joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442800
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
and ebp, 0x1f
push edi
mov edi, dword [esp + 0x14]
cmp ebp, 8
jb 0x4428bf
mov eax, ebp
shr eax, 3
mov dword [esp + 0x20], eax
lea esp, [esp]
cmp dword [esp + 0x24], 1
jne 0x44284b
movq xmm0, qword [ebx]
movq qword [esp + 0x14], xmm0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
jmp 0x442850
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
push 0xc2b2ae3d
push 0x27d4eb4f
push ecx
push eax
call fcn.00440e90
mov ecx, eax
mov eax, edx
mov edx, ecx
shld edx, eax, 0x1f
push 0x9e3779b1
shld eax, ecx, 0x1f
push 0x85ebca87
push eax
push edx
add ebx, 8
call fcn.00440e90
xor eax, edi
xor edx, esi
mov ecx, eax
shld ecx, edx, 0x1b
push 0x9e3779b1
shld edx, eax, 0x1b
push 0x85ebca87
push edx
push ecx
call fcn.00440e90
add eax, 0xc2b2ae63
adc edx, 0x85ebca77
sub ebp, 8
sub dword [esp + 0x20], 1
mov edi, eax
mov esi, edx
jne 0x442830
cmp ebp, 4
jb 0x44290c
mov eax, dword [ebx]
push 0x9e3779b1
push 0x85ebca87
push 0
push eax
add ebx, 4
call fcn.00440e90
xor eax, edi
xor edx, esi
mov ecx, eax
shld ecx, edx, 0x17
push 0xc2b2ae3d
shld edx, eax, 0x17
push 0x27d4eb4f
push edx
push ecx
call fcn.00440e90
add eax, 0x9e3779f9
adc edx, 0x165667b1
mov edi, eax
mov esi, edx
sub ebp, 4
test ebp, ebp
jbe 0x44294e
movzx eax, byte [ebx]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.00440e90
xor edi, eax
xor esi, edx
mov eax, edi
shld eax, esi, 0xb
push 0x9e3779b1
shld esi, edi, 0xb
push 0x85ebca87
push esi
push eax
inc ebx
call fcn.00440e90
sub ebp, 1
mov edi, eax
mov esi, edx
jne 0x442910
push 0xc2b2ae3d
xor ecx, ecx
mov eax, esi
push 0x27d4eb4f
shr eax, 1
xor ecx, esi
xor eax, edi
push ecx
push eax
call fcn.00440e90
mov ecx, eax
mov esi, edx
shrd ecx, esi, 0x1d
push 0x165667b1
shr esi, 0x1d
push 0x9e3779f9
xor esi, edx
xor ecx, eax
push esi
push ecx
call fcn.00440e90
mov ecx, edx
mov esi, eax
pop edi
mov eax, ecx
xor eax, esi
pop esi
xor edx, edx
pop ebp
xor edx, ecx
pop ebx
ret
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
xor dl, al
adc dword [eax], eax
push ebp
mov ebp, esp
sub esp, 0x78
adc al, 0x8b
jne 0x401e56
push esi
lea eax, [ebp - 0x78]
jb 0x401ec8
xchg edx, eax
push esi
dec byte [ecx - 0x7481635f]
jle 0x401de3
cld
inc edi
mov edx, dword [0x40c002]
push eax
push ecx
add edx, 0x40
push 0x40f0ac
push edx
call dword [sym.imp.MSVCRT.dll_fprintf]
mov eax, dword [0x412dac]
and dword [esi], 0xffffffba
test eax, eax
je 0x401e8c
inc ebp
push str.Total_of__d_requests_completed_n
invalid
push esi
call dword [sym.imp.MSVCRT.dll_exit]
insb byte es:[edi], dx
hlt
rcr bl, 0xfa
jne 0x401f0d
mov ecx, dword [esi + 4]
push 0
xchg esi, eax
add ch, dh
call fcn.00406d70
mov dword [esi + 0x838], ebx
call 0x485ba3
add bh, al
inc esi
sbb byte [eax], al
add byte [eax], al
add byte [ebx + 0x4117ecb8], cl
add byte [ecx + 0x60a11456], cl
add al, byte [ecx]
test eax, eax
je 0x401f3a
mov eax, dword [0xa2410270]
sti
retf 0xa703
mov ecx, dword [esi + 0x838]
mov eax, dword [0x40d028]
mov edx, dword [0x40d0ac]
add ecx, eax
mov eax, dword [esi + 0x8b8]
adc eax, edx
loop 0x401f22
mov eax, 0x13000008
ret 0xf8e2
jg 0x402015
jl 0x401f3a
cmp ebx, ecx
sahf
xchg ebx, ebx
add byte [ebx + 0x18268b00], al
mov ebx, dword [0x40d030]
xor al, 0x46
mov esp, dword [esi]
sbb byte [ebx + 0x40d0301d], cl
add byte [esi + eax*2], dh
invalid
push str.Send_request_timed_out__n
call dword [sym.imp.MSVCRT.dll_printf]
xchg dword [edi - 0x49ffe596], esi
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ecx
pop ebp
ret

Function at 0x404a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or dword [esp + ecx + 0x530c5cea], 0x56
wait
lea edx, [eax + 7]
and edx, 0xfffffff8
cmp edx, eax
mov eax, dword [ebp + 8]
mov ecx, edx
clc
xor eax, 0x32408b1d
test dword [edi + 0xf], edx
test byte [esi + 2], al
add byte [ecx - 0x2f7e4096], ah
add esp, 4
xor eax, eax
pop edi
pop esi
inc esi
jg 0x404a7a
pop ebp
ret 8
Function at 0x409860
Capabilities:
Encode data using xor

Disassembly:
push ebp
and ah, ch
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, dword [ecx - 0x75]
fisttp dword [eax]
mov cl, 0x45
adc byte [eax], cl
xchg esp, eax
sti
mov dword [ebx + 0x15d1e810], esi
add byte [eax], al
push ecx
dec ebp
adc byte [esi + 0x3f1f32f], dh
stosb byte es:[edi], al
mov eax, dword [0xef047500]
div byte [edi - 0x22]
jge 0x4098df
adc al, 0x85
leave
je 0x409899
mov dword [ecx], ebx
pop edi
invalid
test byte [edx + eax], ch
add byte [eax], al
mov eax, dword [ebx + ebx - 0x25]
and esi, 0x540055
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], edx
jg 0x4098fa
pushal
inc ebp
cld
mov edx, 0x8b000000
pop ebp
cld
mov edi, dword [edx + 0xe72a]
add byte [eax], al
add byte [ebx - 0x457403a3], cl
sub ah, bh
add byte [eax], al
and al, byte [eax]
je 0x409910
dec ebx
add dh, byte [esi]
pop ebp
cld
sbb dword [ebp], 0x89007000
dec ebp
call 0xcc139f91
add al, 0x89
out 0xfc, al
mov eax, dword [ebp + 0x14]
cmp eax, 2
psubd mm4, mm1
add byte [eax], al
add byte [esi + 0x55], bh
clc
add cl, byte [edi]
cli
loope 0x40992b
add byte [eax], al
jle 0x409984
sub edx, dword [edi]
add al, 0x68
loopne 0x4098f9
rol byte [eax], cl
push edx
xor eax, dword [edi + edi*8 + 0x40c104b3]
add byte [eax], dl
les ecx, [eax*4 - 0x74d21b40]
inc ebp
or al, 0xbb
add al, 0
add byte [edi - 0x65], bl
add eax, 8
push 0xf2410180
pop esp
call dword [0x40f404]
jae 0x409925
or al, 0x1a
sal byte [ecx + 0xe], 0x8b
add eax, 0xabb0c
sbb dword [edi], 0x5041c753
pop esp
add byte [ecx + 0x41804c], ah
test dword [edx + 0x75], edi
sbb dword [eax + 0x68], edx
push 0x6a0041ce
add ebp, ebx
mov dh, 0xf
add byte ss:[ebx + 0x4fa30cc4], al
push es
inc ecx
add bh, cl
sal byte [eax + edi - 0x75], 0x4d
call 0xf82d3d2a
fst dword [edx - 0x73]
push ebp
cmp byte [ebx], bl
leave
jne 0x4099a6
and ecx, edx
invalid
Function at 0x401450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40147a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x14]
test eax, eax
mov dword [ecx], eax
jne 0x40147e
xor eax, eax
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x10]
push 1
mov dword [ecx], eax
pop eax
pop esi
ret

Function at 0x401499
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
xor edi, edi
push edi
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x4014da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4014ed
push 8
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
call esi
test eax, eax
je 0x4014ed
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4014f1
xor eax, eax
jmp 0x401503
cmp dword [ebp - 4], edi
je 0x401500
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x414ddf
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor dword [ecx], esi
sub esp, 4
mov dword [esp], 0x2c32330d
pop edi
add ecx, 4
mov edx, 0xd9d95cc3
cmp ecx, ebx
jne fcn.00414ddf
or edx, edx
and eax, edx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x71a765f7
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x448e4b1f
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x414ddf
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], esi
inc eax
mov edi, 0xb884c92a
add edx, 4
add edi, 0xe8691e1a
cmp edx, ebx
jne fcn.00414ddf
ret
Function at 0x4222bf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00417a80
and dword [ebp - 4], 0
cmp dword [0x435abc], 0
mov ebx, eax
jne 0x422370
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x422421
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x422421
push eax
call fcn.00417a0e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435abc], eax
call esi
push eax
call fcn.00417a0e
mov dword [esp], 0x42a684
push edi
mov dword [0x435ac0], eax
call esi
push eax
call fcn.00417a0e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435ac4], eax
call esi
push eax
call fcn.00417a0e
pop ecx
mov dword [0x435acc], eax
test eax, eax
je 0x422370
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00417a0e
pop ecx
mov dword [0x435ac8], eax
mov eax, dword [0x435ac8]
cmp eax, ebx
je 0x4223c8
cmp dword [0x435acc], ebx
je 0x4223c8
push eax
call fcn.00417a89
push dword [0x435acc]
mov esi, eax
call fcn.00417a89
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4223c8
test edi, edi
je 0x4223c8
call esi
test eax, eax
je 0x4223bf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4223bf
test byte [ebp - 0xc], 1
jne 0x4223c8
or dword [ebp + 0x10], 0x200000
jmp 0x422401
mov eax, dword [0x435ac0]
cmp eax, ebx
je 0x422401
push eax
call fcn.00417a89
pop ecx
test eax, eax
je 0x422401
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x422401
mov eax, dword [0x435ac4]
cmp eax, ebx
je 0x422401
push eax
call fcn.00417a89
pop ecx
test eax, eax
je 0x422401
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435abc]
call fcn.00417a89
pop ecx
test eax, eax
je 0x422421
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x422423
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..pdata
nop
mov ebx, 0x408f6c
mov ecx, 0x6a185633
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x17a12b6b
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x7fc51f70
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x24194d4b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x408f40
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x53ad04]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x409029
sub esp, 0x2c
movsd xmm0, qword [esp + 0x30]
movsd qword [esp], xmm0
call fcn.00409110
mov eax, dword [esp + 0xc]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebx, dword [esp + 8]
shl edx, 5
shr ebx, 0x1b
or ebx, edx
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
lea edx, [0x490b60]
movsd xmm0, qword [edx + ecx*8]
movsd qword [esp + 0x14], xmm0
add ecx, 1
movsd xmm1, qword [edx + ecx*8]
subsd xmm1, xmm0
movsd qword [esp + 0x24], xmm1
add eax, 0xfffffc01
mov ecx, 0xffffffff
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00460a50
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00460ad0
movsd xmm0, qword [esp + 0x1c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm1, qword [esp + 8]
movsd xmm2, qword [esp + 0x24]
mulsd xmm1, xmm2
movsd xmm2, qword [0x4b90ac]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd qword [esp + 0x38], xmm0
add esp, 0x2c
ret
call fcn.00465d00
jmp fcn.00408f40
Function at 0x419180
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x53ad04]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x419366
sub esp, 0x18
mov eax, dword [0x53ac40]
test eax, eax
jne 0x41934f
lea eax, [0x53ac30]
mov dword [esp], eax
call fcn.0040ab10
mov eax, dword [0x53ac34]
test eax, eax
je 0x4191c6
cmp dword [eax + 8], 0xcc
jne 0x41923c
mov eax, dword [0x53ac38]
test eax, eax
jne 0x41921e
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x53f3b0]
mov dword [esp + 8], eax
call fcn.0040d1e0
mov eax, dword [esp + 0xc]
mov dword [0x53ac38], eax
mov ecx, dword [0x53ac3c]
mov dword [eax], ecx
mov eax, dword [0x53ac38]
mov dword [0x53ac3c], eax
movzx eax, byte [0x53b080]
test al, al
jne 0x41921e
xor eax, eax
jmp 0x419343
mov eax, dword [0x53ac38]
mov ecx, dword [eax + 4]
mov dword [0x53ac38], ecx
mov ecx, dword [0x53ac34]
mov dword [eax + 4], ecx
mov dword [0x53ac34], eax
mov eax, dword [0x53ac34]
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
lea edx, [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.00403960
mov eax, dword [0x53adf0]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x41927b
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
jmp 0x419291
call fcn.00467120
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [0x53adf0]
test eax, eax
jne 0x4192b5
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
jmp 0x4192e3
call fcn.00467160
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov ebx, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x14], esi
mov dword [edx + ecx*4 + 0x1c], eax
mov dword [edx + ecx*4 + 0x20], ebx
mov dword [edx + ecx*4 + 0x14], ebp
lea eax, [0x53ac30]
mov dword [esp], eax
call fcn.0040ad10
lea eax, [0x53ac2c]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00403490
add esp, 0x18
ret
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov ebx, ecx
sub ecx, edx
lea edx, [0x49023c]
movzx ecx, byte [edx + ecx]
lea ebp, [0x53b080]
mov byte [ebp + ebx], cl
lea eax, [ebx + 1]
cmp eax, 0x80
jl 0x419317
jmp 0x41921e
lea eax, [0x4af66a]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0043b5b0
nop
call fcn.00465d00
jmp fcn.00419180
Function at 0x4267f0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x53ad04]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4268ca
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [esp + 0x24]
lea ecx, [ecx + edx*8]
mov dword [esp], ecx
call fcn.00426c20
movzx eax, word [esp + 4]
movzx ecx, byte [esp + 0xc]
movzx edx, word [esp + 6]
mov ebx, dword [esp + 8]
mov word [esp + 0x10], ax
mov word [esp + 0x12], dx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x18], cl
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00426f70
lea eax, [esp + 0x18]
mov dword [esp], eax
call fcn.00426e50
movzx eax, byte [esp + 4]
test al, al
jne 0x42688a
cmp word [esp + 0x10], 0x1f0
jbe 0x42688a
lea eax, [esp + 0x18]
mov dword [esp], eax
call fcn.00426e80
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov ecx, dword [esp + 0x24]
lea eax, [eax + ecx*8]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x12]
mov ebx, dword [esp + 0x14]
movzx ebp, byte [esp + 0x18]
mov dword [esp], eax
mov word [esp + 4], cx
mov word [esp + 6], dx
mov dword [esp + 8], ebx
xchg ebp, eax
mov byte [esp + 0xc], al
xchg ebp, eax
call fcn.00426c90
add esp, 0x1c
ret
call fcn.00465d00
jmp fcn.004267f0
Function at 0x4268e0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x53ad04]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426a20
sub esp, 0x24
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
lea ecx, [ecx + edx*8]
mov dword [esp], ecx
call fcn.00426c20
movzx eax, word [esp + 4]
mov ecx, dword [esp + 8]
movzx edx, byte [esp + 0xc]
movzx ebx, word [esp + 6]
mov word [esp + 0x14], ax
mov word [esp + 0x16], bx
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x14]
mov dword [esp], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00427060
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
lea ecx, [ecx + edx*8]
movzx ebx, word [esp + 0x14]
movzx ebp, word [esp + 0x16]
mov esi, dword [esp + 0x18]
movzx edi, byte [esp + 0x1c]
mov dword [esp], ecx
mov word [esp + 4], bx
mov word [esp + 6], bp
mov dword [esp + 8], esi
xchg edi, eax
mov byte [esp + 0xc], al
xchg edi, eax
call fcn.00426c90
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.0042dce0
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x28]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
lea edx, [ebx + edx - 1]
shl edx, 0xd
add edx, dword [esp + 4]
mov dword [esp + 0x10], edx
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.00434110
movzx eax, byte [esp + 8]
test al, al
je 0x4269d8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov dword [ecx + 0x28], eax
jmp 0x4269dc
mov ecx, dword [esp + 0x28]
lea eax, [ecx + 0x20]
mov dword [esp + 0x20], eax
mov dword [esp], eax
call fcn.00434370
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.00434110
movzx eax, byte [esp + 8]
test al, al
je 0x426a1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.00434320
add esp, 0x24
ret
call fcn.00465d00
jmp fcn.004268e0
Function at 0x42d6d0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x53ad04]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42d809
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42d7ac
cmp cl, 1
je 0x42d750
cmp cl, 2
jne 0x42d7f2
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00433110
lea eax, [0x51f220]
mov dword [esp], eax
call fcn.0040ab10
lea eax, [0x51f1a8]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.0041a210
lea eax, [0x51f220]
mov dword [esp], eax
call fcn.0040ad10
jmp 0x42d7ee
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00419180
lea eax, [0x51f220]
mov dword [esp], eax
call fcn.0040ab10
lea eax, [0x51f180]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.0041a210
lea eax, [0x51f220]
mov dword [esp], eax
call fcn.0040ad10
jmp 0x42d7ee
cmp cl, 3
jne 0x42d7b7
mov byte [eax + 8], 1
jmp 0x42d7ee
cmp cl, 4
jne 0x42d7f2
lea eax, [0x51f220]
mov dword [esp], eax
call fcn.0040ab10
lea eax, [0x51f1f8]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.0041a210
lea eax, [0x51f220]
mov dword [esp], eax
call fcn.0040ad10
add esp, 0x14
ret
lea eax, [0x4ad22a]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0043b5b0
nop
call fcn.00465d00
jmp fcn.0042d6d0
Function at 0x45a330
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x53ad04]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45a433
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov ecx, dword [0x53ad04]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0xf0], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.0045ac40
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x49c3e0]
mov dword [esp], ecx
call fcn.0040cf80
mov eax, dword [esp + 4]
mov dword [eax], 0xffffffff
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax + 4], ecx
lea ecx, [0x51f2dc]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 2
mov dword [esp + 0xc], 2
call fcn.00459850
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00458e00
add esp, 0x28
ret
call fcn.00465d00
jmp fcn.0045a330

Function at 0x45d980
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x53ad04]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45da1b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x53ad04]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.004671e7
lea ecx, [0x45da30]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00465c10
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00465d00
jmp fcn.0045d980