joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cc66
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x423bbc], ebx
push esi
push edi
jne 0x41cce6
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x41cd21
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4203bc
push edi
call esi
test eax, eax
mov dword [0x423bbc], eax
je 0x41cd21
push 0x4203ac
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x423bc0], eax
call esi
cmp dword [0x423960], 2
mov dword [0x423bc4], eax
jne 0x41cce6
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x423bcc], eax
je 0x41cce6
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x423bc8], eax
mov eax, dword [0x423bc8]
test eax, eax
je 0x41cd2b
call eax
test eax, eax
je 0x41cd12
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x423bcc]
test eax, eax
je 0x41cd12
test byte [ebp - 8], 1
jne 0x41cd2b
cmp dword [0x42396c], 4
jb 0x41cd25
or byte [ebp + 0x12], 0x20
jmp 0x41cd4a
xor eax, eax
jmp 0x41cd5a
or byte [ebp + 0x12], 4
jmp 0x41cd4a
mov eax, dword [0x423bc0]
test eax, eax
je 0x41cd4a
call eax
mov ebx, eax
test ebx, ebx
je 0x41cd4a
mov eax, dword [0x423bc4]
test eax, eax
je 0x41cd4a
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x423bbc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41cdfb
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00414ef0
mov eax, dword [0x42221c]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x424e40]
mov dword [ebp - 4], eax
jae 0x41cf3e
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x424e60]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x41cf3e
push 1
push esi
push ebx
call fcn.00415580
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 0x1008], eax
je 0x41cf48
push 2
push esi
push ebx
call fcn.00415580
add esp, 0xc
cmp eax, 0xffffffff
je 0x41cf48
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x41cee8
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00419f70
push 0x8000
push ebx
call fcn.0041dd3a
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x41cea7
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.00417b0f
add esp, 0xc
cmp eax, 0xffffffff
je 0x41cec5
sub edi, eax
test edi, edi
jg 0x41ce9c
jmp 0x41cedb
cmp dword [0x423958], 5
jne 0x41ced8
mov dword [0x423954], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.0041dd3a
pop ecx
pop ecx
jmp 0x41cf28
jge 0x41cf28
push 0
push dword [ebp + 0xc]
push ebx
call fcn.00415580
push ebx
call fcn.0041b20c
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x41cf28
mov dword [0x423954], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x423958], eax
push 0
push dword [ebp - 0x1008]
push ebx
call fcn.00415580
add esp, 0xc
mov eax, esi
pop edi
jmp 0x41cf4b
mov dword [0x423954], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0041a0f9
leave
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
or esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
push edx
pop edi
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
push esi
pop eax
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
push eax
pop esi
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x220e454
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov eax, 0
jmp 0x23bd337
add ebp, edx
jmp 0x218b86f
jmp ebp
push eax
cbw
bswap eax
push edx
push ebx
push edi
setp al
rdtsc
movzx edi, si
pushfd
rdtsc
push esi
jmp 0x214918f
lea edi, [edi + eax]
bts bp, dx
sbb eax, edi
mov esi, esp
lea esp, [esp - 0xc0]
mov ebx, edi
mov eax, 0
add edx, ebx
test bh, bh
sub ebx, eax
lea ebp, [0x21eff02]
or dl, cl
mov edx, 0x4a1850e8
mov edx, dword [edi]
cmp ecx, 0x29de7353
add edi, 4
test bp, 0xb7a
xor edx, ebx
stc
rol edx, 1
jmp 0x227232a
push ecx
jmp 0x218d52f
dec edx
clc
rol edx, 1
jmp 0x23be020
push eax
mov edi, dword [esp + 0x28]
inc bp
inc edi
bts ebx, ebp
sbb edx, 0x4d956881
neg edi
bswap edi
mov dx, 0x530c
xor edi, 0x72227a69
cmp cx, si
sub edi, 0x4de944b6
inc bx
not dl
setno dh
bswap edi
inc edi
jmp 0x21efee3
dec edx
xor ebx, edx
test ebx, edx
jmp 0x216603a
Function at 0x4a18d0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a199b
add byte [eax], al
invalid
jmp 0x4a198f

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x10151320
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov ecx, 0x10324284
call fcn.100c0238
mov eax, dword [0x102fcc54]
mov dword [ebp - 4], eax
jmp 0x10151345
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x1015135b
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x10151359
mov eax, dword [ebp - 4]
jmp 0x101513d5
jmp 0x1015133d
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x101513d2
mov eax, dword [ebp - 4]
add eax, 0x20
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
cmp eax, 0xfe0
jbe 0x10151395
mov eax, dword [ebp - 4]
mov ecx, dword [0x102fcc54]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov dword [0x102fcc54], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10152900
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1026a2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x1032440c
call fcn.100c0238
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x102fcc60]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 5
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 8]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1015295b
mov eax, dword [ebp - 0x14]
sub eax, 5
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1015297d
mov eax, 0xa
jmp 0x10152a64
cmp dword [ebp + 0xc], 0
je 0x101529ca
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov byte [eax], 0xe9
mov eax, dword [ebp - 0x14]
add eax, 5
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
sub edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 1], edx
mov eax, dword [ebp - 8]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x101529c8
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xeb
mov eax, dword [ebp - 0x1c]
mov byte [eax + 1], 0xf9
jmp 0x10152a06
mov eax, dword [ebp - 8]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x101529f1
push 7
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100bfca2
add esp, 0xc
jmp 0x10152a06
push 5
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100bfca2
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [ebp + 0xc]
and al, 1
shl al, 1
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 0x14]
and dl, 0xfd
or dl, al
mov eax, dword [ebp - 8]
mov byte [eax + 0x14], dl
mov al, byte [ebp + 0xc]
and al, 1
shl al, 2
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 0x14]
and dl, 0xfb
or dl, al
mov eax, dword [ebp - 8]
mov byte [eax + 0x14], dl
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100bc0cf
mov esp, ebp
pop ebp
ret
Function at 0x10152b50
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x1026a2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x1032440c
call fcn.100c0238
mov dword [ebp - 8], 0
push 0
push 4
call fcn.100bbd91
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x10152cfa
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100bb756
test eax, eax
je 0x10152cf0
mov dword [ebp - 8], 1
cmp dword [ebp - 0x28], 0x10
jb 0x10152c90
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x1c], eax
jne 0x10152c90
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x20], eax
je 0x10152c90
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10152c1b
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 2
push ecx
push 0
mov edx, dword [0x102fcc5c]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10152c19
mov dword [ebp - 8], 0
jmp 0x10152cac
jmp 0x10152c70
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x10152c70
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 2
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x102fcc5c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x10152c68
mov dword [ebp - 8], 0
jmp 0x10152cac
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov edx, dword [ebp - 0x20]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 8], ecx
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100b9375
test eax, eax
jne 0x10152bad
cmp dword [ebp - 8], 0
je 0x10152cc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x10152cc4
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0
jne 0x10152cf0
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10152cf0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x102fcc5c]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100bc0cf
mov esp, ebp
pop ebp
ret
Function at 0x10152f20
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov ecx, 0x1032440c
call fcn.100c0238
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10152b50
add esp, 4
test eax, eax
jne 0x10152f70
mov dword [ebp - 4], 9
jmp 0x10152fde
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10152fde
mov dword [ebp - 8], 0
jmp 0x10152f8a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x10152fde
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10152fdc
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10153050
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10152f81
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10153370
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov ecx, 0x1032440c
call fcn.100c0238
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x101533f2
mov dword [ebp - 4], 0
jmp 0x1015339d
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x101533dd
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x101533db
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10153394
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x102fcc5c]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10154340
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, 0x103244e0
call fcn.100c0238
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10154396
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x90
je 0x10154396
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0xcc
je 0x10154396
xor eax, eax
jmp 0x101543d7
mov dword [ebp - 4], 1
jmp 0x101543a8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x101543d2
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
mov edx, 1
imul eax, edx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
cmp ecx, eax
je 0x101543d0
xor eax, eax
jmp 0x101543d7
jmp 0x1015439f
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c6a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
lea edi, [ebp - 0x54]
mov ecx, 0x15
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
xor ecx, ecx
mov cx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
jmp 0x46c6f3
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x28
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 4], ecx
jge 0x46c7bb
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x10], 0
jne 0x46c766
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jle 0x46c761
mov esi, esp
push 4
push 0x1000
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.0046da00
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
call fcn.0046da40
add esp, 0xc
jmp 0x46c6e1
mov esi, esp
push 4
push 0x1000
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.0046da00
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0046d6c0
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
jmp 0x46c6e1
pop edi
pop esi
pop ebx
add esp, 0x54
cmp ebp, esp
call fcn.0046da00
mov esp, ebp
pop ebp
ret
Function at 0x46c820
Capabilities:
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
lea edi, [ebp - 0x64]
mov ecx, 0x19
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
xor edx, edx
mov dx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x46c86a
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 0x28
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
xor edx, edx
mov dx, word [ecx + 6]
cmp dword [ebp - 4], edx
jge 0x46c99d
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x20000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
and eax, 0x40000000
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0x80000000
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x2000000
test ecx, ecx
je 0x46c8f3
mov esi, esp
push 0x4000
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp esi, esp
call fcn.0046da00
jmp 0x46c858
mov eax, dword [ebp - 0x18]
shl eax, 4
mov ecx, dword [ebp - 0x1c]
lea edx, [eax + ecx*8 + 0x403a70]
mov eax, dword [ebp - 0x20]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
and eax, 0x4000000
test eax, eax
je 0x46c924
mov ecx, dword [ebp - 0xc]
or ch, 2
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x46c968
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0x40
test edx, edx
je 0x46c94d
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x14], edx
jmp 0x46c968
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x80
test ecx, ecx
je 0x46c968
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jbe 0x46c998
mov esi, esp
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.0046da00
test eax, eax
jne 0x46c998
mov byte [ebp - 0x24], 0
jmp 0x46c858
pop edi
pop esi
pop ebx
add esp, 0x64
cmp ebp, esp
call fcn.0046da00
mov esp, ebp
pop ebp
ret