joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4774d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed980
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], 0x1f6d6d43
mov dword [ebp - 0x50], 0x252d2c20
mov dword [ebp - 0x4c], 0x2a6d242a
mov word [ebp - 0x48], 0x2a2d
mov byte [ebp - 0x46], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.00477be0
mov byte [ebp - 4], 1
xor ecx, ecx
nop
mov dl, byte [ebp + ecx - 0x53]
xor dl, byte [ebp - 0x54]
mov byte [ebp + ecx - 0x45], dl
inc ecx
cmp ecx, 0xd
jb 0x477530
lea ecx, [ebp - 0x45]
mov byte [ebp - 0x38], 0
push ecx
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.004078b0
mov eax, dword [ebp - 0x20]
add esp, 0xc
cmp eax, 0x10
jb 0x47756b
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.00409950
cmp dword [ebp - 0x58], 0x10
lea esi, [ebp - 0x6c]
mov bh, 0x7e
mov dword [ebp - 0x1c], 0x7971721e
cmovae esi, dword [ebp - 0x6c]
mov cl, 0x71
mov byte [ebp - 0x6d], bh
mov dh, cl
mov bh, 0x70
mov dword [ebp - 0x30], 0x79787417
mov byte [ebp - 0x6e], bh
mov al, 0x72
mov bh, byte [ebp - 0x1c]
mov ah, 0x78
xor al, bh
mov byte [ebp - 0x18], 0
xor cl, bh
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x6e]
mov bl, 0x79
mov byte [ebp - 0x16], cl
mov ch, bl
mov cl, byte [ebp - 0x30]
xor bl, bh
mov bh, byte [ebp - 0x6d]
xor ah, cl
xor al, cl
mov byte [ebp - 0x27], ah
push esi
mov byte [ebp - 0x23], al
mov dl, 0x74
push 4
lea eax, [ebp - 0x17]
mov dword [ebp - 0x2c], 0x707e71
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 0x15], bl
xor dl, cl
mov byte [ebp - 0x14], 0
xor ch, cl
mov byte [ebp - 0x28], dl
xor dh, cl
mov byte [ebp - 0x26], ch
xor bh, cl
mov byte [ebp - 0x25], dh
push eax
mov byte [ebp - 0x24], bh
mov byte [ebp - 0x22], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
xor eax, eax
mov dword [ebp - 0x2f], eax
mov word [ebp - 0x2b], ax
mov byte [ebp - 0x29], al
mov dword [ebp - 0x1b], eax
mov eax, dword [ebp - 0x58]
cmp eax, 0x10
jb 0x47761f
inc eax
lea ecx, [ebp - 0x6c]
push eax
push dword [ebp - 0x6c]
call fcn.00409950
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049fc55
mov esp, ebp
pop ebp
ret
Function at 0x478660
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2e68
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x48]
push eax
call fcn.004c15e1
xor eax, eax
mov dword [ebp - 0x2c], 7
lea edx, [esi + 0x20c]
mov dword [ebp - 0x30], 0
add esp, 4
mov word [ebp - 0x40], ax
cmp word [edx], ax
jne 0x4786bb
xor ecx, ecx
jmp 0x4786cf
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4786c0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.00403dd0
push 0x50ad4c
lea edx, [ebp - 0x40]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00414b10
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp eax, 8
jb 0x478708
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00403f40
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004c6be3
add esp, 8
cmp eax, 0xffffffff
jne 0x478737
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp - 0x44]
cmp dword [ebp - 0x14], 8
lea eax, [esi + 0x414]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push eax
push ecx
push str._s_s.__I64d.dmp
lea eax, [esi + 4]
push 0x104
push eax
call fcn.00478b60
mov eax, dword [ebp - 0x14]
add esp, 0x1c
cmp eax, 8
jb 0x47877b
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00403f40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049fc55
mov esp, ebp
pop ebp
ret

Function at 0x4787a0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0x10]
push eax
push str.SeDebugPrivilege
push 0
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x47881e
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x10
push eax
push edi
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x47881e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
je 0x47881e
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0049fc55
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0049fc55
mov esp, ebp
pop ebp
ret 0xc
Function at 0x479ee0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4edfc5
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x52610c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
mov dword [ebp - 0x10], 0x52e280
mov dword [0x52e280], 0x50b168
mov dword [0x52e294], 0
mov dword [0x52e298], 0
mov dword [0x52e29c], 0
mov dword [0x52e2a0], 0
mov dword [0x52e2a4], 0
call fcn.0049fc85
add esp, 4
mov dword [0x52e294], eax
test eax, eax
je 0x479f70
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [0x52e294]
mov dword [eax], 0x52e294
push 0x52e2a8
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push 8
mov dword [0x52e290], eax
call fcn.0049fc85
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
push 0
mov byte [ebp - 4], 2
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0047a420
push 0
push 0
push 1
mov dword [esi], eax
mov byte [ebp - 4], 1
push 0
mov dword [0x52e28c], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0xffffffffffffffff
mov dword [0x52e288], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor esi, esi
mov dword [0x52e284], eax
cmp dword [0x52e290], esi
jbe 0x47a05a
nop dword [eax]
push 0
push 0
push 0x52e280
push 0x47a450
push 0
push 0
call fcn.004cade1
mov edi, dword [0x52e28c]
add esp, 0x18
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
mov ebx, dword [edi]
push eax
push dword [ebx + 4]
push ebx
call fcn.0047a6e0
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [edi + 4]
sub ecx, eax
cmp ecx, 1
jb 0x47a073
lea ecx, [eax + 1]
inc esi
mov dword [edi + 4], ecx
mov dword [ebx + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
cmp esi, dword [0x52e290]
jb 0x47a000
mov eax, 0x52e280
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.0049c65e
int3

Function at 0x47b180
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x47b199
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x47b1d6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x47b1d2
nop word [eax + eax]
cmp esi, edx
jae 0x47b1d6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x47b1c0
cmp esi, edx
jb 0x47b1dd
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47b990
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee180
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x52610c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
push ecx
lea ecx, [ebp - 0x14]
call fcn.0047bcb0
push ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0047c910
add esp, 4
mov byte [ebp - 4], 2
or ebx, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47b9fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.0047d3e0
mov edi, eax
add esp, 4
test edi, edi
jne 0x47ba13
xor esi, esi
jmp 0x47bb07
push edi
mov edx, 0x47d820
lea ecx, [ebp - 0x24]
call fcn.0047c670
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
movups xmm0, xmmword [edi + 0x38]
push esi
movups xmmword [ebp - 0x34], xmm0
call fcn.0047bcb0
push 0
push esi
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax - 0xc]
test edx, edx
je 0x47ba77
lea ecx, [edx - 1]
test ecx, ecx
js 0x47bb3a
cmp ecx, edx
jg 0x47bb3a
cmp word [eax + ecx*2], 0x5c
je 0x47ba77
push 0x507d60
lea ecx, [ebp - 0x10]
call fcn.0047bc60
xor esi, esi
cmp dword [ebp - 0x30], esi
jb 0x47badc
mov ebx, dword [ebp - 0x34]
ja 0x47ba90
test ebx, ebx
je 0x47bad9
nop word [eax + eax]
mov edx, dword [ebp - 0x10]
mov ecx, edi
call fcn.0047b590
test eax, eax
je 0x47bb4c
mov ecx, dword [ebp - 0x30]
add ebx, 0xffffffff
mov eax, esi
adc ecx, 0xffffffff
cdq
cmp edx, ecx
ja 0x47bac7
jb 0x47bab8
cmp eax, ebx
jae 0x47bac7
mov ecx, edi
call fcn.0047de00
test eax, eax
jne 0x47bb4c
inc esi
mov eax, esi
cdq
cmp edx, dword [ebp - 0x30]
jb 0x47bb44
ja 0x47bad9
mov ebx, dword [ebp - 0x34]
cmp eax, ebx
jb 0x47ba90
or ebx, 0xffffffff
mov esi, 1
mov byte [ebp - 4], 3
mov eax, ebx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47baff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x24]
call fcn.0047c700
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x47bb26
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.0047b090
mov ebx, dword [ebp - 0x34]
jmp 0x47ba90
xor esi, esi
or ebx, 0xffffffff
jmp 0x47bae1
Function at 0x47e960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
nop
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x47e9ef
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.004b8a60
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x47e9bf
sub eax, esi
jmp 0x47e9c1
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x47e9b0
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x47e9e0
sub eax, esi
jmp 0x47e9e2
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x47e9d1
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x47eb23
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x47ea1c
xor eax, eax
jmp 0x47ea6f
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x47ea39
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.00482970
jmp 0x47ea51
cmp eax, 2
jne 0x47ea57
mov edx, dword [ebx]
test edx, edx
jne 0x47ea48
xor eax, eax
jmp 0x47ea54
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.0047f550
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call fcn.004b8a60
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x47ea97
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x47eaab
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x47e970
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x47eb23
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x47eaf3
sub ecx, esi
mov eax, 0x102
cmp ecx, eax
cmova ecx, eax
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
mov dword [ebp - 8], ecx
push 0
push eax
call fcn.004b8fe0
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x47eb23
mov eax, dword [edi + 0x38]
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
cmova esi, ecx
add eax, edx
push esi
push 0
push eax
call fcn.004b8fe0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47f530
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x47f53b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0047f550
Function at 0x4a2e81
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4d535c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d51db

Function at 0x4da674
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004da334

Function at 0x10119db4
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
invalid
Function at 0x403918
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5a2008], 0x8088405
inc edx
mov dword [ebx + 0x5a2008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd18
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd31
add dl, dl
jne 0x41cd54
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cda5
xor eax, eax
add dl, dl
jne 0x41cd61
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce42
add dl, dl
jne 0x41cd70
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd7b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd86
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd91
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cd9b
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd40
mov eax, 1
add dl, dl
jne 0x41cdb3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdbe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdaa
sub eax, ebx
mov ebx, 1
jne 0x41cdf1
mov ecx, 1
add dl, dl
jne 0x41cdd7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cde2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdce
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd40
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce08
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce13
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdff
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd40
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ce63
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd40
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41d970
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x41d983
add esp, 0xfffffff0
call fcn.00404100
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00403e7c
mov byte [ebx + 4], 0
cmp dword [esi + 0x5c], 0
jne 0x41d9a9
cmp dword [esi + 0x58], 0x40
jb 0x41db8f
jmp 0x41d9af
jl 0x41db8f
lea eax, [ebx + 0xc]
mov edx, 0x40
call fcn.004072d4
push 0
push 0
push 0
push 0x40
lea edx, [ebx + 0xc]
mov eax, esi
call fcn.0041d598
cmp word [ebx + 0xc], 0x5a4d
jne 0x41db8f
mov ecx, dword [ebx + 0x48]
test ecx, ecx
jle 0x41db8f
cmp ecx, 0x10000
jge 0x41db8f
mov eax, ecx
add eax, 4
add eax, 0x14
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41da0a
cmp eax, dword [esi + 0x58]
ja 0x41db8f
jmp 0x41da10
jg 0x41db8f
lea eax, [ebx + 0x4c]
mov edx, 4
call fcn.004072d4
mov eax, dword [ebx + 0x48]
cdq
push edx
push eax
push 0
push 4
lea edx, [ebx + 0x4c]
mov eax, esi
call fcn.0041d598
cmp dword [ebx + 0x4c], 0x4550
jne 0x41db8f
lea eax, [ebx + 0x50]
mov edx, 0x14
call fcn.004072d4
mov eax, dword [ebx + 0x48]
add eax, 4
cdq
push edx
push eax
push 0
push 0x14
lea edx, [ebx + 0x50]
mov eax, esi
call fcn.0041d598
mov ax, word [ebx + 0x50]
cmp ax, 0x8664
jne 0x41dac7
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xf0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41da8b
cmp eax, dword [esi + 0x58]
ja 0x41db18
jmp 0x41da91
jg 0x41db18
lea eax, [ebx + 0x144]
mov edx, 0xf0
call fcn.004072d4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xf0
lea edx, [ebx + 0x144]
mov eax, esi
call fcn.0041d598
mov byte [ebx + 4], 1
jmp 0x41db18
cmp ax, 0x14c
jne 0x41db18
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xe0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41dae8
cmp eax, dword [esi + 0x58]
ja 0x41db18
jmp 0x41daea
jg 0x41db18
lea eax, [ebx + 0x64]
mov edx, 0xe0
call fcn.004072d4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xe0
lea edx, [ebx + 0x64]
mov eax, esi
call fcn.0041d598
mov byte [ebx + 4], 1
cmp byte [ebx + 4], 0
je 0x41db8f
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
mov di, word [ebx + 0x52]
movzx edx, di
shl edx, 3
lea edx, [edx + edx*4]
add eax, edx
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41db49
cmp eax, dword [esi + 0x58]
ja 0x41db8f
jmp 0x41db4b
jg 0x41db8f
movzx eax, di
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x58d4b0]
call fcn.00405f20
add esp, 4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
cdq
push edx
push eax
movzx eax, word [ebx + 0x52]
shl eax, 3
lea eax, [eax + eax*4]
xor edx, edx
push edx
push eax
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.0041d598
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x41dba6
call fcn.00404158
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x41e888
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x58ed47
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e939
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e922
test esi, esi
jbe 0x41e939
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.00408d64
test eax, eax
jne 0x41e914
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e939
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e8f1
jmp 0x41e939
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e939
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58ed4e
ret