joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004bc8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.01003c8c
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.01003cbe
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01003c73
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.01003cae
xchg ebx, eax
cdq
dec edx
sbb eax, 0x10468
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
Function at 0x1006205
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100b2d0]
push edi
xor edi, edi
cmp word [0x100c898], di
mov dword [ebp - 4], eax
jne 0x1006247
cmp dword [0x100c884], edi
jne 0x100623e
call fcn.010043ec
test eax, eax
je 0x1006259
cmp word [0x100c898], di
jne 0x1006247
call fcn.01004bc8
test eax, eax
je 0x1006259
call fcn.0100435e
test eax, eax
je 0x1006259
call fcn.01005f21
test eax, eax
jne 0x1006260
xor eax, eax
jmp 0x100636a
push ebx
push esi
mov esi, 0x105
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1001264
push esi
lea eax, [ebp - 0x10c]
push eax
call fcn.010066cf
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
mov ebx, 0x100bc44
je 0x10062b3
push 0x10014a8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x10062b3
push edi
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x100c884], edi
jne 0x10062da
cmp dword [0x100c490], edi
jne 0x10062da
call fcn.010047b3
test eax, eax
jne 0x10062da
xor eax, eax
jmp 0x1006368
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x1006301
push edi
push 0x10
push edi
push edi
push 0x4bc
push edi
call fcn.01003ebe
call fcn.01003aa1
mov dword [0x100ba5c], eax
jmp 0x10062d3
cmp dword [0x100c88c], edi
jne 0x1006312
call fcn.01005a36
test eax, eax
je 0x10062d3
test byte [0x100cba8], 0xc0
jne 0x1006330
xor eax, eax
mov ax, word [0x100ba64]
push eax
call fcn.01001f93
mov dword [0x100bb84], eax
jmp 0x1006336
mov dword [0x100bb84], edi
cmp dword [0x100c884], edi
jne 0x100634f
cmp dword [0x100c490], edi
jne 0x100634f
call fcn.01005abc
test eax, eax
je 0x10062d3
cmp word [0x100c898], di
jne 0x1006365
cmp dword [0x100c884], edi
jne 0x1006365
call fcn.01004de5
xor eax, eax
inc eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.010064de
leave
ret

Function at 0x100672a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1006741
xor eax, eax
jmp 0x1006749
shr eax, 4
not eax
and eax, 1
pop ebp
ret 4

Function at 0x10069ea
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
je 0x1006a22
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x1006a26
xor eax, eax
jmp 0x1006a3c
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
push 0x400
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
leave
ret 4
Function at 0x4332af
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4cb605
call fcn.004cafb8
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x20], edi
cmp dword [edi], 0
je 0x43349f
push dword [edi]
xor esi, esi
push esi
push dword [edi + 4]
call fcn.0047f475
add esp, 0xc
push 2
lea ecx, [ebp - 0x38]
call fcn.00424c41
push 1
lea ecx, [ebp - 0x50]
call fcn.00424c41
push 4
lea ecx, [ebp - 0x44]
call fcn.00424c41
mov dword [ebp - 0x14], esi
jmp 0x43330f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x433303
mov dword [ebp - 0x14], esi
jmp 0x43332a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov dword [eax + ecx*4], 0x5459eeda
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x43331a
mov dword [ebp - 0x14], esi
jmp 0x433345
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov dword [eax + ecx*4], 0xc3825062
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x433335
mov eax, dword [ebp - 0x38]
mov dword [eax + 4], esi
lea ecx, [ebp - 0x44]
call fcn.00424d13
lea ecx, [ebp - 0x50]
call fcn.00424d13
lea ecx, [ebp - 0x38]
call fcn.00424d13
push dword [edi + 4]
call fcn.004b58dd
pop ecx
mov dword [ebp - 0x1c], 0x4bcc
cmp dword [ebp - 0x1c], 0x4c48
jle 0x43340d
push 0x1199
push 0x912
push 0x10cf
push 0xb2f
push 0x22bd
push esi
push esi
push esi
push esi
push 0xabf
call dword [0xae0450]
mov ebx, esi
mov dword [ebp - 0x18], esi
mov edi, esi
mov eax, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], esi
lea esi, [edi + ebx]
mov ecx, eax
sar esi, cl
mov ebx, dword [ebp - 0x24]
mov eax, esi
xor eax, ebx
cdq
push edx
push eax
mov ecx, 0xadd958
call fcn.00424afd
inc ebx
cmp ebx, 0x38e1
jl 0x4333c7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x48eb
push 0
pop esi
mov ebx, dword [ebp - 0x18]
jl 0x4333ba
inc edi
cmp edi, 0x1267
jl 0x4333b5
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x3915
jl 0x4333b3
mov edi, dword [ebp - 0x20]
mov dword [edi + 4], esi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x48da
jge 0x43342b
mov edx, 0xac53b8
mov ecx, 0xadd958
call fcn.004268b3
or dword [ebp - 4], 0xffffffff
jmp 0x433454
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], esi
jmp 0x43346a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c], 0x3342eb9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x43345c
mov dword [ebp - 0x28], esi
jmp 0x433497
mov dword [ebp - 0x14], 0xed23b618
mov dword [ebp - 0x14], 0xc
jmp 0x43348e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
jl 0x433485
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffec
jne 0x433475
mov dword [edi], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0xeb728b4
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..text_1
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x362d7b8a
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x407bc0
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x407d87
mov eax, dword [0x5afee0]
mov ecx, dword [esp + 0xc]
imul eax, ecx
mov edx, dword [esp + 8]
add eax, edx
mov ebx, dword [esp + 4]
jmp 0x407c54
mov edx, dword [ebx]
xor edx, eax
imul eax, edx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [ebx + 4]
xor edx, ebp
imul edx, edx, 0xc70f85e1
rol edx, 0xf
imul ebp, edx, 0x319bca41
mov edx, dword [ebx + 8]
xor edx, esi
imul edx, edx, 0x319bca41
rol edx, 0xf
imul esi, edx, 0x8b421a21
mov edx, dword [ebx + 0xc]
xor edx, edi
imul edx, edx, 0x8b421a21
rol edx, 0xf
imul edi, edx, 0xbce2d621
nop
add ecx, 0xfffffff0
add ebx, 0x10
mov edx, dword [esp + 8]
cmp ecx, 0x10
jae 0x407bef
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x407cec
cmp ecx, 4
jb 0x407d55
je 0x407d40
cmp ecx, 8
jbe 0x407d12
cmp ecx, 0x10
jbe 0x407c96
mov ebp, dword [0x5afee4]
imul ebp, edx
mov esi, dword [0x5afee8]
imul esi, edx
mov edi, dword [0x5afeec]
imul edi, edx
jmp 0x407c49
mov edx, ebx
lea ebp, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov ebx, dword [edx]
xor eax, ebx
imul ebx, eax, 0xbce2d621
rol ebx, 0xf
imul ebx, ebx, 0xc70f85e1
xor ebx, dword [edx + 4]
imul edx, ebx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ebp]
nop
nop
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ecx]
nop
nop
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x10], eax
ret
mov edx, ebx
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
imul edx, eax, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ecx]
nop
nop
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x407cec
mov ecx, dword [ebx]
xor eax, ecx
imul ecx, eax, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x407cec
mov edx, ebx
lea ebx, [ecx + ebx - 1]
movzx ebp, byte [edx]
xor eax, ebp
shr ecx, 1
movzx ecx, byte [edx + ecx]
shl ecx, 8
xor ecx, eax
movzx edx, byte [ebx]
shl edx, 0x10
xor edx, ecx
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x407cec
call fcn.00458070
jmp fcn.00407bc0
Function at 0x40b610
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b7e3
sub esp, 0x34
mov eax, dword [esp + 0x38]
cmp eax, 0x7000000
jle 0x40b7b6
mov eax, 0x7000000
mov dword [esp + 0x38], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x90]
mov ebx, dword [ecx + 0x94]
mov dword [ecx + 0x90], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x94], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.00459580
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x24]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x582580]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40b7d6
cmp ecx, 0x21
jae 0x40b7ca
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00451ac0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.00451b90
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x50f7f8]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x50f860]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b791
xorps xmm0, xmm0
mov eax, dword [esp + 0x38]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x50f8a8]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x3c], eax
add esp, 0x34
ret
test eax, eax
jne 0x40b63d
mov dword [esp + 0x3c], 0
add esp, 0x34
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00459660
mov eax, ecx
mov ecx, 0x21
call fcn.00459720
nop
call fcn.00458070
jmp fcn.0040b610
Function at 0x413690
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4138af
sub esp, 0x18
mov eax, dword [0x5afd88]
test eax, eax
jne 0x413898
nop
nop
lea eax, [0x5afd6c]
mov dword [esp], eax
call fcn.004093e0
mov eax, dword [0x5afd70]
test eax, eax
je 0x4136de
cmp dword [eax + 8], 0xcc
jne 0x4137a6
mov edx, dword [0x5afd64]
test edx, edx
jne 0x413788
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5b1778]
mov dword [esp + 8], eax
call fcn.0040b7f0
mov eax, dword [esp + 0xc]
mov dword [0x5afd64], eax
mov ecx, dword [0x5afd20]
mov dword [eax], ecx
mov eax, dword [0x5afd64]
mov dword [0x5afd20], eax
movzx eax, byte [0x5b0140]
test al, al
jne 0x413788
xor eax, eax
jmp 0x413745
lea esi, [0x5b0140]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x413788
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x41388e
lea edx, [0x57e114]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x413737
jmp 0x413882
mov edx, dword [0x5afd64]
mov ebx, dword [edx + 4]
mov dword [0x5afd64], ebx
mov ebx, dword [0x5afd70]
mov dword [edx + 4], ebx
mov dword [0x5afd70], edx
mov edx, dword [0x5afd70]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x413878
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004020b0
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x5afef0]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x413869
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x5afef0]
test edx, edx
jne 0x413846
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
mov byte [0x5afce8], 1
nop
lea eax, [0x5afd6c]
mov dword [esp], eax
call fcn.004095f0
add esp, 0x18
ret
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.004595d0
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.004595d0
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.004595d0
jmp 0x41382c
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.004595d0
mov eax, edx
jmp 0x413802
mov ecx, 0xcc
call fcn.00459660
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00459650
mov ecx, 5
call fcn.00459650
lea eax, [0x4e9e2c]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004307d0
nop
call fcn.00458070
jmp fcn.00413690
Function at 0x423060
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4231ce
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00420fa0
mov eax, dword [esp + 4]
test eax, eax
je 0x4231b7
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x78]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.0041f260
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.004093e0
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x4230f7
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x423115
movzx esi, word [ebp + 4]
cmp ebx, esi
jne 0x42310c
cmp byte [ebp + 6], dl
je 0x423171
cmp ebx, esi
jb 0x423115
jne 0x4230f5
cmp byte [ebp + 6], dl
jbe 0x4230f5
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.00422f60
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004095f0
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x423168
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x423168
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004095f0
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x4231ae
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x4231ae
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
lea eax, [0x4eb5a9]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.004307d0
nop
call fcn.00458070
jmp fcn.00423060
Function at 0x423310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42351a
sub esp, 0x28
nop
lea eax, [0x59c064]
mov dword [esp], eax
call fcn.004093e0
lea eax, [0x59c01c]
mov dword [esp], eax
call fcn.004143d0
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
nop
nop
lea ecx, [0x59c064]
mov dword [esp], ecx
call fcn.004095f0
mov eax, dword [esp + 0x24]
mov byte [eax + 6], 1
lea edi, [eax + 8]
mov ecx, dword [0x5afef0]
test ecx, ecx
jne 0x423508
mov ecx, dword [esp + 0x30]
mov dword [eax + 8], ecx
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x34]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x5afef0]
test ecx, ecx
jne 0x4234e5
mov ecx, dword [esp + 0x38]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x3c]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00423060
movzx eax, byte [esp + 8]
test al, al
je 0x423497
mov eax, dword [0x5afd88]
test eax, eax
jne 0x4233d5
mov byte [esp + 0x40], 1
add esp, 0x28
ret
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.0040fa00
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0xc]
nop
inc dword [ecx + 0x78]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x18], ecx
mov ebx, dword [ecx + 0x54]
test byte [ebx], al
test byte [eax], al
mov dword [esp], edx
lea eax, [ebx + 0xb84]
mov dword [esp + 0x1c], eax
mov dword [esp + 4], eax
call fcn.0041bb10
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 4
lea eax, [0x57e0c0]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.0041b9d0
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x4233cc
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x4233cc
mov dword [eax + 8], 0xfffffade
jmp 0x4233cc
nop
nop
lea eax, [0x59c064]
mov dword [esp], eax
call fcn.004093e0
nop
mov eax, dword [0x59c034]
sub eax, dword [0x59c01c]
mov dword [0x59c034], eax
mov eax, dword [0x59c028]
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov dword [0x59c028], ecx
nop
nop
lea eax, [0x59c064]
mov dword [esp], eax
call fcn.004095f0
mov byte [esp + 0x40], 0
add esp, 0x28
ret
lea ecx, [eax + 0x10]
mov edi, ecx
mov ebx, eax
mov eax, dword [esp + 0x38]
call fcn.004595d0
lea edi, [ebx + 0x14]
mov eax, dword [esp + 0x3c]
call fcn.004595d0
mov eax, ebx
jmp 0x4233a5
mov ecx, eax
mov eax, dword [esp + 0x30]
call fcn.004595d0
mov eax, ecx
jmp 0x42337e
call fcn.00458070
jmp fcn.00423310
Function at 0x423660
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x423770
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x4236eb
cmp cl, 2
jne 0x423759
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00428a80
nop
nop
lea eax, [0x59c064]
mov dword [esp], eax
call fcn.004093e0
nop
mov eax, dword [0x59c058]
sub eax, dword [0x59c040]
mov dword [0x59c058], eax
mov eax, dword [0x59c04c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x59c04c], ecx
nop
nop
lea eax, [0x59c064]
mov dword [esp], eax
call fcn.004095f0
add esp, 0x14
ret
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413690
nop
nop
lea eax, [0x59c064]
mov dword [esp], eax
call fcn.004093e0
nop
mov eax, dword [0x59c034]
sub eax, dword [0x59c01c]
mov dword [0x59c034], eax
mov eax, dword [0x59c028]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x59c028], ecx
nop
lea eax, [0x59c064]
mov dword [esp], eax
call fcn.004095f0
jmp 0x4236e7
lea eax, [0x4e7129]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004307d0
nop
call fcn.00458070
jmp fcn.00423660
Function at 0x42f2c0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x14]
test edx, edx
je 0x42f3fb
lea ebx, [esp + 0x24]
cmp dword [edx + 8], ebx
jne 0x42f3f7
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], edx
lea edi, [ecx + 0x14]
mov dword [esp + 0x14], edi
movzx ebx, byte [edx + 6]
test bl, bl
jne 0x42f3b1
mov ebx, dword [edx]
test ebx, ebx
jne 0x42f374
mov ebx, dword [edx + 0x10]
mov ebp, dword [0x5afef0]
test ebp, ebp
jne 0x42f360
mov dword [edx + 0x10], 0
mov dword [esp + 0x10], ebx
test byte [ecx], al
mov ebp, dword [0x5afef0]
mov eax, dword [edx + 0x18]
test ebp, ebp
jne 0x42f359
mov dword [ecx + 0x14], eax
mov dword [esp], edx
call fcn.0042f050
mov eax, dword [esp + 0x10]
test byte [eax], al
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00459220
add esp, 0x20
ret
call fcn.004595d0
jmp 0x42f333
lea ebp, [edx + 0x10]
mov eax, edi
mov edi, ebp
mov esi, eax
xor eax, eax
call fcn.004595d0
mov edi, esi
jmp 0x42f31d
cmp ebx, 4
jne 0x42f388
lea ebx, [edx + 0x28]
test byte [ebx], al
mov ebx, dword [edx + 0x28]
nop
mov dword [esp + 0x24], ebx
jmp 0x42f309
nop
lea eax, [esp + 0x24]
mov dword [esp], eax
lea ecx, [edx + 0x28]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.00459f00
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
jmp 0x42f309
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.0042f720
movzx eax, byte [esp + 8]
test al, al
je 0x42f3ff
mov ecx, dword [esp + 0xc]
test byte [ecx], al
mov edx, dword [0x5afef0]
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x18]
test edx, edx
jne 0x42f3ec
mov dword [ecx + 0x14], eax
mov dword [esp], ebx
call fcn.0042f050
add esp, 0x20
ret
mov edi, dword [esp + 0x14]
call fcn.004595d0
jmp 0x42f3e0
add esp, 0x20
ret
add esp, 0x20
ret
lea eax, [0x4ee5c0]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.004307d0
nop
int3