joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a026
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4120e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406eaa
and dword [ebp - 0x14], 0
cmp dword [0x413c2c], 0
mov dword [ebp - 0x18], eax
jne 0x40a0d9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40a181
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40a181
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x413c2c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x413c30], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x413c34], eax
call edi
push eax
call esi
mov dword [0x413c3c], eax
test eax, eax
je 0x40a0d9
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x413c38], eax
mov eax, dword [0x413c38]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40a132
cmp dword [0x413c3c], ecx
je 0x40a132
push eax
call esi
push dword [0x413c3c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40a132
test ebx, ebx
je 0x40a132
call edi
test eax, eax
je 0x40a129
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40a129
test byte [ebp - 8], 1
jne 0x40a132
or dword [ebp + 0x10], 0x200000
jmp 0x40a165
mov eax, dword [0x413c30]
cmp eax, dword [ebp - 0x18]
je 0x40a165
push eax
call esi
test eax, eax
je 0x40a165
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40a165
mov eax, dword [0x413c34]
cmp eax, dword [ebp - 0x18]
je 0x40a165
push eax
call esi
test eax, eax
je 0x40a165
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x413c2c]
call esi
test eax, eax
je 0x40a181
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40a183
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040dd
leave
ret
Function at 0x40391c
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
and ax, word [0x404054]
push edi
call sub.GDI32.dll_SaveDC
add dword [ebp - 4], 0x2720b0
mov byte [ebp - 8], 0
cmp dword [ebp - 4], 1
je 0x40394b
mov bh, byte [0x404004]
mov byte [ebp - 7], bh
push 0x22fb44
call sub.msvcrt.dll_srand
pop ecx
nop
push 0x401130
call sub.msvcrt.dll_remove
pop ecx
mov word [ebp - 0xc], 0xa8f4
mov ebx, dword [ebp - 4]
cmp dword [ebp - 4], 0x2fafa8
jne 0x40397a
mov ch, byte [0x404004]
push dword [0x404058]
call sub.GDI32.dll_DeleteDC
add dword [0x40405c], edx
mov dword [ebp - 4], 0xffffffff
not eax
push dword [0x404060]
call sub.GDI32.dll_SaveDC
add dword [ebp - 0x10], 1
push 0x36c630
call sub.GDI32.dll_CreateSolidBrush
mov dl, byte [ebp - 7]
push 0
call sub.msvcrt.dll_time
pop ecx
mov dword [ebp - 0x14], 0x415a90
xor dword [ebp - 0x18], 0x144b58
sub dword [0x404064], 0xffffffff
mov word [ebp - 0xc], 0x1024
push edx
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 0x14], 0x6180a0
push 0x404068
call sub.KERNEL32.DLL_GetSystemTime
add dword [0x404078], esi
push esi
call sub.GDI32.dll_SaveDC
mov word [ebp - 0xc], 0xffff
call sub.KERNEL32.DLL_GetCurrentProcess
adc ebx, dword [ebp - 4]
push 0
push 0
push 0x2a
push 0
push 0x40367b
push 0
push 0x40407c
call sub.KERNEL32.DLL_CreateTimerQueueTimer
or eax, eax
jne 0x403a2b
push 0
call sub.KERNEL32.DLL_ExitProcess
neg cl
push 0xffffffffffffffff
call sub.KERNEL32.DLL_Sleep
mov dword [0x40400c], 0x16bc98
leave
ret
Function at 0x403670
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x34
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
mov ecx, dword [eax + 0x18]
cmp dword [ecx + 0x4c], eax
je 0x4036bc
call fcn.00433cd0
lea eax, [0x4e6ba8]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.004345b0
call fcn.00433d40
mov dword [esp], 2
call fcn.0042e120
mov eax, dword [esp + 0x2c]
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
nop
inc dword [ecx + 0x148]
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
mov ebx, ecx
mov dword [edx + 0xc0], ecx
mov ecx, dword [ebx + 0x18]
mov dword [ebx + 0x98], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x30], ecx
test byte [ecx], al
lea esi, [ecx + 0x19c]
lea edi, [esp + 0x10]
call fcn.0045c654
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x28], ecx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0xc], edx
call fcn.00458e00
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x88], 0
mov ecx, dword [eax + 0x18]
test byte [ecx], al
add ecx, 0x1d8
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.00402090
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
call fcn.004037d0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x88], 1
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x30]
cmp ecx, edx
jne 0x4037b6
mov dword [esp], ecx
call fcn.0042f920
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0043bda0
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 0x18]
test byte [eax], al
lea edi, [eax + 0x19c]
lea esi, [esp + 0x10]
call fcn.0045c654
add esp, 0x34
ret
lea eax, [0x4e84d8]
mov dword [esp], eax
mov dword [esp + 4], 0x26
call fcn.004327b0
nop
int3
Function at 0x40b2f0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b4c1
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b31b
mov eax, 0x7000000
jmp 0x40b323
test eax, eax
je 0x40b49c
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x90]
mov ebx, dword [ecx + 0x94]
mov dword [ecx + 0x90], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x94], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.0045bf50
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x583320]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40b4b4
cmp ecx, 0x21
jae 0x40b4a8
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00456610
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.004566e0
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x50696c]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x5069dc]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b477
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x506a1c]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.0045c030
mov eax, ecx
mov ecx, 0x21
call fcn.0045c0e0
nop
call fcn.0045ab60
jmp fcn.0040b2f0
Function at 0x413c50
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x413e66
sub esp, 0x18
mov eax, dword [0x5bb088]
test eax, eax
jne 0x413e4f
nop
nop
lea eax, [0x5bb070]
mov dword [esp], eax
call fcn.00409110
mov eax, dword [0x5bb074]
test eax, eax
je 0x413c9a
cmp dword [eax + 8], 0xcc
jne 0x413d10
mov edx, dword [0x5bb068]
test edx, edx
jne 0x413cf2
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5bcc78]
mov dword [esp + 8], eax
call fcn.0040b4d0
mov eax, dword [esp + 0xc]
mov dword [0x5bb068], eax
mov ecx, dword [0x5bb024]
mov dword [eax], ecx
mov eax, dword [0x5bb068]
mov dword [0x5bb024], eax
movzx eax, byte [0x5bb4c0]
test al, al
jne 0x413cf2
xor eax, eax
jmp 0x413dfb
mov edx, dword [0x5bb068]
mov ebx, dword [edx + 4]
mov dword [0x5bb068], ebx
mov ebx, dword [0x5bb074]
mov dword [edx + 4], ebx
mov dword [0x5bb074], edx
mov edx, dword [0x5bb074]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x413de3
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401fd0
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x5bb250]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x413d6e
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x413d7b
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.0045bfa0
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x5bb250]
test edx, edx
jne 0x413da7
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x413dc8
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.0045bfa0
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.0045bfa0
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.0045bfa0
mov byte [0x5bafe9], 1
nop
nop
lea eax, [0x5bb070]
mov dword [esp], eax
call fcn.00409310
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.0045c030
lea esi, [0x5bb4c0]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x413cf2
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x413e45
lea edx, [0x57f134]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x413ded
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.0045c020
mov ecx, 5
call fcn.0045c020
lea eax, [0x4e52ce]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004327b0
nop
call fcn.0045ab60
jmp fcn.00413c50
Function at 0x423dd0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x423f40
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00421bf0
mov eax, dword [esp + 4]
test eax, eax
je 0x423f29
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x78]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.0041fe00
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00409110
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x423e67
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x423ecd
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x423e7c
cmp byte [ebp + 6], dl
je 0x423e87
cmp esi, ebx
ja 0x423ecd
jne 0x423e65
cmp byte [ebp + 6], dl
jbe 0x423e65
jmp 0x423ecd
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409310
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x423ec4
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x423ec4
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.00423cd0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409310
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x423f20
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x423f20
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x4e6536]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.004327b0
nop
call fcn.0045ab60
jmp fcn.00423dd0
Function at 0x424080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x424273
sub esp, 0x28
nop
lea eax, [0x59f670]
mov dword [esp], eax
call fcn.00409110
lea eax, [0x59f604]
mov dword [esp], eax
call fcn.00414a20
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
nop
nop
lea ecx, [0x59f670]
mov dword [esp], ecx
call fcn.00409310
mov eax, dword [esp + 0x24]
mov byte [eax + 6], 1
lea edi, [eax + 8]
mov ecx, dword [0x5bb250]
test ecx, ecx
jne 0x4240ec
mov ecx, dword [esp + 0x30]
mov dword [eax + 8], ecx
jmp 0x4240f9
mov ecx, eax
mov eax, dword [esp + 0x30]
call fcn.0045bfa0
mov eax, ecx
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x34]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x5bb250]
test ecx, ecx
jne 0x42411e
mov ecx, dword [esp + 0x38]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x3c]
mov dword [eax + 0x14], ecx
jmp 0x42413c
lea ecx, [eax + 0x10]
mov edi, ecx
mov ebx, eax
mov eax, dword [esp + 0x38]
call fcn.0045bfa0
lea edi, [ebx + 0x14]
mov eax, dword [esp + 0x3c]
call fcn.0045bfa0
mov eax, ebx
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00423dd0
movzx eax, byte [esp + 8]
test al, al
je 0x424225
mov eax, dword [0x5bb088]
test eax, eax
je 0x42421c
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.0040ff00
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0xc]
nop
inc dword [ecx + 0x78]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x18], ecx
mov ebx, dword [ecx + 0x54]
test byte [ebx], al
test byte [eax], al
mov dword [esp], edx
lea eax, [ebx + 0xb84]
mov dword [esp + 0x1c], eax
mov dword [esp + 4], eax
call fcn.0041acc0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 4
lea eax, [0x57f0e0]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.0041ab90
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x42421c
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x42421c
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x40], 1
add esp, 0x28
ret
nop
nop
lea eax, [0x59f670]
mov dword [esp], eax
call fcn.00409110
nop
mov eax, dword [0x59f61c]
sub eax, dword [0x59f604]
mov dword [0x59f61c], eax
mov eax, dword [0x59f610]
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov dword [0x59f610], ecx
nop
nop
lea eax, [0x59f670]
mov dword [esp], eax
call fcn.00409310
mov byte [esp + 0x40], 0
add esp, 0x28
ret
call fcn.0045ab60
jmp fcn.00424080
Function at 0x4243b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4244ce
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x424446
cmp cl, 2
je 0x4243ed
cmp cl, 3
jne 0x4244b7
mov byte [eax + 8], 1
jmp 0x4244b3
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00429970
nop
nop
lea eax, [0x59f670]
mov dword [esp], eax
call fcn.00409110
nop
mov eax, dword [0x59f640]
sub eax, dword [0x59f628]
mov dword [0x59f640], eax
mov eax, dword [0x59f634]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x59f634], ecx
nop
lea eax, [0x59f670]
mov dword [esp], eax
call fcn.00409310
jmp 0x4244b3
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413c50
nop
nop
lea eax, [0x59f670]
mov dword [esp], eax
call fcn.00409110
nop
mov eax, dword [0x59f61c]
sub eax, dword [0x59f604]
mov dword [0x59f61c], eax
mov eax, dword [0x59f610]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x59f610], ecx
nop
nop
lea eax, [0x59f670]
mov dword [esp], eax
call fcn.00409310
add esp, 0x14
ret
lea eax, [0x4e2927]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004327b0
nop
call fcn.0045ab60
jmp fcn.004243b0
Function at 0x4262f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x4264f3
sub esp, 0x34
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
cmp dword [edx + 0x34], eax
jbe 0x426319
mov dword [edx + 0x34], eax
mov ebx, dword [esp + 0x40]
mov ebp, ebx
shl ebx, 0xd
lea ebx, [ebx + eax - 1]
cmp dword [edx + 0x78], ebx
jae 0x42632e
mov dword [edx + 0x78], ebx
cmp ebp, 1
je 0x4263c0
nop
nop
nop
nop
mov ecx, eax
shr eax, 0x16
mov esi, ebx
shr ebx, 0x16
and ecx, 0x3fffff
shr ecx, 0xd
and esi, 0x3fffff
shr esi, 0xd
cmp ebx, eax
je 0x42639c
mov ebp, dword [edx + 0x30]
test byte [ebp], al
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], esi
shl eax, 7
add eax, ebp
mov dword [esp], eax
mov dword [esp + 4], ecx
lea eax, [ecx - 0x200]
neg eax
mov dword [esp + 8], eax
call fcn.00427730
mov eax, dword [esp + 0x2c]
inc eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
jmp 0x4264ae
mov ebx, dword [edx + 0x30]
test byte [ebx], al
shl eax, 7
add eax, ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
sub esi, ecx
lea eax, [esi + 1]
mov dword [esp + 8], eax
call fcn.00427730
jmp 0x42645f
mov ebx, dword [edx + 0x30]
test byte [ebx], al
nop
mov esi, eax
shr eax, 0x16
shl eax, 7
add ebx, eax
mov eax, esi
and eax, 0x3fffff
nop
mov edi, eax
shr eax, 0x13
cmp eax, 8
jae 0x426486
mov dword [esp + 0x30], ebx
mov dword [esp + 0x20], eax
shr edi, 0xd
and edi, 0x3f
mov dword [esp + 0x1c], edi
cmp edi, 0x20
sbb ebp, ebp
mov dword [esp + 0x18], ebp
lea esi, [edi - 0x20]
mov dword [esp + 0x14], esi
xchg esi, ebx
neg ebx
xchg esi, ebx
cmp esi, 0x20
sbb edx, edx
mov ebp, dword [esp + 0x14]
cmp ebp, 0x20
sbb edi, edi
lea eax, [ebx + eax*8]
mov ecx, esi
mov ebx, 1
shr ebx, cl
and ebx, edx
mov ecx, ebp
mov edx, 1
shl edx, cl
and edi, edx
or ebx, edi
not ebx
and ebx, dword [eax + 4]
mov ecx, dword [esp + 0x1c]
mov edx, 1
shl edx, cl
mov ebp, dword [esp + 0x18]
and edx, ebp
not edx
and dword [eax], edx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
lea eax, [edx + eax*8 + 4]
mov dword [eax], ebx
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
mov word [esp + 0xc], 1
call fcn.00424be0
add esp, 0x34
ret
mov ecx, 8
call fcn.0045c030
mov dword [esp + 0x10], eax
shl eax, 7
add eax, ebx
mov dword [esp], eax
call fcn.004279e0
mov eax, dword [esp + 0x10]
inc eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
cmp eax, ecx
jae 0x4264c0
mov ebx, dword [edx + 0x30]
test byte [ebx], al
cmp eax, 0x400
jb 0x426490
jmp 0x4264e8
mov eax, dword [edx + 0x30]
test byte [eax], al
shl ecx, 7
add eax, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 8], eax
call fcn.00427730
jmp 0x42645f
mov ecx, 0x400
call fcn.0045c030
nop
call fcn.00459680
jmp fcn.004262f0
Function at 0x430fe0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x14]
test edx, edx
je 0x43110d
lea ebx, [esp + 0x20]
cmp dword [edx + 8], ebx
jne 0x431109
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], edx
lea edi, [ecx + 0x14]
mov dword [esp + 0x18], edi
movzx ebp, byte [edx + 6]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x4310c3
mov ebp, dword [edx]
test ebp, ebp
je 0x43105e
cmp ebp, 4
jne 0x43103e
lea ebp, [edx + 0x28]
test byte [ebp], al
mov ebp, dword [edx + 0x28]
nop
mov dword [ebx], ebp
jmp 0x43105e
nop
mov dword [esp], ebx
lea eax, [edx + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], ebp
call fcn.0045c880
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebx, dword [edx + 0x10]
mov ebp, dword [0x5bb250]
test ebp, ebp
jne 0x431074
mov dword [edx + 0x10], 0
jmp 0x431084
lea ebp, [edx + 0x10]
xor eax, eax
mov esi, edi
mov edi, ebp
call fcn.0045bfa0
mov edi, esi
mov dword [esp + 0x10], ebx
test byte [ecx], al
mov ebp, dword [0x5bb250]
mov eax, dword [edx + 0x18]
test ebp, ebp
jne 0x43109c
mov dword [ecx + 0x14], eax
jmp 0x4310a1
call fcn.0045bfa0
mov dword [esp], edx
call fcn.00430c10
mov eax, dword [esp + 0x10]
test byte [eax], al
mov dword [esp], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call fcn.0045bbf0
add esp, 0x1c
ret
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.00431730
movzx eax, byte [esp + 8]
test al, al
je 0x431111
mov ecx, dword [esp + 0xc]
test byte [ecx], al
mov edx, dword [0x5bb250]
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx + 0x18]
test edx, edx
jne 0x4310f4
mov dword [ecx + 0x14], eax
jmp 0x4310fd
mov edi, dword [esp + 0x18]
call fcn.0045bfa0
mov dword [esp], ebx
call fcn.00430c10
add esp, 0x1c
ret
add esp, 0x1c
ret
add esp, 0x1c
ret
lea eax, [0x4e909f]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.004327b0
nop
int3