joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7f3b
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
add ecx, edx
mov dword [0x4c4d6c], ecx
shr eax, 0x10
mov dword [0x4c4d68], eax
push 1
call fcn.004b900b
pop ecx
test eax, eax
jne 0x4b7f5f
push 0x1c
call fcn.004b8021
pop ecx
call fcn.004b8dc8
test eax, eax
jne 0x4b7f70
push 0x10
call fcn.004b8021
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004b8c0c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4c5434], eax
call fcn.004b8ada
mov dword [0x4c4d58], eax
call fcn.004b888d
call fcn.004b87d4
call fcn.004b84e4
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004b877c
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x4b7fbf
movzx eax, word [ebp - 0x2c]
jmp 0x4b7fc2
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004b8511
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.004b8604
pop ecx
pop ecx
ret

Function at 0x4b90a1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c03c8
cmp edx, dword [eax]
je 0x4b90c3
add eax, 8
inc ecx
cmp eax, 0x4c0458
jl 0x4b90b4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c03c8]
jne 0x4b91f1
mov eax, dword [0x4c4d60]
cmp eax, 1
je 0x4b91cb
test eax, eax
jne 0x4b90f4
cmp dword [0x4c02f4], 1
je 0x4b91cb
cmp edx, 0xfc
je 0x4b91f1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b912b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9a80
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b9f10
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b916e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b9f10
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be73c
push edi
call fcn.004bbde0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9a80
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9a90
lea eax, [ebp - 0xa0]
push 0x4be71c
push eax
call fcn.004b9a90
push dword [esi + 0x4c03cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9a90
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bbd54
add esp, 0x2c
pop edi
jmp 0x4b91f1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c03cc]
push 0
push eax
push dword [esi]
call fcn.004b9f10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4020f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402107
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402138
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x402134
cmp esi, eax
jae 0x402138
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x402124
cmp esi, eax
jb 0x40213e
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x403750
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x45a738
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x474534]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.004027b0
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4037a4
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x14]
call fcn.00402af0
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
mov ecx, esi
mov word [esi + 4], di
call fcn.004027b0
cmp dword [esp + 0x24], 8
jb 0x4037ea
mov eax, dword [esp + 0x10]
push eax
call fcn.00404706
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x404449
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x474534]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00404388
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00408780
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x404498
cmp dword [ebp - 0x1c], 5
jb 0x4044b0
jmp 0x4044ac
cmp dword [ebp - 0x10], 1
jne 0x4044b0
cmp dword [ebp - 0x1c], 4
ja 0x4044ac
jne 0x4044b0
cmp dword [ebp - 0x18], 0
jbe 0x4044b0
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x45b2ec
call fcn.0040421e
test eax, eax
jge 0x4044d1
mov byte [0x4787b0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040470b
add ebp, 0x78
leave
ret

Function at 0x40470b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x474534]
jne 0x404715
repz ret
jmp fcn.00408c11
Function at 0x40a9df
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x474560]
je 0x40a9fa
inc edi
cmp edi, 0x17
jb 0x40a9eb
cmp edi, 0x17
jae 0x40ab7a
push ebp
push 3
call fcn.00410a64
cmp eax, 1
pop ecx
je 0x40ab46
push 3
call fcn.00410a64
test eax, eax
pop ecx
jne 0x40aa2e
cmp dword [0x474388], 1
je 0x40ab46
cmp ebx, 0xfc
je 0x40ab79
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x475de8
push ebp
call fcn.0040abee
add esp, 0xc
test eax, eax
je 0x40aa64
push esi
push esi
push esi
push esi
push esi
call fcn.00404792
add esp, 0x14
push 0x104
mov esi, 0x475e01
push esi
push 0
mov byte [0x475f05], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40aaa8
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0040abee
add esp, 0xc
test eax, eax
je 0x40aaa8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00404792
add esp, 0x14
push esi
call fcn.00406800
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40aaed
push esi
call fcn.00406800
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4760fc
push 0x45c2ac
sub ecx, eax
push ecx
push eax
call fcn.0040fbb7
add esp, 0x14
test eax, eax
je 0x40aaed
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00404792
add esp, 0x14
jmp 0x40aaef
xor esi, esi
push 0x45c2a8
push ebx
push ebp
call fcn.0040fb46
add esp, 0xc
test eax, eax
je 0x40ab0f
push esi
push esi
push esi
push esi
push esi
call fcn.00404792
add esp, 0x14
push dword [edi*8 + 0x474564]
push ebx
push ebp
call fcn.0040fb46
add esp, 0xc
test eax, eax
je 0x40ab31
push esi
push esi
push esi
push esi
push esi
call fcn.00404792
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004108a7
add esp, 0xc
jmp 0x40ab79
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x40ab79
cmp ebp, 0xffffffff
je 0x40ab79
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x474564]
push dword [esi]
call fcn.00406800
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4108a7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040a4fd
xor ebx, ebx
cmp dword [0x476424], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x41097d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x410a5d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x410a5d
push eax
call fcn.0040a48f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x476424], eax
call esi
push eax
call fcn.0040a48f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x476428], eax
call esi
push eax
call fcn.0040a48f
mov dword [0x47642c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00405a44
test eax, eax
pop ecx
pop ecx
je 0x41094b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404792
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x41097d
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040a48f
cmp eax, ebx
pop ecx
mov dword [0x476434], eax
je 0x41097d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a48f
pop ecx
mov dword [0x476430], eax
mov eax, dword [0x476430]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x410a02
cmp dword [0x476434], ecx
je 0x410a02
push eax
call fcn.0040a506
push dword [0x476434]
mov esi, eax
call fcn.0040a506
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x410a02
cmp edi, ebx
je 0x410a02
call esi
cmp eax, ebx
je 0x4109cf
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4109cf
test byte [ebp - 0x18], 1
jne 0x410a02
lea eax, [ebp - 0x10]
push eax
call fcn.00405a7b
test eax, eax
pop ecx
je 0x4109ea
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404792
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4109f9
or dword [ebp + 0x10], 0x200000
jmp 0x410a3d
or dword [ebp + 0x10], 0x40000
jmp 0x410a3d
mov eax, dword [0x476428]
cmp eax, dword [ebp - 8]
je 0x410a3d
push eax
call fcn.0040a506
cmp eax, ebx
pop ecx
je 0x410a3d
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x410a3d
mov eax, dword [0x47642c]
cmp eax, dword [ebp - 8]
je 0x410a3d
push eax
call fcn.0040a506
cmp eax, ebx
pop ecx
je 0x410a3d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x476424]
call fcn.0040a506
cmp eax, ebx
pop ecx
je 0x410a5d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410a5f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4140a0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x474534]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x148]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4140f8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0040470b
add esp, 0x144
ret
push 0x3e
lea eax, [esp + 0x10e]
push ebx
push eax
mov word [esp + 0x114], bx
call fcn.00408780
push 0xf4
lea ecx, [esp + 0x24]
push ebx
push ecx
mov dword [esp + 0x28], ebx
call fcn.00408780
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0x18
push ebx
lea edx, [esp + 0x10]
push edx
push 0x40
lea eax, [esp + 0x114]
push eax
push esi
mov dword [esp + 0x20], ebx
call edi
test eax, eax
je 0x4141a5
cmp dword [esp + 0xc], 0x40
jne 0x4141a5
cmp word [esp + 0x108], 0x5a4d
jne 0x4141a5
mov ecx, dword [esp + 0x144]
push ebx
push ebx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x144], eax
jne 0x4141a5
push ebx
lea edx, [esp + 0x10]
push edx
push 0xf8
lea eax, [esp + 0x1c]
push eax
push esi
call edi
test eax, eax
je 0x4141a5
cmp dword [esp + 0xc], 0xf8
jne 0x4141a5
cmp dword [esp + 0x10], 0x4550
jne 0x4141a5
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0040470b
add esp, 0x144
ret

Function at 0x4141d0
Capabilities:
Read file via mapping

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebp
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
mov edi, eax
push esi
push edi
xor ebp, ebp
call ebx
cmp eax, 0xffffffff
jne 0x414208
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.004140a0
add esp, 4
test eax, eax
je 0x41428f
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x414296
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
je 0x41428f
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x414288
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp word [ecx + 0x18], 0x10b
je 0x414273
xor ebp, ebp
jmp 0x414281
mov ecx, dword [ecx + 0x58]
mov edx, dword [esp + 0x14]
mov dword [edx], ecx
mov ebp, 1
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x4142a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push ebp
push esi
mov esi, dword [ecx]
xor ebp, ebp
and esi, 7
cmp eax, 5
jae 0x4142bd
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
mov edx, dword [esp + 0x14]
push ebx
lea ebx, [edx + eax - 4]
push edi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], ebx
lea edi, [edx + ebp]
cmp edi, ebx
jae 0x4142ef
lea ebx, [ebx]
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x4142ef
add edi, 1
cmp edi, ebx
jb 0x4142e0
mov ebp, edi
sub ebp, edx
mov eax, ebp
sub eax, dword [esp + 0x10]
cmp edi, ebx
jae 0x4143f8
cmp eax, 3
jbe 0x414324
xor esi, esi
mov al, byte [edi + 4]
test al, al
mov dword [esp + 0x10], ebp
je 0x414361
cmp al, 0xff
je 0x414361
and esi, 3
add esi, esi
or esi, 1
add ebp, 1
jmp 0x4142d3
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x414308
movzx ecx, byte [esi + 0x45d3e8]
mov eax, edi
sub eax, ecx
cmp byte [esi + 0x45d3e0], 0
mov al, byte [eax + 4]
je 0x41434d
test al, al
je 0x41434d
cmp al, 0xff
jne 0x414308
and esi, 3
add esi, esi
mov dword [esp + 0x10], ebp
or esi, 1
add ebp, 1
jmp 0x4142d3
movzx ecx, byte [edi + 2]
xor edx, edx
mov dh, al
movzx eax, byte [edi + 1]
mov dl, byte [edi + 3]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
lea ebx, [ebx]
sub edx, ebp
sub edx, 5
test esi, esi
mov eax, edx
je 0x4143c9
movzx edx, byte [esi + 0x45d3e8]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
test bl, bl
je 0x4143ac
cmp bl, 0xff
jne 0x4143c5
mov ebx, dword [esp + 0x14]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
sub edx, 1
xor edx, eax
jmp 0x414380
mov ebx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and cl, 1
sub cl, 1
not cl
mov byte [edi + 4], cl
mov edx, eax
shr edx, 0x10
mov ecx, eax
shr ecx, 8
mov byte [edi + 3], dl
mov edx, dword [esp + 0x1c]
mov byte [edi + 2], cl
mov byte [edi + 1], al
add ebp, 5
jmp 0x4142d3
cmp eax, 3
pop edi
pop ebx
jbe 0x41440f
mov edx, dword [esp + 0x18]
xor esi, esi
mov dword [edx], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
mov edx, dword [esp + 0x18]
lea ecx, [eax - 1]
shl esi, cl
mov eax, ebp
and esi, 7
mov dword [edx], esi
pop esi
pop ebp
add esp, 8
ret

Function at 0x4166a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [edi]
test esi, esi
mov ebx, eax
jne 0x4166b1
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [edi], 0
mov edi, edi
cmp esi, 0x400000
mov eax, 0x400000
ja 0x4166cf
mov eax, esi
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [esp + 0x20], 0
call ebp
mov ecx, dword [esp + 0xc]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x416706
test ecx, ecx
je 0x4166ff
test esi, esi
ja 0x4166c0
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop esi
pop ebx
pop ecx
ret
Function at 0x416720
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [edi]
test esi, esi
mov ebx, eax
jne 0x416731
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [edi], 0
mov edi, edi
cmp esi, 0x400000
mov eax, 0x400000
ja 0x41674f
mov eax, esi
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [esp + 0x20], 0
call ebp
mov ecx, dword [esp + 0xc]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x416786
test ecx, ecx
je 0x41677f
test esi, esi
ja 0x416740
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x417b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
mov eax, dword [0x474534]
xor eax, esp
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
xor ecx, ecx
push edi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x38], ecx
mov ecx, dword [eax + 0x14]
mov ebx, edx
mov edx, dword [eax + 0x10]
push ecx
push edx
lea edi, [esp + 0x30]
mov dword [esp + 0x2c], ebx
call fcn.004174c0
xor edi, edi
add esp, 8
cmp eax, edi
jne 0x417ccb
mov eax, dword [esp + 0xb4]
mov ebx, dword [esp + 0xa8]
mov dword [esp + 0x50], eax
mov eax, 1
mov dword [esp + 0x3c], esi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x74], eax
mov dword [esp + 0x70], edi
mov dword [esp + 0x80], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x78], eax
cmp dword [esp + 0xac], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], 0x40000
ja 0x417c03
jb 0x417bff
cmp ebx, 0x40000
jae 0x417c03
mov dword [esp + 0x14], ebx
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push ebp
call eax
mov esi, eax
add esp, 0xc
cmp esi, edi
jne 0x417cb7
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x4c]
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0xb8]
push 1
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x28]
push ecx
push edx
lea eax, [esp + 0x3c]
call fcn.00417560
mov esi, eax
mov eax, dword [esp + 0x2c]
sub dword [esp + 0x28], eax
add esp, 0x14
sub ebx, eax
sbb dword [esp + 0xac], 0
test esi, esi
jne 0x417cb7
mov ecx, dword [esp + 0x50]
cmp dword [esp + 0x4c], ecx
je 0x417c94
test eax, eax
jne 0x417c7d
cmp edi, dword [esp + 0x4c]
je 0x417c94
push eax
mov eax, dword [ebp + 4]
push ebp
call eax
mov esi, eax
add esp, 8
test esi, esi
jne 0x417cb7
xor edi, edi
jmp 0x417be0
cmp ecx, dword [esp + 0xb4]
jne 0x417cb2
cmp dword [esp + 0x14], 0
jne 0x417cb2
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x417cb7
cmp eax, 4
je 0x417cb7
mov esi, 1
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 4]
push ecx
push eax
call edx
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040470b
add esp, 0x90
ret
Function at 0x418910
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x476500], ecx
add edx, 1
cmp edx, 0x100
jb 0x418913
cmp edx, 0x800
jae 0x4189fb
nop
mov eax, dword [edx*4 + 0x476100]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x476500]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x4764fc], eax
jb 0x4189d0
mov dword [0x478500], 0x4163e0
call fcn.00417ac0
test eax, eax
jne 0x418a18
mov dword [0x478500], 0x416e90
pop ecx
ret
Function at 0x418a20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb0
mov eax, dword [0x474534]
xor eax, esp
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0xb4]
push ebx
push ebp
mov ebp, dword [esp + 0xc8]
push esi
push edi
xor ebx, ebx
mov edi, 1
cmp dword [eax + 0x14], edi
mov esi, ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
je 0x418a67
mov eax, edi
jmp 0x418bbd
mov eax, dword [eax + 0x10]
movzx ecx, byte [eax]
push ecx
lea ecx, [esp + 0x2c]
call fcn.00417fe0
add esp, 4
cmp eax, ebx
jne 0x418bbd
mov edx, dword [esp + 0xd4]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x50], edx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa8], edi
mov dword [esp + 0xac], edi
mov dword [esp + 0xb0], edi
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x78], edi
lea esp, [esp]
cmp dword [esp + 0xcc], ebx
mov eax, 0x40000
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
ja 0x418afc
jb 0x418af1
cmp dword [esp + 0xc8], eax
jae 0x418afc
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x14], eax
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push ebp
call eax
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x418ba9
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x4c]
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0xd8]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edx
lea esi, [esp + 0x38]
call fcn.00417cf0
mov esi, eax
mov eax, dword [esp + 0x28]
sub dword [esp + 0x24], eax
add esp, 0x10
sub dword [esp + 0xc8], eax
sbb dword [esp + 0xcc], ebx
cmp esi, ebx
jne 0x418ba9
mov ecx, dword [esp + 0x50]
cmp dword [esp + 0x4c], ecx
je 0x418b8e
cmp eax, ebx
jne 0x418b78
cmp edi, dword [esp + 0x4c]
je 0x418b8e
push eax
mov eax, dword [ebp + 4]
push ebp
call eax
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x418ad0
jmp 0x418ba9
cmp ecx, dword [esp + 0xd4]
jne 0x418ba4
cmp dword [esp + 0x14], ebx
jne 0x418ba4
cmp dword [esp + 0x20], 1
je 0x418ba9
mov esi, 1
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 4]
push ecx
push eax
call edx
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040470b
add esp, 0xb0
ret