joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018b60
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.1002704b
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x10018bca
push esi
lea edi, [eax + 0x400]
call fcn.10027074
push edi
call fcn.1002704b
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x10018b9a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10018be6
push ecx
push esi
call fcn.1001a6d0
add esp, 8
mov ebx, eax
push esi
call fcn.10027074
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10018ca0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10018d09
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.100179b0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x10018db0
Capabilities:
Get common file path
Get disk size

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x114
test eax, eax
jne 0x10018dd4
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x10018e3f
jmp 0x10018df6
mov edx, dword [esp + 0x11c]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
je 0x10018e3f
mov cl, byte [edx]
mov byte [esp + 0x11], 0x3a
mov byte [esp + 0x10], cl
lea edx, [esp + 4]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 4]
push eax
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
mov byte [esp + 0x26], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x10018e3f
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
imul edx, dword [esp]
push 0x400
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
add esp, 0x114
ret
or eax, 0xffffffff
add esp, 0x114
ret

Function at 0x10018e50
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x10018e6e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x10018e63
pop esi
ret
Function at 0x423640
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
xchg dword [esp + 0x14], ebp
mov eax, ecx
mov cx, 0xf5fa
rdtsc
jmp 0x4236a7
sbb al, bh
sub esp, 0x16
lea edi, reloc.MSVBVM60.DLL__CIcos
not ebx
jmp 0x42362a
bt ax, si
push dword [esp + 0x2c]
ret 0x30
lea esp, [esp + 1]
xchg dword [esp + 0x2c], ebp
cpuid
rdtsc
mov bl, 0x24
inc dh
jmp 0x423667
lea ebp, [ebp - 0x96]
btc esi, edx
sub al, 0xdc
mov cl, 0xa8
sub esp, 0x19
mov byte [esp + 0xc], al
jmp 0x42367d

Function at 0x4244cd
Capabilities:
Encode data using xor

Disassembly:
pop ebx
bsf edx, edi
jp 0x4252d3
sub esp, 9
jmp 0x4245fd
mov dh, 0x6e
lea esp, [esp + 1]
jmp 0x424ec5
sub esp, 9
call 0x424a92

Function at 0x427d1e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 4]
push di
push edi
mov dword [esp + 0x28], ebx
push esi
push dword [esp]
call fcn.00427d69
sub dword [ebx + reloc.MSVBVM60.DLL__CIcos], edi
push ds
imul eax, dword [edi - reloc.MSVBVM60.DLL__CIcos], 0x4c872d49
xchg dword [esp + 4], ecx
lea ecx, [ecx + 0x2d]
xchg dword [esp + 4], ecx
push dword [esp + 1]
jae 0x427cef
push word [esp + 4]
jmp 0x427d2f
push di
push edi
mov dword [esp + 0x28], ebx
jmp 0x427f18
push esi
call fcn.00427e2b

Function at 0x427d69
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 1], ecx
mov dword [esp + 0x30], esp
pushfd
pop word [esp]
call fcn.00427dc7
cmp dword [eax], ebx
jnp 0x427dd1
int 0x5c

Function at 0x427d81
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea esp, [esp + 2]
xchg dword [esp], eax
pushfd
call fcn.00427d60

Function at 0x427d92
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0414a6c
jmp 0x427de3
pop word [esp]
mov byte [esp], dh
push edx
lea esp, [esp + 2]
jmp 0x427dfe
bsf ax, ax
je 0x427e0c
mov bp, 0x3244
jmp 0x427e10
mov di, word [esp]
mov dx, word [esp]
jmp 0x427dcd
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
pushfd
jmp 0x4275a2
mov bp, 0x3244
mov edi, dword [esp + 0x2c]
jmp 0x427ecf
ret
call fcn.00427e9d
jge 0x427e49
outsb dx, byte [esi]
or eax, edi
cmp eax, 0x2c45d55d
fistp word [eax]
les esi, [edi + 0x5e]
invalid
invalid

Function at 0x427e2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00427d81
lea ebp, [esp]
inc bh
ja 0x427ee6
mov ecx, 0xd866826e
jmp fcn.00427f34

Function at 0x42a2a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push cx
mov word [esp], sp
lea esp, [esp + 5]
lea esp, [esp]
jmp 0x42a2d2
Function at 0x42ae89
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x4ff6090a
jmp 0x42aded
jle 0x42abae
bts eax, eax
jmp 0x42abb1
bts eax, eax
inc esi
mov ax, dx
jmp 0x42abbb
btr edx, edi
jo 0x42ac05
not dl
xchg dx, ax
jmp 0x42abef
lea eax, [eax + eax]
mov edx, eax
sub esp, 9
lea esp, [esp + 1]
jmp 0x42ac39
lea esp, [esp + 2]
jmp 0x42adae
lea eax, [eax + eax]
mov edx, eax
sub esp, 9
jmp 0x42abd2
not dl
xchg dx, ax
jmp 0x42abca
sub cl, 0x6a
lea eax, [edi*4]
mov edx, eax
neg edx
jmp 0x42ad4f
mov eax, esi
setb al
mov dx, word [esp]
rdtsc
mov dx, word [esp]
jmp 0x42ac0b
lea esp, [esp + 8]
dec cl
mov eax, dword [esp]
mov dh, byte [esp]
lea eax, [ecx*4]
jmp 0x42ac21
neg ah
lea eax, [edi + ebp]
jmp 0x42acc3
neg ax
clc
lea eax, [eax + ecx]
lea eax, [ebx*4]
rdtsc
jmp 0x42acaa
ja 0x42ada1
lea edx, [edi*4]
mov dl, ch
jmp 0x42abe6
rdtsc
jmp 0x42acaa
clc
lea eax, [eax + ecx]
lea eax, [ebx*4]
jmp 0x42ac87
xor cl, 0xd6
push ecx
push word [esp + 1]
jb 0x42ad18
jae 0x42ace5
cmp ebp, dword [eax + reloc.MSVBVM60.DLL__CIcos]
inc ebp
hlt
dec cl
neg dx
jnp 0x42ac55
neg ax
jmp 0x42ac9d
rcr ax, cl
lea esp, [esp + 2]
jmp 0x42ad26
lea eax, [ebx + edi]
mov eax, esp
mov al, 0x32
jmp 0x42accf
rdtsc
bswap eax
bsf ax, cx
jmp 0x42ad75
bsf ax, cx
jmp 0x42ad75
lea eax, [ebx + edi]
mov eax, esp
mov al, 0x32
rcr ax, cl
lea esp, [esp + 2]
rol cl, 0
bt dx, cx
jmp 0x42ad33
ja 0x42acee
rdtsc
bswap eax
jmp 0x42acfc
jp 0x42ac4e
neg ah
lea eax, [edi + ebp]
jmp 0x42ac53
mov edx, ecx
not eax
call 0x42ad02
lea eax, reloc.MSVBVM60.DLL__CIcos
jmp 0x42ad8b
mov ax, word [esp]
mov al, byte [esp]
jmp 0x4295c5
lea edx, [edi*4]
mov dl, ch
lea esp, [esp + 2]
add bl, al
mov dh, 0x76
mov eax, ecx
stc
jmp 0x42ab98
mov ax, 0x8f9a
jmp 0x42adfe
mov edx, dword [edx - reloc.MSVBVM60.DLL__CIcos]
rol ax, cl
jns 0x42adba
mov ax, 0x8f9a
setae ah
jmp 0x4295da
lea eax, reloc.MSVBVM60.DLL__CIcos
mov ax, 0x286e
mov eax, 0x16b41544
jmp 0x42add0
setae ah
jmp 0x4295da
push word [esp + 3]
jmp 0x42ac73
Function at 0x437742
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 3
mov byte [esp], bl
lea esp, [esp + 1]
lea ebx, [ebx + 0x45]
clc
xchg dword [esp + 0x28], ebx
jmp 0x43775d
mov dword [esp], ecx
jmp 0x437728
stc
call fcn.00437747
jmp 0x437eeb
bsr bx, bx
jle 0x437892
push ebx
jmp 0x437893
xchg bl, bh
jmp 0x4377af
push esi
bts si, ax
jb 0x43778a
xchg bl, bh
jmp 0x43781b
xchg dx, bx
push eax
push bp
setno ch
pop dx
jmp 0x4377eb
bsr ecx, eax
jmp 0x4377a0
mov dx, word [esp]
bsr esi, edi
btc esi, edx
xchg edx, ecx
bswap edx
jmp 0x43782a
cpuid
push ebp
shl bx, cl
je 0x4377d5
jne 0x4377fd
pop ebp
std
insd dword es:[edi], dx
hlt
mov dx, word [esp]
bsr esi, edi
btc esi, edx
jmp 0x437820
xchg dx, bx
jmp 0x4377b2
xchg edx, ecx
bswap edx
jmp 0x43782a
setge bh
pop esi
cpuid
mov cl, al
xchg ebx, edx
jmp 0x437876
xchg edx, ebx
lea edx, reloc.MSVBVM60.DLL__CIcos
inc cl
jns 0x4377d0
bsr ecx, eax
jmp 0x4377a0
lea esp, [esp + 4]
rdtsc
lea ebp, [eax + esi]
jmp 0x437e59
lea edx, [esi*4]
bswap eax
sete dl
mov ebx, dword [esp]
not cx
jmp 0x437860
push ebx
add edi, 4
jmp 0x437848
pop ebp
jmp fcn.0042a398
lea ebx, [esi*4]
mov dl, byte [esp]
setb dl
mov ebp, dword [edi]
mov ebx, 0x85fd541
jmp 0x437768

Function at 0x492a8e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
mov edx, 0x423450
mov dword [edx], eax
pop edx
jmp 0x492a09
push word [esp]
push dword [esp + 3]
jmp 0x492798
lea esp, [esp + 0x1c]
push dword [0x4234e8]
call dword [fcn.004234fc]
push ax
jmp 0x4927ae
lea esp, [esp + 8]
jmp 0x41a3a6
sub esp, 0x1b
lea esp, [esp + 3]
jmp 0x4927c5

Function at 0x4d3dbf
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
jmp 0x4d3dc7
xchg word [esp + 1], bp
bswap ebp
xchg dx, bx
mov ah, byte [esp + 1]
cmc
pushal
jmp 0x4d3e07
mov ah, byte [esp + 8]
lea esp, [esp + 0x23]
rdtsc

Function at 0x4d5ceb
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
lea esp, [esp]
bswap ebp
mov esi, dword [esp]
cpuid
jmp 0x4d5cf3
push dword [esp + 0x1a]
mov byte [esp + 0xe], bh
lea esi, [esi*4]
xchg word [esp + 0x1b], ax
popal
lea eax, [eax*4]
jmp 0x4d5cb1
rdtsc
cpuid
mov ebp, ecx
jmp 0x4d5cc7
mov esi, 0x39b312
mov word [esp], dx
mov byte [esp], ch
rdtsc
not eax
bswap edx
jmp 0x4d5d52
mov cx, ax
cpuid
btc bx, ax
lea edx, [edx + edx]
mov dl, 0x1d
mov byte [esp], dl
jmp 0x4d5d33
mov ch, byte [esp + 1]
push word [esp]
mov eax, dword [esp + 3]
lea esp, [esp + 1]
pop bx
cld
jmp 0x4d5d07
Function at 0x104b509
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1079e94]
jne 0x104b51a
test ecx, 0xffff0000
jne 0x104b51a
ret
jmp fcn.0104b524

Function at 0x104b609
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x100d918
call fcn.0104b8c0
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [0x1000000], 0x5a4d
jne 0x104b651
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x104b651
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x104b66a
cmp ecx, 0x20b
je 0x104b657
and dword [ebp - 0x1c], 0
jmp 0x104b67e
cmp dword [eax + 0x84], 0xe
jbe 0x104b651
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x104b678
cmp dword [eax + 0x74], 0xe
jbe 0x104b651
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 2
pop esi
push esi
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or edi, 0xffffffff
mov dword [0x107cd60], edi
mov dword [0x107cd64], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x107c668]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x107c664]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x107cd68], eax
call fcn.0104b97c
cmp dword [0x1079ea0], 0
jne 0x104b6de
push fcn.0104b97c
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0104b965
push 0x10018b0
push 0x10018ac
call sub.msvcrt.dll__initterm
mov eax, dword [0x107c660]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x107c65c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x38], eax
push 0x10018a8
push 0x10018a0
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov eax, dword [eax]
test eax, eax
jne 0x104b743
mov dword [ebp - 4], edi
mov eax, 0xff
jmp 0x104b7f2
mov dword [ebp - 0x20], eax
cmp word [eax], 0x22
jne 0x104b784
add eax, esi
mov dword [ebp - 0x20], eax
mov cx, word [eax]
test cx, cx
je 0x104b75f
cmp cx, 0x22
jne 0x104b74c
cmp word [eax], 0x22
jne 0x104b76a
add eax, esi
mov dword [ebp - 0x20], eax
mov cx, word [eax]
test cx, cx
je 0x104b778
cmp cx, 0x20
jbe 0x104b765
test byte [ebp - 0x54], 1
je 0x104b791
movzx ecx, word [ebp - 0x50]
jmp 0x104b794
cmp word [eax], 0x20
jbe 0x104b76a
add eax, esi
mov dword [ebp - 0x20], eax
jmp 0x104b784
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x1000000
call fcn.0101d5e5
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], 0
jne 0x104b7b4
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x104b7f0
mov eax, esi
call fcn.0104b8fb
ret
Function at 0x1068e47
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x18], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
jne 0x1068e84
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01068d54
mov esi, eax
cmp esi, edi
je 0x1068e89
push esi
push 0x6901b5
call fcn.01053610
jmp 0x1068ed1
mov eax, dword [ebp + 8]
jmp 0x1068e8c
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push 0xf003f
push edi
push eax
push Ordinal_6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
je 0x1068eb0
push esi
push 0x7601b5
jmp 0x1068e7d
push dword [ebp + 0x14]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
cmp esi, 2
je 0x1068ecf
cmp esi, edi
je 0x1068ecf
push esi
push 0x7b01b5
jmp 0x1068e7d
xor esi, esi
cmp dword [ebp - 4], edi
je 0x1068edf
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], edi
je 0x1068eed
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0106d6ca
pop edi
pop esi
leave
ret 0x14
Function at 0x1068f1f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 0x2c], ebx
push esi
push edi
mov edi, dword [ebp + 0x28]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jne 0x1068f68
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01068d54
mov esi, eax
cmp esi, ebx
je 0x1068f68
push esi
push 0x12401b5
call fcn.01053610
jmp 0x1069028
cmp dword [ebp + 8], ebx
je 0x1068f98
lea eax, [ebp - 4]
push eax
push Ordinal_6
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
cmp esi, ebx
je 0x1068f9f
push esi
push 0x12a01b5
push dword [ebp + 8]
call fcn.0105364b
jmp 0x1069028
mov dword [ebp - 4], Ordinal_6
cmp dword [ebp + 0x2c], ebx
mov eax, dword [ebp + 0xc]
jne 0x1068faa
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x28]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
je 0x1068fd3
push esi
push 0x13901b5
jmp 0x1068f5e
cmp dword [ebp + 0x1c], ebx
je 0x1069026
mov eax, dword [ebp + 0x24]
cmp eax, ebx
mov ecx, dword [ebp + 0x20]
je 0x1068fe6
cmp edi, ebx
jne 0x1069005
cmp ecx, ebx
jbe 0x1069005
cmp ecx, 2
jbe 0x1068ffd
cmp ecx, 7
jne 0x1069005
mov eax, 0x1001b20
push 4
jmp 0x1069004
mov eax, 0x1001fe8
push 2
pop edi
push edi
push eax
push ecx
push ebx
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
je 0x1069026
push esi
push 0x15301b5
jmp 0x1068f5e
xor esi, esi
cmp dword [ebp - 4], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1069041
cmp dword [ebp - 4], 0x80000002
je 0x1069041
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], ebx
je 0x106904f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xc], ebx
je 0x1069059
push dword [ebp - 0xc]
call edi
push esi
call fcn.0106d6ca
pop edi
pop esi
pop ebx
leave
ret 0x28
Function at 0x40e7a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x188
mov edx, dword [0x444ce8]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
xor ebp, ebp
mov dword [esp + 0x10], 0x447d34
mov byte [edx + ebp + 0x4efc], 0
mov eax, dword [0x44acb8]
lea edx, [eax + ebx + 6]
mov al, byte [eax + ebx + 6]
test al, al
jne 0x40e7e1
mov edx, dword [0x444ce8]
inc ebx
jmp 0x40e93d
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, dword [0x444ce8]
not ecx
dec ecx
lea edi, [edx + ebp + 0x4efc]
lea ebx, [ebx + ecx + 1]
mov ecx, dword [0x44acb8]
lea esi, [ecx + ebx + 6]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x444ce8]
xor ecx, ecx
add ebx, 0x14
mov byte [eax + ebp + 0x4f10], 0
mov eax, dword [0x444ce8]
mov cx, word [eax + ebp + 0x4efa]
lea edx, [eax + ebp + 0x4efc]
push ecx
push edx
lea eax, [esp + 0x120]
push str.Avatar_s__03d.gif
push eax
call fcn.00436e62
mov edx, dword [0x444ce8]
mov ecx, dword [esp + 0x20]
add esp, 0x10
cmp word [edx + ebp + 0x4f48], 1
jne 0x40e8e6
mov dword [ecx], 0
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0xa
jl 0x40e93d
movsx eax, byte [esp + ecx + 0x12]
movsx ecx, byte [esp + ecx + 0x13]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2 - 0x210]
mov ecx, dword [esp + 0x10]
test eax, eax
mov dword [ecx], eax
jge 0x40e8cb
mov dword [ecx], 0
mov eax, dword [ecx]
cmp eax, 1
jl 0x40e8d5
dec eax
mov dword [ecx], eax
cmp dword [ecx], 0xa
jl 0x40e93d
mov eax, dword [esp + 0x10]
mov dword [eax], 0
jmp 0x40e93d
mov dword [ecx], 0xa
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0xa
jl 0x40e93d
movsx eax, byte [esp + ecx + 0x12]
movsx ecx, byte [esp + ecx + 0x13]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2 - 0x206]
mov ecx, dword [esp + 0x10]
cmp eax, 0xa
mov dword [ecx], eax
jge 0x40e924
mov dword [ecx], 0xa
mov eax, dword [ecx]
cmp eax, 0xb
jl 0x40e92e
dec eax
mov dword [ecx], eax
cmp dword [ecx], 0x14
jl 0x40e93d
mov eax, dword [esp + 0x10]
mov dword [eax], 0xa
mov eax, dword [esp + 0x10]
add ebp, 0x278
add eax, 4
cmp eax, 0x447d48
mov dword [esp + 0x10], eax
jl 0x40e7bc
xor eax, eax
mov ax, word [edx + 0x4d0c]
lea ecx, [eax + eax*4]
shl ecx, 4
sub ecx, eax
lea eax, [edx + ecx*8]
mov cx, word [edx + ecx*8 + 0x4ef8]
cmp cx, 1
jne 0x40e989
mov edx, dword [0x444cd4]
lea edi, [edx + 0x21e]
jmp 0x40e99b
cmp cx, 2
jne 0x40e9be
mov ecx, dword [0x444cd4]
lea edi, [ecx + 0x21e]
lea edx, [eax + 0x4efc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
Function at 0x4242e0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x420
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
xor edx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x42c]
xor ecx, ecx
mov al, byte [esp + esi + 0x28]
cmp al, 0x20
je 0x424337
cmp ecx, 0xa
jge 0x424337
inc esi
mov byte [esp + ecx + 8], al
inc ecx
mov al, byte [esp + esi + 0x28]
cmp al, 0x20
jne 0x424324
mov byte [esp + ecx + 8], dl
lea ecx, [esp + 8]
push ecx
mov byte [esp + 0x2b], dl
call fcn.004370bf
add esp, 4
cmp ax, 1
mov word [0x4400b8], ax
je 0x4243a6
cmp ax, 2
je 0x4243a6
cmp ax, 0x65
jb 0x42436a
cmp ax, 0x6f
jbe 0x424376
cmp ax, 0xc9
jb 0x424389
cmp ax, 0xcf
ja 0x424389
inc esi
push esi
call fcn.004247d0
add esp, 4
pop edi
pop esi
add esp, 0x420
ret
push 0x440f9c
push 0x43f268
call fcn.0042c420
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x420
ret
inc esi
push esi
call fcn.004243c0
add esp, 4
pop edi
pop esi
add esp, 0x420
ret
Function at 0x4247d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x444
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x54]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [esp + 0x458]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, 0x20
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [esp + ebp + 0x54], al
jne 0x42481b
mov cl, byte [esp + ebp + 0x55]
inc ebp
cmp cl, al
je 0x424812
lea ecx, [esp + ebp + 0x54]
xor bl, bl
mov byte [0x444d60], bl
mov byte [esp + 0x13], bl
mov dx, word [ecx]
add ebp, 3
mov word [esp + 0x10], dx
mov al, byte [ecx + 2]
lea ecx, [esp + 0x10]
push ecx
mov byte [esp + 0x16], al
call fcn.004370bf
mov ecx, eax
lea esi, [esp + ebp + 0x58]
mov edx, ecx
mov edi, 0x445720
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add ebp, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [0x444d60]
movsx edx, cl
shl edx, 7
inc cl
mov byte [edx + eax + 0x445720], bl
lea eax, [esp + ebp + 0x58]
mov byte [0x444d60], cl
add ebp, 3
mov cx, word [eax]
mov word [esp + 0x14], cx
mov dl, byte [eax + 2]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x1a], dl
call fcn.004370bf
mov ecx, eax
lea esi, [esp + ebp + 0x5c]
mov edx, ecx
lea edi, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add ebp, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + eax + 0x1c], bl
lea eax, [esp + 0x1c]
push eax
call fcn.004370bf
lea ecx, [esp + ebp + 0x60]
mov word [0x4461a8], ax
add ebp, 3
mov dx, word [ecx]
mov word [esp + 0x1c], dx
mov al, byte [ecx + 2]
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x22], al
call fcn.004370bf
mov ecx, eax
lea esi, [esp + ebp + 0x64]
mov edx, ecx
mov edi, 0x446128
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add ebp, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [eax + 0x446128], bl
lea eax, [esp + ebp + 0x64]
add ebp, 3
mov cx, word [eax]
mov word [esp + 0x20], cx
mov dl, byte [eax + 2]
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x26], dl
call fcn.004370bf
mov edx, eax
lea esi, [esp + ebp + 0x68]
mov ecx, edx
mov edi, 0x44afd8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
add esp, 0x14
rep movsb byte es:[edi], byte [esi]
mov edi, str.C:Program_FilesCommon_Files
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [edx + 0x44afd8], bl
mov eax, ecx
mov esi, edi
mov edi, 0x444fb8
add edx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x54]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
pop esi
pop ebp
cmp edx, ecx
pop ebx
je 0x4249a6
push 0x440f9c
push 0x43f268
call fcn.0042c420
add esp, 8
xor eax, eax
add esp, 0x444
ret
mov eax, 1
add esp, 0x444
ret