joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52482e
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov ebx, eax
xor eax, eax
cmp word [ebx], 0x5b
push edi
mov dword [ebp - 0x10], eax
mov edi, eax
mov dword [ebp - 4], eax
mov esi, eax
jne 0x524a33
lea eax, [ebx + 2]
push 0x5d
push eax
call dword [0x42a4d8]
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
je 0x524a33
sub eax, ebx
sar eax, 1
dec eax
add eax, eax
mov dword [ebp - 8], eax
add eax, 2
push eax
xor eax, eax
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [0x42a510]
mov ecx, eax
mov dword [ebp - 0x18], ecx
test ecx, ecx
jne 0x52489d
mov esi, 0xc000009a
jmp 0x524a38
push dword [ebp - 8]
lea eax, [ebx + 2]
push eax
push ecx
call fcn.0053855e
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x18]
xor ecx, ecx
mov word [eax + ebx], cx
mov eax, dword [ebp - 0x14]
add eax, 2
push 0x401544
push ebx
mov dword [ebp - 8], eax
call dword [0x42a4e8]
add esp, 0x14
test eax, eax
jne 0x5248e0
push 0x14
mov dword [ebp - 0xc], 1
pop edx
xor ebx, ebx
jmp 0x524913
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.005296fb
mov esi, eax
test esi, esi
js 0x524956
mov ecx, dword [ebp - 4]
push 2
pop edi
mov dword [ebp - 0xc], edi
lea edx, [ecx + 2]
xor ebx, ebx
mov ax, word [ecx]
add ecx, edi
cmp ax, bx
jne 0x5248fe
sub ecx, edx
sar ecx, 1
lea edx, [ecx*2 + 0x16]
mov ecx, dword [ebp - 8]
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x524919
sub ecx, edi
sar ecx, 1
lea ebx, [ecx*2 + 0x2e]
lea eax, [ebx + edx]
push eax
mov dword [ebp - 0x14], eax
xor eax, eax
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
mov dword [ebp - 0x1c], ebx
call dword [0x42a510]
mov edi, eax
test edi, edi
jne 0x524979
mov esi, 0xc000009a
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x524a03
mov eax, dword fs:[0x30]
push ebx
xor ebx, ebx
push ebx
push dword [eax + 0x18]
call dword [fcn.0042a514]
jmp 0x524a05
push dword [ebp - 0x14]
xor eax, eax
push eax
push edi
call fcn.0053856a
mov edx, dword [ebp - 8]
mov ecx, edx
lea eax, [ecx + 2]
add esp, 0xc
mov dword [edi + 0x14], ebx
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x10]
jne 0x524996
sub ecx, dword [ebp - 8]
push edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [edi + 0x18]
push eax
call fcn.00537c9f
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov dword [ebx + edi], eax
mov ebx, dword [ebp - 4]
cmp eax, 2
jne 0x5249f1
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x10]
jne 0x5249cb
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push ebx
push eax
mov eax, dword [ebp - 0x1c]
add eax, 0x14
add eax, edi
push eax
call fcn.00537c9f
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x524959
xor ebx, ebx
push dword [ebp - 0x18]
mov eax, dword fs:[0x30]
push ebx
push dword [eax + 0x18]
call dword [fcn.0042a514]
test esi, esi
jns 0x524a38
test edi, edi
je 0x524a38
mov eax, dword fs:[0x30]
push edi
push ebx
push dword [eax + 0x18]
call dword [fcn.0042a514]
jmp 0x524a38
mov esi, 0xc000000d
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x5268e8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.005288ea
mov ebx, dword [fcn.0042a514]
mov esi, eax
test esi, esi
js 0x5269e0
push edi
lea eax, [ebp - 8]
push eax
push 0x1001030
push 0x800
call fcn.0052a764
mov esi, eax
test esi, esi
js 0x5269cb
mov ecx, dword [ebp - 8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x526942
mov eax, dword [ebp - 4]
sub ecx, edx
sar ecx, 1
lea eax, [eax + ecx*2]
add eax, 2
push eax
mov dword [ebp - 4], eax
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [0x42a510]
mov edi, eax
test edi, edi
jne 0x52697b
mov esi, 0xc000009a
jmp 0x5269cb
push dword [ebp - 4]
push 0
push edi
call fcn.0053856a
add esp, 0xc
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x401844
push dword [ebp - 4]
push edi
call fcn.00526a03
mov esi, eax
add esp, 0x14
test esi, esi
js 0x5269bc
mov edx, dword [ebp - 4]
push 0
push 0x12000004
push dword [ebp + 8]
mov ecx, edi
call fcn.0052c0de
mov esi, eax
mov eax, dword fs:[0x30]
push edi
xor edi, edi
push edi
push dword [eax + 0x18]
call ebx
cmp dword [ebp - 8], 0
je 0x5269e0
push dword [ebp - 8]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call ebx
cmp dword [ebp - 0xc], 0
je 0x5269f5
push dword [ebp - 0xc]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x52d45c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.0052cfe2
mov esi, eax
test esi, esi
js 0x52d50f
mov ecx, dword [ebp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x52d489
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
sub ecx, edx
sar ecx, 1
add eax, 0xc
lea ebx, [ecx*2 + 2]
add eax, ebx
push eax
mov dword [ebp + 0xc], eax
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [0x42a510]
mov esi, eax
test esi, esi
jne 0x52d4ce
mov esi, 0xc000009a
xor ebx, ebx
jmp 0x52d50f
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov dword [esi], 1
mov dword [esi + 8], 5
mov eax, dword [ebp - 4]
push dword [eax + 8]
push eax
lea eax, [esi + 0xc]
push eax
call fcn.0053855e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push ebx
push dword [ebp + 0x10]
add eax, 0xc
add eax, esi
push eax
call fcn.0053855e
add esp, 0x18
xor ebx, ebx
mov dword [edi], esi
mov esi, ebx
cmp dword [ebp - 4], 0
je 0x52d528
push dword [ebp - 4]
mov eax, dword fs:[0x30]
push ebx
push dword [eax + 0x18]
call dword [fcn.0042a514]
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x52dee0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor edx, edx
mov esi, 0x42819a
push edi
mov ebx, eax
mov dword [ebp - 4], edx
mov edi, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x52defc
sub esi, ecx
sar esi, 1
push esi
push 0x42819a
push ebx
call fcn.00537680
add esp, 0xc
test eax, eax
jne 0x52e09e
lea eax, [ebx + esi*2]
push 0x5c
push eax
call fcn.005377b4
mov esi, eax
pop ecx
pop ecx
mov dword [ebp - 0x10], esi
test esi, esi
je 0x52e09e
sub eax, ebx
sar eax, 1
add eax, eax
mov dword [ebp - 8], eax
add eax, 2
push eax
xor eax, eax
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [0x42a510]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x52df6c
mov edi, 0xc000009a
jmp 0x52e0a3
push dword [ebp - 8]
push ebx
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0053855e
mov eax, dword [ebp - 8]
add esp, 0xc
xor ecx, ecx
mov word [eax + ebx], cx
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x52df8a
sub ecx, edx
mov edx, esi
sar ecx, 1
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 4]
jne 0x52df9f
sub edx, esi
sar edx, 1
lea eax, [edx*2 + 0x2e]
mov dword [ebp - 8], eax
lea eax, [eax + ecx*2]
add eax, 0x16
push eax
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [0x42a510]
mov esi, eax
test esi, esi
jne 0x52dfe5
mov edi, 0xc000009a
jmp 0x52e070
push dword [ebp - 0xc]
xor eax, eax
push eax
push esi
call fcn.0053856a
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, edx
mov dword [esi + 0x14], eax
lea eax, [ecx + 2]
add esp, 0xc
mov dword [esi], 3
mov dword [ebp - 0x10], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x52e00b
sub ecx, dword [ebp - 0x10]
push edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [esi + 0x18]
push eax
call fcn.00537c9f
mov edx, dword [ebp - 8]
mov ecx, ebx
lea eax, [ecx + 2]
add esp, 0xc
mov dword [edx + esi], 2
mov dword [ebp - 0x10], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x52e03f
sub ecx, dword [ebp - 0x10]
push ebx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [edx + 0x14]
add eax, esi
push eax
call fcn.00537c9f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov dword [ecx], eax
push ebx
mov ebx, dword [fcn.0042a514]
xor eax, eax
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call ebx
test edi, edi
jns 0x52e0a3
test esi, esi
je 0x52e0a3
push esi
xor eax, eax
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call ebx
jmp 0x52e0a3
mov edi, 0xc000000d
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x52f736
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
push esi
push edi
mov edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], eax
call fcn.0052f8c8
cmp eax, 1
je 0x52f770
add eax, 0xfffffffe
cmp eax, 1
ja 0x52f766
mov eax, 0x42840e
jmp 0x52f775
mov esi, 0xc00000bb
jmp 0x52f8bb
mov eax, 0x4283fa
push ebx
lea ebx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
call fcn.0052f59e
mov esi, eax
test esi, esi
js 0x52f86a
cmp dword [ebp + 8], edi
je 0x52f7ed
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + 2]
xor edi, edi
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x52f798
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + 2]
lea eax, [ebx + ebx]
push eax
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [0x42a510]
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
jne 0x52f7d4
mov esi, 0xc000009a
mov ebx, dword [ebp - 4]
jmp 0x52f86c
push dword [ebp - 0xc]
push ebx
push edi
call fcn.00537c9f
push 0x42820a
push ebx
push edi
call fcn.00537c13
add esp, 0x18
mov ebx, dword [ebp - 0x10]
add ebx, 2
push 0x5c
push ebx
call dword [0x42a498]
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x52f80e
mov esi, 0xc000000d
mov edi, dword [ebp - 8]
jmp 0x52f7cc
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x52f853
sub edi, ebx
sar edi, 1
inc edi
lea eax, [edi + edi]
push eax
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [0x42a510]
cmp dword [ebp - 8], 0
mov ecx, eax
mov dword [ebp - 4], ecx
jne 0x52f841
mov esi, 0xc000009a
jmp 0x52f809
lea eax, [edi - 1]
push eax
push ebx
push edi
push ecx
call fcn.00537d0c
mov eax, dword [ebp + 0xc]
add esp, 0x10
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 8]
test ecx, ecx
je 0x52f85f
mov dword [ecx], edi
mov ebx, dword [ebp - 4]
test eax, eax
je 0x52f86c
mov dword [eax], ebx
jmp 0x52f86c
mov ebx, edi
cmp dword [ebp - 0xc], 0
je 0x52f886
push dword [ebp - 0xc]
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [fcn.0042a514]
test esi, esi
jns 0x52f8ba
test edi, edi
je 0x52f8a3
mov eax, dword fs:[0x30]
push edi
xor edi, edi
push edi
push dword [eax + 0x18]
call dword [fcn.0042a514]
jmp 0x52f8a5
xor edi, edi
test ebx, ebx
je 0x52f8ba
mov eax, dword fs:[0x30]
push ebx
push edi
push dword [eax + 0x18]
call dword [fcn.0042a514]
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x5304a0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0x18
push 0x428800
call fcn.00538430
xor edi, edi
mov dword [ebp - 0x24], edi
mov ebx, edi
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push edi
push edi
push edi
push dword [ebp + 8]
call dword [0x42a590]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, 0xc0000023
je 0x5304e5
test esi, esi
js 0x530563
mov esi, 0xc000000d
mov dword [ebp - 0x1c], esi
jmp 0x530563
push dword [ebp - 0x20]
push edi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [0x42a510]
mov ebx, eax
test ebx, ebx
jne 0x530505
mov esi, 0xc000009a
jmp 0x5304e0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push ebx
push edi
push dword [ebp + 8]
call dword [0x42a590]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
js 0x530563
mov eax, dword [ebx + 0xc]
add eax, 2
push eax
push edi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [0x42a510]
mov ecx, eax
mov dword [ebp - 0x28], ecx
test ecx, ecx
je 0x5304fe
push dword [ebx + 0xc]
lea eax, [ebx + 0x10]
push eax
push ecx
call fcn.0053855e
add esp, 0xc
mov eax, dword [ebx + 0xc]
shr eax, 1
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov word [ecx + eax*2], dx
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
test ebx, ebx
je 0x530578
push ebx
push edi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [fcn.0042a514]
cmp esi, 0xc000017d
jne 0x5305b4
mov dword [ebp - 4], edi
int3
mov eax, esi
call fcn.00538475
ret 8
Function at 0x53196e
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [fcn.0042a5fc]
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
xor edi, edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push 1
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], pe_nt_image_headers32
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [0x42a5b0]
test eax, eax
js 0x531abe
push edi
lea eax, [ebp - 0xc]
push eax
call esi
mov ebx, edi
mov dword [ebp + 8], edi
mov edi, dword [0x42a51c]
jmp 0x531a1a
cmp dword [ebp - 8], 0
je 0x5319f3
push dword [ebp - 8]
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [fcn.0042a514]
mov eax, dword [ebp + 8]
lea ebx, [eax + 2]
push ebx
mov word [ebp - 0xa], ax
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [0x42a510]
mov dword [ebp - 8], eax
test eax, eax
je 0x531ac5
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [0x42a59c]
mov esi, eax
cmp esi, 0xc0000023
je 0x5319d9
push dword [ebp - 4]
call edi
and dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test esi, esi
js 0x531aa6
movzx ecx, word [ebp - 0xc]
shr ecx, 1
xor edx, edx
mov word [eax + ecx*2], dx
lea eax, [ebp - 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
xor esi, esi
push 1
lea eax, [ebp - 4]
push eax
mov word [ebp - 0xa], bx
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], pe_nt_image_headers32
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call dword [0x42a5b0]
test eax, eax
jns 0x531a1a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp dword [ebp - 4], 0
je 0x531aa2
push dword [ebp - 4]
call edi
and dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test esi, esi
jns 0x531abc
test eax, eax
je 0x531abc
push eax
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [fcn.0042a514]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, 0xc000009a
jmp 0x531a90
Function at 0x533c36
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x429000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0x1c
mov dword [ebp - 0x58], eax
jb 0x533d52
cmp dword [edi + 0x18], 0x14
jb 0x533d52
push 7
add edi, 0x1c
push 0x428460
push edi
call dword [0x42a490]
add esp, 0xc
test eax, eax
jne 0x533d52
mov esi, dword [edi + 0xc]
cmp esi, 0x14
jb 0x533d52
cmp dword [edi + 8], eax
je 0x533d52
add esi, 0xffffffec
lea eax, [edi + 0x14]
push esi
push eax
call fcn.00537dde
pop ecx
pop ecx
cmp eax, esi
je 0x533d52
mov esi, dword [edi + 0xc]
mov eax, dword fs:[0x30]
sub esi, 0x14
push esi
push 0
push dword [eax + 0x18]
call dword [0x42a510]
mov ebx, eax
test ebx, ebx
jne 0x533cd7
mov esi, 0xc000009a
jmp 0x533d57
push esi
lea eax, [edi + 0x14]
push eax
push ebx
call fcn.0053855e
push ebx
call fcn.005377d8
push 0x428468
push ebx
call dword [fcn.0042a494]
add esp, 0x18
test eax, eax
jne 0x533d02
mov esi, 0xc0000225
jmp 0x533d3d
add eax, 0x14
sub esi, eax
add esi, ebx
cmp esi, 0x4e
jb 0x533cfb
push 0x13
mov esi, eax
pop ecx
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movsw word es:[edi], word [esi]
mov word [ebp - 8], ax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [fcn.0042a5fc]
push dword [ebp - 0x58]
lea eax, [ebp - 0x60]
push eax
call dword [fcn.0042a500]
mov esi, eax
mov ecx, dword fs:[0x30]
push ebx
push 0
push dword [ecx + 0x18]
call dword [fcn.0042a514]
jmp 0x533d57
mov esi, 0xc000000d
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053765e
leave
ret 4
Function at 0x5340c6
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, eax
mov al, byte [esi]
and al, 0x7f
cmp al, 0x7f
jne 0x5340e3
mov eax, 0xc000003a
jmp 0x534202
movzx edx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
add edx, esi
mov cl, byte [edx]
mov al, cl
push ebx
and al, 0x7f
xor ebx, ebx
cmp al, 0x7f
je 0x5341fc
cmp cl, 4
jne 0x534124
cmp byte [edx + 1], cl
jne 0x534124
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
cmp ecx, 4
jb 0x53416e
lea eax, [ecx - 4]
add ebx, eax
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
add edx, ecx
mov cl, byte [edx]
mov al, cl
and al, 0x7f
cmp al, 0x7f
jne 0x534103
test ebx, ebx
je 0x5341fc
mov eax, dword fs:[0x30]
add ebx, 2
push ebx
push 0
push dword [eax + 0x18]
mov dword [ebp - 8], ebx
call dword [0x42a510]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x534178
mov eax, 0xc000009a
jmp 0x534201
mov eax, 0xc0000095
jmp 0x534201
push edi
movzx edi, byte [esi + 3]
mov ecx, eax
movzx eax, byte [esi + 2]
shl edi, 8
or edi, eax
add edi, esi
mov dl, byte [edi]
mov al, dl
and al, 0x7f
mov dword [ebp - 4], ecx
cmp al, 0x7f
je 0x5341e5
mov ebx, ecx
cmp dl, 4
jne 0x5341c3
cmp byte [edi + 1], dl
jne 0x5341c3
movzx esi, byte [edi + 3]
movzx eax, byte [edi + 2]
shl esi, 8
or esi, eax
sub esi, 4
push esi
lea eax, [edi + 4]
push eax
push ebx
call fcn.0053855e
add esp, 0xc
add ebx, esi
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
add edi, ecx
mov dl, byte [edi]
mov al, dl
and al, 0x7f
cmp al, 0x7f
jne 0x534199
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
pop edi
jmp 0x534201
mov eax, 0xc0000225
pop ebx
pop esi
leave
ret 8
Function at 0x535168
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push ebx
xor ecx, ecx
push esi
push edi
lea ebx, [esp + 0x10]
mov dword [esp + 0x14], ecx
mov edi, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [eax], ecx
call fcn.00535392
mov esi, eax
xor ebx, ebx
test esi, esi
js 0x535366
mov ecx, dword [esp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x5351a7
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
push eax
sub ecx, edx
lea eax, [esp + 0x24]
push eax
sar ecx, 1
lea esi, [ecx + 1]
push 0x428576
push esi
push dword [esp + 0x28]
call fcn.00537b3e
add esp, 0x1c
cmp eax, 4
je 0x5351ee
mov esi, 0xc0000001
jmp 0x535366
cmp dword [esp + 0x18], ebx
jne 0x535313
cmp dword [esp + 0x1c], ebx
jne 0x535313
add esi, 0xa
lea eax, [esi + esi]
push eax
mov eax, dword fs:[0x30]
push ebx
push dword [eax + 0x18]
mov ebx, dword [0x42a510]
call ebx
mov edi, eax
test edi, edi
jne 0x53522d
mov esi, 0xc000009a
xor ebx, ebx
jmp 0x535366
push dword [esp + 0x10]
push 0x4285c6
push 0x42847e
push esi
push edi
call fcn.00537bf2
add esp, 0x14
lea eax, [esp + 0xc]
push eax
push edi
call fcn.00535670
mov esi, eax
test esi, esi
js 0x53531c
xor eax, eax
push eax
push dword [esp + 0x10]
xor ecx, ecx
call fcn.005354ac
mov esi, eax
test esi, esi
js 0x53531c
cmp dword [ebp + 8], 0
jne 0x535306
push 0x4285da
push edi
call dword [fcn.0042a494]
pop ecx
pop ecx
test eax, eax
je 0x535293
xor ecx, ecx
mov word [eax], cx
mov ecx, edi
lea edx, [ecx + 2]
xor esi, esi
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x53529a
sub ecx, edx
sar ecx, 1
lea esi, [ecx*2 + 2]
push esi
xor eax, eax
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call ebx
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x5352d0
mov esi, 0xc000009a
jmp 0x53531c
push esi
push edi
push ebx
call fcn.0053855e
mov eax, dword fs:[0x30]
add esp, 0xc
push dword [esp + 0xc]
xor esi, esi
push esi
push dword [eax + 0x18]
call dword [fcn.0042a514]
lea eax, [esp + 0xc]
push eax
push ebx
mov dword [esp + 0x14], esi
call fcn.00535670
mov esi, eax
test esi, esi
js 0x53531c
mov eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor ebx, ebx
jmp 0x535318
mov esi, 0xc0000001
test esi, esi
jns 0x535338
xor ebx, ebx
cmp dword [esp + 0xc], ebx
je 0x535338
push dword [esp + 0xc]
mov eax, dword fs:[0x30]
push ebx
push dword [eax + 0x18]
call dword [fcn.0042a514]
test edi, edi
je 0x53534d
mov eax, dword fs:[0x30]
push edi
push ebx
push dword [eax + 0x18]
call dword [fcn.0042a514]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x535366
push eax
mov eax, dword fs:[0x30]
push ebx
push dword [eax + 0x18]
call dword [fcn.0042a514]
cmp dword [esp + 0x10], 0
je 0x535381
push dword [esp + 0x10]
mov eax, dword fs:[0x30]
push ebx
push dword [eax + 0x18]
call dword [fcn.0042a514]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x535670
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
mov esi, dword [fcn.0042a5fc]
push edi
push dword [ebp + 8]
lea eax, [esp + 0x24]
xor edi, edi
push eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edi
call esi
lea eax, [esp + 0x20]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
push 1
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x38], edi
mov dword [esp + pe_nt_image_headers32], 0x40
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
call dword [0x42a5d4]
test eax, eax
js 0x5357ec
push edi
lea eax, [esp + 0x1c]
push eax
call esi
mov ebx, edi
mov dword [esp + 0x14], edi
mov edi, dword [0x42a4f4]
jmp 0x535732
cmp dword [esp + 0x1c], 0
je 0x535708
push dword [esp + 0x1c]
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [fcn.0042a514]
mov eax, dword [esp + 0x14]
lea ebx, [eax + 2]
push ebx
mov word [esp + 0x1e], ax
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [0x42a510]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x5357f5
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x18]
call dword [0x42a5d8]
mov esi, eax
cmp esi, 0xc0000023
je 0x5356ec
push dword [esp + 0x10]
call edi
and dword [esp + 0x10], 0
mov eax, dword [esp + 0x1c]
test esi, esi
js 0x5357d4
movzx ecx, word [esp + 0x18]
shr ecx, 1
xor edx, edx
mov word [eax + ecx*2], dx
lea eax, [esp + 0x18]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
xor esi, esi
push 1
lea eax, [esp + 0x18]
push eax
mov word [esp + 0x26], bx
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x38], esi
mov dword [esp + pe_nt_image_headers32], 0x40
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
call dword [0x42a5d4]
test eax, eax
jns 0x535732
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp dword [esp + 0x10], 0
je 0x5357d0
push dword [esp + 0x10]
call edi
and dword [esp + 0x10], 0
mov eax, dword [esp + 0x1c]
test esi, esi
jns 0x5357ea
test eax, eax
je 0x5357ea
push eax
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [fcn.0042a514]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, 0xc000009a
jmp 0x5357ba