joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x470008], 0x8088405
inc edx
mov dword [ebx + 0x470008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cc40
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cc71
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc59
add dl, dl
jne 0x41cc7c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cccd
xor eax, eax
add dl, dl
jne 0x41cc89
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd6a
add dl, dl
jne 0x41cc98
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cca3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ccae
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ccb9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41ccc3
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cc68
mov eax, 1
add dl, dl
jne 0x41ccdb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cce6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ccd2
sub eax, ebx
mov ebx, 1
jne 0x41cd19
mov ecx, 1
add dl, dl
jne 0x41ccff
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cd0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ccf6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cc68
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cd30
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cd3b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cd27
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cc68
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cd8b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cc68
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e214
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4596d3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e2c5
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e2ae
test esi, esi
jbe 0x41e2c5
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088dc
test eax, eax
jne 0x41e2a0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e2c5
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e27d
jmp 0x41e2c5
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e2c5
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4596da
ret
Function at 0x41eb1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x45a0cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eb57
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41eb70
lea eax, [ebp - 0x10]
mov edx, dword [0x472258]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41eb83
lea eax, [ebp - 0x10]
mov edx, dword [0x472258]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41eb8f
adc edx, 0
mov edx, dword [edx*4 + 0x4710e8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41ec9d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ec90
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dcc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ec90
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ec90
cmp dx, 0x150
ja 0x41ec90
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ec90
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41ecb5
inc ebx
cmp ebx, 0x19
jne 0x41eb49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a0d2
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x402a47
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42ec50]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402adb
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a98
cmp dword [ebp + 0x10], ebx
jne 0x402acf
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a47
test eax, eax
jne 0x402aaa
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a7f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405ebe
cmp eax, ebx
je 0x402ae2
push ebx
push dword [0x42ec50]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402adb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42ec50], ebx
jne 0x402ad8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ad8
jmp 0x402adb
Function at 0x40572e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42b428
push esi
call fcn.00405b93
push esi
call fcn.004056d9
mov edi, eax
test edi, edi
jne 0x40574f
xor eax, eax
jmp 0x4057a1
push edi
call fcn.00405dfe
test byte [0x42ebb8], 0x80
je 0x405768
mov al, byte [edi]
test al, al
je 0x40574b
cmp al, 0x5c
je 0x40574b
sub edi, esi
jmp 0x405780
call fcn.00405e97
test eax, eax
je 0x40577a
test byte [eax], 0x10
je 0x40574b
push esi
call fcn.00405687
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x40576c
call fcn.00405640
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x40581c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40583b
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x405841
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405870
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x409368]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4058b5
test edi, edi
jne 0x40587b
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4058af

Function at 0x405a7a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405aeb
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405ada
cmp dword [ebp + 0x14], 1
je 0x405adc
cmp dword [ebp + 0x14], 2
je 0x405adc
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x10008fff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1000900e
pop dword [ebp - 0x48]
mov eax, 0x8d26f3
sub eax, 0xf08c96e5
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x25edd048
add dword [ebp - 0x58], 0x28647503
mov dword [ebp - 0x54], 0xa8dcebd4
add dword [ebp - 0x54], 0x89566071
mov dword [ebp - 0x50], 0x6331588f
add dword [ebp - 0x50], 0xe91aeb9f
mov dword [ebp - 0x4c], 0xb364da92
sub dword [ebp - 0x4c], 0xb364da92
lea eax, [ebp - 0x58]
push eax
mov eax, 0xf209d0e6
sub eax, 0xe20930e2
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x1a7f334b
add dword [ebp - 0x58], 0x59f3360b
mov dword [ebp - 0x54], 0xdda57b52
add dword [ebp - 0x54], 0x63c6e623
mov dword [ebp - 0x50], 0xa166e853
sub dword [ebp - 0x50], 0x3df77be7
mov dword [ebp - 0x4c], 0x74347285
add dword [ebp - 0x4c], 0x8bcb8d7b
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x36c5a
push 0
call eax
mov ecx, 0xfd05be66
add ecx, 0x2fa8a8c
xor esi, esi
add esi, eax
mov edx, 0xdfc6045d
sub edx, 0xcfc50c5d
add edx, dword [ebp - 0x48]
mov edi, 0x80a5e964
mov dword [ebp - 0x28], 0x16aa94e
mov ebx, dword [edx]
xor dword [ebp - 0x44], 0x310ad897
sub ebx, edi
xor dword [ebp - 0x14], 0x6897a730
mov dword [esi], ebx
add esi, 4
add edx, 0xb401fcc8
sub edx, 0xb401fcc4
loop 0x10009127
add eax, 0xca7fef69
add eax, 0x35812732
mov ebx, eax
add eax, 0xad197249
add eax, 0x52e68dbc
mov ecx, 0x49b9dd2f
sub ecx, 0x39b9dd2f
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401b45
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ecx, dword [0x421080]
jne 0x401b4e
ret
jmp 0x401b7b
jmp fcn.00433353

Function at 0x4142cc
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.00527040
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x41407f

Function at 0x418c80
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x418c90
jmp loc.00563276

Function at 0x4250bc
Capabilities:
Get file size

Disassembly:
lock xchg dword [esp], edi
lea edi, [edi - 0x403c]
lock xchg dword [esp], edi
cmp edi, 0xc1656eef
je 0x425117
invalid
Function at 0x425e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
insb byte es:[edi], dx
inc ebp
dec ecx
inc ebx
inc ebx
pop ecx
inc edi
imul edx, dword [ecx + 0x67], 0x4e
dec ebx
push esp
pop ebx
pop eax
pop esi
outsd dx, dword [esi]
push edx
insd dword es:[edi], dx

Function at 0x4285dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp]
lea esp, [esp + 4]
push ebp
lea ebp, [esp + 0xa]
push edi
push esi
mov edi, ebx
add edi, 0xffff9421
push word [esp + 0x10]
popf
mov dword [edi], ecx
pop esi
mov edi, dword [esp]
lea esp, [esp + 4]
lock xchg dword [esp], ebp
lea esp, [esp + 4]
pop ebx
lea esp, [esp + 2]
cmp dword [esp + 0x60], 0x6e24957f

Function at 0x4286e3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bound esp, qword [ebp + 0x78]
dec ecx
popal
popal
pop edi
insb byte es:[edi], dx
pop edi
insb byte es:[edi], dx
inc esp
inc cx
push edx
pop ebp
dec esi
dec ecx
insd dword es:[edi], dx
inc eax
inc ecx
pop edi
push 0x79
pop edx
push 0x40506a60
jns 0x40b629
jns 0x40b61b
dec esp
push esp
pop esi
outsb dx, byte [esi]
insd dword es:[edi], dx
jnp 0x40b610
dec ebx
push ecx
pop eax
dec eax
inc edi
popal
dec esp
dec esp
jnp 0x40b62d
inc eax
inc ecx
dec esp
push 0xe95b6c5f
sub eax, 0x680009be
pop ebx
pop edi
pop ebx
dec ebp
dec ebp
insb byte es:[edi], dx
pop ecx
inc esp
popal
imul ebp, dword [eax + 0x6d], 0x4b
push ebx
pop edi
push edi
dec ecx
dec cx
dec esi
push ebp
inc esi
pop ecx
int3
in al, dx
push ds
inc edx
add byte [ebp - 0x3d], bl
push 1
push 2
push 0
call fcn.0040b4a4
add esp, 0xc
ret
add al, ch
cmp esi, 0xffffffff
inc dword [ebx + 0x6ac30cc4]
add dword [edx], ebp
push 0
call fcn.0040b4a4
add esp, 0xc
ret
invalid
lock xchg dword [esp], ebx
lea ebx, [ebx - 0xe54e]
lock xchg dword [esp], ebx
cmp dword [esp + 0x74], 0xa04a327b
je 0x40b5a7
Function at 0x4298e7
Capabilities:
Packed with generic packer
Terminate process

Disassembly:
cmp dword [esp - 0x20], 0x6914be8b
jne 0x42990e
push 0x10
sub ebx, 1
call fcn.0042abc7
jmp 0x429901
dec dword [ebx + 0x8758bc7]
jne 0x42991c
push ebx
fcomp qword [ecx]
push esi
inc ecx
call fcn.00429977
call 0x41f2d9
test eax, eax
mov eax, dword [esp + 0x1c]
and al, 0x1c
mov esi, ecx

Function at 0x42a4fc
Capabilities:
Packed with generic packer

Disassembly:
pop ebp
mov ecx, dword [ebx + 0x10]
cmp esi, dword [ecx + 0xc]
push ecx
mov word [eax], cx
cmp edx, 0xfffffffe
cmp dword [ebp + 8], eax
mov eax, esi
mov ecx, dword [ebp + 0x1c]
pop ebp
mov ebp, esp
mov ebp, esp
call fcn.0042669b
xor eax, eax
jmp 0x42aa61
pop eax
je 0x42a4cc
int3

Function at 0x42a655
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
invalid
jne 0x42a630
mov dword [0x5f850f], eax
add byte [eax], al
pop edi
add byte [eax], al
add byte [ebx - 0x2c827f14], cl
or al, bl
push edi
jb 0x42a668
mov ebp, esp
cmp byte [ebp - 0x2d], 0xa
ret
je 0x42a66e
jne 0x42a67e
dec edi
mov dword [ecx + 8], edx
cmp eax, 0x400
add byte [eax], al
mov dword [ebp - 0xc], esi
jne 0x42a66e
inc esi
je 0x42a650
push eax
je 0x42a7c7
add byte [esi - 0x18], al
cmp dword [eax + eax], 0
inc esi
call fcn.0042e308
mov dword [ebp - 0x28], edi
sbb eax, eax
jmp 0x42a6b2
inc ebp
or byte [ebx - 0x743cd73c], al
in al, dx
jns 0x42a809

Function at 0x42a6ba
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
jmp 0x4ff2d9
cmp dword [esp + 0x54], 0x967da96f
je 0x42a70d
mov eax, dword [ebp + 8]
cmp dword [esp + 0x78], 0xd9122fbb
jne 0x42a717
je 0x42a6e1
push 0x4204a8
push ebp
add esi, 1
xor eax, eax
mov edi, dword [ebp + 8]
ror byte [ebx + 0x7e8d087d], 0xc
jge 0x42a6ed
lea edi, [esi + 0xc]
add esi, edx
call fcn.0042aa24
add byte [eax], al
mov edi, edi
test byte [ecx], 0x10
and eax, 0xfffff
push dword [ebp + 0x18]
push eax
lea eax, [ebp - 0x570]
test esi, esi
mov ebp, esp
mov ecx, dword [esi + 0x30]
lea esi, [ebp - 0x570]
push eax
inc eax
sub eax, 4
jmp 0x42a6e3
cli
invalid
push esi
cmp ecx, 0x6d71b887
cmove ebx, edi
mov ecx, dword [eax + 0x3c]
cmp dword [esp + 0x5c], 0x5838d30f
je 0x410605
add ecx, eax
cmp esi, 0x5ee760b
jne 0x42a7a0
pop ebx
inc edi
dec ebp
push edx
bound ebp, qword [ecx + 0x47]
push esi
push edx
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
cmp dword [esp - 0xc], 0x6e0d38df
cmove esi, ebp
Function at 0x42b8d8
Capabilities:
Packed with generic packer

Disassembly:
inc edx
add byte [ebp - 0x8f91437], al
mov byte [edi], 0
add byte [eax], al
cmp eax, 9
jnp 0x42ba23
call fcn.0042c035
push 8
cmp eax, 0xa
dec eax
dec ebp
dec ebx
push ecx
insb byte es:[edi], dx
push esp
cmp dword [esp - 0xc], 0x6207f30b
jne 0x42ba7e
push edx
push ebp
jns 0x42ba95
pop ecx
insb byte es:[edi], dx
dec eax
dec edx
pop edi
pop esi
pop ecx
dec esp
push 0x43
dec esi
pop edi
imul eax, dword [ebx + 0x40], 0x6d
push esi
inc edx
dec edi
pop edx
push edx
inc ebp
pop ebp
popal
push edi
pop esi
push eax
jns 0x42baac
pop ebx
push 0x63405179
dec esi
pushal
inc esp
pop esi
pop ebx
inc eax
push eax
dec esp
arpl word [ebx + 0x79], cx
pop edi
push 0x6946596f
dec edi
inc ecx
push edi
bound eax, qword [edi + 0x53]
dec ebp
inc ebx
jnp 0x42bae4
pop edi
push esp
inc eax
bound ebx, qword [eax + 0x55]
mov al, 1
cmp esi, 0x8db76dbf
jne 0x42bad4
inc edx
cmp al, 2
push edi
lea ecx, [ebp + 0xc]
xor eax, eax
mov eax, dword [ebp + 8]
mov ebx, eax
jne 0x42bae0
fdiv dword [ebp + 0x48]
je 0x42ba8c
pop ecx
push ebx
push 0x20
mov edi, dword [ebp + 8]
call fcn.00433902
dec ecx
push esi
movzx eax, byte [eax + 0x4057d7]
je 0x42bab6
push edi
inc eax
add byte [ebp + eax + 0x77], dh
inc edi
ja 0x42bafa
push ebx
invalid
invalid
invalid
add byte [eax], al
invalid
add byte [eax], al

Function at 0x42bf26
Capabilities:
Packed with generic packer

Disassembly:
pushal
insb byte es:[edi], dx
push esp
inc ecx
dec ecx
push 0x6746565a
pop edi
push 0x6f
outsd dx, dword [esi]
outsb dx, byte [esi]
dec edi
push esp
dec ebp
dec edi
js 0x42bfb2
push ecx
insd dword es:[edi], dx
pop ecx
inc cx
dec ecx
push edi
dec edi
bound ebp, qword [edi + 0x40]
pop esi
dec ebp
add byte [0x400000], ch

Function at 0x42c6d5
Capabilities:
Parse pe header

Disassembly:
mov ebp, dword [esp]
lea esp, [esp + 4]
lea esi, [esp + 2]
push eax
lea esp, [esp - 4]
mov dword [esp], edi
mov eax, ebp
add eax, 0xffff533a
Function at 0x4307bb
Capabilities:
Packed with generic packer

Disassembly:
mov edi, dword [esi]
test edi, edi
push 0xe1ec21cd
lea esp, [esp - 2]
mov word [esp], ax
lahf
lock xchg word [esp], ax
push ebx
call fcn.00430749
jne 0x43074b
mov eax, dword [ebp + 0xc]
jmp 0x4307dd
add byte [eax], al
inc esp
pop ebp
inc ebp
dec ebx
pop esi
push ebx
pop ebx
pop esp
push ecx
dec edx
jns 0x430814
pop edx
inc ecx
dec edx
dec eax
push 0x5b
push edi
inc edx
insb byte es:[edi], dx
push edi
jnp 0x430839
imul ecx, dword [ecx + 0x48], 0x5d
insd dword es:[edi], dx
push 0x65
push esp
inc eax
arpl word [ebp + 0x6b], dx
dec esp
pop edx
inc esp
push eax
inc ebx
push 0x48
pushal
pop esi
push eax
pop eax
push esp
outsd dx, dword [esi]
pop edi
dec ebp
outsd dx, dword [esi]
imul ecx, dword [ebx + 0x4f], 0x51
push ecx
bound esp, qword [ebx + 0x53]
pop edx
inc ebx
imul edx, dword [ebp + 0x40], 0x66
push edi
pop ecx
dec ecx
dec ebx
dec esi
inc esp
push edx
outsd dx, dword [esi]
pop ebp
inc ebx
pop edi
pop eax
inc edx
arpl word [edx + 0x53], cx
push ebp
jns 0x43085d
pop ecx
pop ecx
push esi
dec di
bound esp, qword [eax + 0x66]
imul esp, dword [ebx + 0x58], 0x42
dec edx
push ecx
dec esi
dec eax
pop ebp
push ebx
imul ecx, dword gs:[edi + 0x43], 0x677b4b6b
dec esp
outsb dx, byte [esi]
push dword [esp]
lea esp, [esp - 4]
mov dword [esp], edx
add dword [esp + 4], 0xfffe995e
mov edx, dword [esp + 4]
mov edx, dword [edx]
mov dword [esp + 4], edx
add dword [esp + 8], 0xa2
mov edx, dword [esp]
lea esp, [esp + 4]
ret
and al, 0x81
inc esp
and al, 4
pop esi
cdq
invalid
std
sbb ebp, dword [ecx + 0x440f7dfd]
sar edi, 0xd7
add esi, 4
cmp esi, ebx
jb 0x430709
cmp ebp, 0x66ee6323
jne 0x4308bc
cmp byte [eax + 0x308], cl
call dword [0x41a118]
adc edi, 0
cmp esi, 0xfffffffe
push str.__crt_strtox::floating_point_value::as_double
xor eax, eax
mov dword [esi + 0x30], ecx
push edi
nop
mov ebp, esp
call dword [0x41a118]
test edx, edx
xchg dword [ecx], eax
shl eax, 2
adc ecx, edx
push 0
pushfd
push esi
dec ebp
push ebp
bound ecx, qword [ecx - 0x50]
add ebx, ebp
test al, 0x57
push esi
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
dec esi
ret
Function at 0x431d50
Capabilities:
Set thread local storage value

Disassembly:
push ebx
call fcn.00431da2
test esi, esi
push dword [ebp - 0x18]
dec eax
push eax
je 0x431ded
mov al, byte [eax]
add byte [eax], al
jne 0x431d1e
push eax
and al, 4

Function at 0x4335fb
Capabilities:
Allocate thread local storage

Disassembly:
pop eax
lea ecx, [esp + 2]
lea esp, [esp - 4]
mov dword [esp], edi
push esi
mov edi, eax
add edi, 0xfffee532
push word [esp + 8]
popf
mov dword [edi], edx
mov esi, dword [esp]
lea esp, [esp + 4]
lock xchg dword [esp], edi
lea esp, [esp + 4]
lea esp, [esp + 2]
pushf
pushfd
call 0x433693
jns 0x4335bf
rcr byte [ebp + 0x57], 0x56
push bp
call dword [0x41a118]
call fcn.004352c4
call fcn.0043341d
lea eax, [esi + 0x18]
call dword [ebp - 0x10]
mov dword [ecx + 4], eax
lea ecx, [edx + 0x308]
pop esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
adc esi, 0
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test byte [ebp + 0x10], 0x20
add dh, dh
inc ebp
adc byte [eax], ah
call fcn.004315da
jb 0x43366f
mov esi, ecx
inc eax
cmp dword [0x421edc], ebx
jb 0x433692
jge 0x433633
push eax
push edi
and edi, 0xfffffff7
sub eax, 1
mov ecx, dword [ebp - 4]
cld
pop eax
lea ecx, [esp + 2]
push edx
lea esp, [esp - 4]
mov dword [esp], edi
mov edx, eax
add edx, 0xfffee4b3
push word [esp + 8]
popf
mov dword [edx], ebx
lock xchg dword [esp], edi
lea esp, [esp + 4]
pop edx
lea esp, [esp + 2]
pushf
call fcn.00433718
jmp 0x4336d7
add ecx, dword [ebx - 0x5b17f7ab]
out 0xff, eax
dec ecx
xor ecx, ecx
pop ecx
and esi, 0x20
inc eax
dec ebx
dec ebx
ret

Function at 0x435e48
Capabilities:
Set thread local storage value

Disassembly:
add dl, al
or al, 2
add dl, dl
ror byte [edx + eax], cl
add ah, ah
in al, 0xc
add al, byte [eax]
test byte [edx + eax], 0
or cl, byte [0xd200002]
invalid
invalid
add al, byte [eax]
pop esi
mov ecx, dword [ecx + 8]
cmp dword [esp + 0x28], 0x775d5f
cmove ebp, edi
mov edx, dword [esi + edx]
cmp edx, 0xb90f6469
je 0x435e76
mov ecx, dword [edx + ecx]
cmp esi, 0x92ab96bd
xchg edx, eax
je 0x441ad1
add ecx, esi
cmp dword [esp + 0x5c], 0x47e48f03
je 0x41a0d7
add eax, ecx
cmp ecx, 0x552192d3
cmove esi, esi
pop esi
cmp dword [esp - 0x80], 0xd385720f
je 0x431d10
mov esi, 0xc35dffff
pop ebp
ret
or dh, byte [esp + 0x74]
push esp
je 0x441ad4
dec dword [eax]
jne 0x441c4f
add byte [ebx], dh
ror byte [edx + 0x47], 0x63
cmp dword [esp + 8], 0x32f7b999
jne 0x441aec
xor eax, eax
dec edx
inc edi
arpl word [ecx - 0x66f7db84], ax
mov ecx, 0xb7532f7
mov edi, eax
call fcn.004481b3
inc esp
dec edx
pop ebp
outsd dx, dword [esi]
retf
xor eax, eax
cmp edi, 0x6876199b
cmove edi, edx
mov ecx, dword [ebp - 0x10]
cmp edx, 0x7fe9ee63
je 0x441ae4
mov dword fs:[0], ecx
cmp dword [esp + 0x40], 0x77bc5115
cmove edi, ecx
pop ecx
cmp dword [esp + 0x5c], 0xd28805f9
je 0x441ac8
pop edi
cmp dword [esp + 0x7c], 0xb94fdb01
je 0x441aca
pop esi
cmp edi, 0x8b3b0df3
je 0x441ac3
pop ebx
cmp dword [esp + 0x30], 0xb7873d6b
cmove edi, ebp
leave
cmp esi, 0x2005b9bd
cmove edx, edi
ret