joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4146c7
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x2ec]
sub esp, 0x36c
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp + 0x2e8], eax
push ebx
push esi
mov esi, dword [ebp + 0x2f4]
push edi
push 0x44
pop edi
push edi
xor ebx, ebx
lea eax, [ebp - 0x80]
push ebx
push eax
call sub.MSVCR80.dll_memset
mov dword [ebp - 0x80], edi
xor eax, eax
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
xor edi, edi
inc edi
push edi
push 0x104
lea eax, [ebp + 0x1e4]
push eax
call fcn.00414562
cmp eax, ebx
mov dword [ebp - 0x2c], eax
jl 0x4147f5
push dword [esi + 0xc]
lea eax, [ebp + 0x1e4]
push eax
push 0x402604
lea eax, [ebp - 0x24]
push 0x208
push eax
call dword [sym.imp.MSVCR80.dll_sprintf_s]
add esp, 0x14
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push 0x4000020
push edi
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x1e4]
push eax
mov dword [ebp - 0x2c], 0x80004005
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4147f5
mov dword [ebp - 0x28], edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, 0x4e20
push ebx
push dword [esi]
call edi
test eax, eax
jne 0x4147a3
push 1
push dword [esi + 4]
call edi
test eax, eax
jne 0x4147e4
and dword [ebp - 0x28], eax
and dword [ebp - 0x2c], eax
jmp 0x4147e4
push ebx
push dword [esi + 8]
call edi
cmp eax, 0x102
je 0x4147f5
cmp eax, 0x80
je 0x4147ec
push 1
push dword [esi]
call edi
test eax, eax
je 0x4147cc
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x4147d7
push 1
push dword [esi + 4]
call edi
test eax, eax
jne 0x4147db
and dword [ebp - 0x28], 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x28], 0
jne 0x414787
jmp 0x4147f5
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x3c]
call esi
mov ecx, dword [ebp + 0x2e8]
mov eax, dword [ebp - 0x2c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c2a
add ebp, 0x2ec
leave
ret 4
Function at 0x4150a1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
mov edi, 0x20019
push edi
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call esi
test eax, eax
jne 0x41512d
cmp dword [ebp - 4], ebx
je 0x41512d
lea eax, [ebp + 0xc]
push eax
push edi
push ebx
push 0x4027d0
push dword [ebp - 4]
mov dword [ebp + 0xc], ebx
call esi
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
call esi
cmp edi, ebx
jne 0x41512d
cmp dword [ebp + 0xc], ebx
je 0x41512d
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
mov edi, eax
call esi
cmp edi, ebx
je 0x41511f
cmp edi, 0xea
jne 0x415129
cmp dword [ebp + 8], ebx
je 0x415129
xor eax, eax
inc eax
jmp 0x41512f
xor eax, eax
jmp 0x41512f
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x41543e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
push esi
call sub.MSVCR80.dll_wcscpy_s
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x415454
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 - 2], 0x5c
je 0x41547c
push 0x404fb4
push dword [esp + 0xc]
push esi
call sub.MSVCR80.dll_wcscat_s
add esp, 0xc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
call edi
cmp eax, 0xffffffff
jne 0x4154c7
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x415490
sub eax, edx
sar eax, 1
lea eax, [esi + eax*2 - 4]
movzx ecx, word [eax]
cmp cx, 0x73
je 0x4154b5
cmp cx, 0x53
je 0x4154b5
xor eax, eax
jmp 0x4154ca
and word [eax + 2], 0
push esi
mov word [eax], 0x5c
call edi
cmp eax, 0xffffffff
je 0x4154b1
xor eax, eax
inc eax
pop edi
ret 8

Function at 0x4154ce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
xor esi, esi
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0x402918
push dword [ebp + 0x1c]
push dword [ebp + 0x20]
call sub.MSVCR80.dll_swprintf_s
add esp, 0x18
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x415513
cmp dword [ebp + 0x14], esi
je 0x415510
push dword [ebp + 8]
push dword [ebp + 0x18]
call dword [ebp + 0x14]
mov esi, eax
jmp 0x415513
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret 0x1c
Function at 0x41560a
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1e8]
sub esp, 0x268
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp + 0x1e4], eax
mov eax, dword [ebp + 0x1f0]
and dword [ebp - 0x70], 0
push 0x402934
push ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x1f4]
push 0x404a28
push dword [ebp + 0x200]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x1fc]
push edi
mov dword [ebp - 0x7c], eax
call sub.MSVCR80.dll_swprintf_s
add esp, 0x14
lea eax, [ebp - 0x6c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x74], eax
je 0x41574f
push esi
test byte [ebp - 0x6c], 0x10
je 0x41571c
mov ecx, 0x402930
lea eax, [ebp - 0x40]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4156ae
test dx, dx
je 0x4156aa
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4156ae
add eax, 4
add ecx, 4
test dx, dx
jne 0x415688
xor eax, eax
jmp 0x4156b3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41571c
mov ecx, 0x402928
lea eax, [ebp - 0x40]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4156e5
test dx, dx
je 0x4156e1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4156e5
add eax, 4
add ecx, 4
test dx, dx
jne 0x4156bf
xor eax, eax
jmp 0x4156ea
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41571c
lea eax, [ebp - 0x40]
push eax
call sub.MSVCR80.dll__wtol
mov esi, eax
test esi, esi
pop ecx
je 0x41571c
push edi
push dword [ebp + 0x200]
push dword [ebp + 0x1f8]
push dword [ebp - 0x78]
push dword [ebp - 0x80]
push ebx
push esi
call fcn.004154ce
test eax, eax
jne 0x415733
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x415676
jmp 0x41573f
mov eax, dword [ebp - 0x7c]
mov dword [eax], esi
mov dword [ebp - 0x70], 1
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x70], 0
pop esi
jne 0x415753
and word [edi], 0
mov ecx, dword [ebp + 0x1e4]
mov eax, dword [ebp - 0x70]
xor ecx, ebp
call fcn.00413c2a
add ebp, 0x1e8
leave
ret 0x14

Function at 0x4158ad
Capabilities:
Load windows common language runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x4029f4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
jne 0x4158dc
mov eax, 0x80004005
jmp 0x41594e
push 0x4029e0
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4158fa
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x8000ffff
jmp 0x41594e
push esi
push 0x406218
push 0x4061f8
push 0
push 0
push 0
call eax
mov esi, eax
test esi, esi
jge 0x41593c
push 0xffffffffffffffff
push esi
push 0x402940
lea eax, [ebp - 0x104]
push 0x80
push eax
call sub.MSVCR80.dll_swprintf_s
add esp, 0x14
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, 1
je 0x415945
test esi, esi
jge 0x41594c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c2a
leave
ret
Function at 0x4160d7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0x419b64
lea ecx, [ebp - 4]
xor esi, esi
call fcn.00410ed8
push 0x104
lea ecx, [ebp - 4]
mov dword [ebp - 8], 0x208
call fcn.0041113b
lea ecx, [ebp - 8]
push ecx
push eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call fcn.0041108f
pop ecx
push eax
lea ecx, [ebp - 4]
call fcn.00411114
cmp edi, esi
jne 0x416143
push esi
lea ecx, [ebp - 4]
call fcn.00416075
lea ecx, [ebp - 4]
call fcn.00415d8a
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
inc esi
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.004107d0
pop edi
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x421424
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x421587
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x421594
push 0
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x421468
mov ecx, 0x4215b4
mov dl, 1
mov eax, dword [0x412288]
call fcn.00418ef8
call fcn.00406398
push ebx
push 0
call sub.kernel32.dll_SizeofResource
cmp eax, 0x65
je 0x42148b
mov ecx, 0x4215b4
mov dl, 1
mov eax, dword [0x412288]
call fcn.00418ef8
call fcn.00406398
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x4214af
mov ecx, 0x4215b4
mov dl, 1
mov eax, dword [0x412288]
call fcn.00418ef8
call fcn.00406398
push ebx
call sub.kernel32.dll_LockResource
mov edx, dword [0x4265a4]
mov dword [edx], eax
mov eax, dword [0x4265a4]
cmp dword [eax], 0
jne 0x4214dd
mov ecx, 0x4215b4
mov dl, 1
mov eax, dword [0x412288]
call fcn.00418ef8
call fcn.00406398
call fcn.0042141c
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 0xc
call fcn.00406df8
mov ebx, dword [ebp - 4]
cmp ebx, 0x421650
jne 0x421500
mov al, 1
jmp 0x421526
test ebx, ebx
je 0x42150d
mov eax, 0x421650
test eax, eax
jne 0x421511
xor eax, eax
jmp 0x421526
mov edx, 0x421650
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
call fcn.00414d00
test eax, eax
sete al
test al, al
jne 0x421540
mov ecx, 0x4215b4
mov dl, 1
mov eax, dword [0x412288]
call fcn.00418ef8
call fcn.00406398
call fcn.0042141c
mov edx, 0x61
call fcn.0041e26c
mov ebx, eax
call fcn.0042141c
cmp ebx, dword [eax + 0x61]
je 0x421571
mov ecx, 0x4215b4
mov dl, 1
mov eax, dword [0x412288]
call fcn.00418ef8
call fcn.00406398
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42158e
lea eax, [ebp - 4]
call fcn.00406bb8
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1002aaee
pop dword [ebp - 0x28]
mov eax, 0x1002aaee
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xc0f173e6
add dword [ebp - 0x38], 0x8d60d165
mov dword [ebp - 0x34], 0xde4c23fe
sub dword [ebp - 0x34], 0xac18d7b9
mov dword [ebp - 0x30], 0x2ea21276
sub dword [ebp - 0x30], 0xe255ce48
mov dword [ebp - 0x2c], 0xdbe3542b
sub dword [ebp - 0x2c], 0xdbe3542b
lea eax, [ebp - 0x38]
push eax
mov eax, 0xac5491e1
add eax, 0x63ae2e57
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x35c2cbe4
add dword [ebp - 0x38], 0x3eaf9d72
mov dword [ebp - 0x34], 0x6d524f07
sub dword [ebp - 0x34], 0x2be5ed92
mov dword [ebp - 0x30], 0xec705179
sub dword [ebp - 0x30], 0x8900e50d
mov dword [ebp - 0x2c], 0xf8387d57
add dword [ebp - 0x2c], 0x7c782a9
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x4dc8c1ee
sub eax, 0x3dc601c6
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x376c4
push 0
call eax
mov ecx, 0x4bd2
mov esi, eax
mov edx, 0xdbfaa3de
add edx, 0x3408f222
add edx, dword [ebp - 0x28]
mov edi, 0x79d6a22a
mov dword [ebp - 4], 0xd53ba70e
mov ebx, dword [edx]
xor dword [ebp - 4], 0xab127655
sub ebx, edi
mov dword [esi], ebx
add dword [ebp - 0x14], edx
add esi, 4
add edx, 0x3c079633
sub edx, 0x3c07962f
loop 0x1002abff
add eax, 0x2bd826b2
sub eax, 0x2bd70497
mov ebx, eax
add eax, 0x12b5ef3f
add eax, 0xed4a10c6
mov ecx, 0x7b9f9625
sub ecx, 0x6b9f9625
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401151
Capabilities:
Packed with generic packer

Disassembly:
mov ebp, 0xea242b85
add bp, 0xcab6
sub bp, 0x9c86
mov ebp, 0x9e93d11d
add ebp, ebp
shr ebp, 0x8e
mov ebp, dword [esp + 4]
je fcn.004d8537
push dword [esp + 8]
popfd
lea esp, [esp + 0x14]
call fcn.00524a03

Function at 0x401182
Capabilities:
Packed with generic packer

Disassembly:
sub esi, 2
jmp fcn.004dda79

Function at 0x40ae60
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, 0x34567890
mov dword [ecx], 0x12345678
mov dword [ecx + 4], 0x23456789
mov dword [ecx + 8], edi
mov dl, byte [eax]
test dl, dl
je 0x40aed0
push esi
mov esi, dword [ecx + 4]
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
and edx, 0xff
mov edx, dword [ebx + edx*4]
shr eax, 8
xor edx, eax
movzx eax, dl
add esi, eax
mov eax, dword [ebp + 8]
imul esi, esi, 0x8088405
mov dword [ecx], edx
inc esi
mov edx, esi
shr edx, 0x18
xor edx, edi
and edx, 0xff
shr edi, 8
mov dword [ecx + 4], esi
xor edi, dword [ebx + edx*4]
inc eax
mov dword [ecx + 8], edi
mov dl, byte [eax]
mov dword [ebp + 8], eax
test dl, dl
jne 0x40ae86
pop esi
pop edi
pop ebp
ret
Function at 0x40e0d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x432bc8
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.0040f6e4
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40e100
or edi, 0xffffffff
jmp 0x40e16d
mov ecx, dword [ebp + 0xc]
push ebx
push 0x4000
push 1
push ecx
xor edi, edi
call fcn.0040fc44
mov esi, eax
add esp, 0x10
cmp esi, 0x4000
jae 0x40e141
push ebx
call fcn.00410cb4
add esp, 4
test eax, eax
jne 0x40e141
mov edx, dword [ebp + 8]
push edx
push str.error_in_reading__s_n
call fcn.0040f3fa
add esp, 8
or edi, 0xffffffff
test esi, esi
je 0x40e159
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push esi
push eax
push ecx
call fcn.004233f0
add esp, 0xc
mov dword [ebp - 4], eax
test edi, edi
jne 0x40e161
test esi, esi
jne 0x40e100
push ebx
call fcn.0040fcce
mov esi, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push esi
push eax
push str.file__s_crc__lx_n
mov dword [edx], esi
call fcn.0040f3fa
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ec91
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a5cc]
jne 0x40ec9b
repz ret
jmp fcn.0041196a

Function at 0x410ed5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x410efc
call fcn.00411d28
mov dword [eax], esi
call fcn.00411d15
push 0x16
pop esi
mov dword [eax], esi
call fcn.004138b4
mov eax, esi
jmp 0x410f51
test dword [ebp + 0xc], 0xfffffff9
jne 0x410ee2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x410f29
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411d3b
pop ecx
call fcn.00411d15
mov eax, dword [eax]
jmp 0x410f51
test al, 0x10
jne 0x410f4f
test al, 1
je 0x410f4f
test byte [ebp + 0xc], 2
je 0x410f4f
call fcn.00411d28
mov dword [eax], 5
call fcn.00411d15
mov dword [eax], 0xd
jmp 0x410f20
xor eax, eax
pop esi
pop ebp
ret
Function at 0x41b2d4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43a5cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00412322
and dword [ebp - 0x14], 0
cmp dword [0x441298], 0
mov dword [ebp - 0x18], eax
jne 0x41b387
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41b42f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41b42f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x441298], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44129c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4412a0], eax
call edi
push eax
call esi
mov dword [0x4412a8], eax
test eax, eax
je 0x41b387
push 0x42f708
push ebx
call edi
push eax
call esi
mov dword [0x4412a4], eax
mov eax, dword [0x4412a4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41b3e0
cmp dword [0x4412a8], ecx
je 0x41b3e0
push eax
call esi
push dword [0x4412a8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41b3e0
test ebx, ebx
je 0x41b3e0
call edi
test eax, eax
je 0x41b3d7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41b3d7
test byte [ebp - 8], 1
jne 0x41b3e0
or dword [ebp + 0x10], 0x200000
jmp 0x41b413
mov eax, dword [0x44129c]
cmp eax, dword [ebp - 0x18]
je 0x41b413
push eax
call esi
test eax, eax
je 0x41b413
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41b413
mov eax, dword [0x4412a0]
cmp eax, dword [ebp - 0x18]
je 0x41b413
push eax
call esi
test eax, eax
je 0x41b413
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x441298]
call esi
test eax, eax
je 0x41b42f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41b431
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ec91
leave
ret

Function at 0x4233e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004233f0
Function at 0x425360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4254e8
cmp dword [esi + 0x20], 0
je 0x4254e8
cmp dword [esi + 0x24], 0
je 0x4254e8
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4254e8
cmp dword [eax], esi
jne 0x4254e8
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x4253c7
cmp eax, 0x39
je 0x4253c7
cmp eax, 0x45
je 0x4253c7
cmp eax, 0x49
je 0x4253c7
cmp eax, 0x5b
je 0x4253c7
cmp eax, 0x67
je 0x4253c7
cmp eax, 0x71
je 0x4253c7
cmp eax, 0x29a
jne 0x4254e8
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x425400
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x425422
call fcn.004233e0
jmp 0x425427
call fcn.004279e0
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.00426490
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00414e60
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x431eea]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x431ee8]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x431eec]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x431eee]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop ebp
ret
mov eax, 0xfffffffe
pop esi
pop ebp
ret

Function at 0x4279e0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004279f0
Function at 0x473417
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x1c]
call fcn.0055f23f
push cs
jo 0x44f439
adc ah, byte es:[edx]
mov ebp, 0x65127b6
push ecx
push es
jle 0x44f453
inc ebx
push ds
push ss
xchg ecx, eax
movsb byte es:[edi], byte [esi]
add edi, dword [edx + 0x36]
cmp esp, dword [esi - 0x3ca7109]
push 0xffffffffffffffde
mov ecx, dword [esi + eax]
sar dword [eax + edx*8 + 0x7d], 0x81
xor al, 0x43
adc dword [eax + 0x69], 0xd56bc666
outsb dx, byte [esi]
salc
imul esp, dword [esi - 0x3a], 0xd66ed56b
inc ebx
xchg edx, eax
add bh, byte [edi - 0x1b543ed]
ja 0x44f400
push esi
in al, 0xa
jle 0x44f4a4
mov al, byte [0xb66f204c]
dec esp
and byte [edi - 0x4a], ch
xor byte [edx + 0x4f], ch
mov al, byte [0xb2456850]
bound eax, qword ss:[ebp - 0x5c]
pop esi
add byte [ebx], ah
jbe 0x44f438
dec ecx
ja 0x44f421
invalid
inc esi
das
invalid
pop esi
inc ebx
pop ss
dec eax
inc ebx
shr ebx, cl
sbb eax, 0x59515c73
push edx
cmp al, 0x35
mov edi, 0x384739b5
inc esi
or dword [esi], eax
pop esp
pop ecx
invalid
jne 0x5288b3
jae 0x44f3e9
mov ebx, 0x9fb0e460
test dl, dh
iretd

Function at 0x4a8ff2
Capabilities:
Encode data using xor

Disassembly:
rol dl, 1
inc dl
mov dword [esp], 0xb71c2510
neg dword [esp + 3]
adc ebp, 1
jmp 0x50a2c1
xor dl, bl
inc dl
rol dl, 1
add dl, 0x35
neg dl
dec dl
jmp 0x46c8a7

Function at 0x4bf87f
Capabilities:
Check for software breakpoints

Disassembly:
push es
add byte [eax], al
add byte [esi], dh
mov word [esi], dx
push 0x8085eb90
lea esp, [esp + 0xc]
jmp fcn.00554e76
xor al, bl
neg al
add al, 0xa9
xor al, 0x84
neg al
mov dword [esp], 0xfc9a55a3
xor bl, al
rol word [esp], 0x6d
and al, 0xa3
push ebp
lcall 0x4c1, 0x66d832fc
and al, 0x6d
lea eax, [esp + eax + 4]
setae byte [esp]
mov dword [eax], ebp
lea esp, [esp + 4]
jae fcn.0053c675
mov dh, dl
mov dword [0xd7e2e6de], eax
in eax, 0x70
inc edx
salc
stosd dword es:[edi], eax
shl dword [eax - 0x312c1802], cl
and byte [ebx], bl
cli
mov eax, 0x1e6d566b
jl 0x4bf84e
dec ecx
jbe 0x4bf937
push ds
jl 0x4bf8de
mov al, 0xfe
push ebp
sbb al, 0xec
jl 0x4bf88b
sbb ah, cl
or byte [esi - 0x52], dh
add dh, bl
pop ecx
cmpsb byte [esi], byte es:[edi]
jbe 0x4bf8cb
inc ecx
mov esi, 0x7e80c914
pop ss
add dword [edi + 0x38c9903c], 0x901fde22
mov al, 0xc3
xor bl, byte [ebx + esi + 0x537a44ea]
xchg edx, eax
outsd dx, dword [esi]
dec edi
cmp al, 0xcc
fstp xword [ebp - 0x714585b]
invalid
dec ebx
push ss
mov eax, 0x4ff99051
mov esp, 0x3b55b09c
sbb cl, byte ds:[edx]
fisttp dword [ecx - 0x1d]
std
dec edi
jl 0x4bf9a0
salc
ror dword [edx + ecx*4], 1
mov edx, 0x47bb16ba
in eax, dx
adc ah, byte [ebp - 0x52f162d5]
pop es
mov bl, 0x3a
test dword [ebx], esp
lcall 0x1830, 0xbe9c56eb
push esi
pushfd
mov esi, 0xd6131830
jmp 0x4cd5d203

Function at 0x4e6f5a
Capabilities:
Packed with generic packer

Disassembly:
push 0xe8a67db8
sub esi, 2
push 0x1226cb3f
jmp 0x545a6f
and edi, 0x918b302c
adc dl, 0xa1
rol dl, 1
pop edi
sub dl, 0xaf
jmp 0x54d13f
mov word [esi], di
lea esp, [esp + 8]
jmp fcn.0053472f
mov edi, 0x9c0cadbe
xor bl, dl
inc di
add edx, esp
shr di, 0xa1
movzx di, byte [edx]
jo 0x4d3638