joyce8/EMBER2024-capa huggingface dataset:
Function at 0x517740
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
cmp eax, 0xcc
je 0x517832
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x174]
mov edx, dword [ecx]
call edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x6c], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0xcc
jmp 0x517832
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
test eax, eax
je 0x5177c5
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6c]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x54]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 8]
mov edx, dword [ecx]
call edx
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x6c]
push 0
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x6c]
mov eax, dword [ebp - 4]
mov edx, 0
mov edi, dword [ebp - 4]
mov ebx, dword [edi + 0x178]
mov ebx, dword [ebx + 4]
call ebx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6c]
cmp edx, esi
jne 0x5177f9
mov byte [ebp - 8], 0
jmp 0x517864
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6c]
mov eax, dword [ebp - 4]
cmp edx, dword [eax + 0x54]
jb 0x517790
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x174]
mov edx, dword [ecx + 4]
call edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x174]
mov edx, dword [ecx]
call edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x6c], 0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x174]
cmp byte [edx + 8], 0
jne 0x5177f9
mov eax, dword [ebp - 4]
cmp byte [eax + 0x41], 0
je 0x517856
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0xce
jmp 0x517860
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0xcd
mov byte [ebp - 8], 1
mov al, byte [ebp - 8]
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
leave
ret
Function at 0x544eb0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 4], eax
cmp byte [0x631b80], 0
jne 0x544ec7
jmp 0x544fa6
mov dword [ebp - 0x58], 8
mov eax, fcn.0053f070
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
call fcn.00410c00
mov dword [ebp - 0x48], eax
mov eax, str.MAINICON
push eax
push dword [0x63bd90]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x544f09
jmp 0x544f18
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x44], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov eax, str.Window
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x58]
push eax
call sub.user32.dll_RegisterClassW
movzx eax, ax
test eax, eax
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
jne 0x544f57
jmp 0x544fa1
mov eax, dword [ebp - 0x58]
or eax, 0x800
mov dword [ebp - 0x58], eax
mov eax, dword [0x631b90]
cmp eax, 6
jae 0x544f6e
jmp 0x544f79
mov eax, dword [ebp - 0x58]
or eax, 0x20000
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0
mov eax, str.HintWindow
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x58]
push eax
call sub.user32.dll_RegisterClassW
movzx eax, ax
test eax, eax
setne byte [ebp - 8]
jmp 0x545080
mov dword [ebp - 0x30], 8
mov eax, fcn.0053f070
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.00410c00
mov dword [ebp - 0x20], eax
mov eax, str.MAINICON
push eax
push dword [0x63bd90]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x544fe8
jmp 0x544ff7
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, 0x605740
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassA
movzx eax, ax
test eax, eax
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
jne 0x545036
jmp 0x545080
mov eax, dword [ebp - 0x30]
or eax, 0x800
mov dword [ebp - 0x30], eax
mov eax, dword [0x631b90]
cmp eax, 6
jae 0x54504d
jmp 0x545058
mov eax, dword [ebp - 0x30]
or eax, 0x20000
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov eax, 0x605750
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassA
movzx eax, ax
test eax, eax
setne byte [ebp - 8]
mov al, byte [ebp - 8]
leave
ret
Function at 0x546150
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax - 0x14]
test eax, eax
jne 0x546183
jmp 0x546209
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax - 0x1c]
cmp eax, 0
jg 0x5461a1
jmp 0x546209
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.0040b8a0
call fcn.0040d8a0
push eax
test eax, eax
jne 0x5461e6
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
call fcn.0040bb70
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x546205
dec eax
test eax, eax
je 0x546200
call fcn.0040bce0
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
mov ebx, dword [ebp - 0x38]
leave
ret
Function at 0x5a1270
Capabilities:
Encode data using xor

Disassembly:
mov byte [0x2a4137e8], al
lahf
test dword [0xc138c99d], edi
aaa
inc ecx
sub bl, byte [edi - 0x3662c27b]
cmp cl, al
sbb ebp, eax
stosd dword es:[edi], eax
outsb dx, byte [esi]
cmpsb byte [esi], byte es:[edi]
cmp eax, 0x2da69320
sub al, 0x91
cmpsb byte [esi], byte es:[edi]
xor eax, 0xe0686c24
mov esp, ecx
jo 0x5a11f9
mov ch, byte [ecx]
imul esp, ebp, 0x37
inc eax
lahf
lodsb al, byte [esi]
dec eax
retf 0xe060
jb 0x5a11f7
cmp dword [edi + 0x70442c3d], esp
rol cl, 1
xchg esi, eax
psrld mm7, mm6
aas
sbb ebp, eax
mov ebx, 0xabe833be
dec esp
cmpsb byte [esi], byte es:[edi]
sub eax, 0xf0606c30
ret 0x338e

Function at 0x5a2410
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ebx
mov dword [ebp - 4], esi
cmp byte [0x624a20], 0
je 0x5a2434
mov eax, 0x624a70
test eax, eax
setne bl
jmp 0x5a251a
mov eax, str.USER32
push eax
call sub.kernel32.dll_GetModuleHandleA
mov esi, eax
test eax, eax
je 0x5a24cb
mov eax, str.GetSystemMetrics
push eax
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x624a30], eax
mov eax, str.MonitorFromWindow
push eax
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x624a40], eax
mov eax, str.MonitorFromRect
push eax
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x624a50], eax
mov eax, str.MonitorFromPoint
push eax
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x624a60], eax
mov eax, str.EnumDisplayMonitors
push eax
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x624a80], eax
mov eax, str.GetMonitorInfoA
push eax
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x624a70], eax
mov eax, str.EnumDisplayDevicesA
push eax
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x624a90], eax
mov byte [0x624a20], 1
mov bl, 1
jmp 0x5a251a
mov dword [0x624a30], 0
mov dword [0x624a40], 0
mov dword [0x624a50], 0
mov dword [0x624a60], 0
mov dword [0x624a80], 0
mov dword [0x624a70], 0
mov dword [0x624a90], 0
mov byte [0x624a20], 1
mov bl, 0
mov al, bl
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
leave
ret
Function at 0x5d0110
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
mov byte [ebp - 4], dl
push 0
movzx eax, byte [ebp - 4]
push eax
call sub.user32.dll_MapVirtualKeyA
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 4]
bt dword [0x63a950], eax
jae 0x5d0151
push 0
mov cl, byte [ebp - 0xc]
mov al, byte [ebp - 4]
mov ebx, dword [ebp - 8]
mov dl, al
mov eax, ebx
call fcn.005d02a0
jmp 0x5d0161
push 2
mov cl, byte [ebp - 0xc]
mov dl, byte [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.005d02a0
mov ebx, dword [ebp - 0x10]
leave
ret

Function at 0x5d0170
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0xc], eax
mov byte [ebp - 4], dl
mov word [ebp - 8], cx
mov al, byte [ebp - 4]
cmp al, 0x90
jne 0x5d01e9
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
or al, al
setne al
mov byte [ebp - 0x18], al
lea eax, [ebp - 0x118]
push eax
call sub.user32.dll_GetKeyboardState
cmp byte [ebp - 0x18], 0
je 0x5d01d1
mov eax, dword [ebp - 0x88]
and eax, 0xfe
mov byte [ebp - 0x88], al
jmp 0x5d01d8
or byte [ebp - 0x88], 1
lea eax, [ebp - 0x118]
push eax
call sub.user32.dll_SetKeyboardState
jmp 0x5d0285
push 0
movzx eax, byte [ebp - 4]
push eax
call sub.user32.dll_MapVirtualKeyA
mov byte [ebp - 0x14], al
mov bx, word [ebp - 8]
mov word [ebp - 0x10], 1
cmp bx, word [ebp - 0x10]
jb 0x5d0285
dec word [ebp - 0x10]
inc word [ebp - 0x10]
movzx eax, byte [ebp - 4]
bt dword [0x63a950], eax
jae 0x5d0251
push 1
mov cl, byte [ebp - 0x14]
mov al, byte [ebp - 4]
mov esi, dword [ebp - 0xc]
mov dl, al
mov eax, esi
call fcn.005d02a0
cmp byte [ebp + 8], 0
je 0x5d027f
push 3
mov cl, byte [ebp - 0x14]
mov al, byte [ebp - 4]
mov esi, dword [ebp - 0xc]
mov dl, al
mov eax, esi
call fcn.005d02a0
jmp 0x5d027f
push 0
mov cl, byte [ebp - 0x14]
mov al, byte [ebp - 4]
mov esi, dword [ebp - 0xc]
mov dl, al
mov eax, esi
call fcn.005d02a0
cmp byte [ebp + 8], 0
je 0x5d027f
push 2
mov cl, byte [ebp - 0x14]
mov al, byte [ebp - 4]
mov esi, dword [ebp - 0xc]
mov dl, al
mov eax, esi
call fcn.005d02a0
cmp bx, word [ebp - 0x10]
ja 0x5d0210
mov ebx, dword [ebp - 0x120]
mov esi, dword [ebp - 0x11c]
leave
ret 4

Function at 0x5d0380
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0x86
jl 0x5d03d9
sub eax, 0x86
je 0x5d039f
dec eax
je 0x5d03bc
jmp 0x5d03d9
mov eax, dword [0x6404a0]
test eax, eax
setg byte [ebp - 8]
cmp byte [ebp - 8], 0
je 0x5d03e8
mov dword [0x6404a0], 0
jmp 0x5d03e8
mov eax, dword [0x6404a0]
test eax, eax
setl byte [ebp - 8]
cmp byte [ebp - 8], 0
je 0x5d03e8
mov dword [0x6404a0], 0
jmp 0x5d03e8
push dword [ebp - 4]
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl byte [ebp - 8]
mov al, byte [ebp - 8]
leave
ret
Function at 0x5d0ef0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 4]
test edx, edx
jne 0x5d0f0e
mov edx, 0x63bde0
lea esi, [ebp + 0xc]
push esi
push ecx
lea ecx, [ebp - 8]
push ecx
push 0
push edx
push dword [eax + 0xc]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x5d0f2d
mov eax, 0xffffffff
jmp 0x5d0f76
mov edx, dword [ebp - 8]
cmp edx, 1
jne 0x5d0f3d
mov dword [ebx], 1
jmp 0x5d0f73
mov edx, dword [ebp - 8]
cmp edx, 2
jne 0x5d0f4d
mov dword [ebx], 2
jmp 0x5d0f73
mov edx, dword [ebp - 8]
cmp edx, 4
jne 0x5d0f5d
mov dword [ebx], 4
jmp 0x5d0f73
mov edx, dword [ebp - 8]
cmp edx, 3
jne 0x5d0f6d
mov dword [ebx], 3
jmp 0x5d0f73
mov dword [ebx], 0
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
leave
ret 8

Function at 0x5d0f80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edx
mov ebx, ecx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x5d0f9a
mov edx, 0x63bde0
lea ecx, [ebx + 4]
push ecx
push 0
mov ecx, ebx
push ecx
push 0
push edx
push dword [eax + 0xc]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete al
test al, al
jne 0x5d0fc4
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov ebx, dword [ebp - 8]
leave
ret

Function at 0x5d1230
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
test edx, edx
je 0x5d1257
dec edx
je 0x5d125e
dec edx
je 0x5d1265
dec edx
je 0x5d1273
dec edx
je 0x5d126c
jmp 0x5d1278
mov esi, 0
jmp 0x5d1278
mov esi, 1
jmp 0x5d1278
mov esi, 2
jmp 0x5d1278
mov esi, 4
jmp 0x5d1278
mov esi, 3
mov edx, dword [ebp - 4]
test edx, edx
jne 0x5d1284
mov edx, 0x63bde0
push ebx
push ecx
push esi
push 0
push edx
push dword [eax + 0xc]
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete al
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
leave
ret 8
Function at 0x43a08d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
call 0x43a096
pop eax
mov esi, dword fs:[0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
push esi
mov ebx, dword [esi + 8]
cmp eax, ebx
jb 0x43a0b9
mov ecx, dword [esi + 0x10]
add ecx, ebx
cmp eax, ecx
ja 0x43a0b9
mov eax, ebx
jmp 0x43a0ce
mov esi, dword [esi]
mov ebx, dword [esi]
cmp ebx, dword [esp]
jne 0x43a0a5
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
pop esi
pop esi
leave
ret
Function at 0x464ef7
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x464f2f
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x464f1d
mov al, 1
jmp 0x464f8e
cmp dword [ebx + 0x54], ecx
jne 0x464f26
mov al, 2
jmp 0x464f8e
cmp dword [ebx + 0x7c], ecx
jne 0x464f8e
mov al, 3
jmp 0x464f8e
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x464f44
mov al, 4
jmp 0x464f8e
cmp ecx, 5
jne 0x464f64
cmp ebx, 0
jne 0x464f52
mov al, 5
jmp 0x464f8e
cmp ebx, 1
jne 0x464f5b
mov al, 6
jmp 0x464f8e
cmp ebx, 2
jne 0x464f64
mov al, 7
jmp 0x464f8e
cmp ecx, 6
jne 0x464f8c
cmp ebx, 0
jne 0x464f72
mov al, 8
jmp 0x464f8e
cmp ebx, 1
jne 0x464f79
mov al, 9
cmp ebx, 2
jne 0x464f80
mov al, 0xa
cmp ebx, 3
jne 0x464f87
mov al, 0xb
cmp ebx, 4
jne 0x464f8e
mov al, 0xc
pop ebx
leave
ret

Function at 0x4e6868
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x8000
jg 0x4e6982
je 0x4e6979
cmp eax, 0x80
jg 0x4e68ff
je 0x4e68f6
cmp eax, 8
jg 0x4e68c8
je 0x4e68bf
cmp eax, 0x80000000
je 0x4e68b6
cmp eax, 2
je 0x4e68ad
cmp eax, 4
jne 0x4e6a65
mov eax, 2
pop ebp
ret 4
mov eax, 1
pop ebp
ret 4
mov eax, 0x1f
pop ebp
ret 4
mov eax, 3
pop ebp
ret 4
cmp eax, 0x10
je 0x4e68ed
cmp eax, 0x20
je 0x4e68e4
cmp eax, 0x40
jne 0x4e6a65
mov eax, 6
pop ebp
ret 4
mov eax, 5
pop ebp
ret 4
mov eax, 4
pop ebp
ret 4
mov eax, 7
pop ebp
ret 4
cmp eax, 0x800
jg 0x4e6945
je 0x4e693c
cmp eax, 0x100
je 0x4e6933
cmp eax, 0x200
je 0x4e692a
cmp eax, 0x400
jne 0x4e6a65
mov eax, 0xa
pop ebp
ret 4
mov eax, 9
pop ebp
ret 4
mov eax, 8
pop ebp
ret 4
mov eax, 0xb
pop ebp
ret 4
cmp eax, 0x1000
je 0x4e6970
cmp eax, 0x2000
je 0x4e6967
cmp eax, 0x4000
jne 0x4e6a65
mov eax, 0xe
pop ebp
ret 4
mov eax, 0xd
pop ebp
ret 4
mov eax, 0xc
pop ebp
ret 4
mov eax, 0xf
pop ebp
ret 4
cmp eax, 0x800000
jg 0x4e6a0e
je 0x4e6a05
cmp eax, 0x80000
jg 0x4e69d5
je 0x4e69cc
cmp eax, 0x10000
je 0x4e69c3
cmp eax, 0x20000
je 0x4e69ba
cmp eax, 0x40000
jne 0x4e6a65
mov eax, 0x12
pop ebp
ret 4
mov eax, 0x11
pop ebp
ret 4
mov eax, 0x10
pop ebp
ret 4
mov eax, 0x13
pop ebp
ret 4
cmp eax, 0x100000
je 0x4e69fc
cmp eax, 0x200000
je 0x4e69f3
cmp eax, 0x400000
jne 0x4e6a65
mov eax, 0x16
pop ebp
ret 4
mov eax, 0x15
pop ebp
ret 4
mov eax, 0x14
pop ebp
ret 4
mov eax, 0x17
pop ebp
ret 4
cmp eax, 0x8000000
jg 0x4e6a50
je 0x4e6a47
cmp eax, 0x1000000
je 0x4e6a3e
cmp eax, 0x2000000
je 0x4e6a35
cmp eax, 0x4000000
jne 0x4e6a65
mov eax, 0x1a
pop ebp
ret 4
mov eax, 0x19
pop ebp
ret 4
mov eax, 0x18
pop ebp
ret 4
mov eax, 0x1b
pop ebp
ret 4
cmp eax, 0x10000000
je 0x4e6a7d
cmp eax, 0x20000000
je 0x4e6a74
cmp eax, 0x40000000
je 0x4e6a6b
xor eax, eax
pop ebp
ret 4
mov eax, 0x1e
pop ebp
ret 4
mov eax, 0x1d
pop ebp
ret 4
mov eax, 0x1c
pop ebp
ret 4
Function at 0x508d62
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x508e37
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x508e37
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x508e37
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x508dbd
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x508e37
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x508e02
test dl, dl
je 0x508dfe
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x508e02
add ecx, 2
add eax, 2
test dl, dl
jne 0x508de2
xor eax, eax
jmp 0x508e07
sbb eax, eax
or eax, 1
test eax, eax
jne 0x508e19
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x508e24
inc esi
cmp esi, ebp
jae 0x508e37
mov edx, dword [esp + 0x10]
jmp 0x508dd8
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x50909b
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x5090a6
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x5090ba
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x5090be
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x5090f7
cmp dword [edi + ecx], 0x4550
jne 0x5090f7
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x5090f7
test byte [edi + ecx + 0x16], 2
je 0x5090f7
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x5090fc
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x509138
xor eax, eax
jmp 0x50911b
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x509141
inc edx
movzx eax, dx
cmp eax, edi
jl 0x50911b
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x509147
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x50917f
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x50918d
add edx, 0x20
cmp eax, edx
jne 0x50919e
test bx, bx
je 0x5091d3
add esi, 2
add edi, 2
jmp 0x50916f
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x5091ac
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x5091ba
add edx, 0x20
sub ecx, edx
je 0x5091d3
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x509168
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x5091ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x5092c5
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x5092c5
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x5092c5
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x50924b
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x5092c5
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x509290
test dl, dl
je 0x50928c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x509290
add ecx, 2
add eax, 2
test dl, dl
jne 0x509270
xor eax, eax
jmp 0x509295
sbb eax, eax
or eax, 1
test eax, eax
jne 0x5092a7
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x5092b2
inc esi
cmp esi, ebp
jae 0x5092c5
mov edx, dword [esp + 0x10]
jmp 0x509266
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8