joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ccad4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1019842c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x18]
push edi
and dword [ebx + 0x59c], 0
mov edi, dword [ebp + 0x1c]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], esi
mov dword [ebx + 0x598], ecx
mov dword [ebx + 0x5a0], eax
test ecx, ecx
jne 0x100ccb3f
call sym.UserAndPayClient.dll_public:_static_class_xx_DuiLib::MenuObserverImpl____cdecl_xx_DuiLib::CMenuWnd::GetGlobalContextMenuObserver_void_
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
test edi, edi
je 0x100ccb3f
call sym.UserAndPayClient.dll_public:_static_class_xx_DuiLib::MenuObserverImpl____cdecl_xx_DuiLib::CMenuWnd::GetGlobalContextMenuObserver_void_
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x14]
call sym.UserAndPayClient.dll_public:_static_class_xx_DuiLib::MenuObserverImpl____cdecl_xx_DuiLib::CMenuWnd::GetGlobalContextMenuObserver_void_
mov esi, ebx
lea edx, [ebx + 0x10]
neg esi
mov ecx, eax
mov edi, dword [eax]
sbb esi, esi
and esi, edx
push esi
call dword [edi]
mov ecx, dword [ebx + 0x598]
test ecx, ecx
jne 0x100ccb65
mov ecx, dword [ebp - 0x18]
jmp 0x100ccb6c
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call sym.UserAndPayClient.dll_public:_struct_HWND______thiscall_xx_DuiLib::CPaintManagerUI::GetPaintWindow_void_const
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiRect::constructor_void_
push 0
sub esp, 0x10
mov esi, eax
mov edi, esp
mov ecx, ebx
push 0x88
movsd dword es:[edi], dword [esi]
push SysReAllocString
push 0
push dword [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sym.UserAndPayClient.dll_public:_struct_HWND______thiscall_xx_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__struct_tagRECT__struct_HMENU____
mov esi, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_GetParent]
jmp 0x100ccbaf
push esi
call edi
mov esi, eax
push esi
call edi
test eax, eax
jne 0x100ccbaa
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e3849
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x100d28be
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1019842c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
mov dword [ebp - 0x210], esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push esi
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov edi, eax
cmp esi, 0x21
jb 0x100d290c
cmp esi, 0x28
jbe 0x100d2906
lea eax, [esi - 0x2d]
cmp eax, 1
ja 0x100d290c
or edi, 0x100
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100e0f10
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, edi
or ecx, 0x1000000
cmp dword [ebp + 0x10], 0
push 0x104
cmove ecx, edi
push eax
shl ecx, 0x10
push ecx
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e3849
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100d2c0a
Capabilities:
Hide graphical window

Disassembly:
push 0x98
mov eax, 0x10128aab
call fcn.100e44b3
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x10], eax
test eax, eax
je 0x100d2d11
lea eax, [ebp - 0xa4]
push eax
call sym.UserAndPayClient.dll_public:_struct_tagRECT___thiscall_xx_DuiLib::CHotKeyWnd::CalPos_void_
mov ecx, dword [ebx + 0x10]
lea esi, [ebp - 0xa4]
xor eax, eax
push eax
sub esp, 0x10
mov ecx, dword [ecx + 0x44]
mov edi, esp
push eax
movsd dword es:[edi], dword [esi]
push 0x40000080
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sym.UserAndPayClient.dll_public:_struct_HWND______thiscall_xx_DuiLib::CPaintManagerUI::GetPaintWindow_void_const
push eax
mov ecx, ebx
call sym.UserAndPayClient.dll_public:_struct_HWND______thiscall_xx_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__struct_tagRECT__struct_HMENU____
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100d2d11
mov ecx, dword [ebx + 0x10]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CLabelUI::GetFont_void_const
mov ecx, dword [ebx + 0x10]
push eax
mov ecx, dword [ecx + 0x44]
call sym.UserAndPayClient.dll_public:_struct_xx_DuiLib::tagTFontInfo____thiscall_xx_DuiLib::CPaintManagerUI::GetFontInfo_int_
push 1
push dword [eax]
push 0x30
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x10]
movzx eax, word [ecx + 0x85e]
push eax
movzx eax, word [ecx + 0x85c]
mov ecx, ebx
push eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CHotKeyWnd::SetHotKey_unsigned_short_int__unsigned_short_int_
lea eax, [ebp - 0x94]
mov ecx, ebx
push eax
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CDuiString___thiscall_xx_DuiLib::CHotKeyWnd::GetHotKeyName_void_
mov ecx, dword [ebx + 0x10]
and dword [ebp - 4], 0
add ecx, 0x1f8
push eax
call fcn.10076956
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10c]
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [ebx + 0x18], 1
call fcn.100e446e
ret 4
Function at 0x100d42f5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
jne 0x100d4318
xor ebx, ebx
push ebx
push ebx
push ebx
push 2
call fcn.100d7b97
xor al, al
jmp 0x100d43cb
call fcn.100d3cc1
or dword [esi + 8], 0xffffffff
xor ebx, ebx
or dword [esi + 4], 0xffffffff
push 2
push ebx
push edi
call fcn.100fb4b0
push edi
call fcn.100fd378
push ebx
push ebx
push edi
mov dword [ebp - 4], eax
call fcn.100fb4b0
mov eax, dword [ebp - 4]
add esp, 0x1c
test eax, eax
jg 0x100d4354
push ebx
push ebx
push ebx
push 0xc
mov ecx, esi
jmp 0x100d430c
inc eax
push eax
call fcn.100e385a
push dword [ebp + 8]
mov edi, eax
push 1
push dword [ebp - 4]
push edi
mov byte [edi], bl
call fcn.100fb0aa
add esp, 0x14
cmp eax, 1
je 0x100d4383
push edi
call fcn.100e3863
pop ecx
push ebx
push ebx
push ebx
push 2
jmp 0x100d4350
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, edi
mov byte [edi + edx], bl
cmp byte [edi], bl
je 0x100d43b0
mov dl, byte [eax]
mov dword [ebp + 8], eax
cmp dl, 0xd
jne 0x100d43a8
inc eax
mov byte [ecx], 0xa
cmp byte [eax], 0xa
cmovne eax, dword [ebp + 8]
jmp 0x100d43aa
mov byte [ecx], dl
inc eax
inc ecx
cmp byte [eax], bl
jne 0x100d4391
push dword [ebp + 0xc]
mov byte [ecx], bl
mov ecx, esi
mov eax, dword [esi]
push ebx
push edi
call dword [eax + 8]
push edi
call fcn.100e3863
cmp byte [esi + 0x2c], bl
pop ecx
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100e6bd3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1010e75a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1010e5d9

Function at 0x10116d4d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10116a0d
Function at 0x40dacb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x40dba0
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x40dba0
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x40dba0
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x40db26
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x40dba0
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40db6b
test dl, dl
je 0x40db67
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40db6b
add ecx, 2
add eax, 2
test dl, dl
jne 0x40db4b
xor eax, eax
jmp 0x40db70
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40db82
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x40db8d
inc esi
cmp esi, ebp
jae 0x40dba0
mov edx, dword [esp + 0x10]
jmp 0x40db41
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x40de04
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x40de0f
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x40de23
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x40de27
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x40de60
cmp dword [edi + ecx], 0x4550
jne 0x40de60
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x40de60
test byte [edi + ecx + 0x16], 2
je 0x40de60
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x40de65
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x40dea1
xor eax, eax
jmp 0x40de84
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x40deaa
inc edx
movzx eax, dx
cmp eax, edi
jl 0x40de84
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x40deb0
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x40dee8
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x40def6
add edx, 0x20
cmp eax, edx
jne 0x40df07
test bx, bx
je 0x40df3c
add esi, 2
add edi, 2
jmp 0x40ded8
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x40df15
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x40df23
add edx, 0x20
sub ecx, edx
je 0x40df3c
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x40ded1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40e9b5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x40ea76
test ecx, ecx
je 0x40ea76
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x40ea76
test ebx, ebx
je 0x40ea76
mov ebx, eax
add ebx, edx
je 0x40ea76
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x40ea76
cmp dword [edx + eax + 0x14], 0
je 0x40ea76
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x40ea76
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x40ea66
test dl, dl
je 0x40ea62
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x40ea66
add edi, 2
add esi, 2
test dl, dl
jne 0x40ea46
xor eax, eax
jmp 0x40ea6b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40ea82
inc ebp
cmp ebp, dword [esp + 4]
jb 0x40ea33
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x41694f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x416972
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x416972
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x41697c
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4169be
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x416a20
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x416a1b
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x416a06
test dl, dl
je 0x416a02
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x416a06
add ecx, 2
add eax, 2
test dl, dl
jne 0x4169e6
xor eax, eax
jmp 0x416a0b
sbb eax, eax
or eax, 1
test eax, eax
je 0x416a2c
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4169d3
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x416f39
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x41700e
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x41700e
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x41700e
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x416f94
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x41700e
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x416fd9
test dl, dl
je 0x416fd5
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x416fd9
add ecx, 2
add eax, 2
test dl, dl
jne 0x416fb9
xor eax, eax
jmp 0x416fde
sbb eax, eax
or eax, 1
test eax, eax
jne 0x416ff0
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x416ffb
inc esi
cmp esi, ebp
jae 0x41700e
mov edx, dword [esp + 0x10]
jmp 0x416faf
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x417272
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x41727d
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x417291
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x417295
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x4172ce
cmp dword [edi + ecx], 0x4550
jne 0x4172ce
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x4172ce
test byte [edi + ecx + 0x16], 2
je 0x4172ce
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x4172d3
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x41730f
xor eax, eax
jmp 0x4172f2
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x417318
inc edx
movzx eax, dx
cmp eax, edi
jl 0x4172f2
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x41731e
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x417356
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x417364
add edx, 0x20
cmp eax, edx
jne 0x417375
test bx, bx
je 0x4173aa
add esi, 2
add edi, 2
jmp 0x417346
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x417383
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x417391
add edx, 0x20
sub ecx, edx
je 0x4173aa
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x41733f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x417e23
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x417ee4
test ecx, ecx
je 0x417ee4
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x417ee4
test ebx, ebx
je 0x417ee4
mov ebx, eax
add ebx, edx
je 0x417ee4
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x417ee4
cmp dword [edx + eax + 0x14], 0
je 0x417ee4
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x417ee4
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x417ed4
test dl, dl
je 0x417ed0
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x417ed4
add edi, 2
add esi, 2
test dl, dl
jne 0x417eb4
xor eax, eax
jmp 0x417ed9
sbb eax, eax
or eax, 1
test eax, eax
je 0x417ef0
inc ebp
cmp ebp, dword [esp + 4]
jb 0x417ea1
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x42d1b6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x42d28b
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x42d28b
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x42d28b
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x42d211
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x42d28b
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x42d256
test dl, dl
je 0x42d252
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x42d256
add ecx, 2
add eax, 2
test dl, dl
jne 0x42d236
xor eax, eax
jmp 0x42d25b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42d26d
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x42d278
inc esi
cmp esi, ebp
jae 0x42d28b
mov edx, dword [esp + 0x10]
jmp 0x42d22c
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x42d4ef
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x42d4fa
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x42d50e
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x42d512
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x42d54b
cmp dword [edi + ecx], 0x4550
jne 0x42d54b
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x42d54b
test byte [edi + ecx + 0x16], 2
je 0x42d54b
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x42d550
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x42d58c
xor eax, eax
jmp 0x42d56f
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x42d595
inc edx
movzx eax, dx
cmp eax, edi
jl 0x42d56f
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret