joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41729f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ecx
push edi
mov edi, edx
sub eax, ebx
je 0x4172c9
sub eax, 1
jne 0x4172c1
push 4
pop eax
mov ecx, eax
jmp 0x4172d1
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
jmp 0x4172d1
push 2
mov eax, 0x40000000
pop ecx
push ebx
push 0x80
push ecx
push ebx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4172ef
xor al, al
jmp 0x41732d
cmp dword [ebp + 0xc], 1
jne 0x41730e
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41730e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4172eb
push ebx
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x417324
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417334
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 4], edx
push ebx
push 0x80
push 3
push ebx
push 3
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x417362
xor al, al
jmp 0x4173a0
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
mov esi, eax
push ebx
push esi
call fcn.00402439
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push ebx
push eax
push esi
mov dword [ebp - 8], ebx
call fcn.00401f75
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
test eax, eax
je 0x417397
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4173db
Capabilities:
Get file size

Disassembly:
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x417401
xor eax, eax
jmp 0x417414
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
ret
Function at 0x417417
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x417514
push ebx
inc esi
lea ecx, [esp + 0x34]
push esi
call fcn.00409dee
push esi
lea ecx, [esp + 0x34]
call fcn.00401ecb
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
call fcn.004022ea
mov edi, eax
lea ecx, [esp + 0x30]
lea eax, [esp + 0x18]
push eax
call fcn.004022ad
mov esi, eax
lea ecx, [esp + 0x30]
lea eax, [esp + 0x1c]
push eax
call fcn.004022ea
push dword [edi]
lea ecx, [esp + 0x24]
push dword [esi]
push dword [eax]
call fcn.00408228
sub esp, 0xc
mov ecx, esp
push 0x465b1c
call fcn.0040425f
sub esp, 0x18
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00407352
lea ecx, [esp + 0x54]
call fcn.00416e9e
add esp, 0x30
lea ecx, [esp + 0x24]
mov edi, ebx
call fcn.004021d5
test eax, eax
je 0x417502
mov esi, ebx
push ebx
push esi
lea ecx, [esp + 0x2c]
call fcn.00401e29
push eax
lea ecx, [esp + 0x38]
call fcn.00408099
cmp eax, 0xffffffff
jne 0x417525
inc edi
lea ecx, [esp + 0x24]
movzx esi, di
call fcn.004021d5
cmp esi, eax
jb 0x4174d7
lea ecx, [esp + 0x24]
call fcn.00417c50
lea ecx, [esp + 0x30]
call fcn.00401ed0
lea ecx, [ebp + 8]
call fcn.00401ed0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x417547
lea ecx, [esp + 0x30]
call fcn.00401ecb
sub ebx, eax
movzx ecx, word [eax]
mov word [ebx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x417538
lea ecx, [esp + 0x24]
call fcn.00417c50
lea ecx, [esp + 0x30]
call fcn.00401ed0
mov bl, 1
jmp 0x417514
Function at 0x417868
Capabilities:
Change the wallpaper

Disassembly:
push ebx
push esi
push edi
mov edi, edx
sub ecx, 0
je 0x417914
sub ecx, 1
je 0x417906
sub ecx, 1
je 0x4178f8
sub ecx, 1
je 0x4178c5
sub ecx, 1
jne 0x417956
push 1
sub esp, 0x18
mov ecx, esp
push 0x45f6e8
call fcn.00402064
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.00410497
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push 0x45f6e4
jmp 0x417942
push 1
sub esp, 0x18
mov ecx, esp
push 0x4657bc
call fcn.00402064
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.00410497
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push 0x45f6e8
jmp 0x417942
push 1
sub esp, 0x18
mov ecx, esp
push 0x465c30
jmp 0x4178d1
push 1
sub esp, 0x18
mov ecx, esp
push 0x45f6d0
jmp 0x4178d1
push 1
sub esp, 0x18
mov ebx, 0x45f6e8
mov ecx, esp
push ebx
call fcn.00402064
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.00410497
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.00402064
push str.TileWallpaper
mov edx, esi
call fcn.00410497
add esp, 0x20
push 3
push edi
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
pop edi
pop esi
pop ebx
ret

Function at 0x4188b1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
mov bl, cl
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call dword [0x46ca6c]
test bl, bl
mov dword [0x46bebc], eax
pop ebx
jne 0x4188dc
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push edi
push 1
call fcn.00436395
push eax
push 0x465cc4
push str.CONOUT_
call fcn.0043a8d6
push 0xc8
lea eax, [ebp - 0xc8]
push 0
push eax
call fcn.00431810
lea edi, [ebp - 0xc8]
add esp, 0x1c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x418912
push 7
pop ecx
mov esi, str.___________________________n
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0xc8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41892b
mov esi, str.__Remcos_v
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0xc8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x418942
mov esi, str.3.1.5_Pro
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0xc8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41895a
push 6
pop ecx
mov esi, str._n__BreakingSecurity.net_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0xc8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x418975
push 7
pop ecx
mov esi, str.___________________________n_n
lea eax, [ebp - 0xc8]
rep movsd dword es:[edi], dword [esi]
push eax
movsb byte es:[edi], byte [esi]
call fcn.004047f8
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41d11b
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [ecx + 4]
xor eax, eax
xor edx, edx
movzx ecx, word [esi]
cmp ax, cx
jae 0x41d146
movzx eax, dx
mov al, byte [eax + esi + 4]
cmp al, 0x13
je 0x41d146
cmp al, 0xc0
je 0x41d146
cmp al, 0xcc
je 0x41d146
add edx, 2
cmp dx, cx
jb 0x41d12b
pop esi
ret

Function at 0x41fb7b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, edx
mov edx, dword [ebp + 0xc]
lea esi, [edi + 4]
push esi
call fcn.0041fb15
mov edx, dword [ebp + 8]
pop ecx
push 4
sub edx, edi
pop ecx
mov al, byte [edx + edi]
mov byte [edi], al
inc edi
sub ecx, 1
jne 0x41fb97
push 8
pop ecx
mov al, byte [esi + edx]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x41fba5
pop edi
pop esi
pop ebp
ret

Function at 0x421c82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x421c9c
sub edx, ecx
mov eax, dword [edx + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub esi, 1
jne 0x421c8f
pop esi
pop ebp
ret

Function at 0x421c9f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, ecx
or eax, edx
push esi
mov esi, dword [ebp + 8]
or eax, esi
test al, 3
jne 0x421cbc
shr esi, 2
push esi
call fcn.00421c82
pop ecx
jmp 0x421ccd
test esi, esi
je 0x421ccd
sub edx, ecx
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub esi, 1
jne 0x421cc2
pop esi
pop ebp
ret

Function at 0x421cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, edx
mov ebx, ecx
test edi, edi
jle 0x421cf6
sub ebx, esi
movzx edx, byte [ebx + esi]
movzx ecx, byte [esi]
xor edx, ecx
or eax, edx
inc esi
sub edi, 1
jne 0x421ce5
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x421cfb
Capabilities:
Encrypt data using aes

Disassembly:
xor eax, eax
mov ecx, 0x4619e8
push 0x20
pop edx
and eax, dword [ecx]
add ecx, 0x20
sub edx, 1
jne 0x421d05
cmp ecx, str.SHA256wECDSA
jl 0x421d02
ret
Function at 0x429a8b
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x429b84
cmp dword [ebp + 8], 0
mov esi, dword [ebp + 0xc]
jne 0x429aad
test esi, esi
jne 0x429b84
cmp edx, 3
je 0x429ae3
cmp edx, 4
je 0x429ae3
cmp edx, 5
je 0x429ae3
cmp edx, 6
je 0x429ae3
cmp edx, 7
je 0x429ae3
cmp edx, 8
je 0x429ae3
cmp edx, 0xa
je 0x429ae3
cmp edx, 0xb
je 0x429ae3
cmp edx, 0xc
je 0x429ae3
cmp edx, 0xd
jne 0x429b84
xor ebx, ebx
mov byte [edi + 0x114], dl
push ecx
mov byte [edi + 0x115], bl
call fcn.00429a6e
mov dword [ebp - 4], eax
pop ecx
test eax, eax
jne 0x429b89
cmp byte [edi + 0x114], 6
lea ecx, [edi + 0x70]
jne 0x429b84
cmp esi, 0x40
ja 0x429b28
cmp dword [ebp + 8], ebx
je 0x429b4f
push esi
push dword [ebp + 8]
push ecx
call fcn.00431df0
add esp, 0xc
jmp 0x429b4c
mov edx, dword [ebp + 8]
mov ecx, edi
push esi
call fcn.0042e6cc
pop ecx
test eax, eax
jne 0x429b89
lea edx, [edi + 0x70]
mov ecx, edi
call fcn.0042e79d
mov dword [ebp - 4], eax
test eax, eax
jne 0x429b89
push 0x20
pop esi
lea ecx, [edi + 0x70]
cmp esi, 0x40
jae 0x429b67
push 0x40
pop eax
sub eax, esi
push eax
lea eax, [ecx + esi]
push ebx
push eax
call fcn.00431810
add esp, 0xc
mov al, byte [ebx + edi + 0x70]
xor al, 0x5c
mov byte [edi + ebx + 0xb0], al
xor byte [ebx + edi + 0x70], 0x36
inc ebx
cmp ebx, 0x40
jb 0x429b67
mov eax, dword [ebp - 4]
jmp 0x429b89
mov eax, 0xffffff53
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42e01b
Capabilities:
Hash data using sha256

Disassembly:
mov edx, ecx
test edx, edx
jne 0x42dfcf
mov eax, 0xffffff53
ret
push edi
push 8
xor eax, eax
mov edi, edx
pop ecx
rep stosd dword es:[edi], eax
mov dword [edx], 0x6a09e667
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x60], eax
mov dword [edx + 0x64], eax
mov dword [edx + 0x68], eax
pop edi
ret
test ecx, ecx
jne 0x42e025
mov eax, 0xffffff53
ret
mov dword [ecx + 0x6c], edx
jmp 0x42dfc3
Function at 0x42e6f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x42e6fe
mov eax, 0xffffff53
pop esi
ret
mov eax, dword [esi + 0x60]
push ebx
push edi
lea edi, [esi + 0x20]
mov byte [edi + eax], 0x80
inc dword [esi + 0x60]
mov ecx, dword [esi + 0x60]
push 0x38
pop ebx
cmp ecx, ebx
jbe 0x42e74b
push 0x40
pop eax
sub eax, ecx
push eax
lea eax, [ecx + edi]
push 0
push eax
call fcn.00431810
push 0x40
pop eax
push eax
mov edx, edi
mov dword [esi + 0x60], eax
mov ecx, edi
call fcn.0042df96
add esp, 0x10
mov edx, edi
mov ecx, esi
call fcn.0042e02d
test eax, eax
jne 0x42e799
and dword [esi + 0x60], eax
mov eax, dword [esi + 0x60]
sub ebx, eax
push ebx
add eax, edi
push 0
push eax
call fcn.00431810
mov ecx, dword [esi + 0x64]
mov edx, edi
mov eax, dword [esi + 0x68]
shr ecx, 0x1d
push 0x40
lea eax, [ecx + eax*8]
mov ecx, edi
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x64]
shl eax, 3
mov dword [esi + 0x64], eax
call fcn.0042df96
mov eax, dword [esi + 0x68]
add esp, 0x10
mov dword [edi + 0x38], eax
mov edx, edi
mov eax, dword [esi + 0x64]
mov ecx, esi
mov dword [edi + 0x3c], eax
pop edi
pop ebx
pop esi
jmp fcn.0042e02d
pop edi
pop ebx
pop esi
ret

Function at 0x42e79d
Capabilities:
Hash data using sha256

Disassembly:
push ebx
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x42e7d2
test edi, edi
je 0x42e7d2
call fcn.0042e6f0
test eax, eax
jne 0x42e7d7
push esi
push 0x20
mov edx, ebx
mov ecx, ebx
call fcn.0042df96
pop ecx
push 8
pop ecx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
pop esi
pop edi
mov ecx, ebx
pop ebx
jmp 0x42dfc3
mov eax, 0xffffff53
pop edi
pop ebx
ret

Function at 0x42e88c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, edx
mov esi, ecx
neg eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], eax
test esi, esi
je 0x42e929
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x42e929
mov edx, dword [esi]
mov ecx, ebx
inc edx
call fcn.0042a1d9
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x42e92e
xor edx, edx
push edi
cmp dword [esi], edx
jle 0x42e8ee
mov edi, dword [ebx + 0xc]
mov ecx, esi
call fcn.0042e876
mov ecx, ebx
mov esi, eax
call fcn.0042e876
mov ecx, dword [ebp - 4]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
mov esi, dword [ebp - 8]
cmp edx, dword [esi]
jl 0x42e8c7
jmp 0x42e914
mov ecx, dword [ebp - 4]
jmp 0x42e914
mov edi, dword [ebx + 0xc]
mov ecx, esi
call fcn.0042e876
mov ecx, ebx
mov esi, eax
call fcn.0042e876
mov ecx, dword [ebp - 4]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
mov esi, dword [ebp - 8]
cmp edx, dword [ebx]
jl 0x42e8f3
mov eax, dword [ebp - 8]
pop edi
mov eax, dword [eax]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
mov eax, dword [ebp - 0xc]
jmp 0x42e92e
mov eax, 0xffffff53
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x444516
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00444395

Function at 0x4468ef
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044625d
Function at 0x4468fa
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00446498
Function at 0x405ee9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x405f0d
xor eax, eax
test eax, eax
je 0x405f1f
cmp byte [ebp + eax - 0x121], 0x5c
je 0x405f1f
xor ecx, ecx
jmp 0x405f22
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409010]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x405fc6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c634], 0
push esi
jne 0x405ffd
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405fd7
mov dword [ecx*4 + 0x42c630], eax
inc ecx
cmp ecx, 0x100
jl 0x405fd2
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40602e
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c630]
xor eax, esi
inc ecx
dec edx
jne 0x406010
pop edi
not eax
pop esi
ret 0xc

Function at 0x40b2d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
jmp 0x40b2e2
mov esi, dword [edx + 0x28]
nop
jmp 0x40b2f1
xor eax, eax
jmp 0x40b303
lodsb al, byte [esi]
nop
jmp 0x40b316
cmp al, 0x61
jmp 0x40b327
jl 0x40b358
jmp 0x40b338
nop
jmp 0x40b348
sub al, 0x20
jmp 0x40b358
nop
jmp 0x40b364
ror edi, 0xd
add edi, eax
nop
jmp 0x40b37a
dec ecx
jmp 0x40b388
jne 0x40b2e6
jmp 0x40b39f
push edx
nop
jmp 0x40b3ac
mov edx, dword [edx + 0x10]
push edi

Function at 0x40b7cb
Capabilities:
Encode data using xor

Disassembly:
call fcn.0040b6c3
mov ecx, 0x1ff
call 0x40b7cb
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x40b7ce
Function at 0x402b4d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x402b92
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x402b98
add eax, 4
pop esi
dec esi
push esi
jne 0x402b7a
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8

Function at 0x409e67
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
sub esp, 0x40
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
lea eax, [ebp + 0x18]
cmp ecx, edi
ja 0x409e82
cmp esi, edi
jbe 0x409e9f
mov edx, dword [ebp + 0x18]
add esi, 0xffffffff
mov dword [ebp - 0x28], edx
mov edx, dword [ebp + 0x1c]
adc ecx, 0xffffffff
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], ecx
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], edx
jmp 0x409ea5
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
cmp ecx, edi
ja 0x409ead
cmp esi, edi
jbe 0x409eca
add esi, 0xffffffff
adc ecx, 0xffffffff
add eax, 8
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x20], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0x1c], edx
jmp 0x409ed0
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
cmp ecx, edi
ja 0x409ed8
cmp esi, edi
jbe 0x409ef5
add esi, 0xffffffff
adc ecx, 0xffffffff
add eax, 8
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x18], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0x14], edx
jmp 0x409efb
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
cmp ecx, edi
ja 0x409f03
cmp esi, edi
jbe 0x409f20
add esi, 0xffffffff
adc ecx, 0xffffffff
add eax, 8
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x10], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0xc], edx
jmp 0x409f26
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
cdq
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp + 0xc], edi
mov dword [ebp + 0xc], esp
and esp, 0xfffffff8
push 0x33
call 0x409f55
add dword [esp], 5
retf
Function at 0x41cb5f
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0041cd0f
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x41cc5d
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x41cc00
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x41cc43
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x41cc17
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x41cc32
test al, 0x40
je 0x41cc29
mov ecx, dword [edi + 0x20]
jmp 0x41cc30
test al, 0x80
je 0x41cc43
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x41cc43
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x41cbcf
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x41dbc2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x41dc07
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x41dc0d
add eax, 4
pop esi
dec esi
push esi
jne 0x41dbef
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8