joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f5d0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x47f603
push esi
call fcn.004843a0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x47f5fc
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x47f689
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x47f672
mov eax, dword [esi + 8]
test eax, eax
je 0x47f627
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x47f66e
cmp eax, 2
je 0x47f672
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x47f61a
cmp eax, 3
je 0x47f64d
cmp eax, 1
jne 0x47f61a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x47f61a
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x47f61a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0047f6c0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x47f6a9
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0047f6c0
add esp, 4
pop esi
ret

Function at 0x4b0120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4b012b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4b022e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x5132b8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5132b8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5132b8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5132b8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5132b8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5132b8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5132b8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5132b8]
xor eax, edx
inc ecx
dec edi
jne 0x4b0146
pop edi
test esi, esi
je 0x4b0250
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5132b8]
xor eax, edx
inc ecx
dec esi
jne 0x4b0232
pop esi
pop ebx
not eax
ret
Function at 0x4e8eb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x502d30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004ddd9d
mov eax, dword [0x52a960]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004ddccf
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004e9970
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4e8f57
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4e8f4e
cmp al, 0xff
je 0x4e8f4e
dec al
mov byte [ecx], al
jmp 0x4e8f57
push ecx
call fcn.004f26b4
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4e8f88
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4e8f7f
cmp al, 0xff
je 0x4e8f7f
dec al
mov byte [ecx], al
jmp 0x4e8f88
push ecx
call fcn.004f26b4
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4f4d18
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4f4d50
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004f2da5
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004f2d7d
jmp 0x4f4d5c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4f640e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4f6450
call fcn.004fbf7d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4f6450
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4f6447
xor eax, eax
jmp 0x4f6458
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004f645e
pop edi
pop esi
pop ebx
ret 4

Function at 0x4fc4ad
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4fc4db
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4fc4f9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004fc413
jmp 0x4fc4f9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4fc4f9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004fc413
test edi, edi
mov eax, edi
jne 0x4fc4e3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x5bff58
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x68
lea eax, [esp + 0x10]
push ebx
push ebp
push esi
push edi
push eax
call fcn.005c04b8
mov esi, dword [esp + 0x7c]
cmp word [esi], 0x5a4d
je 0x5bff80
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x68
ret 4
mov ebx, dword [esi + 0x3c]
add ebx, esi
mov dword [esp + 0x18], ebx
cmp dword [ebx], reloc.KERNEL32.dll_GlobalAlloc
je 0x5bff9d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x68
ret 4
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x34]
push 4
push 0x2000
push ecx
push edx
call dword [esp + 0x38]
mov edi, eax
test edi, edi
mov dword [esp + 0x10], edi
jne 0x5bffe0
mov eax, dword [ebx + 0x50]
push 4
push 0x2000
push eax
push edi
call dword [esp + 0x38]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x5bffdc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret 4
mov edi, dword [esp + 0x10]
push 0x14
push 0
call dword [esp + 0x3c]
push eax
call dword [esp + 0x50]
mov ebp, eax
push 4
push 8
mov dword [ebp + 4], edi
mov dword [ebp + 0xc], 0
call dword [esp + 0x3c]
push eax
call dword [esp + 0x50]
mov dword [ebp + 8], eax
mov dword [ebp + 0x10], 0
mov ecx, dword [ebx + 0x50]
push 4
push 0x1000
push ecx
push edi
call dword [esp + 0x38]
mov edx, dword [ebx + 0x54]
push 4
push 0x1000
push edx
push edi
call dword [esp + 0x38]
mov ecx, dword [esi + 0x3c]
mov edi, dword [ebx + 0x54]
add ecx, edi
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x7c]
mov edx, dword [ecx + 0x3c]
mov ecx, dword [esp + 0x10]
add eax, edx
lea edx, [esp + 0x4c]
mov dword [ebp], eax

Function at 0x5c0308
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.005c04b8
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x5c0406
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x5c03a9
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x5c03ec
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x5c03c0
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x5c03db
test al, 0x40
je 0x5c03d2
mov ecx, dword [edi + 0x20]
jmp 0x5c03d9
test al, 0x80
je 0x5c03ec
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x5c03ec
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x5c0378
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x861beb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [ecx*4]
sub esp, 0xe
mov al, 0xd6
and esi, ecx
cmc
neg ax
jmp 0x861c19
mov byte [esp + 6], dh
inc al
add esp, 1
and cl, bh
pop si
lea ecx, [ecx - 3]
jmp 0x861bf7
pushal
push dword [esp + 0xe]
lea esp, [esp + 0x30]
pushal
jmp 0x861bc0
add ebx, ebp
mov cx, word [esp + 2]
pop word [esp]
xchg dh, al
mov dx, word [esp]
mov al, ah
jmp 0x861c59
mov cx, bx
mov cx, bx
pop bx
pop dword [esp]
rdtsc
mov ecx, esi
jmp 0x861bd4
cmc

Function at 0x861c84
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 6
mov bl, 0x10
mov edi, dword [esp]
mov di, bx
mov edx, dword [esp]
jmp 0x861e7d
not ebp
mov byte [esp], dh
mov bx, dx
xor edx, esi
shr bh, 3
neg ebp
jmp 0x861ce8
sub esp, 0x1a
lea esp, [esp + 0x4b]
rdtsc
mov al, ah
clc
push esp
jmp 0x861caa
mov si, 0xbf67
lea ecx, [esp + edi]
push dword [esp]
mov al, 0x9e
add esp, 3
jmp 0x861d49
cmc
not di
mov bl, bh
setno ch
neg ecx
setge bh
jmp 0x861ccf
mov ebp, esi
sub esp, 0x10
mov cx, word [esp + 0xf]
xchg byte [esp + 0x10], cl
pushal
pop dword [esp + 0x26]
jmp 0x861cc0
setle bh
bsr cx, cx
add esp, 3
xchg si, ax
cmc
rdtsc
jmp 0x861d78
not esi
lea ecx, [ebp - 0x7f]
cpuid
pop dword [esp + 9]
mov dx, di
neg esi
jmp 0x861d1a
xor si, 0xeb4c
mov ebp, dword [esp + 3]
pushal
rdtsc
mov edx, dword [esp + 7]
mov ecx, 0x66303a60
jmp 0x861d32
mov dh, byte [esp + 7]
lea ecx, [ebp - 0xf]
mov word [esp + 0x16], sp
cmc
stc
pop di
jmp 0x861e15
pop ebp
mov dword [esp + 0x13], eax
push word [esp + 0x15]
push word [esp + 5]
lea esi, [ebx*4]
btr ebp, edx
jmp 0x861d60
setnp ch
mov word [esp + 3], dx
sub bl, ah
mov byte [esp + 7], ch
mov edx, dword [esp + 1]
pop dword [esp]
jmp 0x861d05
mov bh, byte [esp + 7]
pop dword [esp + 6]
not eax
pop dword [esp]
setne bh
jmp 0x861de4
neg ecx
bsr cx, bp
mov dword [esp + 0xf], ebp
mov word [esp + 2], dx
bswap eax
mov dword [esp + 7], ebp
jmp 0x861db6
xchg dword [esp + 2], edx
clc
mov bp, word [esp + 0xc]
lea ebx, [eax*4]
jmp 0x861e54
sub ax, 0x29a8
pop dword [esp + 4]
mov cl, ch
rdtsc
not ah
sete bh
jmp 0x861dcd
pop bp
rdtsc
mov dword [esp + 7], ecx
mov dl, dh
lea ecx, [eax + edx]
sete ch
jmp 0x861dfc
mov di, bx
neg di
add ax, 0xd9ee
btc edx, edi
cpuid
jmp 0x861fc4
btr ecx, edx
setno bh
lea edx, [edi + edi]
lea edx, [eax - 0xc1]
jmp 0x861e27
bswap edi
xchg byte [esp + 7], bl
mov ecx, dword [esp + 0xb]
lea edi, [esp + edx]
btr ebx, edx
xchg byte [esp + 9], dl
jmp 0x861e3d
xchg si, di
bswap edx
sub esp, 8
lea eax, [edi + edi]
setns dh
mov bh, byte [esp + 1]
jmp 0x861d9c
mov eax, 0xac039a4a
call fcn.00861e94
mov ax, 0xac99
mov ebx, 0x7659eb3c
xchg dx, cx
inc esi
xchg ch, dl
lea edx, [edi*4]
jmp 0x861eaa
xchg edx, esi
add si, 0xf9fe
xchg ecx, eax
cpuid
push dword [esp + 2]
xchg ch, dl
jmp 0x861f45

Function at 0x8620c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x86246a
mov byte [esp + 0x1b], ch
Function at 0x8627a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 1
rcl dx, cl
btc ebx, ebx
call 0x8627a4
insb byte es:[edi], dx
jae 0x8627cf
jb 0x8627c0
popal
je 0x8627a1
add byte [esi - 0x75], ah
sbb al, 0x24
jp 0x862808
add byte [edi - 0x2314dbfc], cl
sub ax, 0x7688
bswap edi
sub ax, 0x9318
push dword [esp + 4]
bswap edi
cmc
jmp 0x8629da
mov dword [eax], ebp
dec ebx
mov esi, ebx
setbe ch
push word [esp + 5]
xchg ah, bl
xchg bx, bp
mov ax, bx
not si
jmp 0x862894
xchg bh, cl
lea ebx, reloc.KERNEL32.dll_GlobalAlloc
rdtsc
push word [esp + 7]
xor dword [esi - 1], esp
je 0x862831
pop es
push word [esp + 0xb]
sub edi, eax
jmp 0x8627db
xchg dh, al
lea esi, [ebx + ebx]
mov bx, word [esp]
lea edi, [edx*4]
pop si
push dword [esp + 2]
jmp 0x8627ff
push word [esp + 1]
lea edi, [ebp + 0xc7]
inc bp
bswap ebx
setg ch
bsf si, ax
jmp 0x862821
lea ecx, reloc.KERNEL32.dll_GlobalAlloc
mov word [esp + 8], di
xchg cx, si
setl ah
jmp 0x8629ab
stc
mov bx, 0xf93b
mov word [esp], dx
mov dl, 0x64
mov edi, eax
jmp 0x862866
rdtsc
pop edi
mov dword [esp + 1], ebp
cpuid
btc edi, edi
mov al, ah
jmp 0x86287d
push word [esp + 5]
push dword [esp]
add esp, 5
pop edi
lea esp, [esp + 1]
push word [esp + 1]
jmp 0x86284e
xchg byte [esp + 8], al
stc
inc ebp
pop dword [esp + 0xc]
mov dword [esp + 0x19], esi
mov edi, eax
jmp 0x8628f3
sub esp, 6
mov word [esp + 5], sp
mov bp, 0xc00d
lea esi, [edx + ebx]
pushal
mov bp, sp
jmp 0x8628c3
mov dword [esp + 0xa], ecx
popal
btr edx, edx
add esp, 3
mov byte [esp], ah
xchg cx, bx
jmp 0x86293d
mov eax, ebp
mov cx, 0xb44f
mov eax, dword [esp]
neg esi
stc
rdtsc
jmp 0x8628de
mov word [esp], dx
lea edi, [ecx - 0x4b]
call fcn.00862924
mov bh, byte [esp + 3]
mov eax, 0xf532d210
add esp, 1
xchg bx, ax
sub esp, 0
xchg word [esp + 1], si
jmp 0x862985
btr ebx, edx
rdtsc
not eax
mov dword [esp + 0xf], esi
lea esp, [esp + 0x11]
mov cx, di
jmp 0x862914
mov eax, dword [esp + 1]
lea ebx, [esp + eax]
mov cx, word [esp]
pop word [esp]
lea esp, [esp + 2]
add esp, 0
jmp 0x8629be
mov bp, 0x8f15
sub esp, 8
xchg dh, al
cpuid
mov dword [esp + 5], ecx
mov dl, dh
jmp 0x862971
add esp, 0
neg ch
setne ch
mov bp, 0x54d1
lea ebp, [edx*4]
call fcn.00862bc4
mov ah, 0xa7
into
pop ecx
pop ax
pop cx
mov word [esp], bx
xchg word [esp + 5], bx
mov ecx, dword [esp + 7]
mov ecx, 0x8a400838
jmp 0x8628ac

Function at 0x862a0d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea edi, [edx + edx]
lea eax, [edx*4]
xchg ebx, edx
mov eax, ecx
bswap ebp
jmp 0x862a12
pop dword [esp]
jmp 0x8629f5
setbe dh
pop word [esp + 0x1c]
push dword [esp + 0x1c]
xchg ecx, eax
mov ecx, dword [esp + 0x1b]
xchg ecx, ebx
jmp 0x862a90
rdtsc
inc bp
bsf bx, ax
call fcn.00862a41
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
inc esi
jb 0x862ad4
add byte gs:[edx + 0x66], al
push dword [esp + 1]
inc edx
push word [esp + 1]
inc dx
rdtsc
bsr ax, bp
pop ebx
jmp 0x862a59
cpuid
popal
pop word [esp]
pop ebp
add esp, 1
mov dh, byte [esp + 1]
jmp 0x862a71
inc esp
and al, 1
Function at 0x862a41
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ecx
btr ebx, esp
neg bh
jmp 0x862ab7
btr edx, edx
bsr ax, cx
lea edx, [edx*4]
jmp 0x862ae6
rcr eax, 0x17
xchg dh, al
mov al, byte [esp]
mov dx, 0x947b
sub esp, 0x1c
pushal
jmp 0x862aa1
pop dword [esp + 0x24]
mov ax, di
lea ebx, [eax*4]
lea edx, [esp + ecx]
xchg word [esp + 5], bp
neg ch
jmp 0x862b4c
lea edx, [edi*4]
bswap edx
pushal
lea esp, [esp + 0x58]
lea ebx, [edx + edi]
mov edx, 0x6a6b73bc
jmp 0x862b8e
mov si, word [esp + 0x2e]
mov dx, word [esp + 0x1e]
mov word [esp + 6], bx
mov ecx, 0x907d59a
mov word [esp + 0x28], sp
mov dword [esp + 0x13], eax
jmp 0x862b22
btr ebp, edx
bsr dx, cx
mov edx, dword [esp]
mov ecx, dword [esp]
clc
inc ebp
jmp 0x862b9c
xchg edi, eax
cpuid
bswap ecx
xchg ch, dl
not esi
neg dh
jmp 0x862b6b
lea ebp, [eax + ebx]
bsf dx, ax
lea edx, [ebp*4]
rdtsc
mov cx, 0x8da5
mov bp, bx
jmp 0x862bf9
xchg bh, cl
mov ax, 0xe823
lea edx, [ecx - 0xcb]
mov dx, bx
jmp 0x862c2b
mov di, 0xd383
bsr ax, cx
mov si, 0xbbd3
xchg ebp, edx
not bp
jmp 0x862bcb
btc ebp, edi
bsf dx, ax
ror bh, 3
lea ebx, [esi*4]
mov bx, di
mov bp, bx
jmp 0x862be2
btr ebp, esp
pop esi
xchg word [esp + 9], ax
not bh
pop dword [esp]
mov al, 0x7e
jmp 0x8632ce
mov cl, 0x6a
sub esp, 0x12
pop word [esp + 5]
xchg byte [esp + 9], dl
rdtsc
xchg dword [esp + 0xa], ebx
jmp 0x862c12
pop word [esp + 3]

Function at 0x8674b4
Capabilities:
Parse pe header

Disassembly:
call fcn.00866047
push dword [esp]
mov word [esp], sp
mov word [esp + 6], di
push dword [esp + 6]
jmp 0x867502
lea esp, [esp + 0x58]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x86751a
push eax
jmp 0x866042
push word [esp + 0xb]
mov dword [esp + 3], ebp
lea esp, [esp + 0xd]
pushal
lea esp, [esp + 1]
mov dword [esp + 0x58], edi
jmp 0x8674d6
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x8674e5

Function at 0x867565
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push edx
mov byte [esp + 1], ah
call fcn.008674b4
lea esp, [esp + 5]
lea esp, [esp + 1]
push word [esp + 1]
lea esp, [esp + 1]
lea esp, [esp + 3]
mov dword [esp + 0x38], esi
jmp 0x8674cc
mov byte [esp + 2], ch
push edx
pop word [esp + 1]
mov dword [esp + 3], eax
jmp 0x867538
Function at 0x4022b0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x5e6ea9af
push esi
push edi
mov edi, edx
movzx esi, cx
mul ebx
shr ecx, 0x10
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebx
mov dword [ebp - 0xc], ecx
sub edx, eax
mov dword [ebp - 4], edx
test edi, edi
jne 0x4022ec
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x402407
xor ebx, ebx
cmp edx, 7
jbe 0x402356
mov eax, 7
sub eax, edi
mov dword [ebp - 0x10], eax
movzx eax, byte [edi]
add ebx, 8
add esi, eax
movzx eax, byte [edi + 1]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 2]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 3]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 4]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 5]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 6]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 7]
add ecx, esi
add edi, 8
add esi, eax
mov eax, dword [ebp - 0x10]
add eax, edi
add ecx, esi
cmp eax, edx
jb 0x402305
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 0x10], 0
cmp ebx, eax
jae 0x4023c9
sub eax, ebx
cmp eax, 2
jb 0x4023b5
mov edx, dword [ebp - 4]
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea eax, [ebx + edx*2]
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, ebx
movzx eax, byte [edi]
add esi, eax
movzx eax, byte [edi + 1]
add ebx, esi
add edi, 2
add esi, eax
add ecx, esi
sub edx, 1
jne 0x402383
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jae 0x4023c1
movzx eax, byte [edi]
mov edx, dword [ebp - 8]
add esi, eax
add ecx, esi
inc edi
jmp 0x4023c4
movzx eax, byte [edi]
mov ebx, edx
add esi, eax
add ecx, esi
inc edi
jmp 0x4023c4
mov edx, dword [ebp - 8]
lea eax, [edx + ebx]
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, 0x15b0
add ecx, eax
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov dword [ebp + 8], eax
mov dword [ebp - 4], edx
jne 0x4022f4
shl ecx, 0x10
pop edi
lea eax, [esi + ecx]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402420
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 4
jb 0x40248b
push edi
mov edi, esi
shr edi, 2
movzx eax, byte [edx]
sub esi, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b8668]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b8668]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b8668]
movzx eax, byte [edx + 3]
add edx, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b8668]
sub edi, 1
jne 0x402434
pop edi
test esi, esi
je 0x4024aa
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b8668]
sub esi, 1
jne 0x402490
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x406ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x204c
call fcn.00499d90
mov eax, dword [0x4c0008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x2048], 0
mov esi, edx
mov dword [ebp - 0x2044], esi
push edi
test ebx, ebx
jne 0x406f16
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d890
mov esp, ebp
pop ebp
ret
push 0x2000
lea eax, [ebp - 0x2008]
push 0
push eax
call fcn.00473960
add esp, 0xc
lea eax, [ebp - 0x2040]
push 0x38
push 0
push eax
call fcn.00473960
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x406f42
sub esi, ecx
mov edx, 2
inc esi
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047a17a
add esp, 4
mov edi, eax
push esi
push edi
push esi
push dword [ebp - 0x2044]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x2040]
push eax
push edi
call fcn.00477fed
push edi
mov esi, eax
call fcn.004793d4
add esp, 0xc
test esi, esi
je 0x406fb1
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d890
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2018]
mov edx, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2044]
mov dword [ebx + 0x4e010], eax
mov dword [ebx + 0x4e014], edx
call fcn.00404bb0
mov esi, eax
test esi, esi
jne 0x406fee
lea eax, [esi - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d890
mov esp, ebp
pop ebp
ret
push esi
push 0x2000
lea eax, [ebp - 0x2008]
push 1
push eax
call fcn.00479ce2
add esp, 0x10
test eax, eax
je 0x40704c
nop dword [eax]
push eax
lea edx, [ebp - 0x2008]
mov ecx, ebx
call fcn.00406df0
add esp, 4
test eax, eax
js 0x407042
push esi
push 0x2000
lea eax, [ebp - 0x2008]
push 1
push eax
call fcn.00479ce2
add esp, 0x10
test eax, eax
jne 0x407010
jmp 0x40704c
mov dword [ebp - 0x2048], 0xfffffff8
push esi
call fcn.004788e7
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp - 0x2048]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0041d890
mov esp, ebp
pop ebp
ret