx
mov dword [ebx + 0xb13008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cb9c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cbcd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cbb5
add dl, dl
jne 0x41cbd8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc29
xor eax, eax
add dl, dl
jne 0x41cbe5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ccc6
add dl, dl
jne 0x41cbf4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cbff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc0a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc15
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cc1f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cbc4
mov eax, 1
add dl, dl
jne 0x41cc37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc42
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc2e
sub eax, ebx
mov ebx, 1
jne 0x41cc75
mov ecx, 1
add dl, dl
jne 0x41cc5b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc66
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc52
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cc8c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc97
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc83
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cce7
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cbc4
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xafc56f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e161
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e14a
test esi, esi
jbe 0x41e161
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ac
test eax, eax
jne 0x41e13c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e161
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e119
jmp 0x41e161
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e161
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xafc576
ret
Function at 0x41e9a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0xafcf53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41e9df
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41e9f8
lea eax, [ebp - 0x10]
mov edx, dword [0xb15248]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ea0b
lea eax, [ebp - 0x10]
mov edx, dword [0xb15248]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ea17
adc edx, 0
mov edx, dword [edx*4 + 0xb140d8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406af4
mov esi, eax
cmp esi, 0xffffffff
je 0x41eb25
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41eb18
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d9c
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41eb18
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41eb18
cmp dx, 0x150
ja 0x41eb18
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41eb18
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406aac
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41eb3d
inc ebx
cmp ebx, 0x19
jne 0x41e9d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xafcf5a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret