joyce8/EMBER2024-capa huggingface dataset:
Function at 0x912250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x926808
push 0x916288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x912329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x912329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.009151d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x912329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x912329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x91232c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00912351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x912d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x912d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x912d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x912d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x912d94
push eax
push esi
call fcn.0091520b
add esp, 8
pop esi
ret 0x10

Function at 0x912da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x912e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x912e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x92b320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00914dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x912dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x912e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x912ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x912eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x92b320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00914dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x912eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x912e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x913000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x913131
push esi
call fcn.00916145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00905080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x913131
push 0
push ebp
call fcn.009053a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00905260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x91308b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.009052f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x913121
push 0x92b918
push edi
call fcn.009143f0
push eax
push ebx
push esi
call fcn.00912f60
push 0x92b8f8
push edi
call fcn.009143f0
push eax
push ebx
push esi
call fcn.00912f60
push 0x92b8d8
push edi
call fcn.009143f0
push eax
push ebx
push esi
call fcn.00912f60
push 0x92b8c0
push edi
call fcn.009143f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00912f60
push 0x92b8a0
push edi
call fcn.009143f0
push eax
push ebx
push esi
call fcn.00912f60
push 0x92b888
push edi
call fcn.009143f0
push eax
push ebx
push esi
call fcn.00912f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x9141b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00914140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00914140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00914140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00914140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x914bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x914c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x92687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x914c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x914c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x41cbd3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41cc1b
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x41cc1b
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41cc1b
cmp word [eax + 2], 0
je 0x41cc1b
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x41cc1b
add eax, 0x30
jmp 0x41cc20
mov eax, 0x4254a8
pop esi
pop ebp
ret
Function at 0x404470
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x2c
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
mov ecx, dword [eax + 0x18]
cmp dword [ecx + 0x4c], eax
jne 0x404572
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
nop
inc dword [ecx + 0x144]
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
mov ebx, ecx
mov dword [edx + 0xbc], ecx
mov ecx, dword [ebx + 0x18]
mov dword [ebx + 0x84], ecx
mov ecx, dword [eax + 0x18]
test byte [ecx], al
lea esi, [ecx + 0x18c]
lea edi, [esp + 0xc]
call fcn.0045d094
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x24], ecx
mov edx, dword [eax + 0x3c]
mov dword [esp + 8], edx
call fcn.00458f00
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x88], 0
mov ecx, dword [eax + 0x18]
test byte [ecx], al
add ecx, 0x1c4
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.00402940
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.004045b0
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x18]
mov dword [esp], ecx
call fcn.0042ffd0
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x88], 1
mov ecx, dword [esp + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
call fcn.0043b160
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0x18]
test byte [eax], al
lea edi, [eax + 0x18c]
lea esi, [esp + 0xc]
call fcn.0045d094
add esp, 0x2c
ret
call fcn.00433c00
lea eax, [0x6839b4]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.004345e0
call fcn.00433c70
mov dword [esp], 2
call fcn.0042e910
mov eax, dword [esp + 0x28]
jmp 0x404490
Function at 0x408f90
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x409157
mov eax, dword [0x7e34d0]
mov ecx, dword [esp + 0xc]
imul eax, ecx
mov edx, dword [esp + 8]
add eax, edx
mov ebx, dword [esp + 4]
jmp 0x409024
mov edx, dword [ebx]
xor edx, eax
imul eax, edx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [ebx + 4]
xor edx, ebp
imul edx, edx, 0xc70f85e1
rol edx, 0xf
imul ebp, edx, 0x319bca41
mov edx, dword [ebx + 8]
xor edx, esi
imul edx, edx, 0x319bca41
rol edx, 0xf
imul esi, edx, 0x8b421a21
mov edx, dword [ebx + 0xc]
xor edx, edi
imul edx, edx, 0x8b421a21
rol edx, 0xf
imul edi, edx, 0xbce2d621
nop
add ecx, 0xfffffff0
add ebx, 0x10
mov edx, dword [esp + 8]
cmp ecx, 0x10
jae 0x408fbf
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x4090bc
cmp ecx, 4
jb 0x409125
je 0x409110
cmp ecx, 8
jbe 0x4090e2
cmp ecx, 0x10
jbe 0x409066
mov ebp, dword [0x7e34d4]
imul ebp, edx
mov esi, dword [0x7e34d8]
imul esi, edx
mov edi, dword [0x7e34dc]
imul edi, edx
jmp 0x409019
mov edx, ebx
lea ebp, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov ebx, dword [edx]
xor eax, ebx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [edx + 4]
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [ebp]
nop
nop
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [ecx]
nop
nop
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x10], eax
ret
mov edx, ebx
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
imul edx, eax, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ecx]
nop
nop
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x4090bc
mov ecx, dword [ebx]
xor eax, ecx
imul ecx, eax, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x4090bc
mov edx, ebx
lea ebx, [ecx + ebx - 1]
movzx ebp, byte [edx]
xor eax, ebp
shr ecx, 1
movzx ecx, byte [edx + ecx]
shl ecx, 8
xor ecx, eax
movzx edx, byte [ebx]
shl edx, 0x10
xor edx, ecx
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x4090bc
call fcn.0045b380
jmp fcn.00408f90
Function at 0x40c960
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40cb6e
sub esp, 0x44
mov eax, dword [esp + 0x48]
cmp eax, 0x7000000
jle 0x40cb41
mov eax, 0x7000000
mov dword [esp + 0x48], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x90]
mov ebx, dword [ecx + 0x94]
mov dword [ecx + 0x90], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x94], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.0045c8d0
fld qword [esp + 4]
fld st(0)
fstp qword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x2c]
shr edi, 0x1b
or edi, ebx
test esi, esi
fstp st(0)
jne 0x40cb61
cmp ecx, 0x21
jae 0x40cb55
mov dword [esp + 0x10], edi
lea ebx, [0x5ed340]
fld qword [ebx + ebp*8]
fld st(0)
fstp qword [esp + 0x1c]
fld qword [ebx + ecx*8]
fld st(0)
fstp qword [esp + 0x24]
mov dword [esp], eax
add edx, 0xfffffc01
mov eax, 0xffffffff
adc eax, 0
mov dword [esp + 4], eax
fstp st(0)
fstp st(0)
call fcn.00453eb0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
fld qword [esp + 8]
fld st(0)
fstp qword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], 0
fstp st(0)
call fcn.00453fa0
fld qword [esp + 0x3c]
fld qword [esp + 0x1c]
fld st(0)
faddp st(2)
fld qword [esp + 0x24]
fld st(1)
fsubp st(1)
fld qword [esp + 8]
fstp st(2)
fld st(0)
fmulp st(2)
fld qword [0x6c6d50]
fstp st(1)
fld st(1)
fmulp st(1)
fld st(0)
faddp st(3)
fld qword [0x6c71e8]
fstp st(2)
fld st(1)
fsubp st(3)
fld st(2)
fstp qword [esp + 0x14]
fldz
fstp st(2)
fld st(2)
fucomp st(2)
mov dword [esp + 0x34], eax
fnstsw ax
sahf
mov eax, dword [esp + 0x34]
fstp st(0)
fstp st(0)
fstp st(0)
jbe 0x40cafa
fldz
fld st(0)
fstp qword [esp + 0x14]
fstp st(0)
mov eax, dword [esp + 0x48]
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
fld qword [0x6c7508]
fld st(0)
fmulp st(2)
fld qword [esp + 0x14]
fstp st(1)
fld st(1)
fmulp st(1)
fld st(0)
fnstcw word [esp + 0x38]
lea eax, [0x5e7088]
fldcw word [eax]
fistp dword [esp + 0x34]
mov eax, dword [esp + 0x34]
fldcw word [esp + 0x38]
inc eax
mov dword [esp + 0x4c], eax
fstp st(0)
fstp st(0)
add esp, 0x44
ret
test eax, eax
jne 0x40c98d
mov dword [esp + 0x4c], 0
add esp, 0x44
ret
mov eax, ecx
mov ecx, 0x21
call fcn.0045c9b0
mov eax, ecx
mov ecx, 0x21
call fcn.0045ca80
nop
call fcn.0045b380
jmp fcn.0040c960
Function at 0x415900
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x415b1f
sub esp, 0x18
mov eax, dword [0x7e3274]
test eax, eax
jne 0x415b08
nop
nop
lea eax, [0x7e325c]
mov dword [esp], eax
call fcn.0040a670
mov eax, dword [0x7e3260]
test eax, eax
je 0x41594e
cmp dword [eax + 8], 0xcc
jne 0x415a16
mov edx, dword [0x7e3254]
test edx, edx
jne 0x4159f8
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x7e5758]
mov dword [esp + 8], eax
call fcn.0040cb80
mov eax, dword [esp + 0xc]
mov dword [0x7e3254], eax
mov ecx, dword [0x7e3210]
mov dword [eax], ecx
mov eax, dword [0x7e3254]
mov dword [0x7e3210], eax
movzx eax, byte [0x7e3780]
test al, al
jne 0x4159f8
xor eax, eax
jmp 0x4159b5
lea esi, [0x7e3780]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x4159f8
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x415afe
lea edx, [0x5e70bc]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x4159a7
jmp 0x415af2
mov edx, dword [0x7e3254]
mov ebx, dword [edx + 4]
mov dword [0x7e3254], ebx
mov ebx, dword [0x7e3260]
mov dword [edx + 4], ebx
mov dword [0x7e3260], edx
mov edx, dword [0x7e3260]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x415ae8
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402880
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x7e34e0]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x415ad9
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x7e34e0]
test edx, edx
jne 0x415ab6
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
mov byte [0x7e31d0], 1
nop
lea eax, [0x7e325c]
mov dword [esp], eax
call fcn.0040a880
add esp, 0x18
ret
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.0045c920
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.0045c920
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.0045c920
jmp 0x415a9c
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.0045c920
mov eax, edx
jmp 0x415a72
mov ecx, 0xcc
call fcn.0045c9b0
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.0045c9a0
mov ecx, 5
call fcn.0045c9a0
lea eax, [0x680ec6]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00432350
nop
call fcn.0045b380
jmp fcn.00415900
Function at 0x4252c0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42542e
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00423250
mov eax, dword [esp + 4]
test eax, eax
je 0x425417
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x78]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.004214f0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.0040a670
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x425357
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x425375
movzx esi, word [ebp + 4]
cmp ebx, esi
jne 0x42536c
cmp byte [ebp + 6], dl
je 0x4253d1
cmp ebx, esi
jb 0x425375
jne 0x425355
cmp byte [ebp + 6], dl
jbe 0x425355
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.004251c0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040a880
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x4253c8
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x4253c8
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040a880
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x42540e
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x42540e
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
lea eax, [0x682e52]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00432350
nop
call fcn.0045b380
jmp fcn.004252c0
Function at 0x425570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42577a
sub esp, 0x28
nop
lea eax, [0x7db0e0]
mov dword [esp], eax
call fcn.0040a670
lea eax, [0x7db098]
mov dword [esp], eax
call fcn.00416640
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
nop
nop
lea ecx, [0x7db0e0]
mov dword [esp], ecx
call fcn.0040a880
mov eax, dword [esp + 0x24]
mov byte [eax + 6], 1
lea edi, [eax + 8]
mov ecx, dword [0x7e34e0]
test ecx, ecx
jne 0x425768
mov ecx, dword [esp + 0x30]
mov dword [eax + 8], ecx
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x34]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x7e34e0]
test ecx, ecx
jne 0x425745
mov ecx, dword [esp + 0x38]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x3c]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004252c0
movzx eax, byte [esp + 8]
test al, al
je 0x4256f7
mov eax, dword [0x7e3274]
test eax, eax
jne 0x425635
mov byte [esp + 0x40], 1
add esp, 0x28
ret
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.004124a0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0xc]
nop
inc dword [ecx + 0x78]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x18], ecx
mov ebx, dword [ecx + 0x54]
test byte [ebx], al
test byte [eax], al
mov dword [esp], edx
lea eax, [ebx + 0xb80]
mov dword [esp + 0x1c], eax
mov dword [esp + 4], eax
call fcn.0041d9c0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 4
lea eax, [0x5e7042]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.0041d880
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x42562c
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x42562c
mov dword [eax + 8], 0xfffffade
jmp 0x42562c
nop
nop
lea eax, [0x7db0e0]
mov dword [esp], eax
call fcn.0040a670
nop
mov eax, dword [0x7db0b0]
sub eax, dword [0x7db098]
mov dword [0x7db0b0], eax
mov eax, dword [0x7db0a4]
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov dword [0x7db0a4], ecx
nop
nop
lea eax, [0x7db0e0]
mov dword [esp], eax
call fcn.0040a880
mov byte [esp + 0x40], 0
add esp, 0x28
ret
lea ecx, [eax + 0x10]
mov edi, ecx
mov ebx, eax
mov eax, dword [esp + 0x38]
call fcn.0045c920
lea edi, [ebx + 0x14]
mov eax, dword [esp + 0x3c]
call fcn.0045c920
mov eax, ebx
jmp 0x425605
mov ecx, eax
mov eax, dword [esp + 0x30]
call fcn.0045c920
mov eax, ecx
jmp 0x4255de
call fcn.0045b380
jmp fcn.00425570