joyce8/EMBER2024-capa huggingface dataset:
Function at 0x504fe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00505fb0
test byte [ebp + 0xd], 0xc0
jne 0x505004
mov eax, dword [0x539ae0]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x505011
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x50503e
je 0x505050
sub ecx, 0x100
je 0x50505e
sub ecx, 0x100
je 0x505065
sub ecx, 0x100
je 0x505057
jmp 0x50506c
sub ecx, 0x600
je 0x505065
sub ecx, 0x100
je 0x505050
jmp 0x50506c
mov edi, 1
jmp 0x505071
mov edi, 2
jmp 0x505071
mov edi, 4
jmp 0x505071
mov edi, 5
jmp 0x505071
mov edi, 3
test byte [ebp + 0xd], 1
je 0x505098
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x539558]
test al, 0x80
je 0x505091
mov ebx, 0x80
jmp 0x5050aa
mov ebx, 1
jmp 0x5050aa
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x5050aa
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x5050bc
je 0x5050c5
dec eax
je 0x5050ce
jmp 0x5050d7
mov dword [ebp - 4], 0x80000000
jmp 0x5050e6
mov dword [ebp - 4], 0x40000000
jmp 0x5050e6
mov dword [ebp - 4], 0xc0000000
jmp 0x5050e6
push 1
call fcn.005063a8
pop ecx
mov ebx, eax
jmp 0x5051d6
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x505102
sub eax, 0x10
je 0x505109
sub eax, 0x10
je 0x505112
sub eax, 0x10
je 0x50511b
jmp 0x50511b
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x505122
mov dword [ebp - 8], 1
jmp 0x505122
mov dword [ebp - 8], 2
jmp 0x505122
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x50518f
call sub.kernel32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x505184
test byte [ebp + 0xd], 1
je 0x50517f
mov ebx, 0x50
jmp 0x505184
mov ebx, 2
push ebx
call fcn.005063a8
pop ecx
mov ebx, eax
jmp 0x5051d6
mov edi, esi
push edi
call fcn.00504f44
pop ecx
test eax, eax
je 0x5051a3
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x5051af
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.005060d0
add esp, 8
mov ebx, eax
inc eax
jne 0x5051d6
push 4
call fcn.005063a8
pop ecx
push esi
call sub.kernel32.dll_CloseHandle
call fcn.00505fe4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x505674
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
dec eax
je 0x505690
call fcn.00506414
jmp 0x5056ff
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
test eax, eax
jne 0x5056ac
call fcn.00506414
jmp 0x5056ff
cmp dword [0x553614], 1
je 0x5056fd
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.0050a248
pop ecx
cmp al, 0x41
jl 0x5056fd
cmp al, 0x5a
jg 0x5056fd
cmp byte [ebp - 0x107], 0x3a
jne 0x5056fd
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.kernel32.dll_SetEnvironmentVariableA
dec eax
je 0x5056fd
call fcn.00506414
jmp 0x5056ff
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x505704
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
cmp byte [ebp - 0x104], 0x61
jl 0x505733
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffa0
jmp 0x50573d
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffc0
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret

Function at 0x505748
Capabilities:
Get disk information
Query environment variable
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor eax, eax
lea ecx, [ebp - 4]
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x108]
mov dword [esi], eax
mov byte [ebp - 4], 0x3d
mov dl, byte [ebp + 8]
add dl, 0x40
mov byte [ebp - 3], dl
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push 0x104
push edi
push ecx
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
jne 0x5057ae
mov al, byte [ebp - 3]
mov byte [edi], al
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
push edi
lea edx, [ebp - 4]
push edx
call sub.kernel32.dll_SetEnvironmentVariableA
dec eax
je 0x5057ae
call fcn.00506414
jmp 0x5057e9
push edi
call sub.kernel32.dll_SetCurrentDirectoryA
dec eax
je 0x5057be
call fcn.00506414
jmp 0x5057e9
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
mov byte [edi], 0x41
jmp 0x5057e4
push edi
call sub.kernel32.dll_GetDriveTypeA
mov ebx, eax
test eax, eax
je 0x5057e2
cmp ebx, 1
je 0x5057e2
inc dword [esi]
inc byte [edi]
cmp byte [edi], 0x5a
jle 0x5057cf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50a360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
test eax, eax
je 0x50a3c2
call fcn.0050a310
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00503b8c
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00503b8c
pop ecx
push eax
push edi
push ebx
call sub.kernel32.dll_WriteFile
push ebx
call sub.kernel32.dll_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x50a440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x53aaec], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x50a51a
cmp dword [0x53aae8], 0
jne 0x50a51a
cmp dword [0x53acf4], 0
je 0x50a4d4
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0050a1f0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x50a4ba
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0050a1f0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x50a4ba
lea ebx, [ebp - 0x84]
jmp 0x50a4bb
inc ebx
call fcn.0050a3fc
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.user32.dll_MessageBoxA
jmp 0x50a555
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x53aaf0
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00503b8c
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x53aaf3
push ebx
call sub.kernel32.dll_WriteFile
jmp 0x50a555
cmp dword [0x53aae8], 0
je 0x50a534
cmp dword [0x53aae8], 0xffffffff
je 0x50a555
push esi
call dword [0x53aae8]
pop ecx
mov eax, dword [0x53aaec]
test eax, eax
je 0x50a555
cmp dword [0x53aaec], 0xffffffff
je 0x50a555
cmp byte [eax], 0
je 0x50a555
push esi
push eax
call fcn.0050a360
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50addc
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x55362c], 0
jne 0x50ae5d
cmp dword [0x55364c], 0
jne 0x50ae0c
call sub.kernel32.dll_GetEnvironmentStrings
mov dword [0x55364c], eax
test eax, eax
jne 0x50ae0c
push 0x53ac2c
call fcn.0050a56c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x55364c]
jmp 0x50ae20
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00503b8c
pop ecx
mov edi, eax
test eax, eax
jne 0x50ae18
lea edi, [ebp + 1]
push edi
call fcn.00503470
pop ecx
mov ebx, eax
mov dword [0x553630], ebx
test ebx, ebx
jne 0x50ae4a
xor eax, eax
jmp 0x50af20
push edi
mov edx, dword [0x55364c]
push edx
push ebx
call fcn.00503a3c
add esp, 0xc
jmp 0x50ae7d
xor esi, esi
mov ebx, dword [0x55362c]
jmp 0x50ae77
push eax
call fcn.00503b8c
pop ecx
test eax, eax
jne 0x50ae73
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x50ae67
lea ebx, [esi + 4]
push 4
mov dword [0x553634], ebx
inc ebx
push ebx
call fcn.00502c2c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x50aea0
xor eax, eax
jmp 0x50af20
cmp dword [0x55362c], 0
jne 0x50aed1
xor esi, esi
mov ebx, dword [0x553630]
mov eax, dword [esp]
mov ebp, eax
jmp 0x50aec2
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00503b8c
pop ecx
mov edi, eax
test eax, eax
jne 0x50aeb8
jmp 0x50af02
xor esi, esi
mov ebx, dword [0x55362c]
mov eax, dword [esp]
mov edi, eax
jmp 0x50aefc
push eax
call fcn.00503b8c
pop ecx
test eax, eax
je 0x50aef1
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x50aef5
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x50aee0
mov eax, dword [0x55362c]
test eax, eax
je 0x50af12
push eax
call fcn.00503480
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x55362c], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5119c8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x5119f6
mov eax, ebx
call fcn.00512480
cmp dword [ebx + 0x3c], 0
je 0x5119ef
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x511a67
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x511a59
cmp dword [ebx + 8], 0
je 0x511a18
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x511a2a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x511a59
cmp dword [ebx + 8], 0
je 0x511a0b
cmp eax, 3
je 0x511a3d
dec eax
jne 0x511a0b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x511a0b
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x511a0b
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x511a85
cmp dword [ebx + 0x10], 0xcc
je 0x511a85
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00511a90
pop ebx
ret
Function at 0x402c40
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x510c20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x402e10
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.0045b270
jmp fcn.00402c40
Function at 0x40b560
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x510c20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b72b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b589
mov eax, 0x7000000
jmp 0x40b591
test eax, eax
je 0x40b706
mov dword [esp + 0x34], eax
mov ecx, dword [0x510c20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x4a4]
mov ebx, dword [ecx + 0x4a8]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x4a4], ebx
mov dword [ecx + 0x4a8], ebp
mov dword [esp], edx
call fcn.0045c610
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x4d0700]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40b71e
cmp edx, 0x21
jae 0x40b712
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.00458670
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00458740
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x48540c]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x48547c]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b6e1
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x4854b4]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.0045c6f0
mov eax, edx
mov ecx, 0x21
call fcn.0045c780
nop
call fcn.0045b270
jmp fcn.0040b560
Function at 0x411da0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x510c20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x411f9e
sub esp, 0x18
mov eax, dword [0x510b60]
test eax, eax
jne 0x411f87
nop
nop
lea eax, [0x510b50]
mov dword [esp], eax
call fcn.00409140
mov eax, dword [0x510b54]
test eax, eax
je 0x411de8
cmp dword [eax + 8], 0xcc
jne 0x411e5e
mov edx, dword [0x510b58]
test edx, edx
jne 0x411e40
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5133d0]
mov dword [esp + 8], eax
call fcn.0040b740
mov eax, dword [esp + 0xc]
mov dword [0x510b58], eax
mov ecx, dword [0x510b5c]
mov dword [eax], ecx
mov eax, dword [0x510b58]
mov dword [0x510b5c], eax
movzx eax, byte [0x510f40]
test al, al
jne 0x411e40
xor eax, eax
jmp 0x411f58
mov edx, dword [0x510b58]
mov ebx, dword [edx + 4]
mov dword [0x510b58], ebx
mov ebx, dword [0x510b54]
mov dword [edx + 4], ebx
mov dword [0x510b54], edx
mov edx, dword [0x510b54]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x411f37
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004024a0
mov eax, dword [0x510c98]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x411eb0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x411ef0
call fcn.0045c6d0
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
nop
nop
lea eax, [0x510b50]
mov dword [esp], eax
call fcn.00409360
nop
lea eax, [0x510b4c]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402600
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.0045c6f0
lea edx, [0x4d0320]
movzx ebx, byte [edx + eax]
lea ebp, [0x510f40]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x411e40
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x411f41
mov ecx, 5
call fcn.0045c6e0
lea eax, [0x470136]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00432000
nop
call fcn.0045b270
jmp fcn.00411da0
Function at 0x425360
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x510c20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4254d0
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x425460
cmp cl, 1
je 0x4253f2
cmp cl, 2
jne 0x4254b9
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042a880
nop
nop
lea eax, [0x4dcfc0]
mov dword [esp], eax
call fcn.00409140
mov eax, dword [0x4dcf64]
sub eax, dword [0x4dcf48]
nop
mov dword [0x4dcf64], eax
mov eax, dword [0x4dcf54]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x4dcf54], ecx
nop
lea eax, [0x4dcfc0]
mov dword [esp], eax
call fcn.00409360
jmp 0x4254b5
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00411da0
nop
nop
lea eax, [0x4dcfc0]
mov dword [esp], eax
call fcn.00409140
mov eax, dword [0x4dcf3c]
sub eax, dword [0x4dcf20]
nop
mov dword [0x4dcf3c], eax
mov eax, dword [0x4dcf2c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x4dcf2c], ecx
nop
lea eax, [0x4dcfc0]
mov dword [esp], eax
call fcn.00409360
jmp 0x4254b5
cmp cl, 3
jne 0x42546b
mov byte [eax + 8], 1
jmp 0x4254b5
cmp cl, 4
jne 0x4254b9
nop
nop
lea eax, [0x4dcfc0]
mov dword [esp], eax
call fcn.00409140
mov eax, dword [0x4dcfb4]
sub eax, dword [0x4dcf98]
nop
mov dword [0x4dcfb4], eax
mov eax, dword [0x4dcfa4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x4dcfa4], ecx
nop
nop
lea eax, [0x4dcfc0]
mov dword [esp], eax
call fcn.00409360
add esp, 0x14
ret
lea eax, [0x46f09c]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00432000
nop
call fcn.0045b270
jmp fcn.00425360
Function at 0x42b0f0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x510c20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42b1d6
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [eax + 0x88], 0
lea ecx, [0x510ef0]
mov dword [esp], ecx
call fcn.00402410
mov eax, dword [esp + 4]
test eax, eax
je 0x42b1b2
mov dword [esp + 8], 0
mov ecx, dword [0x510c20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov dword [esp + 0xc], ecx
lea edx, [esp + 0x30]
lea edi, [esp + 0x10]
xor eax, eax
call fcn.0045c819
lea ecx, [0x42b1e0]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 3
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x10]
mov dword [esp], edx
call fcn.0045b180
mov eax, dword [esp + 8]
cmp eax, 0x20
jge 0x42b1ae
jae 0x42b1cb
mov ecx, dword [esp + 0x30]
mov dword [ecx + eax*4 + 8], 0
add esp, 0x2c
ret
lea eax, [fcn.0043e6e0]
inc eax
mov ecx, dword [esp + 0x30]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0
add esp, 0x2c
ret
mov ecx, 0x20
call fcn.0045c6e0
nop
call fcn.0045b270
jmp fcn.0042b0f0
Function at 0x43c930
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x2c
call fcn.00450330
mov eax, dword [0x510c20]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ecx, dword [eax + 0x18]
mov edx, dword [esp]
mov dword [esp + 0x14], edx
mov ebx, dword [esp + 4]
mov dword [esp + 0xc], ebx
inc dword [ecx + 0x7c]
mov dword [eax + 8], 0xfffffade
mov byte [eax + 0x6b], 1
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
mov ebp, dword [esp + 0x34]
mov dword [esp + 4], ebp
call fcn.0043c8d0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x38], eax
mov edx, dword [esp + 0x30]
mov dword [ecx + 0x3c], edx
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.00436740
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x38]
cmp dword [eax], ecx
ja 0x43c9b5
cmp dword [eax + 4], ecx
jae 0x43c9e3
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
lea ecx, [0x43cb90]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x24]
mov dword [esp], ecx
call fcn.0045b180
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x43ca39
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
lea eax, [0x43cb40]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call fcn.0045b180
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.0043c8d0
lea eax, [0x4d30e0]
mov dword [esp], eax
call fcn.004022e0
movzx eax, byte [esp + 4]
test al, al
je 0x43ca72
lea eax, [0x473bb4]
mov dword [esp], eax
call fcn.0045b180
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.0043c8d0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
test byte [ecx], al
mov ecx, dword [ecx + 0x11a0]
test ecx, ecx
je 0x43caae
lea eax, [0x473c6c]
mov dword [esp], eax
call fcn.0045b180
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.0043c8d0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x58]
mov edx, dword [edx + 0x10]
mov dword [ecx + 0x1f8], edx
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
lea edx, [ecx + 4]
mov dword [ecx + 0x2c], 0
mov ebx, dword [eax + 0x18]
mov dword [ebx + 0x60], ecx
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0x58], 0
mov dword [esp], edx
mov dword [esp + 4], 2
call fcn.00402560
lea eax, [0x4d30d4]
mov dword [esp], eax
call fcn.004022e0
movzx eax, byte [esp + 4]
test al, al
je 0x43cb26
lea eax, [0x473bb0]
mov dword [esp], eax
call fcn.0045b180
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0043c8d0
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x7c]
add esp, 0x2c
ret