joyce8/EMBER2024-capa huggingface dataset:
Function at 0xaacf7e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
lea esi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
push eax
push 0x20019
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x9f67e8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
js 0xaad00b
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 3
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push 0x9f67bc
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jle 0xaacfff
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0xaad00b
lea esi, [ebp - 0x34]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x1c], 0
lea esi, [ebp - 0x18]
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xaad024
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor ecx, ebp
pop edi
pop esi
call fcn.00ab3c50
leave
ret 4
Function at 0xaae6d4
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc84
mov eax, dword [0xc940a0]
xor eax, esp
mov dword [esp + 0xc80], eax
push ebx
push esi
push edi
mov edi, 0x104
lea eax, [esp + 0x260]
push edi
push eax
push 0
push 0
push 0x9f76ac
call dword [sym.imp.api_ms_win_storage_exports_internal_l1_1_0.dll_SHGetFolderPathEx]
test eax, eax
jne 0xaae79a
push 0x20
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrChrW]
mov esi, eax
test esi, esi
je 0xaae79a
lea eax, [esp + 0x260]
mov edx, edi
push eax
lea ecx, [esp + 0x674]
call fcn.00a535e0
xor eax, eax
lea ecx, [esp + 0xa80]
mov word [esi], ax
mov edx, edi
lea eax, [esp + 0x260]
push eax
call fcn.00a535e0
lea ecx, [esp + 0x260]
mov eax, esi
sub eax, ecx
mov edx, edi
sar eax, 1
mov ecx, esi
push 0x9f68dc
sub edx, eax
call fcn.00a535e0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0xb576a3
mov ecx, dword [esp + 0xc8c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00ab3c50
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x260]
mov edx, edi
push eax
lea ecx, [esp + 0x46c]
call fcn.00a535e0
lea eax, [esp + 0x468]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x3c]
mov edx, edi
push eax
lea ecx, [esp + 0x46c]
call fcn.00a4355b
mov eax, dword [esp + 0x10]
xor edi, edi
and eax, 0x410
cmp eax, 0x410
jne 0xb5775f
lea eax, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x470]
call fcn.00b67feb
test eax, eax
js 0xb5775f
mov ecx, dword [esp + 0xc]
push edi
push edi
push 0x104
mov eax, dword [ecx]
mov esi, dword [eax + 0xc]
lea eax, [esp + 0x884]
push eax
push ecx
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb5774b
push 1
push 0xffffffffffffffff
lea eax, [esp + 0x678]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x888]
push eax
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
cmp eax, 2
jne 0xb5774b
inc edi
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0xc99200]
call esi
test byte [esp + 0x10], 0x10
je 0xb57780
lea eax, [esp + 0x468]
push eax
lea eax, [esp + 0xa84]
push eax
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
jne 0xb577b3
test edi, edi
jne 0xb577b3
mov esi, dword [0xc9596c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetDesktopWindow]
push 0xa166ac
push 5
lea ecx, [esp + 0x470]
push ecx
push 0xb755d0
push 0x14
push esi
push eax
call dword [sym.imp.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_Ordinal_292]
cmp eax, 5
je 0xb577cd
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
je 0xb577cd
mov edi, 0x104
jmp 0xb576a3
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
jmp 0xaae79a
Function at 0xaaed9f
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0xc9596c]
push edi
mov edi, ecx
call fcn.00aa56cf
push 0x10
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push reloc.SHCORE.dll_Ordinal_1
push ebx
and eax, 0x400000
add eax, 8
push 0x9f0b4c
push eax
call dword [sym.imp.api_ms_win_rtcore_ntuser_private_l1_1_0.dll_CreateWindowInBand]
mov dword [edi + 0x4c], eax
cmp eax, 0xffffffff
je 0xb579d8
test eax, eax
je 0xaaeebb
push 0x2c
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x240], 0x30
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [edi + 0x10]
lea eax, [ebp - 0x210]
add esp, 0xc
mov dword [ebp - 0x23c], 0xb1
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], esi
push 0x208
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetWindowTextW]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x240]
push eax
push ebx
push 0x432
push dword [edi + 0x4c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
test eax, eax
je 0xb579f2
push 0x12c
push ebx
push 0x418
push dword [edi + 0x4c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
push 4
lea eax, [ebp - 0x244]
mov dword [ebp - 0x244], 1
push eax
push 0xc
push dword [edi + 0x4c]
call dword [sym.imp.dwmapi.dll_DwmSetWindowAttribute]
mov ecx, edi
call fcn.00a7b3ac
mov ebx, dword [edi + 0x30]
test ebx, ebx
jne 0xb57a0e
and dword [edi + 0x30], 0
mov ecx, edi
call fcn.00a4b074
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret
mov ecx, dword [ebp + 4]
mov edx, 0x2a5
push 0x9fa91c
call fcn.00b6203c
mov eax, dword [edi + 0x4c]
jmp 0xaaedfa
mov ecx, dword [ebp + 4]
mov edx, 0x2b4
push 0x80004005
push 0x9fa91c
call fcn.00ab606d
jmp 0xaaee89
cmp ebx, 0xffffffff
je 0xaaeecd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.UxTheme.dll_CloseThemeData]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
jmp 0xaaeecd
Function at 0xab1fc7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 1
push esi
push 0x9f6a9c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xab2029
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push esi
push 0x9f6a8c
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0xb5872f
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
cmp dword [ebp - 8], 4
jne 0xab2020
xor esi, esi
inc esi
jmp 0xab2020

Function at 0xab20ff
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
push esi
mov esi, 0x80004005
cmp dword [0xc96f78], ebx
jne 0xab2140
push 0x9f6b48
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov edx, eax
test edx, edx
je 0xab2138
push edi
mov ecx, edx
mov edi, 0xc96f78
xor eax, eax
lock cmpxchg dword [edi], ecx
pop edi
test eax, eax
jne 0xab2159
cmp dword [0xc96f78], ebx
je 0xab2154
push 0xffffffffffffffff
push dword [0xc96f78]
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
jne 0xab2162
mov esi, ebx
mov eax, esi
pop esi
pop ebx
ret
push edx
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0xab2138
cmp eax, 0x80
jne 0xab2154
jmp 0xab2152

Function at 0xab280d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x10
push eax
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push esi
push 2
push 0x9f6c88
push 0x9f6c20
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
xor ecx, ecx
inc ecx
test eax, eax
je 0xab2870
mov eax, 0xc96f7c
xchg dword [eax], esi
call fcn.00a4644d
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov byte [0xc958d8], 0
pop esi
call fcn.00ab3c50
leave
ret
mov esi, ecx
jmp 0xab2850

Function at 0xab4386
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0xab439d
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
je 0xab439f
xor eax, eax
ret
Function at 0xab496d
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
push eax
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
pop eax
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov dword [ebp - 0xc], edi
mov esi, dword [edi]
cmp esi, edi
je 0xab4a28
xor eax, eax
mov ebx, eax
cmp dword [esi + 0x30], eax
je 0xab49f8
cmp dword [esi + 0x30], 0xffff
je 0xab49f8
lea eax, [ebp - 0x78]
push 0x64
push eax
call fcn.00ab433c
mov eax, dword [esi + 0x30]
pop ecx
pop ecx
xor ecx, ecx
jmp 0xab49c7
inc ebx
lea eax, [eax + 2]
cmp word [eax], cx
jne 0xab49c3
test ebx, ebx
jle 0xab49eb
mov edi, ecx
mov eax, dword [esi + 0x30]
mov cx, word [eax + edi*2]
call fcn.00ab436e
mov word [ebp + edi*2 - 0x78], ax
inc edi
cmp edi, ebx
jl 0xab49d2
mov edi, dword [ebp - 0xc]
lea ecx, [ebp - 0x78]
call fcn.00ab442a
cmp dword [ebp - 0x10], eax
je 0xab4a00
mov eax, dword [esi]
mov esi, eax
cmp eax, edi
jmp 0xab4997
mov edi, dword [ebp - 0x14]
test edi, edi
je 0xab4a23
push dword [esi + 0x28]
call fcn.00ab4926
lea eax, [eax*2 + 2]
push eax
push dword [esi + 0x28]
push edi
call fcn.00ab48e9
add esp, 0x10
mov eax, dword [esi + 0x18]
jmp 0xab4a2a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0xab4b0f
Capabilities:
Authenticate hmac

Disassembly:
push esi
mov esi, ecx
push esi
call fcn.00ab4926
call [ecx - 0x7b]
invalid
je 0xab4b30
invalid
lea ecx, [esi + eax*2]

Function at 0xab4b1c
Capabilities:
Authenticate hmac

Disassembly:
call [ecx - 0x7b]
sal byte [ebx + edx - 0x73], 0xc
invalid
lea ecx, [esi + eax*2]

Function at 0xab4b22
Capabilities:
Authenticate hmac

Disassembly:
mov edx, ecx
dec eax
sub ecx, 2
cmp word [ecx], 0x5c
je 0xab4b35
test eax, eax
jne 0xab4b20
or eax, 0xffffffff
pop esi
ret
mov ecx, edx
pop esi
jmp fcn.00ab442a

Function at 0xab4cd5
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
test edi, edi
je 0xab4cf3
mov al, byte [ebp + ecx + 8]
xor byte [edx + esi], al
lea eax, [ecx + 1]
sub ecx, 3
inc edx
neg ecx
sbb ecx, ecx
leave
and ecx, eax
cmp edx, edi
jb 0xab4cdb
pop edi
pop esi
pop ebp
ret

Function at 0xab4cf7
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
movzx edi, word [ecx + 6]
xor esi, esi
test edi, edi
je 0xab4d23
movzx eax, word [ecx + 0x14]
add ecx, 0x18
add ecx, eax
cmp edx, dword [ecx + 0xc]
jb 0xab4d1b
mov eax, dword [ecx + 0x10]
add eax, dword [ecx + 0xc]
cmp edx, eax
jbe 0xab4d29
inc esi
add ecx, 0x28
cmp esi, edi
jb 0xab4d0c
or eax, 0xffffffff
pop edi
pop esi
ret
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edx
jmp 0xab4d26

Function at 0xab54f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [ebp + 8]
mov dword [eax + 0x23c], 1
mov ecx, dword [ebp + 8]
mov dword [ecx + StartServiceWx228], 0
xor edx, edx
mov ecx, 0x6ae69f02
call fcn.00ab496d
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
xor edx, edx
mov ecx, 0xa7dc6e73
call fcn.00ab496d
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
push 0x208
invalid
xchg ebp, eax
invalid
Function at 0xab6172
Capabilities:
64-bit execution via heavens gate

Disassembly:
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x60], eax
cmp dword [ebp + 0xc], 0
jle 0xab61a1
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp - 8]
add edx, 8
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x28], edx
jmp 0xab61af
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov edx, dword [ebp - 8]
add edx, 8
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, 8
xor ecx, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov eax, dword [ebp + 0xc]
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + eax - 0x3c]
xor edx, edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 4], ax
mov word [ebp - 4], fs
mov word [ebp - 4], fs

Function at 0xab621a
Capabilities:
64-bit execution via heavens gate

Disassembly:
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0xc], esp
and esp, 0xfffffff0
push 0x33
call 0xab6232
add dword [esp], 5
retf

Function at 0xab62d0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
lea eax, [ebp + 4]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x84], 0
xor ecx, ecx
je 0xab63b3
lea edx, [ebp + 4]

Function at 0xab62f7
Capabilities:
64-bit execution via heavens gate

Disassembly:
mov dword [ebp - 0x54], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x54]
sub ecx, dword [eax + 0x28]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
Function at 0xab65f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0xab6622
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 6]
cmp dword [ebp - 8], ecx
jge 0xab6666
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jb 0xab6664
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0x10]
ja 0xab6664
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + 0x14]
jmp 0xab6669
jmp 0xab6610
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0xab7900
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
call fcn.00ab4386
mov dword [ebp - 4], eax
push 4
push 0x1000
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x50]
push edx
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
call ecx
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x6c], 0
jne 0xab7946
xor al, al
jmp 0xab7a10
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x54]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x6c]
push eax
call fcn.00ab48e9
add esp, 0xc
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 6]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
jmp 0xab7999
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
add edx, 0x28
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jae 0xab79e6
mov dword [ebp - 0xc], 0
jmp 0xab79b3
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x10]
jae 0xab79e4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
mov eax, dword [ebp - 8]
add edx, dword [eax + 0x14]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x6c]
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
mov dl, byte [edx + esi]
mov byte [eax + ecx], dl
jmp 0xab79aa
jmp 0xab7987
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x6c]
push edx
call fcn.00ab81e0
add esp, 0xc
movzx eax, al
test eax, eax
jne 0xab7a0e
xor al, al
jmp 0xab7a10
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xab7f70
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
and eax, 0x20000000
je 0xab7f90
mov dword [ebp - 0x14], 1
jmp 0xab7f97
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
and edx, 0x40000000
je 0xab7fb1
mov dword [ebp - 0x18], 1
jmp 0xab7fb8
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
and ecx, 0x80000000
je 0xab7fd2
mov dword [ebp - 0x1c], 1
jmp 0xab7fd9
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 8], 0
jne 0xab7ffd
cmp dword [ebp - 0xc], 0
jne 0xab7ffd
cmp dword [ebp - 0x10], 0
jne 0xab7ffd
mov dword [ebp - 4], 1
jmp 0xab80be
cmp dword [ebp - 8], 0
jne 0xab801b
cmp dword [ebp - 0xc], 0
jne 0xab801b
cmp dword [ebp - 0x10], 0
je 0xab801b
mov dword [ebp - 4], 8
jmp 0xab80be
cmp dword [ebp - 8], 0
jne 0xab8039
cmp dword [ebp - 0xc], 0
je 0xab8039
cmp dword [ebp - 0x10], 0
jne 0xab8039
mov dword [ebp - 4], 2
jmp 0xab80be
cmp dword [ebp - 8], 0
jne 0xab8054
cmp dword [ebp - 0xc], 0
je 0xab8054
cmp dword [ebp - 0x10], 0
je 0xab8054
mov dword [ebp - 4], 4
jmp 0xab80be
cmp dword [ebp - 8], 0
je 0xab806f
cmp dword [ebp - 0xc], 0
jne 0xab806f
cmp dword [ebp - 0x10], 0
jne 0xab806f
mov dword [ebp - 4], 0x10
jmp 0xab80be
cmp dword [ebp - 8], 0
je 0xab808a
cmp dword [ebp - 0xc], 0
jne 0xab808a
cmp dword [ebp - 0x10], 0
je 0xab808a
mov dword [ebp - 4], 0x80
jmp 0xab80be
cmp dword [ebp - 8], 0
je 0xab80a5
cmp dword [ebp - 0xc], 0
Function at 0xab80e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], 0
jmp 0xab812c
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 0xc], eax
jge 0xab81ae
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0xab81a9
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
push eax
call fcn.00ab7f70
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + 0xc]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov eax, dword [ebp - 0x18]
cdq
push edx
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00ab67e0
add esp, 0x18
movzx edx, al
test edx, edx
jne 0xab81a9
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x38]
call eax
jmp 0xab811a
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x58]
call edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x58]
call ecx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0xab9cc0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.00ab4386
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 8]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
jmp 0xab9cf4
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 4], eax
jge 0xab9d3f
imul ecx, dword [ebp - 4], 0x28
mov edx, dword [ebp - 0xc]
cmp dword [edx + ecx], 0x7865742e
jne 0xab9d3d
imul eax, dword [ebp - 4], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
imul ecx, dword [ebp - 4], 0x28
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov edx, dword [ebp - 0xc]
add eax, dword [edx + ecx + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov al, 1
jmp 0xab9d41
jmp 0xab9ceb
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0xab9f50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
call fcn.00ab4386
mov dword [ebp - 0xc], eax
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0xc]
add ecx, dword [eax + edx + 0x78]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x20]
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x1c]
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x24]
mov dword [ebp - 0x14], edx
in al, dx
mov ecx, 1
test ecx, ecx
je 0xaba01b
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00ab9ca0
add esp, 0xc
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
mov edx, dword [ebp - 0x18]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00ab9f20
add esp, 8
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
add edx, 0x3c
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
invalid
salc
std