joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4139e6
Capabilities:
Terminate process

Disassembly:
test byte [ebx + 4], 4
jne 0x4139f1
jmp fcn.004138bc
mov dword ds:[ebp - 0x68], esi
mov dword ds:[ebp - 0x64], edi
pop dword ds:[ebp - 0x6c]
pop eax
pop ax
xor ah, ah
pop cx
cmp cl, byte [ebx + 6]
call fcn.00413b0d
pop edx
cmp edx, dword [ebx + 0x14]
call fcn.00413b0d
movzx ecx, ch
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
lea edi, [ebx + esi + 0x10]
pop dword ds:[ebp - 0x60]
push dword [edi]
pop edx
cmp edx, dword [ebx + esi + 0x10]
call fcn.00413b0d
pop edx
cmp edx, dword [ebx + esi + 0xc]
call fcn.00413b0d
sub esi, 0xc
jne 0x413a2b
or ah, ah
jne 0x413afa
cmp cl, byte [ebx + 7]
jne 0x413afa
mov edx, dword ds:[ebp - 0x60]
cmp edx, dword [edi - 4]
jl 0x413afa
mov byte [ebx + 4], al
mov ecx, dword [edi]
sub ecx, edx
jle 0x413a90
cmp byte [ebx + 7], 1
je 0x413a75
imul ecx, dword [edi - 8]
push edi
mov al, byte [ebx + 6]
mov esi, ecx
mov edi, dword [ebx]
push dword [ebx + 8]
sub dword [esp], ecx
pop ecx
imul ecx, dword [ebx + 0x14]
add edi, ecx
call fcn.00413bfe
pop edi
push dword [ebx + 8]
push dword [ebx + 0xc]
movzx ecx, byte [ebx + 7]
xor esi, esi
mov dword [edi], edx
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
inc eax
dec ecx
je 0x413ac3
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x413aaa
jb 0x413af0
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x413af0
mov ecx, eax
xchg dword [ebx + 0xc], eax
mov edx, eax
mov eax, dword [ebx]
call fcn.00413b12
jb 0x413af2
add esp, 8
mov dword [ebx], eax
or byte [ebx + 4], 4
mov esi, dword ds:[ebp - 0x68]
mov edi, dword ds:[ebp - 0x64]
notrack jmp dword ds:[ebp - 0x6c]
mov al, 9
pop dword [ebx + 0xc]
pop dword [ebx + 8]
mov dx, 0x9b0
mov al, 9
mov esi, dword ds:[ebp - 0x68]
mov edi, dword ds:[ebp - 0x64]
push dword ds:[ebp - 0x6c]
jmp fcn.004134cc

Function at 0x413b86
Capabilities:
Terminate process

Disassembly:
call fcn.00413b93
jb 0x413b8e
ret
jmp fcn.004134cc
Function at 0x41432d
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov ax, word [ebp - 0x46]
call fcn.0041861c
jb 0x4143a8
mov al, byte [esi + 0xc]
test al, 0x20
je 0x4143a4
mov ecx, edi
call fcn.00418548
jb 0x4143ae
push ecx
push edx
push 0
lea edx, [esi + 0x3c]
push edx
push ecx
push edi
push dword [esi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_ReadFile]
call fcn.0041b43d
mov al, dl
pop edx
pop ecx
jb 0x414397
and word [esi + 0x2c], 0xfffd
mov eax, dword [esi + 0x3c]
cmp eax, ecx
je 0x414388
or word [esi + 0x2c], 2
push esi
mov ecx, eax
mov esi, edx
call fcn.004185ca
pop esi
jb 0x4143ae
add dword [esi + 0x14], eax
adc dword [esi + 0x18], 0
call fcn.0041aee0
pop edi
pop esi
ret
mov esi, edx
call fcn.0041857c
jmp 0x4143ae
mov al, 0x36
mov dx, 0x34b0
mov al, 0x34
mov dx, 0x3fb0
call fcn.0041aede
pop edi
pop esi
jmp fcn.004134cc
Function at 0x414820
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov ax, word [ebp - 0x46]
call fcn.0041861c
jb 0x414837
call fcn.0041ac48
jb 0x414837
pop edi
pop esi
ret
pop edi
pop esi
jmp fcn.004134cc

Function at 0x41483e
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.004185a4
or ecx, ecx
je 0x414914
mov ebx, esi
mov edx, 3
mov al, byte [ebx]
cmp al, 0x22
jne 0x414875
inc ebx
dec ecx
je 0x414892
cmp byte [ebx], 0x22
jne 0x414867
inc ebx
loop 0x414861
jmp 0x414892
cmp al, 0x5c
jne 0x414882
inc ebx
dec ecx
je 0x414892
inc ebx
loop 0x414861
jmp 0x414892
cmp al, 0x3b
je 0x41488b
inc ebx
loop 0x414861
jmp 0x414892
push ebx
dec edx
je 0x414896
inc ebx
loop 0x414861
push ebx
dec edx
jne 0x414892
pop edx
pop ecx
pop ebx
ftst
wait
fnstsw ax
sahf
jb 0x4148b6
jne 0x4148b2
cmp ecx, edx
je 0x4148b2
inc ecx
cmp ecx, edx
je 0x4148b2
mov eax, edx
mov esi, ecx
jmp 0x4148c5
mov eax, ebx
jmp 0x4148c5
cmp ebx, ecx
je 0x4148b2
inc ebx
cmp ebx, edx
je 0x4148b2
mov eax, ecx
mov esi, ebx
fchs
cmp eax, esi
jbe 0x414914
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x4148ce
push esp
push esi
push esi
push eax
mov ecx, eax
sub ecx, esi
call fcn.0041493c
call fcn.0041b424
pop ecx
mov esi, esp
push ecx
call fcn.0041af27
jb 0x414902
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
mov edx, eax
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.004134c1
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x414919
mov esi, esp
call fcn.0041b110
call fcn.0041b424
dec edx
cmp byte [esi], 0x20
jne 0x414938
dec edx
inc esi
mov ecx, edx
jmp 0x4148ef

Function at 0x4156de
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.004185a4
jecxz 0x415720
call fcn.00418548
jb 0x415725
cld
test eax, eax
je 0x41570b
lodsb al, byte [esi]
call fcn.0041582c
stosb byte es:[edi], al
loop 0x4156fe
mov esi, edx
jmp 0x415718
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharUpperBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.0041857c
pop ebp
pop edi
pop esi
pop ecx
ret
mov edx, eax
pop ebp
pop edi
pop esi
pop ecx
jmp fcn.004134c1

Function at 0x41592d
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.0041861c
jb 0x415961
cmp word [esi + 0xa], 2
je 0x41595d
push ecx
lea eax, [esi + 0x3c]
push eax
push dword [esi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_GetFileSize]
call fcn.0041b43d
pop ecx
jb 0x415963
push dword [esi + 0x3c]
push eax
fild qword [esp]
pop edx
pop edx
pop esi
ret
pop esi
fldz
ret
mov edx, eax
pop esi
fldz
jmp fcn.004134c1
Function at 0x41596b
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, ecx
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.004185a4
test eax, eax
jns 0x415984
add eax, ecx
test edx, edx
je 0x4159c4
jns 0x41598f
add edx, ecx
js 0x4159c4
inc edx
dec edx
add esi, edx
sub ecx, edx
jae 0x415998
xor ecx, ecx
cmp ecx, eax
jb 0x41599e
mov ecx, eax
call fcn.00418548
jb 0x4159c8
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00418d7c
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
ret
xor edx, edx
jmp 0x4159b2
pop edi
pop esi
jmp fcn.004134cc

Function at 0x4159cf
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.004185a4
test eax, eax
jns 0x4159e7
add eax, ecx
cmp eax, ecx
jae 0x415a13
xchg ecx, eax
call fcn.00418548
jb 0x415a17
sub eax, ecx
add esi, eax
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00418d7c
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
ret
pop edi
pop esi
pop ecx
jmp fcn.004134cc

Function at 0x415ae7
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
sub esp, 0x218
lea eax, [esp]
push eax
push 0x104
mov edx, dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
call fcn.0041b43d
jb 0x415b89
lea edx, [esp + 0x104]
call fcn.0041a922
test al, al
jne 0x415b21
lea eax, [esp]
push eax
jmp 0x415b5d
mov word [edx + 1], 0x3a
push edx
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
call fcn.0041b43d
jb 0x415b81
pop edx
push edx
push edx
push 0x104
mov edx, dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
call fcn.0041b43d
jb 0x415b81
lea eax, [esp + 4]
push eax
mov edx, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
call fcn.0041b43d
jb 0x415b81
pop esi
cld
xor al, al
mov ecx, 0x104
mov edi, esi
repne scasb al, byte es:[edi]
lea ecx, [edi - 1]
sub ecx, esi
call fcn.0041af27
jb 0x415b89
add esp, 0x218
pop edi
pop esi
pop ecx
pop eax
ret
call fcn.0041aede
add esp, 4
add esp, 0x218
pop edi
pop esi
pop ecx
pop eax
jmp fcn.004134c1

Function at 0x4168ca
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov esi, eax
mov edi, ecx
test esi, esi
je 0x41691f
push ebx
mov ebx, esp
push 0
push 0
push 0
push edi
push 0x110
push edi
call esi
mov eax, edi
call fcn.0041807e
push ax
push cx
mov ecx, 0x14
mov edx, edi
call fcn.004187fb
cmp eax, 3
mov ecx, 2
je 0x416916
cmp eax, 6
mov ecx, 1
je 0x416916
mov ecx, 0
push ecx
push 5
push edi
call esi
mov esp, ebx
pop ebx
mov eax, esi
mov ecx, 0x24
mov edx, edi
call fcn.0041880d
jb 0x416970
or dword [ecx + 0xc], 0x4000
mov eax, ebx
mov ecx, 0x28
mov edx, edi
call fcn.0041880d
mov ecx, 0x14
mov edx, edi
call fcn.004187fb
push eax
push eax
push edi
call dword [sym.imp.USER32.DLL_ShowWindow]
pop eax
cmp eax, 0
je 0x416970
cmp eax, 6
je 0x416970
cmp eax, 2
je 0x416970
mov eax, edi
call fcn.00417d09
pop edi
pop esi
ret
Function at 0x4181b4
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, 7
sub esp, 0x20
mov esi, esp
call fcn.0041b115
jmp 0x4181d3

Function at 0x4181c7
Capabilities:
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x20
mov esi, esp
call fcn.0041b110
mov ax, word [ebp - 0x46]
push edx
call fcn.0041865a
pop edx
jb 0x4181ed
call fcn.0041abee
jb 0x4181ed
add esp, 0x20
pop edi
pop esi
ret
add esp, 0x20
jmp fcn.0041828e

Function at 0x4181f5
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov ax, word [ebp - 0x46]
call fcn.0041865a
jb 0x41821a
mov esi, dword [ebp + esi - 0x6c]
call fcn.004185a4
jecxz 0x41821a
mov edx, ecx
call fcn.0041abee
pushfd
call fcn.0041b424
popfd
jb fcn.0041828e
pop edi
pop esi
ret

Function at 0x418226
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov ax, word [ebp - 0x46]
call fcn.0041865a
jb fcn.0041828e
mov eax, dword [edi + 0x24]
xor edx, edx
mov ecx, 0xe
div ecx
sub ecx, edx
mov edx, ecx
mov esi, 0x413258
call fcn.0041abee
jb fcn.0041828e
pop edi
pop esi
ret

Function at 0x4182e7
Capabilities:
Terminate process

Disassembly:
push edi
xchg ecx, ebx
call fcn.00418548
jb 0x418307
call fcn.0041aee0
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
ret
call fcn.0041aede
pop edi
jmp fcn.004134cc

Function at 0x418e22
Capabilities:
Terminate process

Disassembly:
call fcn.0041afd2
jb 0x418e2a
ret
jmp fcn.004134cc

Function at 0x418e89
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [0x41c3e0]
mov ecx, eax
jecxz 0x418ee3
cld
lodsb al, byte [esi]
test al, al
je 0x418edf
cmp al, 0x20
je 0x418e97
cmp al, 0x22
je 0x418ebf
lea edi, [esi - 1]
lodsb al, byte [esi]
test al, al
je 0x418eb4
cmp al, 0x20
jne 0x418ea7
loop 0x418e97
jmp 0x418eb6
loop 0x418edf
lea ecx, [esi - 1]
mov esi, edi
sub ecx, esi
jmp 0x418ef2
mov edi, esi
lodsb al, byte [esi]
test al, al
je 0x418ed4
cmp al, 0x22
jne 0x418ec1
cmp byte [esi - 2], 0x22
je 0x418e97
loop 0x418e97
jmp 0x418ed6
loop 0x418edf
lea ecx, [esi - 1]
mov esi, edi
sub ecx, esi
jmp 0x418ef2
xor ecx, ecx
jmp 0x418ef2
push esi
mov ecx, 0xffffffff
dec esi
inc ecx
inc esi
test byte [esi], 0xff
jne 0x418eea
pop esi
call fcn.0041af27
pop edi
pop esi
pop ecx
jb 0x418efd
ret
jmp fcn.004134cc

Function at 0x418f91
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.004185a4
je 0x418fd8
mov al, 0x20
cmp byte [esi], al
je 0x418fb2
jmp 0x418fd8
cmp byte [esi], al
jne 0x418fb5
inc esi
loop 0x418fae
call fcn.00418548
jb 0x418fdd
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00418d7c
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
pop eax
ret
mov edx, eax
pop edi
pop esi
pop ecx
pop eax
jmp fcn.004134c1
Function at 0x418fe8
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.004185a4
je 0x418fd8
lea edi, [esi - 1]
add edi, ecx
mov al, 0x20
cmp byte [edi], al
je 0x41900e
jmp 0x418fd8
cmp byte [edi], al
jne 0x418fb5
dec edi
loop 0x41900a
jmp 0x418fb5

Function at 0x419013
Capabilities:
Terminate process

Disassembly:
push eax
call fcn.004190f5
jb 0x41906d
cmp ecx, edx
ja 0x41906d
mov eax, esi
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x419035
mov eax, esi
sub edx, ebx
jl 0x419035
mov ecx, ebx
mov edi, ebp
jmp 0x419025
or edx, edx
jns 0x41903b
xor edx, edx
mov esi, eax
mov ecx, edx
pop ebp
call fcn.00418548
jb 0x419075
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041b424
call fcn.00418d7c
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
pop ebp
call fcn.0041b424
jmp 0x419067
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.004134c1

Function at 0x419081
Capabilities:
Terminate process

Disassembly:
push eax
call fcn.004190f5
jb 0x41906d
cmp ecx, edx
ja 0x41906d
mov eax, esi
add esi, edx
sub esi, ecx
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x419035
sub esi, ebx
sub esi, ebx
sub edx, ebx
jl 0x419035
mov ecx, ebx
mov edi, ebp
jmp 0x419097
Function at 0x41911f
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.004185b7
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edx
push dword [ebp + esi - 0x6c]
mov esi, dword [ebp + esi - 0x64]
call fcn.004185a4
pop edi
call fcn.004185b7
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x64], edx
jecxz 0x419153
jne 0x4191a6
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
call fcn.00418548
jb 0x41918b
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041b424
call fcn.0041b424
call fcn.00418d7c
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
ret
mov al, 5
pop edi
pop esi
call fcn.0041b424
call fcn.0041b424
call fcn.0041b424
call fcn.0041aede
jmp fcn.004134cc
mov ebx, edi
mov dword [ebp - 0x54], ecx
sub edx, ecx
jb 0x419153
add ebx, edx
inc ebx
mov edx, esi
mov dword [ebp - 0x58], 0
cld
call fcn.00419262
jb 0x4191cf
inc dword [ebp - 0x58]
add edi, dword [ebp - 0x54]
mov esi, edx
cmp edi, ebx
jb 0x4191bc
mov ecx, dword [ebp - 0x58]
test ecx, ecx
je 0x419153
mov esi, edx
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x54]
imul ecx
jno 0x4191e8
jmp 0x419189
mov ecx, dword [ebp - 0x64]
add ecx, eax
js 0x4191e6
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0x64], eax
call fcn.00418548
jb 0x41918b
mov dword [ebp - 0x68], edi
push edx
mov edi, dword [ebp - 0x6c]
mov edx, esi
call fcn.00419262
jb 0x419245
mov esi, dword [ebp - 0x6c]
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push esi
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0x68], edi
mov edi, dword [ebp - 0x54]
add edi, esi
mov dword [ebp - 0x6c], edi
mov esi, edx
jmp 0x419205
mov ecx, dword [ebp - 0x64]
mov esi, dword [ebp - 0x6c]
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edx
jmp 0x41916d

Function at 0x41932b
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 7
xor edx, edx
call fcn.00419399
pop ecx
jb 0x419394
ret

Function at 0x41933c
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 0xf
xor edx, edx
call fcn.00419399
pop ecx
jb 0x419394
ret
jmp fcn.004134c1
Function at 0x41a3c5
Capabilities:
Terminate process

Disassembly:
push esi
mov ax, word [ebp - 0x46]
call fcn.0041861c
jb 0x41a422
cmp word [esi + 0xa], 1
mov al, 0x36
jne 0x41a422
fisub word [esi + 0x2e]
fistp qword [esi + 0x14]
test byte [esi + 0xc], 4
je 0x41a3fa
fild qword [esi + 0x14]
fimul dword [esi + 0x1c]
fistp qword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push 0
push eax
push dword [ebp - 0x6c]
jmp 0x41a403
lea eax, [esi + 0x18]
push 0
push eax
push dword [esi + 0x14]
push dword [esi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
call fcn.0041b43d
jb 0x41a426
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
and word [esi + 0x2c], 0xfffd
pop esi
ret
fstp st(0)
jmp 0x41a42c
mov al, dl
mov dx, 0x3fb0
pop esi
jmp fcn.004134cc

Function at 0x41a49c
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x41a4bc
and esi, 0xfffffffe
jne 0x41a4c6
xchg dword [ebx], esi
call fcn.0041857c
pop edi
pop esi
ret
call fcn.004185a4
mov edi, dword [ebx]
or edi, edi
je 0x41a4d6
cmp ecx, dword [edi - 4]
je 0x41a4f6
call fcn.00418548
jb 0x41a506
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.0041857c
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.0041857c
pop edi
pop esi
jmp fcn.004134cc

Function at 0x41a71d
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x41a73a
mov dword [ebx], eax
ret
push esi
push edi
mov esi, eax
call fcn.004185a4
call fcn.00418548
jb 0x41a75c
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx], edx
pop edi
pop esi
ret
mov dword [ebx], edx
pop edi
pop esi
jmp fcn.004134cc

Function at 0x41a765
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x41a785
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.004185a4
call fcn.00418548
jb 0x41a7aa
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.004134cc
Function at 0x41a967
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.004185a4
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.004185a4
jecxz 0x41a9dd
test ebx, ebx
je 0x41a9e5
add ebx, ecx
xchg ecx, ebx
call fcn.00418548
jb 0x41a9f2
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.0041857c
mov esi, dword [ebp + edi - 0x6c]
call fcn.0041857c
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
mov esi, dword [ebp + edi - 0x6c]
mov dword [ebp + edi - 0x68], esi
add dword [ebp - 0x88], 4
pop esi
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.004134cc

Function at 0x41adc6
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push esi
mov ebx, dword [ebp - 0x84]
sub ebx, 0xa
mov esi, dword [ebx]
sub ebx, 4
shr esi, 1
jb 0x41adf3
je 0x41adef
shr esi, 1
jae 0x41ae14
shl esi, 2
mov esi, dword [ebp + esi]
call fcn.0041857c
jmp 0x41add2
pop esi
pop edx
pop eax
ret
shr esi, 1
jb 0x41ae25
push ebx
shl esi, 2
lea ebx, [ebp + esi]
mov eax, 1
call fcn.00413b93
pop ebx
jae 0x41add2
pop esi
pop edx
pop eax
jmp fcn.004134cc
shl esi, 2
mov ecx, dword [ebp + esi]
jecxz 0x41add2
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
jmp 0x41add2
lea ecx, [ebp + esi*4]
push ecx
call dword [sym.imp.OLEAUT32.DLL_VariantClear]
jmp 0x41add2
Function at 0x121c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x121c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x121c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x121c06a
add dl, dl
jne 0x121c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x121c0dc
xor eax, eax
add dl, dl
jne 0x121c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x121c17d
add dl, dl
jne 0x121c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x121c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x121c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x121c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x121c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x121c075
mov eax, 1
add dl, dl
jne 0x121c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x121c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x121c0e1
sub eax, ebx
mov ebx, 1
jne 0x121c128
mov ecx, 1
add dl, dl
jne 0x121c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x121c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x121c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x121c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x121c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x121c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x121c136
cmp eax, 0x7d00
jae 0x121c16d
cmp eax, 0x500
jb 0x121c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x121c075
cmp eax, 0x7f
ja 0x121c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x121c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x121c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x121c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x403508
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x403517
pop dword [ebp - 0x14]
mov eax, 0xfa2c831e
add eax, 0x613b1f9
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x1aa9608b
sub dword [ebp - 0x24], 0xcc571b40
mov dword [ebp - 0x20], 0xbbfc7125
sub dword [ebp - 0x20], 0x89c924e0
mov dword [ebp - 0x1c], 0x141f0c72
add dword [ebp - 0x1c], 0x382d37bc
mov dword [ebp - 0x18], 0x64297949
sub dword [ebp - 0x18], 0x64297949
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x314229f1
add dword [ebp - 0x24], 0x43303f65
mov dword [ebp - 0x20], 0xbe59493
sub dword [ebp - 0x20], 0xca79331e
mov dword [ebp - 0x1c], 0x77ba2b7d
sub dword [ebp - 0x1c], 0x144abf11
mov dword [ebp - 0x18], 0xf4c358ea
add dword [ebp - 0x18], 0xb3ca716
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x391ec
push 0
call eax
mov ecx, 0x791bcf6d
add ecx, 0x86e476f2
xor esi, esi
add esi, eax
mov edx, 0xb322a17e
add edx, 0x4d1f0e82
add edx, dword [ebp - 0x14]
mov edi, 0x1a9fcb56
add dword [ebp - 0xc], 0x42ab7670
mov ebx, dword [edx]
add dword [ebp - 4], edi
xor ebx, edi
xor dword [ebp - 8], 0xb93fa04e
mov dword [esi], ebx
sub dword [ebp - 0xc], edi
add esi, 4
add edx, 0xc4df9bd4
add edx, 0x3b206430
loop 0x40362b
add eax, 0xc2d4c1dd
sub eax, 0xc2d3b58e
xor ebx, ebx
add ebx, eax
add eax, 0xedc17bfd
add eax, 0x123e8408
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret