joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fdc8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x46fe5c
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x46fe13
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, edi
call fcn.00404f60
jmp 0x46fe46
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
cmp byte [ebx], 0
jne 0x46fe29
lea eax, [ebp - 4]
call fcn.00404e70
jmp 0x46fe3c
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0046fc1c
mov ebx, eax
test esi, esi
je 0x46fe3c
dec esi
jmp 0x46fe1a
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404ec4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46fe63
lea eax, [ebp - 4]
call fcn.00404e70
ret

Function at 0x470258
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040aaa8
add esp, 0x104
pop ebx
ret

Function at 0x470284
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040aaa8
add esp, 0x104
pop ebx
ret
Function at 0x470554
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x470688
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x470672
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x4705b1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x470672
cmp dword [ebp - 0x14], 0
jne 0x4705c6
mov eax, dword [ebp - 0xc]
call fcn.00404e70
mov bl, 1
jmp 0x470672
cmp dword [ebp - 0x14], 0x70000000
jb 0x4705d4
call fcn.0040dab8
mov esi, dword [ebp - 0x14]
shr esi, 0
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00404f60
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00405360
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA_1
cmp eax, 0xea
je 0x47057a
test eax, eax
jne 0x470672
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x470622
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x470672
mov esi, dword [ebp - 0x14]
shr esi, 0
jmp 0x47062b
dec esi
test esi, esi
je 0x470639
mov eax, dword [ebp - 4]
cmp byte [eax + esi - 1], 0
je 0x47062a
cmp dword [ebp - 0x10], 7
jne 0x470644
test esi, esi
je 0x470644
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405590
cmp dword [ebp - 0x10], 7
jne 0x470665
test esi, esi
je 0x470665
lea eax, [ebp - 4]
call fcn.00405360
mov byte [eax + esi - 1], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404ec4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47068f
lea eax, [ebp - 4]
call fcn.00404e70
ret

Function at 0x4706b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov ebp, eax
push 0
push 0
push 0
push 0
push esi
push ebp
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete bl
test bl, bl
je 0x47072e
test esi, esi
je 0x4706e0
cmp byte [esi], 0
jne 0x47072e
mov eax, dword [0x5004f0]
cmp dword [eax], 2
je 0x47072e
xor ebx, ebx
xor esi, esi
mov dword [esp + 4], 2
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push esi
push ebp
call sub.advapi32.dll_RegEnumValueA
mov edi, eax
test edi, edi
je 0x47071d
cmp edi, 0xea
jne 0x47072e
test edi, edi
jne 0x47072b
cmp byte [esp], 0
jne 0x47072b
mov bl, 1
jmp 0x47072e
inc esi
jmp 0x4706ee
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x470798
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x4707ac
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyA
pop esi
pop ebx
ret
cmp dword [0x505cd0], 0
jne 0x4707cf
push 0x4707f4
push 0x470804
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x505cd0], eax
cmp dword [0x505cd0], 0
je 0x4707e9
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x505cd0]
jmp 0x4707ee
mov eax, 0x7f
pop esi
pop ebx
ret

Function at 0x470814
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x47096e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5004f0]
cmp dword [eax], 2
jne 0x470947
push 0
push 8
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
movzx eax, byte [ebp - 5]
call fcn.00470770
test eax, eax
jne 0x470947
xor eax, eax
push ebp
push 0x470940
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.00404f60
xor eax, eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x470894
sub ebx, 4
mov ebx, dword [ebx]
mov dword [ebp - 0x1c], ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.00405360
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov esi, eax
cmp esi, 0xea
jne 0x4708ff
mov edi, dword [ebp - 4]
test edi, edi
je 0x4708cf
sub edi, 4
mov edi, dword [edi]
cmp edi, 0x10000
jge 0x470929
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4708ee
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00404f60
jmp 0x470888
test esi, esi
jne 0x470929
mov eax, dword [ebp - 4]
call fcn.00405300
mov ecx, eax
mov edx, dword [ebp - 0x14]
movzx eax, byte [ebp - 5]
call fcn.00470814
test eax, eax
je 0x470888
inc dword [ebp - 0x18]
jmp 0x470888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470947
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
movzx eax, byte [ebp - 5]
call fcn.00470798
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470975
lea eax, [ebp - 4]
call fcn.00404e70
ret
Function at 0x470980
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov edi, edx
mov ebx, eax
push 0
push 1
lea eax, [esp + 8]
push eax
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.00470770
mov esi, eax
test esi, esi
jne 0x4709fe
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x2c]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov esi, eax
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
test esi, esi
jne 0x4709fe
cmp dword [esp + 4], 0
jne 0x4709f9
cmp dword [esp + 8], 0
jne 0x4709f9
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.00470798
mov esi, eax
jmp 0x4709fe
mov esi, 0x91
mov eax, esi
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x470a08
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x5004f0]
cmp dword [eax], 2
je 0x470a25
mov byte [ebp - 1], 1
jmp 0x470bf3
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x4fcba0
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x470bf3
xor eax, eax
push ebp
push 0x470bec
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x470a87
push 0x470c00
push 0x470c18
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x470aae
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x470bd5
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x470bd5
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x470aff
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x470ae0
call fcn.00404948
jmp 0x470bf3
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x470aff
call fcn.00404948
jmp 0x470bf3
xor eax, eax
push ebp
push 0x470bce
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x470b42
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x470b42
call fcn.00404948
call fcn.00404948
jmp 0x470bf3
mov eax, dword [ebp - 0x14]
call fcn.00402ea0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x470b74
call fcn.00404948
call fcn.00404948
jmp 0x470bf3
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x470baf
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x470bab
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x470bab
mov byte [ebp - 1], 1
jmp 0x470baf
inc ebx
dec esi
jne 0x470b81
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470bd5
mov eax, dword [ebp - 0x18]
call fcn.00402ebc
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470bf3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471b8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
xor eax, eax
push ebp
push 0x471c23
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0
mov eax, dword [edi]
call fcn.00406394
mov ebx, eax
test ebx, ebx
jl 0x471c0d
inc ebx
xor esi, esi
push 0
push 0x5517e877
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00405e64
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [edi]
movzx eax, byte [eax + esi]
mov edx, dword [eax*8 + 0x4fcbf8]
mov eax, dword [eax*8 + 0x4fcbf4]
xor eax, dword [ebp - 0x10]
xor edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
inc esi
dec ebx
jne 0x471bd1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471c2d
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x473268
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x47330f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00405300
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x4732f9
lea eax, [ebp - 4]
mov edx, edi
call fcn.00405590
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.00405300
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4732f9
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x473320
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4732f9
cmp dword [ebp - 0xc], 0x34
jne 0x4732f9
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473316
lea eax, [ebp - 4]
call fcn.00404e70
ret
Function at 0x4734a8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x473611
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.00403544
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x4fd4cc], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4fd4d0], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4fd4d4], eax
mov eax, dword [0x5004f0]
cmp dword [eax], 2
sete byte [0x4fd43c]
push 0x47361c
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.00473238
cmp byte [0x4fd43c], 0
jne 0x473534
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00473268
test al, al
je 0x473534
mov eax, dword [ebp - 0x4c]
mov dword [0x506268], eax
jmp 0x47353b
xor eax, eax
mov dword [0x506268], eax
call fcn.00473344
and eax, 0x7f
cmp eax, 0xb
ja case.0x47354c.0
jmp dword [eax*4 + 0x473553]
mov byte [0x4fd428], 1
jmp case.0x47354c.0
mov byte [0x4fd42c], 1
jmp case.0x47354c.0
mov byte [0x4fd430], 1
jmp case.0x47354c.0
mov byte [0x4fd434], 1
jmp case.0x47354c.0
mov byte [0x4fd438], 1
jmp case.0x47354c.0
mov byte [0x4fd440], 1
mov byte [0x4fd444], 1
jmp case.0x47354c.0
mov byte [0x4fd440], 1
mov byte [0x4fd448], 1
jmp case.0x47354c.0
mov byte [0x4fd440], 1
mov byte [0x4fd44c], 1
jmp case.0x47354c.0
mov byte [0x4fd450], 1
jmp case.0x47354c.0
mov byte [0x4fd454], 1
jmp case.0x47354c.0
mov byte [0x4fd458], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473618
lea eax, [ebp - 4]
call fcn.00404e70
ret

Function at 0x4736f4
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x473733
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x473733
cmp dword [eax + 0x3c], 0
je 0x473733
mov esi, dword [eax + 0x3c]
add esi, ebx
push 0xf8
push esi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x473731
cmp dword [esi], 0x4550
je 0x473733
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x475b4c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x47af54
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
lea edi, [ebp - 0xd]
mov bl, 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0x18]
dec esi
test esi, esi
jl 0x47b102
inc esi
mov eax, dword [ebp + 8]
push eax
mov eax, edi
mov edx, 5
call fcn.00479ce4
pop ecx
test al, al
jne 0x47af9b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.0047b234
xor ebx, ebx
jmp 0x47b102
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
cmp eax, dword [edi]
ja 0x47afb9
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.0047b234
xor ebx, ebx
jmp 0x47b102
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 4]
mov edx, dword [edi]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.0048e590
test eax, eax
jne 0x47aff0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.0047b234
xor ebx, ebx
jmp 0x47b102
test byte [edi + 4], 1
je 0x47b0fb
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov edx, 4
call fcn.00479ce4
pop ecx
test al, al
jne 0x47b024
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.0047b234
xor ebx, ebx
jmp 0x47b102
mov edx, dword [0x477d14]
mov eax, 0xc
call fcn.00405dd8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47b0cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405590
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00405360
mov edx, dword [ebp - 4]
call fcn.00479ce4
pop ecx
test al, al
jne 0x47b090
mov edx, dword [0x477d14]
mov eax, dword [ebp - 8]
call fcn.00405dec
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.0047b234
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b102
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00476a24
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
call fcn.00476cf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b0fb
dec esi
jne 0x47af72
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49dc50
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
xor edx, edx
mov ecx, edx
mov edi, dword [esi + 0x154]
test edi, edi
je 0x49dc86
test dl, dl
jne 0x49dc70
test byte [edi + 0x70], 0x10
setne dl
test cl, cl
jne 0x49dc7b
test byte [edi + 0x71], 0x10
setne cl
test cl, dl
jne 0x49dc86
mov edi, dword [edi + 0x30]
test edi, edi
jne 0x49dc65
test dl, dl
jne 0x49dc97
test byte [esi + 0xb8], 0x10
jne 0x49dc97
xor eax, eax
jmp 0x49dc99
mov al, 1
test cl, cl
jne 0x49dcaa
test byte [esi + 0xb9], 0x10
jne 0x49dcaa
xor ebx, ebx
jmp 0x49dcac
mov bl, 1
mov byte [esp], bl
mov edi, dword [esi + 0x154]
test edi, edi
je 0x49dd7d
mov ebp, dword [edi + 0x70]
mov ebx, ebp
and ebx, 0x1f
sub ebx, 2
je 0x49dcd1
sub ebx, 2
je 0x49dcf1
jmp 0x49dd0f
test al, al
jne 0x49dce8
or ebp, 0x400000
or ebp, 0x200000
mov dword [edi + 0x70], ebp
mov dl, 1
jmp 0x49dd0f
and dword [edi + 0x70], 0xff9fffff
jmp 0x49dd0f
test al, al
je 0x49dd08
or ebp, 0x400000
or ebp, 0x200000
mov dword [edi + 0x70], ebp
mov dl, 1
jmp 0x49dd0f
and dword [edi + 0x70], 0xff9fffff
mov ebx, dword [edi + 0x70]
and ebx, 0x1f00
sub ebx, 0x200
je 0x49dd2a
sub ebx, 0x200
je 0x49dd4f
jmp 0x49dd72
cmp byte [esp], 0
jne 0x49dd46
mov ecx, dword [edi + 0x70]
or ecx, 0x40000000
or ecx, 0x20000000
mov dword [edi + 0x70], ecx
mov cl, 1
jmp 0x49dd72
and dword [edi + 0x70], 0x9fffffff
jmp 0x49dd72
cmp byte [esp], 0
je 0x49dd6b
mov ecx, dword [edi + 0x70]
or ecx, 0x40000000
or ecx, 0x20000000
mov dword [edi + 0x70], ecx
mov cl, 1
jmp 0x49dd72
and dword [edi + 0x70], 0x9fffffff
mov edi, dword [edi + 0x30]
test edi, edi
jne 0x49dcbd
test dl, dl
je 0x49dd9b
mov edx, dword [esi + 0xb8]
or edx, 0x400000
or edx, 0x100000
mov dword [esi + 0xb8], edx
jmp 0x49dda5
and dword [esi + 0xb8], 0xffafffff
mov edx, dword [esi + 0xb8]
mov ebx, edx
and ebx, 0x1f
sub ebx, 2
je 0x49ddbc
sub ebx, 2
je 0x49ddd7
jmp 0x49ddf0
test al, al
jne 0x49ddce
or edx, 0x20
or edx, 0x40
mov dword [esi + 0xb8], edx
jmp 0x49ddf0
and dword [esi + 0xb8], 0xffffff9f
jmp 0x49ddf0
test al, al
je 0x49dde9
or edx, 0x20
or edx, 0x40
mov dword [esi + 0xb8], edx
jmp 0x49ddf0
and dword [esi + 0xb8], 0xffffff9f
test cl, cl
je 0x49de0c
mov eax, dword [esi + 0xb8]
or eax, 0x40000000
or eax, 0x10000000
mov dword [esi + 0xb8], eax
jmp 0x49de16
and dword [esi + 0xb8], 0xafffffff
mov eax, dword [esi + 0xb8]
mov edx, eax
and edx, 0x1f00
sub edx, 0x200
je 0x49de36
sub edx, 0x200
je 0x49de5a
jmp 0x49de7c
cmp byte [esp], 0
jne 0x49de4e
or eax, 0x2000
or eax, 0x4000
mov dword [esi + 0xb8], eax
jmp 0x49de7c
and dword [esi + 0xb8], 0xffff9fff
jmp 0x49de7c
cmp byte [esp], 0
je 0x49de72
or eax, 0x2000
or eax, 0x4000
mov dword [esi + 0xb8], eax
jmp 0x49de7c
and dword [esi + 0xb8], 0xffff9fff
mov edi, dword [esi + 0x144]
mov eax, edi
call fcn.00493d30
mov ebx, dword [edi + 0x20]
test ebx, ebx
jle 0x49dea7
dec ebx
mov edx, ebx
mov eax, edi
call fcn.004944a4
mov edx, dword [eax]
mov eax, esi
call fcn.0049d94c
test ebx, ebx
jne 0x49de90
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49e4cc
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
xor edx, edx
mov ecx, edx
mov edi, dword [esi + 0x154]
test edi, edi
je 0x49e508
test dl, dl
jne 0x49e4ef
test byte [edi + 0x80], 0x10
setne dl
test cl, cl
jne 0x49e4fd
test byte [edi + 0x81], 0x10
setne cl
test cl, dl
jne 0x49e508
mov edi, dword [edi + 0x30]
test edi, edi
jne 0x49e4e1
test dl, dl
jne 0x49e519
test byte [esi + 0xc8], 0x10
jne 0x49e519
xor eax, eax
jmp 0x49e51b
mov al, 1
test cl, cl
jne 0x49e52c
test byte [esi + 0xc9], 0x10
jne 0x49e52c
xor ebx, ebx
jmp 0x49e52e
mov bl, 1
mov byte [esp], bl
mov edi, dword [esi + 0x154]
test edi, edi
je 0x49e623
mov ebp, dword [edi + 0x80]
mov ebx, ebp
and ebx, 0x1f
sub ebx, 2
je 0x49e556
sub ebx, 2
je 0x49e57c
jmp 0x49e5a0
test al, al
jne 0x49e570
or ebp, 0x400000
or ebp, 0x200000
mov dword [edi + 0x80], ebp
mov dl, 1
jmp 0x49e5a0
and dword [edi + 0x80], 0xff9fffff
jmp 0x49e5a0
test al, al
je 0x49e596
or ebp, 0x400000
or ebp, 0x200000
mov dword [edi + 0x80], ebp
mov dl, 1
jmp 0x49e5a0
and dword [edi + 0x80], 0xff9fffff
mov ebx, dword [edi + 0x80]
and ebx, 0x1f00
sub ebx, 0x200
je 0x49e5be
sub ebx, 0x200
je 0x49e5ec
jmp 0x49e618
cmp byte [esp], 0
jne 0x49e5e0
mov ecx, dword [edi + 0x80]
or ecx, 0x40000000
or ecx, 0x20000000
mov dword [edi + 0x80], ecx
mov cl, 1
jmp 0x49e618
and dword [edi + 0x80], 0x9fffffff
jmp 0x49e618
cmp byte [esp], 0
je 0x49e60e
mov ecx, dword [edi + 0x80]
or ecx, 0x40000000
or ecx, 0x20000000
mov dword [edi + 0x80], ecx
mov cl, 1
jmp 0x49e618
and dword [edi + 0x80], 0x9fffffff
mov edi, dword [edi + 0x30]
test edi, edi
jne 0x49e53f
test dl, dl
je 0x49e641
mov edx, dword [esi + 0xc8]
or edx, 0x400000
or edx, 0x100000
mov dword [esi + 0xc8], edx
jmp 0x49e64b
and dword [esi + 0xc8], 0xffafffff
mov edx, dword [esi + 0xc8]
mov ebx, edx
and ebx, 0x1f
sub ebx, 2
je 0x49e662
sub ebx, 2
je 0x49e67d
jmp 0x49e696
test al, al
jne 0x49e674
or edx, 0x20
or edx, 0x40
mov dword [esi + 0xc8], edx
jmp 0x49e696
and dword [esi + 0xc8], 0xffffff9f
jmp 0x49e696
test al, al
je 0x49e68f
or edx, 0x20
or edx, 0x40
mov dword [esi + 0xc8], edx
jmp 0x49e696
and dword [esi + 0xc8], 0xffffff9f
test cl, cl
je 0x49e6b2
mov eax, dword [esi + 0xc8]
or eax, 0x40000000
or eax, 0x10000000
mov dword [esi + 0xc8], eax
jmp 0x49e6bc
and dword [esi + 0xc8], 0xafffffff
mov eax, dword [esi + 0xc8]
mov edx, eax
and edx, 0x1f00
sub edx, 0x200
je 0x49e6dc
sub edx, 0x200
je 0x49e700
jmp 0x49e722
cmp byte [esp], 0
jne 0x49e6f4
or eax, 0x2000
or eax, 0x4000
mov dword [esi + 0xc8], eax
jmp 0x49e722
and dword [esi + 0xc8], 0xffff9fff
jmp 0x49e722
cmp byte [esp], 0
je 0x49e718
or eax, 0x2000
or eax, 0x4000
mov dword [esi + 0xc8], eax
jmp 0x49e722
and dword [esi + 0xc8], 0xffff9fff
mov edi, dword [esi + 0x148]
mov eax, edi
call fcn.00493d30
mov ebx, dword [edi + 0x20]
test ebx, ebx
jle 0x49e74d
dec ebx
mov edx, ebx
mov eax, edi
call fcn.004944a4
mov edx, dword [eax]
mov eax, esi
call fcn.0049e1bc
test ebx, ebx
jne 0x49e736
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret