joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456708
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
add ecx, 0x70
movzx eax, byte [esi + 0x68]
push eax
call fcn.0045206c
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x456736
lea eax, [esi + 0x38]
xor edx, edx
cmp ecx, eax
setne dl
mov eax, dword [ecx]
push edx
call dword [eax + 0x10]
mov dword [esi + 0x5c], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x456774
mov eax, dword [esi + 0x28]
sub eax, ecx
cmp eax, 0x1000
jb 0x45675f
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x4567ea
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.00471733
add esp, 8
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4567ae
mov eax, dword [esi + 0x18]
sub eax, ecx
cmp eax, 0x1000
jb 0x456799
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x4567ea
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.00471733
add esp, 8
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4567e8
mov eax, dword [esi + 0xc]
sub eax, ecx
cmp eax, 0x1000
jb 0x4567d3
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x4567ea
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.00471733
add esp, 8
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
pop esi
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
Function at 0x46e2bb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [esp + 0x2c], 0
js 0x46e44b
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
movzx eax, word [eax + 2]
xor edx, edx
mov dword [esp + 8], eax
test eax, eax
sete dl
mov ecx, 0x8a
mov eax, 7
cmove eax, ecx
mov dword [esp + 4], eax
mov eax, 4
sub eax, edx
mov dword [esp], eax
xor edx, edx
dec edx
xor edi, edi
xor esi, esi
mov ebp, dword [esp + 8]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xc], esi
movzx ecx, word [ecx + esi*4 + 6]
lea esi, [edi + 1]
cmp esi, dword [esp + 4]
mov dword [esp + 8], ecx
jge 0x46e32f
cmp ebp, ecx
jne 0x46e32f
mov ebp, edx
jmp 0x46e434
cmp esi, dword [esp]
jge 0x46e357
movzx eax, word [ebx + ebp*4 + 0xef6]
movzx ecx, word [ebx + ebp*4 + 0xef4]
push eax
push ecx
push ebx
call fcn.0046e453
add esp, 0xc
dec esi
jne 0x46e334
jmp 0x46e401
test ebp, ebp
je 0x46e3b4
cmp ebp, edx
je 0x46e37c
movzx eax, word [ebx + ebp*4 + 0xef6]
movzx ecx, word [ebx + ebp*4 + 0xef4]
push eax
push ecx
push ebx
call fcn.0046e453
add esp, 0xc
mov esi, edi
add esi, 0xfffffffd
xor eax, eax
cmp esi, 4
setb al
push str._3_6_
push eax
push ebx
call fcn.0046d6e7
add esp, 0xc
movzx eax, word [ebx + 0xf36]
movzx ecx, word [ebx + 0xf34]
push eax
push ecx
push ebx
call fcn.0046e453
add esp, 0xc
push 2
push esi
jmp 0x46e3f8
cmp edi, 9
jg 0x46e3d9
movzx eax, word [ebx + 0xf3a]
movzx ecx, word [ebx + 0xf38]
push eax
push ecx
push ebx
call fcn.0046e453
add esp, 0xc
add edi, 0xfffffffe
push 3
jmp 0x46e3f7
movzx eax, word [ebx + 0xf3e]
movzx ecx, word [ebx + 0xf3c]
push eax
push ecx
push ebx
call fcn.0046e453
add esp, 0xc
add edi, 0xfffffff6
push 7
push edi
push ebx
call fcn.0046e453
add esp, 0xc
xor esi, esi
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x46e425
xor eax, eax
cmp ebp, ecx
sete al
mov ecx, 4
sub ecx, eax
mov dword [esp], ecx
xor eax, 7
mov dword [esp + 4], eax
jmp 0x46e434
mov dword [esp], 3
mov dword [esp + 4], 0x8a
mov eax, dword [esp + 0xc]
lea ecx, [eax + 1]
mov edi, esi
mov edx, ebp
cmp eax, dword [esp + 0x2c]
mov esi, ecx
jne 0x46e306
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46ee5a
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
lea eax, [edi - 1]
xor ecx, ecx
cmp eax, 8
setb cl
push str.bad_pack_level
push ecx
push esi
call fcn.0046d6e7
add esp, 0xc
mov dword [esi + 0x6af78], 0
cmp dword [esi + 0x6af70], 0
jne 0x46eea5
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
lea eax, [esi + 0x4af70]
push 0x20000
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
movq xmm0, qword [edi*8 + 0x473f7c]
pshuflw xmm0, xmm0, 0x87
pxor xmm1, xmm1
punpcklwd xmm0, xmm1
movdqu xmmword [esi + 0x6af94], xmm0
mov ax, 4
cmp edi, 3
jl 0x46eeeb
mov ax, 2
cmp edi, 8
jl 0x46eef2
mov ecx, dword [esp + 0x14]
or word [ecx], ax
lea eax, [esi + 0x1af70]
xor ecx, ecx
mov dword [esi + 0x6af84], ecx
mov dword [esi + 0x6af74], ecx
push 0x10000
push eax
push esi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
lea ecx, [eax + 1]
cmp ecx, 1
ja 0x46ef37
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], 0
jmp 0x46ef88
mov dword [esi + 0x6af8c], 0
cmp eax, 0x105
ja 0x46ef51
push esi
call fcn.0046ef8b
add esp, 4
mov dword [esi + 0x6af7c], 0
mov al, 1
xor ecx, ecx
xor edx, edx
inc edx
xor edi, edi
shl ecx, 5
movzx edi, byte [esi + edi + 0x1af70]
and ecx, 0x7fe0
xor ecx, edi
mov dword [esi + 0x6af7c], ecx
mov edi, edx
test al, 1
mov eax, 0
jne 0x46ef64
pop esi
pop edi
ret
Function at 0x46ef8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x1c]
lea eax, [esi + 0x1af70]
mov dword [esp + 4], eax
lea eax, [esi + 0x22f70]
mov dword [esp], eax
mov eax, dword [esi + 0x6af90]
mov ebp, 0xffff8000
mov edi, dword [esi + 0x6af70]
mov ebx, dword [esi + 0x6af84]
add eax, ebx
sub edi, eax
cmp edi, 0xffffffff
je 0x46f093
cmp ebx, 0xfefa
jb 0x46f098
cmp dword [esi + 0x6af78], 0
je 0x46f098
push 0x8000
push dword [esp + 4]
push dword [esp + 0xc]
call sub.VCRUNTIME140.dll_memcpy
movdqa xmm4, xmmword [0x473df0]
movdqa xmm3, xmmword [0x473d90]
movdqa xmm2, xmmword [0x473de0]
add esp, 0xc
add dword [esi + 0x6af88], ebp
add ebx, ebp
mov dword [esi + 0x6af84], ebx
add dword [esi + 0x6af74], ebp
xor eax, eax
movdqu xmm0, xmmword [esi + eax*4 + 0x4af70]
movdqa xmm1, xmm0
psubd xmm1, xmm2
pxor xmm0, xmm3
pcmpgtd xmm0, xmm4
pand xmm0, xmm1
movdqu xmmword [esi + eax*4 + 0x4af70], xmm0
add eax, 4
cmp eax, 0x8000
jne 0x46f029
xor eax, eax
movdqu xmm0, xmmword [esi + eax*4 + 0x2af70]
movdqa xmm1, xmm0
psubd xmm1, xmm2
pxor xmm0, xmm3
pcmpgtd xmm0, xmm4
pand xmm0, xmm1
movdqu xmmword [esi + eax*4 + 0x2af70], xmm0
add eax, 4
cmp eax, 0x8000
jne 0x46f05b
add edi, 0x8000
jmp 0x46f098
mov edi, 0xfffffffe
cmp dword [esi + 0x6af8c], 0
jne 0x46f10a
xor eax, eax
cmp edi, 2
setae al
push str.more___2
push eax
push esi
call fcn.0046d6e7
add esp, 0xc
mov eax, dword [esi + 0x6af84]
add eax, esi
mov ecx, dword [esi + 0x6af90]
add eax, ecx
add eax, 0x1af70
push edi
push eax
push esi
call dword [esi + 0xc]
add esp, 0xc
lea ecx, [eax + 1]
cmp ecx, 1
jbe 0x46f100
add eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af90], eax
cmp eax, 0x105
ja 0x46f10a
cmp dword [esi + 0x6af8c], 0
je 0x46efb4
jmp 0x46f10a
mov dword [esi + 0x6af8c], 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47017c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x470273
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
not eax
cmp edx, 8
jb 0x470251
mov esi, 0xff
movzx edi, byte [ecx]
mov ebx, eax
and ebx, esi
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x473fcc]
movzx edi, byte [ecx + 1]
mov ebx, eax
and ebx, esi
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x473fcc]
movzx edi, byte [ecx + 2]
mov ebx, eax
and ebx, esi
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x473fcc]
movzx edi, byte [ecx + 3]
mov ebx, eax
and ebx, esi
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x473fcc]
movzx edi, byte [ecx + 4]
mov ebx, eax
and ebx, esi
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x473fcc]
movzx edi, byte [ecx + 5]
mov ebx, eax
and ebx, esi
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x473fcc]
movzx edi, byte [ecx + 6]
mov ebx, eax
and ebx, esi
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x473fcc]
movzx edi, byte [ecx + 7]
add ecx, 8
mov ebx, eax
and ebx, esi
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x473fcc]
add edx, 0xfffffff8
cmp edx, 7
ja 0x4701a3
test edx, edx
je 0x47026f
xor esi, esi
movzx edi, byte [ecx + esi]
movzx ebx, al
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x473fcc]
inc esi
cmp edx, esi
jne 0x470257
not eax
jmp 0x470275
xor eax, eax
pop esi
pop edi
pop ebx
ret

Function at 0x470279
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
movzx eax, byte [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov esi, dword [ecx + 8]
mov edi, 0xff
mov ebx, edx
and ebx, edi
xor ebx, eax
shr edx, 8
xor edx, dword [ebx*4 + 0x473fcc]
mov dword [ecx], edx
and edx, edi
add edx, dword [ecx + 4]
imul eax, edx, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
and edi, esi
xor edi, eax
shr esi, 8
xor esi, dword [edi*4 + 0x473fcc]
mov dword [ecx + 8], esi
pop esi
pop edi
pop ebx
ret
Function at 0x470473
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov ebp, dword [esp + 0x60]
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x47057d
mov edi, dword [esp + 0x64]
mov eax, dword [esp + 0x18]
xor ecx, ecx
test al, 1
sete cl
test al, 0x10
mov edx, closesocket
mov esi, 0x40000000
cmove esi, edx
shl ecx, 0x17
and eax, 0x37
or eax, esi
lea ebx, [ecx + eax]
add ebx, 0x1000000
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x29
jb 0x47059b
mov dword [esp + 4], eax
mov dword [esp], ebx
xor edi, edi
push edi
push edi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea esi, [esp + 0x14]
lea eax, [esp + 0xa]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push esi
push 2
push eax
push ebp
call ebx
push edi
push edi
push 0x24
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0xc]
push edi
push esi
push 4
push eax
push ebp
call ebx
lea eax, [esp + 0xa]
movzx eax, word [eax]
cmp eax, 0x54ad
jne 0x470587
mov edx, dword [esp + 0xc]
lea ecx, [edx + 0x34]
mov eax, dword [esp + 4]
cmp eax, ecx
jbe 0x470594
xor edi, edi
push edi
push edi
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea esi, [esp + 0x10]
push edi
lea eax, [esp + 0x18]
push eax
push 4
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi]
lea ecx, [eax - 0x454c]
cmp ecx, 4
ja 0x470567
mov edx, 0x15
bt edx, ecx
jb 0x47056e
cmp eax, 0x5a4d
jne 0x470587
mov ebx, dword [esp]
or ebx, 0x400000
mov edi, dword [esp + 0x64]
jmp 0x47058e
mov eax, 0x200
jmp 0x470625
mov edi, dword [esp + 0x64]
mov ebx, dword [esp]
mov eax, dword [esp + 4]
jmp 0x47059b
mov edi, dword [esp + 0x64]
mov ebx, dword [esp]
mov ecx, dword [esp + 0x68]
test edi, edi
je 0x4705a5
mov dword [edi], ebx
mov edi, dword [esp + 0x6c]
test ecx, ecx
je 0x4705af
mov dword [ecx], eax
mov esi, dword [esp + 0x70]
test edi, edi
je 0x4705f8
push dword [esp + 0x28]
push dword [esp + 0x28]
call fcn.004703e2
add esp, 8
mov dword [edi + 4], edx
mov dword [edi], eax
push dword [esp + 0x30]
push dword [esp + 0x30]
call fcn.004703e2
add esp, 8
mov dword [edi + 0xc], edx
mov dword [edi + 8], eax
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.004703e2
add esp, 8
mov dword [edi + 0x14], edx
mov dword [edi + 0x10], eax
test esi, esi
je 0x470623
lea edi, [esp + 0x10]
lea ebx, [esp + 0xc]
push edi
push ebx
push dword [esp + 0x38]
push dword [esp + 0x38]
call fcn.00470403
add esp, 0x10
movzx eax, word [edi]
movzx ecx, word [ebx]
shl ecx, 0x10
or ecx, eax
mov dword [esi], ecx
xor eax, eax
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4707c2
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, ecx
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
cmp byte [ecx + 0x2d], 0
je 0x470831
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x4707ec
cmp dword [edi + 0x40], esi
jae 0x4707fe
push eax
call fcn.0047176d
add esp, 4
lea eax, [esi + esi]
push eax
call fcn.00471764
add esp, 4
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], esi
push esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
test esi, esi
je 0x47082e
lea ebx, [edi + 0x30]
xor ebp, ebp
mov eax, dword [edi + 0x3c]
movsx eax, byte [eax + ebp]
push eax
push ebx
call fcn.004702e0
add esp, 8
mov ecx, dword [edi + 0x3c]
mov byte [ecx + ebp], al
inc ebp
cmp esi, ebp
jne 0x470812
mov ebx, dword [edi + 0x3c]
mov eax, dword [edi + 0x20]
test eax, eax
je 0x470855
mov ecx, dword [edi + 0x24]
lea edx, [ecx + esi]
cmp edx, dword [edi + 0x28]
jae 0x47086e
add eax, ecx
push esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [edi + 0x24], esi
jmp 0x470880
mov eax, dword [edi + 4]
test eax, eax
je 0x470877
mov edi, esp
push 0
push edi
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [edi]
jmp 0x470880
mov dword [edi + 0x14], 0x30000
jmp 0x47087e
mov dword [edi + 0x14], 0x1000000
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x470d74
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x84]
test ecx, ecx
je 0x470dce
mov ebp, dword [esi + 0x88]
mov edx, dword [esi + 0x8c]
xor edi, edi
sub ebp, edx
jbe 0x470e08
cmp ebp, eax
cmova ebp, eax
add ecx, edx
push ebp
push ecx
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [esi + 0x8c], ebp
add dword [esi + 0x74], ebp
push ebp
push ebx
push dword [esi + 0x78]
call fcn.0047017c
add esp, 0xc
mov dword [esi + 0x78], eax
mov edi, ebp
jmp 0x470e08
mov ecx, dword [esi + 0x7c]
test ecx, ecx
je 0x470dff
mov edx, esp
push 0
push edx
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x470e06
mov edi, dword [esp]
add dword [esi + 0x74], edi
push edi
push ebx
push dword [esi + 0x78]
call fcn.0047017c
add esp, 0xc
mov dword [esi + 0x78], eax
jmp 0x470e08
mov dword [esi + 0x14], 0x1000000
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10003ebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10003ece
pop dword [ebp - 8]
mov eax, 0x28d51194
sub eax, 0x18d4d2c6
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x5f56f2a3
sub dword [ebp - 0x18], 0x1104ad58
mov dword [ebp - 0x14], 0x608787b1
add dword [ebp - 0x14], 0xd1abc494
mov dword [ebp - 0x10], 0x2e49058a
sub dword [ebp - 0x10], 0xe1fcc15c
mov dword [ebp - 0xc], 0xa92ad3
sub dword [ebp - 0xc], 0xa92ad3
lea eax, [ebp - 0x18]
push eax
mov eax, 0x3df10f45
add eax, 0xd20f40ff
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xaae90798
sub dword [ebp - 0x18], 0x36769e42
mov dword [ebp - 0x14], 0x69dd7b24
sub dword [ebp - 0x14], 0x287119af
mov dword [ebp - 0x10], 0xd83f8a51
sub dword [ebp - 0x10], 0x74d01de5
mov dword [ebp - 0xc], 0x58e194f5
add dword [ebp - 0xc], 0xa71e6b0b
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x92c3bced
add eax, 0x7d3c9353
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x375c2
push 0
call eax
mov ecx, 0xae3e1b1d
sub ecx, 0xae3dd035
xor edx, edx
add edx, eax
mov edi, 0x1000b600
add edi, dword [ebp - 8]
mov esi, 0x8be5b4d4
sub esi, 0xe2b8ff2d
mov dword [ebp - 4], 0xbbbc3b1d
mov ebx, dword [edi]
sub dword [ebp - 4], 0x84156915
xor ebx, esi
sub dword [ebp - 4], 0x7964f853
mov dword [edx], ebx
add edx, 4
add edi, 0xe993cdd3
add edi, 0x166c3231
loop 0x10003fec
add eax, 0x5c5bf2c1
sub eax, 0x5c5ad44e
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0xa5f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a5f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa5f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa5f06a
add dl, dl
jne 0xa5f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa5f0dc
xor eax, eax
add dl, dl
jne 0xa5f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa5f17d
add dl, dl
jne 0xa5f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa5f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa5f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa5f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa5f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa5f075
mov eax, 1
add dl, dl
jne 0xa5f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa5f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa5f0e1
sub eax, ebx
mov ebx, 1
jne 0xa5f128
mov ecx, 1
add dl, dl
jne 0xa5f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa5f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa5f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa5f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa5f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa5f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa5f136
cmp eax, 0x7d00
jae 0xa5f16d
cmp eax, 0x500
jb 0xa5f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa5f075
cmp eax, 0x7f
ja 0xa5f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa5f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa5f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa5f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d5b0f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x24]
push eax
call fcn.005a4799
mov ecx, dword [esp + 0x30]
mov esi, eax
push ecx
mov edi, edx
call fcn.005a4799
mov ecx, dword [0x666d08]
add esp, 8
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x18], 3
add ecx, 0xfffffffc
cmp ecx, 0xf
ja case.default.0x405ad4
jmp dword [ecx*4 + 0x405d40]

Function at 0x405e40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d5b77
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
mov dword [esp + 8], 0
push ecx
lea eax, [ebp + 0x14]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
mov dword [esp + 0x30], 2
call fcn.005c095d
push ecx
lea edx, [ebp + 0xc]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
mov byte [esp + 0x34], 3
call fcn.005c095d
mov ecx, esi
mov byte [esp + 0x30], 2
call fcn.00405d80
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.005a4ab4
mov ecx, dword [ebp + 0x14]
fstp qword [esp + 0x18]
push ecx
call fcn.005a4ab4
mov edx, dword [0x666d08]
add esp, 8
fstp qword [esp + 0xc]
mov dword [esp + 4], edx
mov eax, dword [ebp + 0x10]
mov byte [esp + 0x28], 4
add eax, 0xfffffffc
cmp eax, 0xf
ja case.default.0x405edf
jmp dword [eax*4 + 0x4061c4]
Function at 0x408c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d5f4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x666d08]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
mov dword [ecx], eax
xor edi, edi
push 0x66b9a0
mov dword [esp + 0x1c], edi
call fcn.005c0d71
lea ecx, [esp + 0xc]
or eax, 0xffffffff
mov dword [esi + 0x10], edi
push ecx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov dword [esi + 8], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x14], edi
mov dword [esi], edi
call fcn.005bd5d8
lea edx, [esp + 0xc]
push edx
call fcn.005bd5d8
lea eax, [esp + 0xc]
push eax
call fcn.005bd5d8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x408c7d
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d5f4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x666d08]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
mov dword [ecx], eax
xor edi, edi
push 0x66b9a0
mov dword [esp + 0x1c], edi
call fcn.005c0d71
lea ecx, [esp + 0xc]
or eax, 0xffffffff
mov dword [esi + 0x10], edi
push ecx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov dword [esi + 8], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x14], edi
mov dword [esi], edi
call fcn.005bd5d8
lea edx, [esp + 0xc]
push edx
call fcn.005bd5d8
lea eax, [esp + 0xc]
push eax
call fcn.005bd5d8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x408d00
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d5f70
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
xor ebx, ebx
lea eax, [edi + 0x2c]
mov dword [esp + 0x18], ebx
push eax
push ecx
push edx
call fcn.005c0e7d
push eax
lea ecx, [esi + 4]
mov byte [esp + 0x1c], 1
call fcn.005c0d21
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], bl
call fcn.005c0be8
mov eax, dword [edi]
push 1
mov dword [esi + 8], eax
mov ecx, dword [edi + 0x1c]
push ebx
push ebx
push ecx
call fcn.005a4a80
mov ecx, dword [edi + 0x20]
xor ebp, ebp
add eax, ecx
mov dword [esi + 0x30], ebx
adc edx, ebp
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
lea edx, [esi + 0x18]
lea eax, [edi + 4]
push edx
push eax
mov dword [esi + 0x2c], ebx
call fcn.00408dd0
lea ecx, [esi + 0x1c]
lea edx, [edi + 0xc]
push ecx
push edx
call fcn.00408dd0
lea eax, [esi + 0x20]
add edi, 0x14
push eax
push edi
call fcn.00408dd0
mov ecx, dword [esp + 0x40]
add esp, 0x18
mov dword [esi], ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call fcn.005c0be8
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x414940
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5d7738
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x50]
push eax
mov eax, dword [esi + 0x54]
push ecx
push edx
push eax
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov dword [esp + 0x2c], 1
call fcn.005c095d
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x30], 2
call fcn.005c095d
mov edx, dword [esi]
mov ecx, esi
mov byte [esp + 0x2c], 1
call dword [edx + 8]
lea ecx, [esp + 0x1c]
mov esi, eax
mov byte [esp + 0x14], 0
call fcn.005c0be8
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 0xffffffff
call fcn.005c0be8
mov ecx, dword [esp + 0xc]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 8

Function at 0x4164bd
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d7bdb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x666d08]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
mov dword [ecx], eax
xor edi, edi
push 0x66b9a0
mov dword [esp + 0x1c], edi
call fcn.005c0d71
lea ecx, [esp + 0xc]
or eax, 0xffffffff
mov dword [esi + 0x10], edi
push ecx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov dword [esi + 8], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x14], edi
mov dword [esi], edi
call fcn.005bd5d8
lea edx, [esp + 0xc]
push edx
call fcn.005bd5d8
lea eax, [esp + 0xc]
push eax
call fcn.005bd5d8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret