joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001247
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.01003600
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
je 0x10012b4
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100122c
sub eax, ecx
mov dword [ebp - 4], eax
lea eax, [eax + eax + 2]
push eax
push ebx
call esi
push eax
call edi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x10012b4
mov eax, dword [ebp - 4]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
add eax, eax
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
jl 0x10012a7
push dword [ebp - 4]
lea eax, [ebp - 4]
push dword [ebp - 8]
push eax
push 0x1fff
lea eax, [ebp - 0x200c]
push eax
jmp loc.0100a525
push dword [ebp - 8]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jne 0x10012c1
jmp loc.0100a20d
push ebx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push 0x400
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [ebp - 4], eax
lea eax, [eax + eax + 2]
push eax
push ebx
call esi
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x100134d
mov eax, dword [ebp - 4]
push eax
push dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
add eax, eax
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
jl 0x100134d
push dword [ebp - 4]
lea eax, [ebp - 4]
push esi
push eax
push 0x1fff
lea eax, [ebp - 0x200c]
push eax
jmp loc.0100b8dd
push 1
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x1001447
Capabilities:
Terminate process

Disassembly:
push dword [esp + 4]
jmp loc.0100b3be

Function at 0x1001d90
Capabilities:
Packed with generic packer

Disassembly:
push ebx
xor ebx, ebx
cmp dword [0x10065d4], ebx
push esi
push edi
jne 0x1001de3
mov eax, dword [0x1006604]
push 2
cdq
pop ecx
idiv ecx
mov esi, edx
imul esi, esi, 0x1c
add esi, 0x1006080
lea edi, [esi + 4]
cmp dword [edi], ebx
jmp loc.0100bcc4
cmp dword [0x1006610], ebx
je 0x1001e3f
mov eax, dword [0x1006604]
push 2
cdq
pop ecx
idiv ecx
mov esi, edx
imul esi, esi, 0x1c
add esi, 0x1006080
lea edi, [esi + 4]
cmp dword [edi], ebx
jne 0x1001e3f
push 1
push edi
lea eax, [esi + 8]
push eax
push dword [0x1006114]
jmp loc.0100b909
inc dword [0x1006604]
pop edi
pop esi
pop ebx
ret

Function at 0x1002142
Capabilities:
Get disk size

Disassembly:
inc eax
test cl, cl
jne 0x1002128
lea eax, [ebp - 0x3ec]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_strchr]
test eax, eax
pop ecx
pop ecx
je 0x100214b
and byte [eax + 1], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x3ec]
push eax
call esi
test eax, eax
jne 0x1002183
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0
call esi
mov eax, dword [ebp - 4]
pop esi
leave
ret 4
Function at 0x1002363
Capabilities:
Packed with generic packer

Disassembly:
push ecx
mov eax, dword [0x10060e0]
cmp eax, dword [0x1006130]
jne 0x1002362
jmp fcn.0100a876
push ebx
push ebp
push esi
push edi
jmp fcn.0100aaf5

Function at 0x10025f0
Capabilities:
Encrypt data using speck
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [0x1006124]
push edi
mov edi, dword [0x10060c0]
push edi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
jmp loc.0100bb9c

Function at 0x100294c
Capabilities:
Packed with generic packer
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100612c]
cmp eax, 2
push ebx
push esi
push edi
mov edi, dword [0x10060cc]
mov dword [ebp - 4], edi
jne 0x10029ae
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
mov ebx, eax
shl ebx, 1
pop ecx
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x10065d4], 0
mov edi, dword [ebp - 4]
mov eax, edi
jne 0x100299e
and word [ebx + eax], 0
inc ebx
inc ebx
jmp 0x1002a0e
mov word [ebx + eax], 0xd
inc ebx
inc ebx
mov word [ebx + eax], 0xa
jmp 0x100299a
cmp eax, 1
jne 0x10029d1
xor eax, eax
push eax
push eax
jmp 0x100a81a
mov esi, dword [ebp + 8]
mov ebx, esi
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x10029d9
sub ebx, ecx
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
jmp 0x100a971
mov eax, dword [0x1006194]
mov dword [ebp + 8], eax
mov eax, dword [0x10060c4]
sub eax, dword [ebp + 8]
mov dword [ebp - 8], ebx
cmp ebx, eax
jl 0x1002a28
mov dword [ebp - 8], eax
jmp 0x100a297

Function at 0x1002eea
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x3c]
push esi
mov esi, dword [ebx + 0x28]
mov eax, ecx
sub eax, esi
cdq
add eax, dword [ebx + 0x30]
adc edx, dword [ebx + 0x34]
cmp edx, dword [ebx + 0x44]
jl 0x1002f18
jg 0x1002f11
cmp eax, dword [ebx + 0x40]
jb 0x1002f18
xor eax, eax
jmp 0x100b230
mov eax, dword [ebx + 0x38]
add eax, esi
cmp ecx, eax
jne 0x1002f27
push ebx
call fcn.01002e4b
mov eax, dword [ebx + 0x28]
add eax, dword [ebx + 0x38]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push edi
mov edx, dword [0x1006060]
sub edx, dword [ebp - 4]
mov esi, dword [ebx + 0x3c]
add edx, esi
cmp eax, edx
mov ecx, esi
jbe 0x1002f4c
mov eax, edx
cmp dword [0x10061c8], 2
jne 0x1002f77
cmp esi, eax
mov ecx, esi
jae 0x1002f67
cmp word [ecx], 0
je 0x1002f67
inc ecx
inc ecx
cmp ecx, eax
jb 0x1002f5b
mov edi, ecx
sub edi, esi
cmp ecx, eax
mov dword [ebp + 8], edi
je 0x1002f92
add ecx, 2
jmp 0x1002f98
cmp esi, eax
jae 0x1002f85
cmp byte [ecx], 0
je 0x1002f85
inc ecx
cmp ecx, eax
jb 0x1002f7b
mov edx, ecx
sub edx, esi
cmp ecx, eax
mov dword [ebp + 8], edx
mov edi, edx
jne 0x1002f97
mov dword [ebx + 0x3c], ecx
jmp 0x1002fa8
inc ecx
cmp dword [ebp - 4], 0
mov dword [ebp - 8], 1
mov dword [ebx + 0x3c], ecx
je 0x1003005
jmp 0x100b149
mov ecx, dword [0x10061c8]
jmp 0x100b6e8
Function at 0x1002f3a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x3c]
push esi
mov esi, dword [ebx + 0x28]
mov eax, ecx
sub eax, esi
cdq
add eax, dword [ebx + 0x30]
adc edx, dword [ebx + 0x34]
cmp edx, dword [ebx + 0x44]
jl 0x1002f18
jg 0x1002f11
cmp eax, dword [ebx + 0x40]
jb 0x1002f18
xor eax, eax
jmp 0x100b230
mov eax, dword [ebx + 0x38]
add eax, esi
cmp ecx, eax
jne 0x1002f27
push ebx
call fcn.01002e4b
mov eax, dword [ebx + 0x28]
add eax, dword [ebx + 0x38]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push edi
mov edx, dword [0x1006060]
sub edx, dword [ebp - 4]
mov esi, dword [ebx + 0x3c]
add edx, esi
cmp eax, edx
mov ecx, esi
jbe 0x1002f4c
mov eax, edx
cmp dword [0x10061c8], 2
jne 0x1002f77
cmp esi, eax
mov ecx, esi
jae 0x1002f67
cmp word [ecx], 0
je 0x1002f67
inc ecx
inc ecx
cmp ecx, eax
jb 0x1002f5b
mov edi, ecx
sub edi, esi
cmp ecx, eax
mov dword [ebp + 8], edi
je 0x1002f92
add ecx, 2
jmp 0x1002f98
cmp esi, eax
jae 0x1002f85
cmp byte [ecx], 0
je 0x1002f85
inc ecx
cmp ecx, eax
jb 0x1002f7b
mov edx, ecx
sub edx, esi
cmp ecx, eax
mov dword [ebp + 8], edx
mov edi, edx
jne 0x1002f97
mov dword [ebx + 0x3c], ecx
jmp 0x1002fa8
inc ecx
cmp dword [ebp - 4], 0
mov dword [ebp - 8], 1
mov dword [ebx + 0x3c], ecx
je 0x1003005
jmp 0x100b149
mov ecx, dword [0x10061c8]
jmp 0x100b6e8
Function at 0x100a8f7
Capabilities:
Get disk size

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x100a940
Capabilities:
Encrypt data using speck
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x100a964
Capabilities:
Terminate process

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x100ae35
Capabilities:
Read file on windows

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
invalid
Function at 0x100aeab
Capabilities:
Get disk size
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x100b13c
Capabilities:
Terminate process

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
and eax, 0xbfffffff
cmp ax, 6
add esp, 0xc
leave
popal
popfd
jmp fcn.010019d4

Function at 0x100b3af
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [0x10060ec]
cmp ecx, eax
jge 0x1001d70
mov eax, ecx
cdq
idiv dword [0x1004004]
imul edx, edx, 0x1c
add edx, edi
lea esi, [edx + 4]
cmp dword [esi], ebx
jne 0x1001cdd
push 1
push esi
add edx, 8
push edx
push dword [0x1006614]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1001cdd
push ebx
push dword [0x1006608]
call fcn.01001200
mov eax, dword [0x10060ec]
cdq
idiv dword [0x1004004]
mov esi, dword [esi]
inc dword [0x10060ec]
mov eax, dword [edx*4 + 0x10060d8]
jmp fcn.0100aec4
mov dword [0x10065d8], 1
jmp 0x1001d8b
pop edi
pop esi
pop ebx
leave
ret
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
push 0x8001
push 8
push 0x2b4
push eax
push 0x40931c
push 0x409304
push 0x46ad20
push eax
mov edi, 0x4c3000
push edi
mov eax, edi
add esp, 0x30
leave
popal
popfd
jge 0x1001c97
jmp fcn.01001bc5

Function at 0x100b737
Capabilities:
Terminate process

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
mov eax, 0x10011000
push 0xd311600f
push 0x40
push 0x3000
push 0x61fb
push 0
mov ebx, 0x323
mov edi, eax
push eax
add esp, 0x18
leave
popal
popfd
mov edi, ecx
adc edi, dword [esp + 0x10]
jmp loc.010025ca

Function at 0x100b924
Capabilities:
Get memory capacity

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
xor eax, eax
mov ecx, 0x11
push edi
push ebx
mov edi, edx
mov eax, 0x30
and eax, 0xfffffff0
add esp, 8
leave
popal
popfd
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp fcn.01001e1b
Function at 0x100baf6
Capabilities:
Terminate process

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
call fcn.0100200a
jmp loc.01002919
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x639008], 0x8088405
inc edx
mov dword [ebx + 0x639008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d330
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d361
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d349
add dl, dl
jne 0x41d36c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d3bd
xor eax, eax
add dl, dl
jne 0x41d379
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d45a
add dl, dl
jne 0x41d388
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d393
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d39e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d3a9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d3b3
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d358
mov eax, 1
add dl, dl
jne 0x41d3cb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d3d6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3c2
sub eax, ebx
mov ebx, 1
jne 0x41d409
mov ecx, 1
add dl, dl
jne 0x41d3ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d3fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3e6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d358
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d420
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d42b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d417
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d358
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d47b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d358
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f5a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x61ca8e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f5ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f60e
mov ecx, edx
add ecx, ebx
jmp 0x41f60e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f60e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f680
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f669
test esi, esi
jbe 0x41f680
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f65b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f680
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f638
jmp 0x41f680
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f680
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61ca95
ret
Function at 0x4207ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x61de07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420827
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x420840
lea eax, [ebp - 0x10]
mov edx, dword [0x63b77c]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x420853
lea eax, [ebp - 0x10]
mov edx, dword [0x63b77c]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42085f
adc edx, 0
mov edx, dword [edx*4 + 0x63a568]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4209d9
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4209cc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4209cc
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x42096a
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x42096a
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x42096a
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x42096a
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4209cc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4209cc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4209cc
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4209cc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4209f1
inc ebx
cmp ebx, 0x19
jne 0x420819
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61de0e
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret