joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016d0
Capabilities:
Identify system language via api
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x214]
sub esp, 0x288
mov dword [ebp - 0x270], eax
mov dword [esp], str.msi.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
xor ecx, ecx
sub esp, 4
mov word [ebp - 0x214], cx
mov edi, eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
sub esp, 0xc
test eax, eax
jne 0x40172c
test byte [section..data], 2
jne 0x4018d4
lea eax, [ebp - 0x268]
mov dword [esp + 0x10], 0
xor edx, edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x264]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [ebp - 0x268], 0x28
mov word [ebp - 0x264], dx
call sym._MsiGetFileVersionW_20
sub esp, 0x14
test eax, eax
je 0x40177f
test byte [section..data], 2
jne 0x4018a7
mov edx, dword [sym.imp.user32.dll_LoadStringW]
lea eax, [ebp - 0x26c]
mov dword [esp], edi
mov dword [esp + 0xc], 0
mov dword [ebp - 0x27c], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0xa
call edx
mov ecx, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x268], eax
add eax, 1
sub esp, 0x10
lea ebx, [eax + eax]
mov dword [ebp - 0x274], ecx
mov dword [esp], ebx
add ebx, 0x50
mov dword [ebp - 0x278], eax
call ecx
mov dword [esp], ebx
mov ecx, dword [ebp - 0x274]
mov dword [ebp - 0x26c], eax
mov esi, eax
call ecx
mov ebx, eax
test eax, eax
je 0x401882
test esi, esi
je 0x401882
xor eax, eax
mov edx, dword [ebp - 0x27c]
mov word [esi], ax
mov eax, dword [ebp - 0x278]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xa
mov dword [esp], edi
call edx
lea eax, [ebp - 0x264]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x26c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x268]
add eax, 0x29
mov dword [esp + 4], eax
call sym._swprintf
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
mov dword [esp + 0x14], 0
movzx eax, ax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call sym._MsiMessageBoxW_24
sub esp, 0x18
mov eax, dword [ebp - 0x26c]
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], eax
call esi
mov dword [esp], ebx
call esi
mov eax, dword [ebp - 0x270]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.MsiGetFileVersion_failed_with__ld_n
mov dword [esp + 8], str.ShowUsage
mov dword [esp + 4], 0x407000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x40177f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.GetModuleFileName_failed:__ld_n
mov dword [esp + 8], str.ShowUsage
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x407000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x40172c
Function at 0x401a20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x10
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 6]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x401a82
xor ecx, ecx
lea esi, [esi]
movzx ebx, word [edi + ecx]
mov word [eax + ecx + 4], bx
add ecx, 2
test bx, bx
jne 0x401a50
mov edx, dword [esi]
mov dword [eax], 0
test edx, edx
je 0x401a78
lea esi, [esi]
mov esi, edx
mov edx, dword [edx]
test edx, edx
jne 0x401a70
mov dword [esi], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [section..data], 2
jne 0x401a98
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.Out_of_memory__n
mov dword [esp + 8], str.StringListAppend
mov dword [esp + 4], 0x407000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x401a8b

Function at 0x401d50
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
lea ebx, [ebp - 0x804]
sub esp, 0x81c
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x800
mov dword [esp + 8], ebx
mov dword [esp], 6
mov dword [esp + 4], 0
call dword [sym.imp.ucrtbase.dll___stdio_common_vsprintf]
mov eax, dword [0x409004]
test eax, eax
je 0x401db8
mov dword [esp + 4], ebx
mov dword [esp], 0x40807e
call sym._wine_dbg_printf
mov ebx, dword [ebp - 4]
leave
ret
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
mov dword [esp + 4], ebx
movzx eax, ax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.MsiExec
mov dword [esp], 0
call sym._MsiMessageBoxA_24
mov ebx, dword [ebp - 4]
sub esp, 0x18
leave
ret

Function at 0x401e00
Capabilities:
Accept command line arguments
Create service
Delete service
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0xc
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esi], eax
sub esp, 0xc
test eax, eax
je 0x401e4d
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
test eax, eax
je 0x401e71
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp], str.Unable_to_load_dll__s_n
mov dword [esp + 4], eax
call sym._report_error
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], str.Dll__s_does_not_implement_function__s_n
call sym._report_error
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
push eax
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x405c00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [esp + 4], sym._ServiceCtrlHandler_4
mov dword [esp], str.MSIServer
call dword [sym.imp.advapi32.dll_RegisterServiceCtrlHandlerA]
mov dword [0x409010], eax
sub esp, 8
test eax, eax
je 0x405d00
mov eax, 2
call sym._UpdateSCMStatus.constprop.0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [0x409008], eax
sub esp, 0x10
test eax, eax
je 0x405d10
lea eax, [ebp - 4]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._ServiceExecutionThread_4
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [0x40900c], eax
sub esp, 0x18
test eax, eax
je 0x405ce0
mov eax, 4
call sym._UpdateSCMStatus.constprop.0
mov eax, dword [0x40900c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, 1
sub esp, 8
call sym._UpdateSCMStatus.constprop.0
leave
ret 8
mov dword [esp], str.Failed_to_create_thread_n
call sym._report_error
call sym._KillService
mov eax, 1
call sym._UpdateSCMStatus.constprop.0
leave
ret 8
mov dword [esp], str.Failed_to_register_service_ctrl_handler_n
call sym._report_error
leave
ret 8
mov dword [esp], str.Failed_to_create_event_n
call sym._report_error
call sym._KillService
mov eax, 1
call sym._UpdateSCMStatus.constprop.0
leave
ret 8

Function at 0x405f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x405f58
cmp byte [esi + ebx - 1], 0xa
je 0x405f2c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4090a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x406580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x406758
mov edi, dword [0x4090a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x406667
test byte [0x407028], 8
jne 0x406700
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x407038], 8
jne 0x4066c0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x406609
cmp esi, 3
jbe 0x406678
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x40661a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x408aec]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x406609
mov dword [esp], 0x407038
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x4065e0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x4065e0
mov dword [esp], 0x407028
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x4065cb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x4065d3
mov eax, 0xffffffff
jmp 0x406667

Function at 0x4067d0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x406890
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call sym.___main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40690f
cmp al, 9
je 0x406900
cmp al, 0x20
je 0x406900
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp al, 0x5c
je 0x406968
cmp al, 0x22
je 0x406978
mov dword [ebp - 0x54], 0
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x40690f
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x4068c0
test edi, 1
jne 0x4068c0
lea esi, [esi]
movzx eax, byte [ebx + 1]
add ebx, 1
cmp al, 9
je 0x406900
cmp al, 0x20
je 0x406900
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x24], 1
jne 0x40692a
mov word [ebp - 0x20], 1
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [ebp - 0x54], 1
jmp 0x4068d7
and dword [ebp - 0x54], 1
jne 0x4068d0
xor edi, 1
jmp 0x4068d7
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x3b2520e0
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..idata
mov ebx, 0x42e3d0
nop
mov ecx, 0x776f3124
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x7c826e7c
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, str.NeR
nop
mov ebx, 0x42f314
nop
mov ecx, 0x1bc0074e
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4092b0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4093d6
sub esp, 0x2c
movsd xmm0, qword [esp + 0x30]
movsd qword [esp], xmm0
call fcn.004094b0
mov eax, dword [esp + 0xc]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
mov edi, dword [esp + 8]
shl ebx, 5
shr edi, 0x1b
or edi, ebx
lea ebx, [0x5b96c0]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x4093c9
cmp ecx, 0x21
jae 0x4093bd
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00462820
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x24], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.004628a0
movsd xmm0, qword [esp + 0x24]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x526404]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd qword [esp + 0x38], xmm0
add esp, 0x2c
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00468a10
mov eax, ecx
mov ecx, 0x21
call fcn.00468ac0
nop
call fcn.00467570
jmp fcn.004092b0
Function at 0x417ac0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x417ce1
sub esp, 0x18
mov eax, dword [0x61d104]
test eax, eax
jne 0x417cca
lea eax, [0x61d0f0]
mov dword [esp], eax
call fcn.0040ae80
mov eax, dword [0x61d0f4]
test eax, eax
je 0x417b08
cmp dword [eax + 8], 0xcc
jne 0x417b7e
mov edx, dword [0x61d0e8]
test edx, edx
jne 0x417b60
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x61fa10]
mov dword [esp + 8], eax
call fcn.0040d560
mov eax, dword [esp + 0xc]
mov dword [0x61d0e8], eax
mov ecx, dword [0x61d0ac]
mov dword [eax], ecx
mov eax, dword [0x61d0e8]
mov dword [0x61d0ac], eax
movzx eax, byte [0x61d680]
test al, al
jne 0x417b60
xor eax, eax
jmp 0x417c76
mov edx, dword [0x61d0e8]
mov ebx, dword [edx + 4]
mov dword [0x61d0e8], ebx
mov ebx, dword [0x61d0f4]
mov dword [edx + 4], ebx
mov dword [0x61d0f4], edx
mov edx, dword [0x61d0f4]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x417c5e
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402910
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x61d360]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x417bdc
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x417be9
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00468980
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x61d360]
test edx, edx
jne 0x417c15
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x417c36
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00468980
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00468980
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00468980
lea eax, [0x61d0f0]
mov dword [esp], eax
call fcn.0040b080
lea eax, [0x61d0ec]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402440
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00468a10
lea esi, [0x61d680]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x417b60
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x417cc0
lea edx, [0x5b52bc]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x417c68
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00468a00
mov ecx, 5
call fcn.00468a00
lea eax, [0x5178f6]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0043b160
nop
call fcn.00467570
jmp fcn.00417ac0
Function at 0x42bac0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42bbe7
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00429130
mov eax, dword [esp + 4]
test eax, eax
je 0x42bbd0
mov dword [esp + 0xc], eax
call fcn.0044c230
mov eax, dword [esp]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0xc]
mov dword [esp], ecx
call fcn.004268f0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00428cd0
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
movzx edx, byte [ecx + 6]
mov byte [esp + 0xb], dl
mov ebx, dword [esp + 0xc]
lea ebp, [ebx + 0x48]
mov dword [esp + 0x18], ebp
mov dword [esp], ebp
call fcn.0040ae80
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x42bb58
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42bb99
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x42bb6d
cmp byte [ebp + 6], dl
je 0x42bb78
cmp esi, ebx
ja 0x42bb99
jne 0x42bb56
cmp byte [ebp + 6], dl
jbe 0x42bb56
jmp 0x42bb99
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040b080
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0044c250
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.0042b8d0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040b080
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0044c250
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x5193a0]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.0043b160
nop
call fcn.00467570
jmp fcn.0042bac0

Function at 0x42c0e0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42c1d9
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x42c164
cmp cl, 2
je 0x42c11d
cmp cl, 3
jne 0x42c1c2
mov byte [eax + 8], 1
jmp 0x42c1be
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00431b70
lea eax, [0x6016b8]
mov dword [esp], eax
call fcn.0040ae80
lea eax, [0x601668]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00418b20
lea eax, [0x6016b8]
mov dword [esp], eax
call fcn.0040b080
jmp 0x42c1be
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00417ac0
lea eax, [0x6016b8]
mov dword [esp], eax
call fcn.0040ae80
lea eax, [0x601640]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00418b20
lea eax, [0x6016b8]
mov dword [esp], eax
call fcn.0040b080
add esp, 0x14
ret
lea eax, [0x5145e9]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0043b160
nop
call fcn.00467570
jmp fcn.0042c0e0
Function at 0x45b9e0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45bae0
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.0045c320
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4f6da0]
mov dword [esp], ecx
call fcn.0040d2f0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x601750]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.0045aef0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.0045a510
add esp, 0x28
ret
call fcn.00467570
jmp fcn.0045b9e0