joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5172b8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x5172c0
push ebx
push esi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5174b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0x11c
mov eax, dword [ebp - 8]
add eax, 4
push eax
call sub.kernel32.dll_GetVersionExW
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 6
jne 0x517413
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 2
jne 0x517413
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00403f80
mov edx, dword [ebp - 0x1c]
mov ecx, 0x5174cc
mov eax, 0x517500
call fcn.0050cdb8
lea ecx, [ebp - 0x24]
mov dl, 1
mov eax, 0x25
call fcn.0050ca5c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00414af4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ecx, 0x517580
call fcn.00406b80
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00406738
mov esi, eax
push esi
call fcn.0047fd14
mov ebx, eax
test ebx, ebx
jbe 0x517413
mov eax, ebx
call fcn.00403350
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x51740c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
push 0
push esi
call fcn.0047fd78
test eax, eax
je 0x5173f6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x51759c
mov eax, dword [ebp - 0xc]
push eax
call fcn.0047fdd8
test eax, eax
je 0x5173f6
cmp dword [ebp - 0x18], 0x34
jne 0x5173f6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
call fcn.0047f5b4
movzx eax, ax
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
call fcn.0047f5ac
movzx eax, ax
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
call fcn.0047f5b4
movzx eax, ax
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x517413
mov eax, dword [ebp - 0xc]
call fcn.0040336c
ret
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00403f80
mov eax, dword [ebp - 0x28]
push eax
push 0x5175ac
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.0040d888
push dword [ebp - 0x30]
push 0x5175e0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.0040d888
push dword [ebp - 0x34]
push 0x5175e0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x38]
call fcn.0040d888
push dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.00406c64
mov eax, dword [ebp - 0x2c]
mov ecx, 0x5174cc
pop edx
call fcn.0050cdb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5174b7
lea eax, [ebp - 0x38]
mov edx, 8
call fcn.004066a4
lea eax, [ebp - 4]
call fcn.0040669c
ret
Function at 0x54883c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x548896
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00548830
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00545cfc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00545860
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54889d
lea eax, [ebp - 4]
call fcn.0040669c
ret
Function at 0x560ae8
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
xor eax, eax
push ebp
push 0x560c5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call fcn.004066ac
xor eax, eax
mov dword [ebp - 8], eax
mov eax, 0x3c
call fcn.00403350
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x560c38
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, 0x7a
jne 0x560c22
mov eax, dword [ebp - 4]
call fcn.0040336c
mov eax, dword [ebp - 8]
call fcn.00403350
mov dword [ebp - 4], eax
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.iphlpapi.dll_GetIpForwardTable
test eax, eax
jne 0x560c22
xor ebx, ebx
mov esi, ebx
add esi, esi
add esi, esi
add esi, esi
sub esi, ebx
mov eax, dword [ebp - 4]
cmp dword [eax + esi*8 + 4], 0
jne 0x560c18
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*8 + 0x10]
and eax, 0xff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.0040d888
push dword [ebp - 0xc]
push 0x560c74
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*8 + 0x10]
shr eax, 8
and eax, 0xff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call fcn.0040d888
push dword [ebp - 0x10]
push 0x560c74
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*8 + 0x10]
shr eax, 0x10
and eax, 0xff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.0040d888
push dword [ebp - 0x14]
push 0x560c74
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*8 + 0x10]
shr eax, 0x18
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.0040d888
push dword [ebp - 0x18]
mov eax, edi
mov edx, 7
call fcn.00406c64
jmp 0x560c22
inc ebx
cmp ebx, 1
jne 0x560b73
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x560c3f
mov eax, dword [ebp - 4]
call fcn.0040336c
ret
Function at 0x567650
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x134], ebx
test dl, dl
je 0x567676
add esp, 0xfffffff0
call fcn.00404594
mov dword [ebp - 4], ecx
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00406694
xor eax, eax
push ebp
push 0x567883
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x56774c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x12c], 0x11c
lea eax, [ebp - 0x12c]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x567742
cmp byte [ebp + 8], 0
je 0x567742
cmp dword [ebp - 0x128], 6
jne 0x567742
cmp dword [ebp - 0x124], 2
jne 0x567742
mov dl, 1
mov eax, dword [0x437c34]
call fcn.00437da0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x56773b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00437e7c
mov cl, 1
mov edx, 0x5678bc
mov eax, dword [ebp - 0x10]
call fcn.00437ee0
test al, al
je 0x567725
xor ecx, ecx
mov edx, 0x567940
mov eax, dword [ebp - 0x10]
call fcn.00438490
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x567742
mov eax, dword [ebp - 0x10]
call fcn.004040a8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x567756
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0x64
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
add eax, 0x14
mov edx, dword [ebp - 4]
call fcn.0040eb44
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 8]
add eax, 0x214
xor ecx, ecx
mov edx, 0xc
call fcn.00403968
mov eax, dword [ebp - 8]
add eax, 0x214
push eax
mov eax, dword [ebp - 8]
add eax, 4
push eax
call fcn.005672c4
test eax, eax
jne 0x56785d
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 0x214]
mov eax, ebx
sub eax, 0xa
je 0x5677ef
sub eax, 0x66
je 0x5677d7
sub eax, 0x3b2
je 0x567807
jmp 0x56781f
mov ecx, 0x567994
mov dl, 1
mov eax, dword [0x567488]
call fcn.00413460
call fcn.00404bfc
jmp 0x56785d
mov ecx, 0x567a18
mov dl, 1
mov eax, dword [0x567500]
call fcn.00413460
call fcn.00404bfc
jmp 0x56785d
mov ecx, 0x567ab0
mov dl, 1
mov eax, dword [0x567408]
call fcn.00413460
call fcn.00404bfc
jmp 0x56785d
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x134]
call fcn.0040d888
mov ecx, dword [ebp - 0x134]
lea eax, [ebp - 0x130]
mov edx, 0x567b60
call fcn.00406b80
mov ecx, dword [ebp - 0x130]
mov dl, 1
mov eax, dword [0x567390]
call fcn.00413460
call fcn.00404bfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56788a
lea eax, [ebp - 0x134]
mov edx, 2
call fcn.004066a4
lea eax, [ebp - 4]
call fcn.0040669c
ret
Function at 0x56c6f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x56c6f8
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56c926
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0056c59c
xor edx, edx
push ebp
push 0x56c89b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0040de50
test al, al
je 0x56c75c
push ebp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0056c5d4
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00406738
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x56c891
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040de50
test al, al
je 0x56c891
push ebp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0056c5d4
pop ecx
push 0xffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dl, 1
mov eax, dword [0x4265e4]
call fcn.0042ce20
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x56c86e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x56c858
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
call fcn.00428a8c
mov ebx, eax
push dword [ebx + 0xc]
push dword [ebx + 8]
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00411b8c
push dword [ebp - 0xc]
push 0x56c940
push dword [ebx + 0x10]
push 0x56c950
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00406c64
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.004068f0
mov eax, dword [ebp - 8]
test eax, eax
je 0x56c82d
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x56c82d
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.0040571c
mov ebx, eax
test ebx, ebx
je 0x56c838
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 8]
call fcn.00405ca0
mov edx, eax
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x10]
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x56c7c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56c875
mov eax, dword [ebp - 0x14]
call fcn.004040a8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56c8fb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56c92d
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004066a4
lea eax, [ebp - 0xc]
call fcn.0040669c
lea eax, [ebp - 8]
call fcn.00405500
ret
Function at 0x56d548
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.0040de50
test al, al
je 0x56d627
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
call fcn.0040de50
test al, al
je 0x56d627
xor edx, edx
push ebp
push 0x56d5d7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00428648
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
call fcn.005115d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00406738
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00406738
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56d6fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0040de50
test al, al
je 0x56d6fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.0040de50
test al, al
je 0x56d6fc
xor edx, edx
push ebp
push 0x56d6b1
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00428648
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
call fcn.005115d4
mov eax, dword [ebp - 4]
call fcn.0056dc1c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00406738
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00406738
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56d6fc
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x100064fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x1000650b
pop dword [ebp - 4]
mov eax, 0x1000650b
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x82bebbe3
add dword [ebp - 0x14], 0xcb938968
mov dword [ebp - 0x10], 0x5796ab10
sub dword [ebp - 0x10], 0x25635ecb
mov dword [ebp - 0xc], 0x6779044
add dword [ebp - 0xc], 0x45d4b3ea
mov dword [ebp - 8], 0xf50cebd2
sub dword [ebp - 8], 0xf50cebd2
lea eax, [ebp - 0x14]
push eax
mov eax, 0xdc2266b6
sub eax, 0xcc217606
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x9f29a563
add dword [ebp - 0x14], 0xd548c3f3
mov dword [ebp - 0x10], 0x3d6e7096
add dword [ebp - 0x10], 0x3fdf0df
mov dword [ebp - 0xc], 0x7dfe6ddc
add dword [ebp - 0xc], 0xe570fe90
mov dword [ebp - 8], 0x67f1ebb2
sub dword [ebp - 8], 0x67f1ebb2
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x2d79e455
sub eax, 0x1d78f3ad
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3afa7
push 0
call eax
mov ecx, 0xe118b94b
sub ecx, 0xe1186897
xor ebx, ebx
add ebx, eax
mov esi, 0x10023600
add esi, dword [ebp - 4]
mov edx, 0x3dadf15b
add edx, 0xe47acbe4
mov edi, dword [esi]
xor edi, edx
mov dword [ebx], edi
add ebx, 4
add esi, 0xd89adb03
add esi, 0x27652501
loop 0x10006624
add eax, 0x844eb186
sub eax, 0x844d7be3
mov ebx, eax
add eax, 0x215723d7
add eax, 0xdea8dc2e
mov ecx, 0xf97bb2a3
add ecx, 0x16844d5d
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x1000b1e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x1000b238
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x1000b238
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.100064fc
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x1000b7d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x4b4abd
Capabilities:
Resolve function by hash

Disassembly:
mov eax, dword fs:[0x30]
test eax, eax
js 0x4b4ad3
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov ebx, dword [eax + 8]
jmp 0x4b4adc
mov eax, dword [eax + 0x34]
mov ebx, dword [eax + 0xb8]
pop esi
add esi, 3
push ebx
mov edx, 0xec0e4e8e
call esi
push eax
mov edx, 0x7c0dfcaa
call esi
push eax
push edi
mov edx, 0x4ee4a045
call esi
xor edx, edx
push edx
push 0x6d756369
push 0x6c656167
push esp
push edx
push edx
call eax
push eax
mov edx, 0x75da1966
call esi
call eax
xchg edi, eax
mov edx, 0xffd97fb
call esi
call eax
cmp edi, 0xb7
jne 0x4b4b2b
mov esp, ebp
popal
ret
call fcn.004b4b4c
sti
xchg edi, eax
std
pcmpeqd mm5, qword [ebp - 0x50]
inc ebp
jb 0x4b4b38
mov bl, 0x16
mov eax, dword [0xd2d83d6a]
invalid

Function at 0x4b5187
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edx
push ebx
call dword [edi + 0x30]
push edi
push eax
or esi, esi
jne 0x4b51a0
pop eax
cmp byte [ebx + eax - 1], 0x5c
jne 0x4b51ae
dec eax
jmp 0x4b51ae
push esi
call dword [edi + 0x30]
xchg ecx, eax
pop eax
lea edi, [ebx + eax]
add eax, ecx
inc ecx
rep movsb byte es:[edi], byte [esi]
call 0x4b51b8
pop esp
sub ch, byte [esi]
sub al, byte [eax]
pop esi
lea edi, [ebx + eax]
push edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
inc esi
pop edi
push ebx
push esi
push dword [ebp - 4]
push ebx
call dword [edi + 0x38]
mov byte [esi], 0
cmp eax, 0xffffffff
je 0x4b523f
mov esi, eax
mov ebx, dword [ebp - 4]
test byte [ebx], 0x10
lea ebx, [ebx + 0x2c]
je 0x4b51f6
cmp byte [ebx], 0x2e
je 0x4b5226
push esi
mov edx, dword [ebp - 4]
mov esi, ebx
mov ebx, dword [ebp - 8]
call fcn.004b5187
pop esi
jmp 0x4b5226
push ebx
call dword [edi + 0x30]
push eax
call 0x4b5205
js 0x4b5269
add byte [ebp + 0x51fc034c], cl
call dword [edi + 0x34]
or eax, eax
pop ecx
jne 0x4b5226
push esi
push edi
mov esi, ebx
mov edi, dword [ebp - 0xc]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp - 8]
call fcn.004b5241
pop esi
mov ebx, dword [ebp - 0xc]
mov byte [ebx], 0
push dword [ebp - 4]
push esi
push 1
call dword [edi]
call dword [edi + 0x3c]
or eax, eax
jne 0x4b51d5
push esi
call dword [edi + pe_nt_image_headers32]
leave
ret
jae 0x4b52d6
jb 0x4b52db
insb byte es:[edi], dx
js 0x4b52d7
invalid
Function at 0x4b51b8
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edx
push ebx
call dword [edi + 0x30]
push edi
push eax
or esi, esi
jne 0x4b51a0
pop eax
cmp byte [ebx + eax - 1], 0x5c
jne 0x4b51ae
dec eax
jmp 0x4b51ae
push esi
call dword [edi + 0x30]
xchg ecx, eax
pop eax
lea edi, [ebx + eax]
add eax, ecx
inc ecx
rep movsb byte es:[edi], byte [esi]
call 0x4b51b8
pop esp
sub ch, byte [esi]
sub al, byte [eax]
pop esi
lea edi, [ebx + eax]
push edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
inc esi
pop edi
push ebx
push esi
push dword [ebp - 4]
push ebx
call dword [edi + 0x38]
mov byte [esi], 0
cmp eax, 0xffffffff
je 0x4b523f
mov esi, eax
mov ebx, dword [ebp - 4]
test byte [ebx], 0x10
lea ebx, [ebx + 0x2c]
je 0x4b51f6
cmp byte [ebx], 0x2e
je 0x4b5226
push esi
mov edx, dword [ebp - 4]
mov esi, ebx
mov ebx, dword [ebp - 8]
call fcn.004b5187
pop esi
jmp 0x4b5226
push ebx
call dword [edi + 0x30]
push eax
call 0x4b5205
js 0x4b5269
add byte [ebp + 0x51fc034c], cl
call dword [edi + 0x34]
or eax, eax
pop ecx
jne 0x4b5226
push esi
push edi
mov esi, ebx
mov edi, dword [ebp - 0xc]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp - 8]
call fcn.004b5241
pop esi
mov ebx, dword [ebp - 0xc]
mov byte [ebx], 0
push dword [ebp - 4]
push esi
push 1
call dword [edi]
call dword [edi + 0x3c]
or eax, eax
jne 0x4b51d5
push esi
call dword [edi + pe_nt_image_headers32]
leave
ret
jae 0x4b52d6
jb 0x4b52db
insb byte es:[edi], dx
js 0x4b52d7
invalid

Function at 0x4b5241
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor edx, edx
push edx
push edx
push 3
push edx
push 1
push 0xc0000000
push eax
mov esi, eax
push esi
call dword [edi + 0x30]
lea esi, [esi + eax - 0xc]
push esi
call fcn.004b5273
outsb dx, byte [esi]
je 0x4b52d8

Function at 0x4b5273
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
call dword [edi + 0x34]
or eax, eax
jne 0x4b527c
leave
call dword [edi + 0x44]
mov ebx, eax
inc ebx
jne 0x4b528e
dec ebx
push pe_nt_image_headers32
pop esi
sub esp, esi
mov edx, esp
push 0
push esp
push esi
push edx
push ebx
call dword [edi + 0x48]
cmp dword [esp - 4], esi
jne 0x4b5284
cmp word [esp], 0x5a4d
jne 0x4b5284
cmp byte [esp + 0x32], 0x56
je 0x4b5284
push eax
add esp, esi
pop esi
mov dword [ebp - 0x1c], esi
push 0
push 0
push esi
push ebx
call dword [edi + 0x50]
inc eax
je 0x4b5284
sub esp, 0x58
mov edx, esp
push 0
push esp
push 0x58
push edx
push ebx
call dword [edi + 0x48]

Function at 0x10001822
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x1000182c
repz ret
jmp fcn.10001bc2
Function at 0x10004520
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002de70
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x1003efc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [0x1003ed88]
lea eax, [ebp - 0x110]
push 0xff
push eax
push 0x100303e8
push dword [0x1003e3c8]
push dword [0x1003ed8c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x12c]
call fcn.10004440
mov dword [ebp - 4], 0
call fcn.10017e3f
cmp dword [ebp - 0x118], 0xf
lea esi, [ebp - 0x12c]
mov edi, eax
lea eax, [ebp - 0x114]
cmova esi, dword [ebp - 0x12c]
push 0xa
push eax
push esi
mov dword [edi], 0
call fcn.100186fe
add esp, 0xc
cmp esi, dword [ebp - 0x114]
je 0x10004627
cmp dword [edi], 0x22
je 0x10004631
mov ecx, dword [ebp - 0x118]
mov dword [0x100447b0], eax
cmp ecx, 0xf
jbe 0x1000460a
mov edx, dword [ebp - 0x12c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10004600
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000463b
push ecx
push edx
call fcn.10010e5b
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001130c
mov esp, ebp
pop ebp
ret
push str.invalid_stoi_argument
call fcn.1000eb0c
push str.stoi_argument_out_of_range
call fcn.1000eb4c
call fcn.10015bef
int3

Function at 0x10006bf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, 0x1103
movzx ecx, word [eax]
cmp cx, dx
jne 0x10006c18
cmp dword [eax + 0x18], 0x38324535
jne 0x10006cb0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x1fe
cmp cx, ax
jne 0x10006cb0
mov ecx, dword [0x10044d04]
movups xmm0, xmmword [ecx + 2]
movups xmmword [0x10044c38], xmm0
movups xmm0, xmmword [ecx + 0x12]
movups xmmword [0x10044c48], xmm0
movups xmm0, xmmword [ecx + 0x22]
movups xmmword [0x10044c58], xmm0
movzx eax, byte [ecx + 0x32]
mov byte [0x10044c68], al
movups xmm0, xmmword [ecx + 0x34]
movups xmmword [0x10044ca0], xmm0
movups xmm0, xmmword [ecx + 0x44]
movups xmmword [0x10044cb0], xmm0
movups xmm0, xmmword [ecx + 0x54]
movups xmmword [0x10044cc0], xmm0
movzx eax, byte [ecx + 0x64]
mov byte [0x10044cd0], al
movups xmm0, xmmword [ecx + 0x66]
movups xmmword [0x10044d08], xmm0
movups xmm0, xmmword [ecx + 0x76]
movups xmmword [0x10044d18], xmm0
movups xmm0, xmmword [ecx + 0x86]
movups xmmword [0x10044d28], xmm0
movzx eax, byte [ecx + 0x96]
mov byte [0x10044d38], al
pop ebp
ret