joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5debfc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005eaef2
add esp, 0xc
ror esp, 0
not edx
not edx
ror ebx, 0x14
rol ebx, 0x14
jg 0x5dec24
jle 0x5dec43
pushf
call fcn.005dec2d

Function at 0x5dfe1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005eaef2
add esp, 0xc
dec ecx
inc ecx
jo 0x5dfe42
cmp esi, dword [esp]
jb 0x5dfe52
js 0x5dfe49
lea esp, [esp]
jle 0x5dfe4e
jae 0x5dfe52
mov edi, 0xe845c6ba
push ecx
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
clc
xor ecx, dword [esp]
xor ecx, dword [esp]
cmp edx, dword [esp]
jl 0x5dff18
pushf
jae 0x5dff0b
popf
jne 0x5dff0f
xchg ebx, ecx
xchg ebx, ecx
mov ebx, ebx
jge 0x5dff18
add eax, 0x3993e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.005e38b0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5dff2d
xor eax, eax
jmp 0x5dffb7
add esp, 0
xchg edi, edx
xchg edi, edx
jg 0x5dff36
rol edx, 0
jns 0x5dff55
pushf
ror ebx, 0x12
rol ebx, 0x12
test dword [esp], ebx
ror edx, 1
rol edx, 1
dec ecx
inc ecx
popf
jno 0x5dff50
mov edi, edi
js 0x5dff55
mov ebp, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.005cb5eb
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.005eaef2
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x5dff7f
xor eax, eax
jmp 0x5dffb7
jmp 0x5dff81
xchg ecx, esi
xchg ecx, esi
jge 0x5dff8f
jge 0x5dff89
jae 0x5dff8b
jl 0x5dff8f
call 0xfcb38b2b
mov edx, dword [ebp - 4]
push edx
call fcn.005e7465
add esp, 4
mov edi, edi
jno 0x5dff9f
jns 0x5dffac
pushf
mov eax, eax
popf
mov eax, eax
js 0x5dffac
add eax, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5e215d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x5c22ec], 1
jne 0x5e22ef
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005eaef2
add esp, 0xc
shl esp, 0
cmp esp, 0x5659
nop
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
jne 0x5e21a1
jnp 0x5e2199
xchg esp, esp
mov ebx, ebx
je 0x5e21a1
lcall 0xc648, 0xe845c659
inc ebp
in eax, dx
insd dword es:[edi], dx
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
push ebx
add ebx, 0x14db
ror ebx, 4
pop ebx
js 0x5e21de
jne 0x5e21e0
cmp edi, 0x1bd1
je 0x5e2200
pushf
ror eax, 0
popf
jp 0x5e21f1
lea eax, [eax + 0x769f]
lea eax, [eax - 0x769f]
jne 0x5e2200
sub eax, 0x80e84d8a
jmp 0xe8abaa0a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.005e38b0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5e2275
xor eax, eax
jmp 0x5e2355
and esp, 0xffffffff
push eax
pop eax
ror edi, 0
xchg edi, eax
xchg edi, eax
jae 0x5e2289
mov eax, eax
xchg ebx, ebx
jb 0x5e2289
mov eax, 0xe8458d7f
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.005cb5eb
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.005eaef2
add esp, 0xc
add edi, 0x137f
sub edi, 0x137f
test edx, ebx
lea edi, [edi + 0x7ff1]
lea edi, [edi - 0x7ff1]
jb 0x5e22d9
mov esp, esp
jl 0x5e22c9
nop
lea ebx, [ebx + 0x4215]
lea ebx, [ebx - 0x4215]
jae 0x5e22d9
mov esi, 0xf87d83
cmp dword [ebp - 8], 0
je 0x5e22e9
mov eax, dword [ebp - 8]
mov dword [0x5c22ec], eax
jmp 0x5e22ed
xor eax, eax
jmp 0x5e2355
jmp 0x5e22f8
mov ecx, dword [0x5c22ec]
mov dword [ebp - 8], ecx
lea ebx, [ebx + 0x5ea7]
lea ebx, [ebx - 0x5ea7]
sub esp, 0
je 0x5e231c
pushf
jg 0x5e230d
test dword [esp + 0x10], eax
jo 0x5e2313
popf
jno 0x5e2317
jle 0x5e2319
jne 0x5e231c
mov esi, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov esp, esp
jno 0x5e233e
pushf
test ebx, 0x21f9
inc esi
dec esi
xor ecx, esi
xor ecx, esi
shl edi, 0
popf
jmp 0x5e233b
jo 0x5e233e
mov ecx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.005e7465
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5e5376
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005eaef2
add esp, 0xc
jl 0x5e5391
je 0x5e53a7
pushf
test esp, 0x293f
je 0x5e539d
rol eax, 0
popf
jmp 0x5e53a4
jne 0x5e53a7
mov ebp, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
call fcn.005e53f8
Function at 0x5e8ef6
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x5c1ca0
call fcn.005def52
add esp, 0xc
mov byte [0x5c1ca0], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x4102f8
Capabilities:
Encode data using xor

Disassembly:
add byte [edx], cl
or al, byte [edx]
adc ecx, dword [ecx]
push ss
adc ecx, dword [edx]
cmp al, cl
add byte [eax], al
add byte [ecx], dl
or dword [ecx], edx
or bl, byte [edx + 0x1718070b]
push ss
adc al, byte [edx]
pop ss
lea ebp, [ecx]
add byte [eax], al
add dword [ebx], edx
or edx, dword [ecx]
or edx, dword [esi]
pop ds
sub bl, byte [ebp + 0x1d280b11]
add byte [eax], al
push es
or eax, 0xa86f09
add byte [edx], cl
pop ss
xor cl, byte [esi]
or dword [edi - 0x58], ebp
add byte [eax], al
or bl, byte [eax]
inc byte [edx]
push ss
inc byte [ecx]
sub eax, dword [ecx]
push ss
jb 0x4102ef
invalid
adc eax, 0x16287000
add byte [eax], al
or cl, byte [ecx]
push ss
outsd dx, dword [esi]
test eax, 0x740a0000
or dh, byte [eax + ebp]
add byte [ecx], al
sub byte [eax], ah
add byte [eax], al
push es
adc eax, dword [ecx + ecx]
push ss
outsd dx, dword [esi]
test eax, 0x740a0000
sub byte [eax], al
add byte [ecx], al
adc dword [ebx + eax], eax
sub byte [edx], dh
add byte [esi], al
adc eax, dword [0x11030511]
add al, 0x28
jae 0x410372
add byte [esi], al
adc eax, dword [esi]
adc dword [0x6f090713], eax
test al, 0
add byte [edx], cl
pop ss
xor dword [ecx], ebp
or dword [edi], edx
outsd dx, dword [esi]
test eax, 0x740a0000
sub byte [eax], al
add byte [ecx], al
sub byte [eax], ah
add byte [eax], al
push es
adc eax, dword [ecx + ecx]
pop ss
outsd dx, dword [esi]
test eax, 0x740a0000
sub byte [eax], al
add byte [ecx], al
adc dword [ebx + eax], eax
sub byte [edx], dh
add byte [esi], al
adc eax, dword [edi]
adc dword [esi], eax
adc dword [edi], eax
jae 0x4103f5
add byte [eax], al
push es
adc ecx, dword [eax]
push es
adc dword [eax], ecx
outsd dx, dword [esi]
wait
add byte [eax], al
or dl, byte [ecx]
or dl, byte [edi]
pop eax
adc ecx, dword [edx]
adc dword [edx], ecx
adc dword [ecx], ecx
mov gs, word [ecx + 0x3f]
sub eax, 0x6ffffff
Function at 0x407d20
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x790808f9
or byte [edx], al
out 8, eax
or byte [eax], cl
or byte [eax], cl
add byte [eax], cl
or byte [eax], cl
or byte [eax + ecx + 8], cl
or byte [ebp + 0x8080808], dh
or byte [eax], cl
or byte [eax], cl
int1
add eax, 0x8fe0887
or byte [eax], cl
test eax, 0x90909090
or eax, 0x8b559090
in al, dx
sub esp, 0xfffffff3
push esi
lea eax, [ebp - 0x58]
arpl word [ebx + 0x4dc2107d], cx
cld
mov dh, 0x8b
add byte [eax + edx*8], cl
push ebp
or al, 0x51
mov ecx, dword [ebp + 8]
push edx
push edi
push eax
push ecx
call 0x6d407ec0
dec ebp
cld
mov edx, dword [ebp + 0x52]
add esp, 0x18
mov esi, ecx
into
clc
test ecx, ecx
mov esi, edx
je 0x407d4f
add ch, byte ds:[0x8d01728d]
dec edi
call dword [ebx - 0x7b]
pop edi
mov cl, 0xf
sahf
add byte [ecx], 0x30
jne 0x407dbd
dec edi
dec ecx
test ebp, ecx
jg 0x407d65
mov dword [ebp - 0x36], edi
dec ecx
pop ebp
or al, 0x85
fisttp dword [edi]
stosb byte es:[edi], al
mov ah, 0x69
add byte [eax], al
test bl, 0x2b
iretd
mov edi, dword [ebp + 0x10]
mov edx, dword [eax - 0x75]
push ebp
adc al, 3
fadd dword [ebx]
jl 0x407dfc
push eax
mov edx, dword [ebp + 0x14]
add ebx, eax
add edi, dword [esi + esi + 0x45]
inc ebp
clc
mov dword [ebp + 0xc], ebx
mov ecx, 1
outsd dx, dword [esi]
stc
jl 0x407db9
mov edi, 0x46168810
inc eax
cmp ecx, ebx
jne 0x407de2
mov byte [esi], 0x19
inc esi
inc ecx
cmp ecx, edi
jle 0x407dd4
mov edx, dword [ebp + 0x14]
cmp edi, ebx
jge 0x407e10
inc eax
fistp qword [eax + 0x30303030]
mov ebx, ebx
mov edi, esi
mov edx, ecx
shr ecx, 0x63
rep stosd dword es:[edi], eax
mov bl, 0x83
xchg ebp, eax
xchg edi, eax
add esi, ebx
rep stosb byte es:[edi], al
mov byte [esi], 0x2e
mov edx, dword [ebp + 0x14]
inc esi
jmp 0x64ec7164
xchg ebp, edx
call [ebx + 0x3c]
invalid
Function at 0x409ea0
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
loop 0x409e99
add bl, al
nop
sub edx, dword [eax - 0x74aa6f70]
in al, dx
stosb byte es:[edi], al
dec ebp
or byte [ebx], dh
sal dh, 9
and byte [ebp + eax - 0x48], ch
jno 0x409ef2
add byte [eax], al
neg byte [edx]
rcl dword [edx + eax]
or al, 2
test cl, 1
je 0x409ec0
or al, 4
daa
dec ebp
or al, 0xd3
loopne 0x409f23
ret
rol ecx, 1
sbb eax, 0xaa8f0b04
push 4
sub edx, 0x4c70000d
mov dword [eax + 0x7e], edx
mov dword [eax + 4], ecx
mov eax, ecx
mov ecx, dword [ebp + 0xc]
not eax
and eax, ecx
neg eax
sbb eax, eax
or byte [eax + 0x11], bh
add dword [eax], eax
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x6d]
push esi
mov esi, dword [ebp - 0x39]
push edi
mov ecx, 0x18
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x10]
xor edx, edx
movsb byte es:[edi], byte [esi]
xchg ecx, eax
xchg ecx, eax
mov dh, 0xb4
mov dword [ebp + 0xc], edx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
call 0xe240b881
cmp al, 0xe8
xor bl, byte [ecx]
add dl, ah
mov dword [esi + 0x38], eax
jecxz 0x409f4f
sub ecx, dword [ebx - 0x2f74f3b5]
cmp dword [esi + 0x50], eax
test dword [edi - 0x38222ef5], edi
mov dword [esi + 0x38], edx
popfd
inc esi
cmp al, 0xc0
mov edx, eax
mov edi, dword [edi]
cmp byte [ecx - 0x1783adf6], al
sbb byte [esi], dl
add byte [eax], al
mov dword [esi + 0x3c], edx
mov ecx, dword [esi + 0x3c]
mov edx, eax
mov dword [esi + 0x38], eax
adc dword [eax], 0x81b779c0
rcl dword [ebx]
cmpsd dword [esi], dword es:[edi]
salc
dec dword [ecx + 0x78938c7]
cmp al, 0x8b
dec ebx
or byte [ecx - 0x3e60b7b2], cl
mov edx, edi
mov ecx, 0x75000020
mov dword [esi + 0x4c], edi
call 0xa1f370
mov dword [esi + 0x48], eax
mov dword [esi - 0x64], edx
mov edx, dword [ebx + 4]
mov ecx, dword [esi + 0x4c]
or eax, edx
or ecx, edi
cdq
inc esi
ja 0x409f49
dec esi
dec esp
push edi
ffreep st(1)
inc edi
je 0x40a010
push 0xffffffffffffffe6
push eax
push ecx
call 0xb7b590
mov dword [esi + 0x48], eax
adc eax, 0x46890077
dec eax
add eax, 0xb779299e
mov dword [esi + 0x4c], edx
adc byte [esi + 0x48], al
add dword [ecx + ebp*2], 0x3ff53a1
and byte [eax], al
add byte [eax], al
mov dword [esi + 0x4c], edx
mov edx, dword [ebx + 0x54]
mov dword [esi + 0x40], edx
mov eax, edx
loop 0x409fce
mov dword [esi + 0x44], edi
call fcn.0040b870
mov dword [esi + 0x40], eax
add cl, byte [esi + 0x40]
mov ecx, edx
inc esp
mov eax, dword [ebx + 0x14]
popal
enter 0xffffffffffffc262, 0xffffffffffffff89
dec esi
inc eax
mov edx, dword [esi + 0x40]
add eax, edi
push edi
mov ecx, eax
add al, 0xa
push ecx
mov dword cs:[esi + 0x44], eax
call 0x416790
mov dword [esi + 0x44], edx
mov ecx, dword [esi + 0x44]
mov edx, eax
mov dword [esi + 0x40], eax
ficomp dword [edi + 0x10]
pop esp
ret 0x818a
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5bc008], 0x8088405
inc edx
mov dword [ebx + 0x5bc008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf75
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf5d
add dl, dl
jne 0x41cf80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cfd1
xor eax, eax
add dl, dl
jne 0x41cf8d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d06e
add dl, dl
jne 0x41cf9c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfbd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cfc7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf6c
mov eax, 1
add dl, dl
jne 0x41cfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfd6
sub eax, ebx
mov ebx, 1
jne 0x41d01d
mov ecx, 1
add dl, dl
jne 0x41d003
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d00e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cffa
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d034
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d03f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d02b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d08f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf6c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x5a058e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
jmp 0x41f10e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f180
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f169
test esi, esi
jbe 0x41f180
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f15b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f180
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f138
jmp 0x41f180
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f180
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a0595
ret
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x5a18f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0x5be54c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0x5be54c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0x5bd378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a18fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x417f10
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58304b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5df310]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004177e0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], vtable.CryptoPP::BaseN_Decoder.0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], vtable.CryptoPP::BaseN_Decoder.1.0
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
call fcn.0041abb0
mov byte [ebp - 4], 1
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x1c]
call fcn.0053c520
push 1
lea eax, [ebp + 8]
push eax
call fcn.00416e20
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.0041d920
add esp, 0x10
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov byte [ebp - 4], 2
lea eax, [ebp + 0xc]
push eax
call fcn.00416e10
push eax
mov ecx, dword [ebp - 0x24]
call fcn.0041d8f0
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.0053fa00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00417b60
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4b500c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0042e7a8
call fcn.00424f0e
cmp eax, esi
pop esi
jne 0x4b5028
mov ecx, 0x5e4958
jmp fcn.004461cc
ret

Function at 0x532750
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x580e23
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5df310]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
push ebx
call fcn.00532410
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x5e8cb0
or eax, 0xffffffff
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x5bb029
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.005337a0
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret