joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41def1c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffae4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x41c], ebx
mov esi, ecx
lea edi, [ebp - 0x218]
xor ecx, ecx
mov cl, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov esi, eax
lea edi, [ebp - 0x118]
xor ecx, ecx
mov cl, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x41df0bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
mov ebx, 0x41ff75c
mov edx, 0x41df0d0
lea eax, [ebp - 0x51c]
call sub.VCL30.dpl_System._PStrCpy_51F89FF7
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x51c]
call sub.VCL30.dpl_System._PStrCat_51F89FF7
mov edx, 0x41df0d4
lea eax, [ebp - 0x51c]
call sub.VCL30.dpl_System._PStrCat_51F89FF7
mov edx, ebx
lea eax, [ebp - 0x51c]
call sub.VCL30.dpl_System._PStrCat_51F89FF7
lea edx, [ebp - 0x51c]
lea eax, [ebp - 0x41c]
call sub.VCL30.dpl_System._LStrFromString_EF219F52
mov edx, dword [ebp - 0x41c]
lea eax, [ebp - 0x318]
call sub.VCL30.dpl_SysUtils.StrPCopy_17A29F31
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x318]
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x41df08f
lea eax, [ebp - 0x418]
call fcn.041debc0
mov dword [ebp - 0xc], 2
xor eax, eax
mov al, byte [ebp - 0x418]
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov al, byte [ebp - 0x218]
inc eax
mov dword [ebp - 8], eax
mov ax, word [ebp - 0xc]
add ax, word [ebp - 0x10]
add ax, word [ebp - 8]
mov word [ebp - 4], ax
movzx eax, word [ebp - 4]
call sub.VCL30.dpl_System._GetMem_51F89FF7
mov edi, eax
mov edx, edi
lea eax, [ebp - 2]
mov ecx, dword [ebp - 0xc]
call sub.VCL30.dpl_System.Move_8E671582
mov eax, dword [ebp - 0xc]
lea edx, [edi + eax]
lea eax, [ebp - 0x418]
mov ecx, dword [ebp - 0x10]
call sub.VCL30.dpl_System.Move_8E671582
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea edx, [edi + eax]
lea eax, [ebp - 0x218]
mov ecx, dword [ebp - 8]
call sub.VCL30.dpl_System.Move_8E671582
push 0
lea eax, [ebp - 0x14]
push eax
movzx eax, word [ebp - 4]
push eax
push edi
push esi
call sub.kernel32.dll_WriteFile
movzx edx, word [ebp - 4]
mov eax, edi
call sub.VCL30.dpl_System._FreeMem_51F89FF7
push esi
call sub.kernel32.dll_CloseHandle
add ebx, 0x100
dec dword [ebp - 0x18]
jne 0x41def6c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41df0c6
lea eax, [ebp - 0x41c]
call sub.VCL30.dpl_System._LStrClr_40929B27
ret
Function at 0x41e07f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffae8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x414], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41e09f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x41ffd24]
cmp dword [eax], 0
je 0x41e09db
mov dl, 1
mov eax, dword [0x4199db0]
call fcn.04199e0c
mov dword [ebp - 0xc], eax
mov eax, 0x7d00
call sub.VCL30.dpl_System._GetMem_51F89FF7
mov esi, eax
lea eax, [ebp - 0x30d]
xor edx, edx
call sub.VCL30.dpl_SysUtils.StrPCopy_17A29F31
mov byte [ebp - 5], 0
lea eax, [ebp - 0x514]
call fcn.04199690
lea edx, [ebp - 0x514]
lea eax, [ebp - 0x414]
call sub.VCL30.dpl_System._LStrFromString_EF219F52
mov edx, dword [ebp - 0x414]
lea eax, [ebp - 0x40e]
call sub.VCL30.dpl_SysUtils.StrPCopy_17A29F31
lea eax, [ebp - 0x40e]
push eax
push 0x7d00
push esi
lea eax, [ebp - 0x30d]
push eax
push 0
push 0x41e0a04
call sub.kernel32.dll_GetPrivateProfileStringA
xor ebx, ebx
mov byte [ebp - 0x20c], 0
cmp byte [esi + ebx], 0
je 0x41e08cc
lea eax, [ebp - 0x518]
mov dl, byte [esi + ebx]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x518]
lea eax, [ebp - 0x20c]
call sub.VCL30.dpl_System._PStrCat_51F89FF7
jmp 0x41e0921
cmp byte [ebp - 0x20c], 0
je 0x41e0916
lea eax, [ebp - 0x10c]
push eax
mov ecx, 0x41e0a10
lea edx, [ebp - 0x20c]
mov eax, 0x41e0a14
call fcn.041996e4
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x20c]
mov dl, 1
mov eax, dword [0x41e0668]
call fcn.041e06b4
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x41e091a
mov byte [ebp - 5], 1
mov byte [ebp - 0x20c], 0
inc ebx
cmp byte [ebp - 5], 0
jne 0x41e0934
cmp ebx, 0x7d00
jl 0x41e08a4
mov eax, esi
call sub.VCL30.dpl_System._FreeMem_51F89FF7
mov eax, dword [ebp - 0xc]
call fcn.0419a3ac
mov esi, eax
dec esi
test esi, esi
jl 0x41e0978
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0419a39c
test eax, eax
je 0x41e0974
cmp byte [eax + 0x204], 0
je 0x41e0974
xor ecx, ecx
lea edx, [eax + 0x104]
mov eax, dword [ebp - 4]
call fcn.041dfb0c
inc ebx
dec esi
jne 0x41e094d
mov eax, dword [ebp - 0xc]
call fcn.0419a3ac
mov esi, eax
dec esi
test esi, esi
jl 0x41e09b5
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0419a39c
test eax, eax
je 0x41e09b1
cmp byte [eax + 0x204], 0
jne 0x41e09b1
xor ecx, ecx
lea edx, [eax + 0x104]
mov eax, dword [ebp - 4]
call fcn.041dfb0c
inc ebx
dec esi
jne 0x41e098a
mov eax, dword [ebp - 0xc]
call fcn.0419a3ac
test eax, eax
jle 0x41e09d3
mov eax, 0x41e0a14
call fcn.04199aa0
mov eax, dword [ebp - 4]
call fcn.041e0004
mov eax, dword [ebp - 0xc]
call sub.VCL30.dpl_System.TObject.Free_23EDC2EF
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e09fb
lea eax, [ebp - 0x414]
call sub.VCL30.dpl_System._LStrClr_40929B27
ret
Function at 0x41e0a20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x408], edx
xor eax, eax
push ebp
push 0x41e0b5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x41ffd24]
cmp dword [eax], 0
je 0x41e0b44
mov eax, dword [0x41ffd24]
mov eax, dword [eax]
call fcn.041f7c38
mov eax, 0x7d00
call sub.VCL30.dpl_System._GetMem_51F89FF7
mov esi, eax
lea eax, [ebp - 0x301]
xor edx, edx
call sub.VCL30.dpl_SysUtils.StrPCopy_17A29F31
xor ebx, ebx
lea eax, [ebp - 0x508]
call fcn.04199690
lea edx, [ebp - 0x508]
lea eax, [ebp - 0x408]
call sub.VCL30.dpl_System._LStrFromString_EF219F52
mov edx, dword [ebp - 0x408]
lea eax, [ebp - 0x402]
call sub.VCL30.dpl_SysUtils.StrPCopy_17A29F31
lea eax, [ebp - 0x402]
push eax
push 0x7d00
push esi
lea eax, [ebp - 0x301]
push eax
push 0
push 0x41e0b6c
call sub.kernel32.dll_GetPrivateProfileStringA
xor edi, edi
mov byte [ebp - 0x200], 0
cmp byte [esi + edi], 0
je 0x41e0af5
lea eax, [ebp - 0x50c]
mov dl, byte [esi + edi]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x50c]
lea eax, [ebp - 0x200]
call sub.VCL30.dpl_System._PStrCat_51F89FF7
jmp 0x41e0b30
cmp byte [ebp - 0x200], 0
je 0x41e0b27
lea eax, [ebp - 0x100]
push eax
mov ecx, 0x41e0b74
lea edx, [ebp - 0x200]
mov eax, 0x41e0b78
call fcn.041996e4
lea eax, [ebp - 0x100]
call fcn.041f7e38
jmp 0x41e0b29
mov bl, 1
mov byte [ebp - 0x200], 0
inc edi
test bl, bl
jne 0x41e0b3d
cmp edi, 0x7d00
jl 0x41e0acd
mov eax, esi
call sub.VCL30.dpl_System._FreeMem_51F89FF7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e0b64
lea eax, [ebp - 0x408]
call sub.VCL30.dpl_System._LStrClr_40929B27
ret
Function at 0x41e1028
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x30c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41e1165
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x7d00
call sub.VCL30.dpl_System._GetMem_51F89FF7
mov esi, eax
lea eax, [ebp - 0x205]
xor edx, edx
call sub.VCL30.dpl_SysUtils.StrPCopy_17A29F31
xor ebx, ebx
lea eax, [ebp - 0x40c]
call fcn.04199690
lea edx, [ebp - 0x40c]
lea eax, [ebp - 0x30c]
call sub.VCL30.dpl_System._LStrFromString_EF219F52
mov edx, dword [ebp - 0x30c]
lea eax, [ebp - 0x306]
call sub.VCL30.dpl_SysUtils.StrPCopy_17A29F31
lea eax, [ebp - 0x306]
push eax
push 0x7d00
push esi
lea eax, [ebp - 0x205]
push eax
push 0
push 0x41e1174
call sub.kernel32.dll_GetPrivateProfileStringA
xor edi, edi
mov byte [ebp - 0x104], 0
cmp byte [esi + edi], 0
je 0x41e10e6
lea eax, [ebp - 0x410]
mov dl, byte [esi + edi]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x410]
lea eax, [ebp - 0x104]
call sub.VCL30.dpl_System._PStrCat_51F89FF7
jmp 0x41e1134
cmp byte [ebp - 0x104], 0
je 0x41e112b
lea eax, [ebp - 0x40c]
push eax
mov ecx, 0x41e117c
lea edx, [ebp - 0x104]
mov eax, 0x41e1180
call fcn.041996e4
lea edx, [ebp - 0x40c]
lea eax, [ebp - 0x104]
call sub.VCL30.dpl_System._PStrCpy_51F89FF7
push ebp
lea eax, [ebp - 0x104]
call fcn.041e0b80
pop ecx
jmp 0x41e112d
mov bl, 1
mov byte [ebp - 0x104], 0
inc edi
test bl, bl
jne 0x41e1145
cmp edi, 0x7d00
jl 0x41e10be
mov eax, esi
call sub.VCL30.dpl_System._FreeMem_51F89FF7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e116c
lea eax, [ebp - 0x30c]
call sub.VCL30.dpl_System._LStrClr_40929B27
ret
Function at 0x41fa0dc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41fa151
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x104]
call sub.VCL30.dpl_SysUtils.StrPas_B7CE3C1C
mov edx, dword [ebp - 0x108]
mov eax, ebx
mov ecx, 0xff
call sub.VCL30.dpl_System._LStrToString_51F89FF7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41fa158
lea eax, [ebp - 0x108]
call sub.VCL30.dpl_System._LStrClr_40929B27
ret

Function at 0x41faf58
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41fafe8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x208]
lea eax, [ebp - 0x101]
call sub.VCL30.dpl_SysUtils.StrPas_B7CE3C1C
lea eax, [ebp - 0x208]
mov edx, 0x41faffc
call sub.VCL30.dpl_System._LStrCat_51F89FF7
mov edx, dword [ebp - 0x208]
lea eax, [ebp - 0x201]
mov ecx, 0xff
call sub.VCL30.dpl_System._LStrToString_51F89FF7
mov eax, ebx
lea edx, [ebp - 0x201]
call sub.VCL30.dpl_System._PStrCpy_51F89FF7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41fafef
lea eax, [ebp - 0x208]
call sub.VCL30.dpl_System._LStrClr_40929B27
ret
Function at 0x429df0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1b000]
push edi
jmp 0x429e0a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x429e11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x429e00
mov eax, 1
add ebx, ebx
jne 0x429e23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x429e18
jne 0x429e34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x429e18
xor ecx, ecx
sub eax, 3
jb 0x429e48
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x429eba
mov ebp, eax
add ebx, ebx
jne 0x429e53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x429e60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x429e84
inc ecx
add ebx, ebx
jne 0x429e70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x429e65
jne 0x429e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x429e65
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x429ea4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x429e95
jmp 0x429e06
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x429ea4
add edi, ecx
jmp 0x429e06
pop esi
mov edi, esi
mov ecx, 0x5f3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x429ec2
cmp byte [edi], 0x11
jne 0x429ec2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x429ec7
lea edi, [esi + 0x25000]
mov eax, dword [edi]
or eax, eax
je 0x429f36
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2a234]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2a358]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x429ef4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2a360]
or eax, eax
je 0x429f30
mov dword [ebx], eax
add ebx, 4
jmp 0x429f11
call dword [esi + 0x2a35c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x429f67
cmp al, 0xef
ja 0x429f5a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x429f3c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x429f49
mov ebp, dword [esi + 0x2a364]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x429f9b
sub esp, 0xffffff80
jmp 0x403f63
Function at 0x1000cd31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002cd97
call fcn.10017073
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000cdae
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000cdae
call fcn.10005a99
mov esi, eax
jmp 0x1000ce85
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000cdd1
call fcn.10005a99
jmp 0x1000ce78
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000cdc7
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000ce01
mov esi, 0x8007000e
jmp 0x1000ce7a
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000cea8
jmp 0x1000ce27
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cdfa
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000cdc7
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1000cea8
mov esi, eax
test edi, edi
je 0x1000ce85
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000ce9e
lea ecx, [ebp - 0x418]
call fcn.1000c4af
mov eax, esi
call fcn.10016fc0
ret 0x10
Function at 0x4137c0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4139e4
sub esp, 0x18
mov eax, dword [0x5a3d0c]
test eax, eax
jne 0x4139cd
nop
lea eax, [0x5a3cf8]
mov dword [esp], eax
call fcn.00409920
mov eax, dword [0x5a3cfc]
test eax, eax
je 0x413809
cmp dword [eax + 8], 0xcc
jne 0x41387f
mov edx, dword [0x5a3cf0]
test edx, edx
jne 0x413861
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5a6510]
mov dword [esp + 8], eax
call fcn.0040be50
mov eax, dword [esp + 0xc]
mov dword [0x5a3cf0], eax
mov ecx, dword [0x5a3cb4]
mov dword [eax], ecx
mov eax, dword [0x5a3cf0]
mov dword [0x5a3cb4], eax
movzx eax, byte [0x5a4180]
test al, al
jne 0x413861
xor eax, eax
jmp 0x413979
mov edx, dword [0x5a3cf0]
mov ebx, dword [edx + 4]
mov dword [0x5a3cf0], ebx
mov ebx, dword [0x5a3cfc]
mov dword [edx + 4], ebx
mov dword [0x5a3cfc], edx
mov edx, dword [0x5a3cfc]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x413961
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402140
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x5a3e90]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x4138dd
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x4138ea
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00463740
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x5a3e90]
test edx, edx
jne 0x413916
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x413937
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00463740
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00463740
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00463740
nop
lea eax, [0x5a3cf8]
mov dword [esp], eax
call fcn.00409b20
nop
lea eax, [0x5a3cf4]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.004022c0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.004637d0
lea esi, [0x5a4180]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x413861
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x4139c3
lea edx, [0x5691f4]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x41396b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.004637c0
mov ecx, 5
call fcn.004637c0
lea eax, [0x4d299e]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004358a0
nop
call fcn.00462370
jmp fcn.004137c0
Function at 0x427910
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x427a80
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.004256a0
mov eax, dword [esp + 4]
test eax, eax
je 0x427a69
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.004233c0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00409920
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x4279a7
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x427a0d
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x4279bc
cmp byte [ebp + 6], dl
je 0x4279c7
cmp esi, ebx
ja 0x427a0d
jne 0x4279a5
cmp byte [ebp + 6], dl
jbe 0x4279a5
jmp 0x427a0d
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409b20
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x427a04
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x427a04
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.00427810
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409b20
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x427a60
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x427a60
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x4d3bd3]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.004358a0
nop
call fcn.00462370
jmp fcn.00427910
Function at 0x427f00
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42801c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x427f95
cmp cl, 2
je 0x427f3d
cmp cl, 3
jne 0x428005
mov byte [eax + 8], 1
jmp 0x428001
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042d130
nop
lea eax, [0x5882d8]
mov dword [esp], eax
call fcn.00409920
nop
mov eax, dword [0x5882a4]
sub eax, dword [0x588288]
mov dword [0x5882a4], eax
mov eax, dword [0x588294]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x588294], ecx
nop
lea eax, [0x5882d8]
mov dword [esp], eax
call fcn.00409b20
jmp 0x428001
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.004137c0
nop
lea eax, [0x5882d8]
mov dword [esp], eax
call fcn.00409920
nop
mov eax, dword [0x58827c]
sub eax, dword [0x588260]
mov dword [0x58827c], eax
mov eax, dword [0x58826c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x58826c], ecx
nop
nop
lea eax, [0x5882d8]
mov dword [esp], eax
call fcn.00409b20
add esp, 0x14
ret
lea eax, [0x4d01c8]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004358a0
nop
call fcn.00462370
jmp fcn.00427f00
Function at 0x42db90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42dc62
sub esp, 0x30
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x42dbcd
lea eax, [0x4cf177]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043a390
movzx ecx, byte [esp + 0x40]
mov dword [esp + 8], 0
mov edx, dword [esp + 0x38]
test edx, edx
jne 0x42dbe1
test cl, cl
jmp 0x42dc4f
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00463917
lea ecx, [0x42dc70]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], ecx
movzx ecx, byte [esp + 0x40]
mov byte [esp + 0x28], cl
lea edx, [esp + 8]
mov dword [esp + 0x2c], edx
lea edx, [esp + 0xc]
mov dword [esp], edx
call fcn.00462260
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x42dc56
call fcn.0043a4c0
mov eax, dword [esp + 8]
mov dword [esp + 0x44], eax
add esp, 0x30
ret
call fcn.00462370
jmp fcn.0042db90