joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7440
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], 0xa7
mov edx, dword [edx + 0xaaa73]
lea esp, [esp + 0x2c]
jns 0x4cc914
push 0x6b951397
mov byte [esp], 0x95
lea edx, [edx - 0x5d226101]
pushal
push 0x733e3da3
call fcn.004e4df2
sal esi, cl
shl byte [esi + 0xf], cl
mov esi, 0xcfa7bad2
inc ebx
add byte [eax - 0x17], ah
inc esi
scasd eax, dword es:[edi]
cld
invalid

Function at 0x4b6bdb
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp], ecx
pushfd
mov byte [esp], al
jmp 0x4d3854
xchg dword [esp], ecx
bswap ecx
movsx ecx, al
mov ecx, 0x450eef
jmp 0x4b0483
pushal
push esi
mov ecx, dword [ecx + 0x49159]
pushal
push 0x5f604de1
push dword [esp + 8]
jmp 0x4e998c
not cl
nop
jmp 0x4cb523
movzx cx, cl
pop ecx
jmp 0x49e1ba
jmp 0x4aea2b
lea ecx, [ecx + 0x4af4049f]
mov byte [esp + 4], 0x89
pushfd
jmp fcn.004a6fdb

Function at 0x4b9d10
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], 0x783b96c9
jmp 0x4dfd33
mov eax, dword [eax + 0x98aa3]
jmp 0x4d31a3

Function at 0x4bc67c
Capabilities:
Encode data using xor

Disassembly:
call 0x4aff8a
push esp
mov edi, 0x311a286b
mov ebx, 0x2bac1aa5
test byte [edi - 0x5d], cl
xchg ecx, eax
adc eax, 0xe863bfef
push ebp
fisttp dword [ebx]
sub ebp, dword [eax - 0x1e]
test eax, 0x17340e85
test dword [esi], ecx
xor al, 0x17
pop es
test byte [edx - 0x4c90c017], ch
lcall 0x7784, 0x39edbba4
movsb byte es:[edi], byte [esi]
mov ebx, 0x778439ed
cdq
loop 0x4bc69d
cmp eax, 0x7b8db80e
mov edi, dword [eax]
mov dl, 0x36
or al, 0x59
in al, dx
dec ecx
cmp bh, byte [edi]
aas
fdivr qword [esi]
adc eax, 0xc2ec50fd
xor al, 0xb4
mov al, byte [0xf139159e]
loopne 0x4bc6c1
push eax
pop edi
aad 0x3d
mov byte [ebx - 0x51], dh
sahf
clc
sub cl, byte [ecx - 0xcc86331]
je 0x4bc6a9
sub ah, bl
mov eax, 0x8c4f063
std
add ebp, ebx
cmp eax, 0xfaf20818
sahf
xlatb
aas
mov eax, dword [0xe4216ee5]
dec ebp
push ecx
retf
Function at 0x4d31a8
Capabilities:
Packed with generic packer

Disassembly:
lea ebx, [ebx + 0x69001aa5]
call fcn.004e7276
pushfd
mov byte [esp], ah
mov ebx, dword [ebx + 0x7d2cd]
pushfd
pushal
jmp 0x4aea3d
push eax
push esi
movsx dx, dl
mov edx, 0x458f08
call fcn.004c727b
push edi
call fcn.004a3c86
push ebp
mov word [esp], 0x3029
call fcn.004ecef2
call fcn.00499ab9
mov ebx, 0x431d7d
lea esp, [esp + 0x28]
jge 0x4c0121
pushfd
push dword [esp]
mov ebx, dword [ebx + 0x7d2cd]
pushfd
call fcn.004dbd35
scasb al, byte es:[edi]
nop
stosb byte es:[edi], al
loope 0x4d321f
pop ebx
lds esp, [ecx]
sbb ecx, dword [ebx - 0x650ee277]
xchg esp, eax
mov ecx, dword [ecx - 0x6b650ee3]
inc dword [ecx + 0x65]
mov bh, 0xf7
and esi, dword [eax]
cdq
jge 0x4d3181
pop ebp
fist dword [ebx]
pop ss
or byte [ebp + 0x156c6a55], cl
loopne 0x4d31f5
invalid
mov al, 0x1a
adc byte [ecx + 0x7a], bh
insb byte es:[edi], dx
jecxz 0x4d321c
pop eax
jbe 0x4d321b
pop ebp
ja 0x4d31c9
push 0xd0c37f57
bound edx, qword [ebx + 0x62]
xchg esp, eax
xor ebx, 0xffffffaa
push edi
xchg esi, eax
das
xchg edx, eax
invalid
loope 0x4d31d0
mov bl, 0x73
pop ecx
jae 0x4d3283
pop ecx
mov cl, 0x32
popal
xchg dword [ebp + 0x44cc5498], esi
push esi
rol byte [ebp - 0x4d], 1
imul ebp, dword [ecx - 0x587e5d9c], 0x1cd23bf3
mov edi, 0xb362dc3f
outsd dx, dword [esi]
sahf
jo 0x4d31e5
push esi
adc byte es:[ecx + 0x37e16412], al
pushfd
mov dword [esp + 8], 0x5da52d6e
pushfd
pushfd
pushfd
lea esp, [esp + 0x14]
jmp fcn.004011b7
inc esp
and al, 0x2c
sti
mov byte [ecx], dl
mov byte [esp], 0x6d
push 0x516151be
lea esp, [esp + 0x30]
jmp fcn.00402b58
or eax, 0xae7a19
and dh, al
jo 0x4d3268
invalid
inc ecx
insd dword es:[edi], dx
lodsd eax, dword [esi]
sahf
jbe 0x4d32c3
aam 0xda
dec eax
inc ebx
jmp 0x4d32f9
div al
inc esi
xor eax, 0x3e13faef
ficomp word [esi]
xor ebp, dword [edx]
sub al, byte [ebx - 0x46]
xor bh, byte [edx]
insb byte es:[edi], dx
test byte [esi - 0x3c], al
in al, 0x6f
int 0xe1
sub dword [edx + ebx], esp
xor esi, ebx
sbb al, 0x56
jbe 0x4d328a
insd dword es:[edi], dx
aam 0xe
cmp ch, byte [ecx - 0x6b312cdb]
xor eax, 0x5e61cef2
jmp 0xfc8cfe1b
pop edx
into
cmc
push eax
xor byte [edx + 0x3a], al
cmp bl, dl
fld xword [edi]
xor bl, ah
int 0x3e
leave
inc ebp
sbb eax, 0xed7312cb
invalid
Function at 0x4e4a18
Capabilities:
Packed with generic packer

Disassembly:
push eax
setl bh
mov ebx, 0x42fb86
push 0x895a12b5
pushfd
mov ebx, dword [ebx + 0x8f536]
pushfd
call fcn.0048b2ee
jmp 0x4f7d43
call fcn.004d70e2
mov byte [esp], al
xchg dword [esp + 0x2c], ebx
jmp 0x4e7b56
mov ebx, dword [ebx + 0x8f536]
mov byte [esp], 0x35
jmp 0x4e7978
jmp 0x4cd674
lea ebx, [ebx*4 + 0x44253956]
js 0x4e8b05
nop
pushfd
setp bl
pushal
mov ebx, dword [esp + 0x24]
pushfd
lea esp, [esp + 0x2c]
jnp 0x499b15
xchg dword [esp], ebx
jmp 0x4ef252
call fcn.004ad2bc
push ebx
push dword [esp + 0x10]
xchg dword [esp + 0x30], ebx
pop ebx
mov ebx, 0x42fb86
pushfd
mov byte [esp], 0xbf
mov ebx, dword [ebx + 0x8f536]
call fcn.004cb8e6
not dl
mov edx, 0x429e41
call fcn.004b467c
setno bh
nop
lea ebx, [eax + 0xb0ff2d1]
pushal
mov ebx, dword [esp + 0x20]
pushfd
pushfd
jmp 0x4af2be
push eax
lea esp, [esp + 4]
jge 0x4ad2de
pushfd
mov dword [esp], ebx
setae bl
not ebx
mov ebx, 0x42fb86
pushal
jmp 0x4d1cc9
push eax
xchg dword [esp + 4], ebx
pushal
pushfd
push esi
pushfd
mov dword [esp + 0x2c], ebx
jmp 0x491cf4

Function at 0x4e797d
Capabilities:
Packed with generic packer

Disassembly:
add bh, al
add al, 0x24
test byte [edi + 0x685320a4], 0xb3
std
insd dword es:[edi], dx
aad 0x8d
and al, 8
jmp loc.00401582
call fcn.004de8f9
test bh, cl
popal
inc ebp
fnstcw word [edx - 0x7a]
sub cl, bl
jae 0x4e79fb
aaa
mov esp, 0x14d23661
sub byte [esi + 0x5043efa4], al
lock inc byte [edx - 0x5c]
and byte [esi], 0xf0
wait
xchg ecx, eax
adc eax, 0x5c37f7ef
salc
xlatb
cmp edx, dword [edi + 0x33]
jle 0x4e79b6
push cs
mov al, byte [0x9da5a085]
mov dh, 0x5c
jne 0x4e7950
fdiv st(4), st(0)
mov word [esi + 0x5247c66c], cs
int1
push ebx
int 0x71
sbb byte [eax + 0x1c39f99a], cl
push ds
test dword [ebx], 0xd4e3372e
sub dword [ecx], edx
mov byte [esi + eax*4 - 0x72616361], ch
sal ecx, 0x9a
wait
xchg dword [edx + 0x7721f3f8], ebp
ret
xchg dword [edi], ebx
out 0x12, eax
cmc
stosd dword es:[edi], eax
inc ebp
push edi
in al, 0x4e
aam 0x6e
frstor dword [edi]
xchg dword [ebx + 0x250e04a2], edx
inc ebx
shl ebp, 0x29
sub ch, al
imul edi
dec ecx
movsd dword es:[edi], dword [esi]
xchg ebx, eax
sbb ebx, edi
cld
or ah, byte [ecx]
invalid

Function at 0x5085e4
Capabilities:
Encode data using xor

Disassembly:
nop
sub eax, 0xafe34556
inc esp
in al, dx
mov edx, 0x545dc14c
inc esi
sub al, 0x6d
cmpsd dword [esi], dword es:[edi]
shl al, 0x2f
sbb ch, byte [esi + 0xdfdb157]
or byte [edx], cl
sti
jmp 0x5f575ff5
pushal
mov word [esp + 4], 0x698f
pushal
mov dword [esp + 0x3c], 0xb501743a
call fcn.00501f5b
xchg esi, eax
jne 0x50859e
stosb byte es:[edi], al
jl 0x50860f
cmc
in eax, 0xe2
into
cmp byte [edi], 0xe4
sbb dword [0x6ba7ac8e], eax
call 0x74cb4c3a
mov ah, 0x3a
invalid
invalid
Function at 0x10009ff0
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x1000a01f
rcr byte [ecx - 0x55], 0x56
push esi
sub al, 0x59
sbb ebx, dword [edx + 0x3d]
or edx, ebx
in eax, dx
scasb al, byte es:[edi]
movsd dword es:[edi], dword [esi]
rcr dh, 1
pop ebx
xor al, 0xe5
mov al, byte [0xe8e20ad6]
scasd eax, dword es:[edi]
cmp byte [ebp - 0x6e742150], ah
jns 0x10009ff3
stc
xchg ebp, eax
push ecx
int1
push 0x9859eb19
and dword [edx], edi
ja 0x10009fea
jae 0x1000a047
add edx, edx
xchg edi, eax
jmp 0x1000a09a
cmp eax, 0x63564af3
xchg ebx, eax
sub al, 0xac
invalid
pop edx
int1
fdiv qword [esp + esi*2 + 0x22]
and ebp, dword [edi + 0x1e]
xor al, 0xbe
add eax, 0xd1dd8cb3
sub byte [ecx - 0x5fd21b9], bl
lock or byte [esi + 0x38], dh
or byte [esi + 0x38], dh
scasd eax, dword es:[edi]
xlatb
loopne 0x1000a047
mov al, byte [0x52ac99ec]
call 0x8427d3b6
sub al, 0xa6
pop esi
or al, 0xa8
add al, 1
and eax, 0x8fc456ef
adc al, 0x45
wait
jle 0x1000a083
dec edi
sbb al, 0xcb
ffree st(0)
dec ebx
bound ebx, qword [eax + 0x5a]
mov dl, 0x86
and dword [edx + 0x21461bc6], edi
int 0xe4
sbb bh, byte [edi + 0x2f0be5a1]
out 0xa3, eax
sub ebp, dword [ebx]
or eax, 0xc7e8e50
push eax
pushal
push dx
popal
mov esp, 0x1240b640
sbb eax, 0x69d9dd2d
jmp [ecx + 0x1a440257]
test eax, 0x1a440257

Function at 0x1000f280
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
add ch, byte [0x49a49824]
dec esi
add ebp, dword [eax + 0x5a183255]
push 0xa3f3872f
sbb cl, dl
xchg edx, eax
enter 0x7f22, 0xffffffffffffff8a
xor al, 0xce
adc bh, dl
test al, 0x5a
mov ah, 0x34
xchg edx, eax
cdq
sti
inc ebx
mov bl, 0xd1
dec ecx
js 0x1000f28e
dec esi
add dword [edi], eax
add al, ch
mov ah, 0x86
std
and dword [edi + 0x54c5cd3a], esi
mov dword [0x8922ff43], eax
and dword [edi + edi], edi
imul edi, dword [edx - 0x7db8179a], 0x3e
xor byte [eax + 0x7b77d778], ch
arpl word [edi], di
out 0xc0, eax
push 0x25a970a7
adc bl, dh
rcr cl, cl
mov byte [esi - 0x37], al
je 0x1000f31a
in al, dx
push cs
push esp
xor byte [esi], bl
mov byte [0xe38630f7], al
invalid
test al, 0xf0
invalid
Function at 0x401995
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x40199f
add dword [esp], 5
retf

Function at 0x401b52
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ax, 0x53
mov fs, eax
push 0x33
call 0x401b62
add dword [esp], 5
retf

Function at 0x401cc8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x401cd2
add dword [esp], 5
retf

Function at 0x401ee3
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x401f0f
add dword [esp], 5
retf

Function at 0x4022b7
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4022e3
add dword [esp], 5
retf
Function at 0x409cda
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x409d1d
push 0x2b
push 0x4012fb8
push 6
call fcn.004192a8
add esp, 0xc
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x2c25cbf]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.00404e56
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.0041b1a0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x409d70
push ebx
call fcn.0041929c
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x409da6
push 0x84
push 0x4012fb8
push 6
call fcn.004192a8
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x409dc2
push eax
mov ebx, eax
call fcn.0040162f
inc eax
push eax
call fcn.004192a2
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x409dc7
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x409dd8
push ebx
call fcn.0041929c
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40d9e9
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40d9ff
mov eax, dword [ebp + 8]
mov edx, dword fs:[0x18]
mov dword [eax], edx
push 0x33
call 0x40da06
add dword [esp], 5
retf

Function at 0x40da60
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x40da6a
add dword [esp], 5
retf
Function at 0x40de0a
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
cmp dword [ebp + 8], 0xfffffffe
jne 0x40df41
mov eax, dword fs:[0x18]
mov dword [ebp - 4], eax
mov ax, 0x53
mov fs, eax
push 0x33
call 0x40df0c
add dword [esp], 5
retf
lea eax, [ebp - 0x3c]
push eax
call fcn.0040bbfc
mov dword [ebp - 0x44], eax
mov eax, 0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
push 0x30
push dword [ebp - 0x44]
push 0
push dword [ebp + 8]
call fcn.0040e0aa
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
cmp dword [ebp - 0x58], 0
jne 0x40df7e
cmp dword [ebp - 0x54], 0
jne 0x40df95
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
jmp 0x40df9f
mov eax, 0
jmp 0x40e0a4
cmp dword [ebp + 0x18], 0
mov eax, 0
sete al
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x40dfdb
xor eax, eax
cmp dword [ebp - 8], 0
jl 0x40dfcc
jg 0x40dfcb
cmp dword [ebp - 0xc], 0xffff
jbe 0x40dfcc
inc eax
test eax, eax
je 0x40dfdb
mov eax, 1
jmp 0x40dfe0
mov eax, 0
test eax, eax
je 0x40e052
push dword [ebp + 8]
call fcn.0040e34b
push edx
push eax
push 1
push 0
push 1
push 0x1f0fff
call fcn.0040e464
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x40e052
push dword [ebp - 0x40]
call fcn.0040e84a
test eax, eax
je 0x40e032
mov eax, dword [ebp - 0x40]
cdq
push edx
push eax
call fcn.0040e8ca
jmp 0x40e052
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x40]
cdq
push edx
push eax
call fcn.0040ebaa
mov eax, dword [ebp - 0x40]
cdq
push edx
push eax
call fcn.0040e8ca
cmp dword [ebp + 0x10], 0
mov eax, 0
sete al
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x40e079
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov dword [ebx + 4], edx
cmp dword [ebp + 0x18], 0
mov eax, 0
sete al
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x40e09a
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov eax, 1
jmp 0x40e0a4
mov esp, ebp
pop ebp
ret 0x14
Function at 0x410456
Capabilities:
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
cmp dword [0x2c2641e], 0xffff
jge 0x41047e
push 0x3cfa685d
call fcn.0041048c
mov dword [0x2c2641e], eax
mov eax, dword [0x2c2641e]
jmp 0x410488
mov esp, ebp
pop ebp
ret

Function at 0x41048c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
pop edx
pop ecx
push edx
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x4104e0
mov al, cl
cmp al, 0x61
jb 0x4104bb
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x4104e0
mov al, cl
cmp al, 0x61
jb 0x4104d3
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x4104ac
cmp edx, dword [esp + 0x18]
je 0x4104f0
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x4104a5
xor eax, eax
jmp 0x4104f3
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x41055f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x410660
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x410666
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4105c1
cmp al, 0x61
jb 0x4105b9
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x4105ac
cmp edx, dword [esp + 0x14]
je 0x4105d1
dec ecx
jne 0x4105a1
xor eax, eax
jmp 0x410660
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x410660
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x410660
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x410611
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x410620
jmp 0x410608
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x410666
test eax, eax
je 0x410660
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x41065b
cmp al, 0x61
jb 0x410653
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x410646
call 0x410575
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x4106b3
mov al, cl
cmp al, 0x61
jb 0x41068e
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x4106b3
mov al, cl
cmp al, 0x61
jb 0x4106a6
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x41067f
cmp edx, dword [esp + 0x18]
je 0x4106c3
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x410678
xor eax, eax
jmp 0x4106c6
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x410575
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x410660
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x410666
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4105c1
cmp al, 0x61
jb 0x4105b9
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x4105ac
cmp edx, dword [esp + 0x14]
je 0x4105d1
dec ecx
jne 0x4105a1
xor eax, eax
jmp 0x410660
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x410660
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x410660
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x410611
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x410620
jmp 0x410608
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x410666
test eax, eax
je 0x410660
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x41065b
cmp al, 0x61
jb 0x410653
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x410646
call 0x410575
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x4106b3
mov al, cl
cmp al, 0x61
jb 0x41068e
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x4106b3
mov al, cl
cmp al, 0x61
jb 0x4106a6
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x41067f
cmp edx, dword [esp + 0x18]
je 0x4106c3
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x410678
xor eax, eax
jmp 0x4106c6
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x410666
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x410660
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x410666
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4105c1
cmp al, 0x61
jb 0x4105b9
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x4105ac
cmp edx, dword [esp + 0x14]
je 0x4105d1
dec ecx
jne 0x4105a1
xor eax, eax
jmp 0x410660
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x410660
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x410660
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x410611
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x410620
jmp 0x410608
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x410666
test eax, eax
je 0x410660
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x41065b
cmp al, 0x61
jb 0x410653
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x410646
call 0x410575
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x4106b3
mov al, cl
cmp al, 0x61
jb 0x41068e
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x4106b3
mov al, cl
cmp al, 0x61
jb 0x4106a6
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x41067f
cmp edx, dword [esp + 0x18]
je 0x4106c3
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x410678
xor eax, eax
jmp 0x4106c6
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x413d0d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x413dc0
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x41884c
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 1
push 0
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
nop
nop
cmp dword [ebp - 4], esp
je 0x41888d
push 0
push 0x4018be5
push 6
call fcn.004192a8
add esp, 0xc
mov dword [ebp - 4], esp
push 4
push 0
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
nop
nop
cmp dword [ebp - 4], esp
je 0x4188c5
push 0x2c
push 0x4018be5
push 6
call fcn.004192a8
add esp, 0xc
mov esp, ebp
pop ebp
ret 4