joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451330
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x451363
push esi
call fcn.00454480
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x45135c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4513e9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4513d2
mov eax, dword [esi + 8]
test eax, eax
je 0x451387
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4513ce
cmp eax, 2
je 0x4513d2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45137a
cmp eax, 3
je 0x4513ad
cmp eax, 1
jne 0x45137a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45137a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45137a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00451410
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4513f8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00451410
add esp, 4
pop esi
ret

Function at 0x4603e0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x460483
test eax, eax
jbe 0x460483
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x460483
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x46042e
xor esi, esi
jmp 0x460434
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x46045f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00461f50
add esi, eax
push esi
mov ebx, esi
call fcn.00461f50
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x460440
pop ebp
test edi, edi
pop edi
jne 0x460483
test ebx, ebx
je 0x460483
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0046c7a0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4605a5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4606bd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4606bd
mov eax, dword [esi + 0x3c]
push eax
call fcn.0047d987
mov esi, eax
test esi, esi
je 0x4606bd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4606bd
mov ecx, esi
call fcn.00460530
cmp edi, eax
jge 0x4606bd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x460643
mov dword [esp + 0x34], 1
jmp 0x46069e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4606bd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0045edc0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x47cd12
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.00486ec9
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47cd43
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.0047cd56
pop edi
pop esi
pop ebx
ret 8

Function at 0x47e32a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47e362
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047c373
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047c34b
jmp 0x47e36e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x47fc1d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47fc5f
call fcn.00486ec9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47fc5f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47fc56
xor eax, eax
jmp 0x47fc67
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047fc6d
pop edi
pop esi
pop ebx
ret 4

Function at 0x4873f9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x487427
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x487445
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048735f
jmp 0x487445
mov eax, dword [esi + 0x14]
test eax, eax
je 0x487445
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048735f
test edi, edi
mov eax, edi
jne 0x48742f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x43bba0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
mov ebx, dword [eax]
push edi
push 0x800
push 0x40
mov dword [esp + 0x1c], ebx
call dword [ebx + 0x2c]
mov edi, eax
test edi, edi
jne 0x43bbcc
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push 0
push 0
push ecx
push edx
call dword [ebx + 0x24]
mov eax, dword [esp + 0x2c]
mov ebp, 0x543a2110
test eax, eax
je 0x43bc90
jmp 0x43bbf4
mov eax, dword [esp + 0x2c]
cmp eax, 0x800
jb 0x43bc00
mov eax, 0x800
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push 0
push ecx
push eax
push edi
push edx
call dword [ebx + 0x14]
test eax, eax
je 0x43bca0
mov edx, dword [esp + 0x10]
test edx, edx
je 0x43bce2
xor esi, esi
test edx, edx
jle 0x43bc67
mov ecx, ebp
xor ecx, 0x2da05629
mov eax, ecx
mov ebx, ecx
shr eax, 0x18
shr ebx, 0x10
xor al, bl
mov ebx, ecx
shr ebx, 8
xor al, bl
mov bl, byte [esi + edi]
xor al, bl
xor al, cl
mov byte [esi + edi], al
and eax, 0xff
shl ebp, 8
add ebp, eax
inc esi
cmp esi, edx
jl 0x43bc2b
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push 0
push eax
push edx
push edi
push ecx
call dword [ebx + 0x18]
test eax, eax
je 0x43bcc2
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
sub eax, edx
mov dword [esp + 0x2c], eax
jne 0x43bbf0
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
mov ax, 1
pop ebx
add esp, 0xc
ret
push 0
call dword [ebx + 0x78]
push eax
mov eax, dword [esp + 0x38]
push eax
call fcn.0043c910
add esp, 0xc
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret
call dword [ebx + 0x78]
mov ecx, dword [esp + 0x30]
push eax
push ecx
call fcn.0043c980
add esp, 8
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret
push 0
call dword [ebx + 0x78]
mov edx, dword [esp + 0x34]
push eax
push edx
call fcn.0043c910
add esp, 0xc
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret

Function at 0x43c780
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
mov al, byte [ecx]
xor edi, edi
mov byte [esi], al
mov al, byte [ecx]
test al, al
je 0x43c7ba
mov edx, esi
push ebx
sub edx, ecx
mov al, byte [ecx + 1]
mov bl, byte [edx + ecx]
inc edi
inc ecx
dec al
xor al, bl
mov byte [edx + ecx], al
mov al, byte [ecx]
test al, al
jne 0x43c79b
mov byte [edi + esi], 0
pop ebx
mov eax, esi
pop edi
pop esi
ret
mov byte [edi + esi], 0
mov eax, esi
pop edi
pop esi
ret
Function at 0x716aae
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
jmp 0x716ac1
movzx ebx, byte [eax]
movzx edx, byte [eax + 1]
movzx edi, byte [eax + 5]
shl ebx, 8
xor ebx, edx
movzx edx, byte [eax + 2]
shl ebx, 8
xor ebx, edx
movzx edx, byte [eax + 3]
shl ebx, 8
xor ebx, edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 6]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 7]
shl edx, 8
xor edx, edi
xor edx, dword [ecx + 4]
movzx edi, byte [eax + 9]
mov dword [ebp - 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 0xa]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 0xb]
shl edx, 8
xor edx, edi
xor edx, dword [ecx + 8]
movzx edi, byte [eax + 0xd]
mov dword [ebp - 0x10], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
xor ebx, dword [ecx]
shl edx, 8
xor edx, edi
mov edi, dword [ebp - 0x10]
shl edx, 8
xor edx, eax
xor edx, dword [ecx + 0xc]
shr edi, 8
mov dword [ebp - 0x14], edx
shr edx, 0x10
mov eax, 0xff
and edx, eax
mov edx, dword [edx*4 + reloc.WINMM.dll_waveOutPause]
and edi, eax
xor edx, dword [edi*4 + reloc.WINMM.dll_waveOutPause]
mov edi, ebx
shr edi, 0x18
xor edx, dword [edi*4 + reloc.WINMM.dll_waveOutPause]
mov edi, dword [ebp - 4]
and edi, eax
xor edx, dword [edi*4 + reloc.WINMM.dll_waveOutPause]
mov edi, ebx
xor edx, dword [ecx + 0x10]
shr edi, 0x10
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x14]
shr edx, 8
and edx, eax
and edi, eax
mov dword [ebp - 8], edi
mov edi, dword [edx*4 + reloc.WINMM.dll_waveOutPause]
mov edx, dword [ebp - 8]
xor edi, dword [edx*4 + reloc.WINMM.dll_waveOutPause]
mov edx, dword [ebp - 4]
shr edx, 0x18
xor edi, dword [edx*4 + reloc.WINMM.dll_waveOutPause]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx

Function at 0x85b6c8
Capabilities:
Parse pe header

Disassembly:
pushfd
pop dword [esp]
push word [esp + 2]
pop word [esp]
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x85b675
mov word [esp], ax
jmp 0x85b69e

Function at 0x85b709
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov dword [esp], eax
pushfd
pop dword [esp]
lea esp, [esp + 2]
mov dword [esp + 0x28], esi
call fcn.0085b6c8
or dword [edx + reloc.WINMM.dll_waveOutPause], ecx
std
adc dword [ebx], 0x76
test dword [ebx + 0x49], edx
pop ss
and ebp, ebx
jmp 0x85b6e5
pop eax
xor ax, ax
jmp 0x85b6e5
Function at 0x40215c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x402231
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x402231
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x402231
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x4021b7
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x402231
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4021fc
test dl, dl
je 0x4021f8
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4021fc
add ecx, 2
add eax, 2
test dl, dl
jne 0x4021dc
xor eax, eax
jmp 0x402201
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402213
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x40221e
inc esi
cmp esi, ebp
jae 0x402231
mov edx, dword [esp + 0x10]
jmp 0x4021d2
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x402495
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x4024a0
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x4024b4
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x4024b8
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x4024f1
cmp dword [edi + ecx], 0x4550
jne 0x4024f1
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x4024f1
test byte [edi + ecx + 0x16], 2
je 0x4024f1
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x4024f6
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x402532
xor eax, eax
jmp 0x402515
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x40253b
inc edx
movzx eax, dx
cmp eax, edi
jl 0x402515
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x402541
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x402579
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x402587
add edx, 0x20
cmp eax, edx
jne 0x402598
test bx, bx
je 0x4025cd
add esi, 2
add edi, 2
jmp 0x402569
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x4025a6
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x4025b4
add edx, 0x20
sub ecx, edx
je 0x4025cd
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x402562
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x403046
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x403107
test ecx, ecx
je 0x403107
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x403107
test ebx, ebx
je 0x403107
mov ebx, eax
add ebx, edx
je 0x403107
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x403107
cmp dword [edx + eax + 0x14], 0
je 0x403107
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x403107
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4030f7
test dl, dl
je 0x4030f3
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4030f7
add edi, 2
add esi, 2
test dl, dl
jne 0x4030d7
xor eax, eax
jmp 0x4030fc
sbb eax, eax
or eax, 1
test eax, eax
je 0x403113
inc ebp
cmp ebp, dword [esp + 4]
jb 0x4030c4
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x40a439
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x40a4ec
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x508325
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x5083fa
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x5083fa
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x5083fa
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x508380
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x5083fa
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x5083c5
test dl, dl
je 0x5083c1
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x5083c5
add ecx, 2
add eax, 2
test dl, dl
jne 0x5083a5
xor eax, eax
jmp 0x5083ca
sbb eax, eax
or eax, 1
test eax, eax
jne 0x5083dc
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x5083e7
inc esi
cmp esi, ebp
jae 0x5083fa
mov edx, dword [esp + 0x10]
jmp 0x50839b
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x50865e
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x508669
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x50867d
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x508681
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x5086ba
cmp dword [edi + ecx], 0x4550
jne 0x5086ba
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x5086ba
test byte [edi + ecx + 0x16], 2
je 0x5086ba
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x5086bf
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x5086fb
xor eax, eax
jmp 0x5086de
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x508704
inc edx
movzx eax, dx
cmp eax, edi
jl 0x5086de
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x50870a
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x508742
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x508750
add edx, 0x20
cmp eax, edx
jne 0x508761
test bx, bx
je 0x508796
add esi, 2
add edi, 2
jmp 0x508732
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x50876f
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x50877d
add edx, 0x20
sub ecx, edx
je 0x508796
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x50872b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x50920f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x5092d0
test ecx, ecx
je 0x5092d0
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x5092d0
test ebx, ebx
je 0x5092d0
mov ebx, eax
add ebx, edx
je 0x5092d0
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x5092d0
cmp dword [edx + eax + 0x14], 0
je 0x5092d0
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x5092d0
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x5092c0
test dl, dl
je 0x5092bc
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x5092c0
add edi, 2
add esi, 2
test dl, dl
jne 0x5092a0
xor eax, eax
jmp 0x5092c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x5092dc
inc ebp
cmp ebp, dword [esp + 4]
jb 0x50928d
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x537a34
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x537ae7
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]