joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f950
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov edx, 1
xor ecx, ecx
mov eax, edx
mov byte [ecx + 0x44636c], dl
and eax, 0xff
mov esi, 0x101
mov byte [eax + 0x44626c], cl
lea eax, [edx + edx*4]
xor edx, edx
lea eax, [eax + eax*8]
div esi
inc ecx
cmp ecx, 0x100
jb 0x42f958
pop esi
ret

Function at 0x42f990
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, 0xd
sub esp, 0x18
cmp ecx, eax
jbe 0x42f9a4
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x2c]
mov al, byte [esp + 0x24]
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x28]
push edi
lea edi, [esp + 0x10]
mov byte [ecx], al
lea ebx, [esp + 0x1c]
inc ecx
sub edi, esi
sub ebp, esi
mov byte [esp + 0x18], 0
mov byte [esp + 0x24], 0
sub ebx, esi
mov dword [esp + 0x3c], 8
mov dl, byte [esi]
mov al, dl
shr al, 3
shl dl, 5
or al, dl
mov byte [edi + esi], al
mov dl, byte [esp + 0x18]
xor dl, al
mov al, byte [esi + ebp]
mov byte [esp + 0x18], dl
mov byte [ebx + esi], al
mov dl, byte [esp + 0x24]
mov byte [ecx], al
xor dl, al
mov eax, dword [esp + 0x3c]
inc ecx
inc esi
dec eax
mov byte [esp + 0x24], dl
mov dword [esp + 0x3c], eax
jne 0x42f9db
mov eax, dword [esp + 0x34]
mov ebp, 1
cmp eax, ebp
jb 0x42faea
mov edi, 0x446388
xor esi, esi
mov al, byte [esp + esi + 0x10]
mov dl, al
shl dl, 6
shr al, 2
or dl, al
mov al, byte [esp + esi + 0x1c]
mov byte [esp + esi + 0x10], dl
mov dl, al
shl dl, 6
shr al, 2
or dl, al
mov byte [esp + esi + 0x1c], dl
inc esi
cmp esi, 9
jb 0x42fa2b
xor esi, esi
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42fa7e
lea eax, [esi + ebp*2 - 1]
xor edx, edx
mov ebx, 9
div ebx
xor eax, eax
mov al, byte [edi + esi - 9]
mov bl, byte [eax + 0x44636c]
mov dl, byte [esp + edx + 0x10]
jmp 0x42fa8e
mov bl, byte [esp + esi + 0x10]
xor eax, eax
mov al, byte [edi + esi - 9]
mov dl, byte [eax + 0x44636c]
add dl, bl
mov byte [ecx], dl
inc ecx
inc esi
cmp esi, 8
jb 0x42fa57
xor esi, esi
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42fac0
lea eax, [esi + ebp*2]
xor edx, edx
mov ebx, 9
div ebx
xor eax, eax
mov al, byte [edi + esi]
mov bl, byte [eax + 0x44636c]
mov dl, byte [esp + edx + 0x1c]
jmp 0x42facf
mov bl, byte [esp + esi + 0x1c]
xor eax, eax
mov al, byte [edi + esi]
mov dl, byte [eax + 0x44636c]
add dl, bl
mov byte [ecx], dl
inc ecx
inc esi
cmp esi, 8
jb 0x42fa9b
mov eax, dword [esp + 0x34]
inc ebp
add edi, 0x12
cmp ebp, eax
jbe 0x42fa29
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4301b0
Capabilities:
Encrypt data using blowfish

Disassembly:
sub esp, 8
mov ecx, 0x412
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov esi, 0x442798
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x48
jle 0x4301d6
mov ecx, 0x48
mov edi, dword [esp + 0x20]
push ebp
mov eax, edi
mov ebp, ebx
lea esi, [ecx + edi]
mov dword [esp + 0x1c], 0x12
xor ecx, ecx
mov cl, byte [eax]
inc eax
cmp eax, esi
jb 0x4301f5
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x430205
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x430215
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x430225
mov eax, edi
mov edx, dword [ebp]
add ebp, 4
xor edx, ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebp - 4], edx
dec ecx
mov dword [esp + 0x1c], ecx
jne 0x4301ea
xor eax, eax
mov esi, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov edi, 9
pop ebp
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.004302a0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 8
add esi, 8
dec edi
jne 0x43024d
lea esi, [ebx + 0x48]
mov edi, 0x200
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.004302a0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 8
add esi, 8
dec edi
jne 0x430276
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x524a28a4
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x19a34264
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4015d8
Capabilities:
Hash data with md5

Disassembly:
push edi
xor eax, eax
mov dword [0x410470], eax
xor eax, eax
mov dword [0x410474], eax
mov edi, 0x410420
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov eax, 0x410460
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop edi
ret

Function at 0x402169
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x410784], eax
push str.XYplorer_v26.x_Keygen
push 0
call sub.user32.dll_FindWindowA
cmp eax, 0
je 0x40219c
push eax
push 9
push eax
call sub.user32.dll_ShowWindow
pop eax
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, 0
ret
call sub.comctl32.dll_InitCommonControls
push 0
push 0x40235d
push 0
push 0x7d0
push dword [0x410784]
call sub.user32.dll_DialogBoxParamA
push eax
call sub.KERNEL32.DLL_ExitProcess

Function at 0x40304e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push dword [ebp + 8]
call sub.user32.dll_GetParent
mov ecx, eax
lea eax, [ebp - 0x18]
push eax
push ecx
call sub.user32.dll_GetWindowRect
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
add edi, 3
add esi, 3
push 0x410b64
push dword [ebp + 8]
call sub.user32.dll_GetClientRect
push 0x410b94
push 0
push 0
push 0x4019ff
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x410b90], eax
push 1
push 0x410b90
call sub.KERNEL32.DLL_SetThreadPriority
leave
ret 4

Function at 0x405c8d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
xor eax, eax
cmp byte [0x410185], 0
jne 0x405d76
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x90], 5
jne 0x405cd4
cmp dword [ebp - 0x8c], 1
jne 0x405cd4
mov al, 7
jmp 0x405d6f
cmp dword [ebp - 0x90], 5
jne 0x405ced
cmp dword [ebp - 0x8c], 0
jne 0x405ced
mov al, 6
jmp 0x405d6f
cmp dword [ebp - 0x90], 4
jne 0x405d03
cmp dword [ebp - 0x8c], 0x5a
jne 0x405d03
mov al, 5
jmp 0x405d6f
cmp dword [ebp - 0x90], 4
jne 0x405d19
cmp dword [ebp - 0x8c], 0xa
jne 0x405d19
mov al, 4
jmp 0x405d6f
cmp dword [ebp - 0x90], 5
jne 0x405d2f
cmp dword [ebp - 0x8c], 2
jne 0x405d2f
mov al, 8
jmp 0x405d6f
cmp dword [ebp - 0x90], 4
jne 0x405d45
cmp dword [ebp - 0x8c], 0
jne 0x405d45
mov al, 3
jmp 0x405d6f
cmp dword [ebp - 0x90], 4
jne 0x405d5b
cmp dword [ebp - 0x8c], 0
jne 0x405d5b
mov al, 2
jmp 0x405d6f
cmp dword [ebp - 0x90], 3
jne 0x405d6f
cmp dword [ebp - 0x8c], 0x33
jne 0x405d6f
mov al, 1
mov byte [0x410185], al
jmp 0x405d7b
mov al, byte [0x410185]
leave
ret
Function at 0x409b3e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10000
call fcn.0040c2a0
push ebx
push esi
push 0x4103e0
mov ebx, ecx
push dword [ebp + 8]
call sub.MSVCRT.dll_fopen
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x409b94
push edi
push esi
push 0x10000
lea eax, [ebp - 0x10000]
push 1
push eax
call sub.MSVCRT.dll_fread
push esi
mov edi, eax
call sub.MSVCRT.dll_fclose
add esp, 0x14
lea eax, [ebp - 0x10000]
mov ecx, ebx
push edi
push eax
call fcn.00409b9a
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40c310
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x40c351
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
leave
ret 4
Function at 0x403640
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x34
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
mov ecx, dword [eax + 0x18]
cmp dword [ecx + 0x4c], eax
je 0x40368c
call fcn.00434410
lea eax, [0x5561ce]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00434cf0
call fcn.00434480
mov dword [esp], 2
call fcn.0042e540
mov eax, dword [esp + 0x2c]
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
nop
inc dword [ecx + 0x148]
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
mov ebx, ecx
mov dword [edx + 0xc0], ecx
mov ecx, dword [ebx + 0x18]
mov dword [ebx + 0x98], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x30], ecx
test byte [ecx], al
lea esi, [ecx + 0x19c]
lea edi, [esp + 0x10]
call fcn.0045d0a4
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x28], ecx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0xc], edx
call fcn.00459780
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x88], 0
mov ecx, dword [eax + 0x18]
test byte [ecx], al
add ecx, 0x1d8
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.00402090
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
call fcn.004037a0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x88], 1
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x30]
cmp ecx, edx
jne 0x403786
mov dword [esp], ecx
call fcn.0042fd40
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0043c4e0
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 0x18]
test byte [eax], al
lea edi, [eax + 0x19c]
lea esi, [esp + 0x10]
call fcn.0045d0a4
add esp, 0x34
ret
lea eax, [0x55829d]
mov dword [esp], eax
mov dword [esp + 4], 0x26
call fcn.00432c80
nop
int3
Function at 0x40b410
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b5e1
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b43b
mov eax, 0x7000000
jmp 0x40b443
test eax, eax
je 0x40b5bc
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x90]
mov ebx, dword [ecx + 0x94]
mov dword [ecx + 0x90], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x94], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.0045c930
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x637a60]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40b5d4
cmp ecx, 0x21
jae 0x40b5c8
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00456f80
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.00457050
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x586948]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x586a18]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b597
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x586a78]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.0045ca10
mov eax, ecx
mov ecx, 0x21
call fcn.0045caf0
nop
call fcn.0045b540
jmp fcn.0040b410
Function at 0x413f70
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x414186
sub esp, 0x18
mov eax, dword [0x68ab20]
test eax, eax
jne 0x41416f
nop
nop
lea eax, [0x68ab08]
mov dword [esp], eax
call fcn.00409230
mov eax, dword [0x68ab0c]
test eax, eax
je 0x413fba
cmp dword [eax + 8], 0xcc
jne 0x414030
mov edx, dword [0x68ab00]
test edx, edx
jne 0x414012
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x68c958]
mov dword [esp + 8], eax
call fcn.0040b5f0
mov eax, dword [esp + 0xc]
mov dword [0x68ab00], eax
mov ecx, dword [0x68aabc]
mov dword [eax], ecx
mov eax, dword [0x68ab00]
mov dword [0x68aabc], eax
movzx eax, byte [0x68b000]
test al, al
jne 0x414012
xor eax, eax
jmp 0x41411b
mov edx, dword [0x68ab00]
mov ebx, dword [edx + 4]
mov dword [0x68ab00], ebx
mov ebx, dword [0x68ab0c]
mov dword [edx + 4], ebx
mov dword [0x68ab0c], edx
mov edx, dword [0x68ab0c]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x414103
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401fd0
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x68ad40]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x41408e
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x41409b
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.0045c980
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x68ad40]
test edx, edx
jne 0x4140c7
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x4140e8
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.0045c980
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.0045c980
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.0045c980
mov byte [0x68aa72], 1
nop
nop
lea eax, [0x68ab08]
mov dword [esp], eax
call fcn.00409430
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.0045ca10
lea esi, [0x68b000]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x414012
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x414165
lea edx, [0x632148]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x41410d
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.0045ca00
mov ecx, 5
call fcn.0045ca00
lea eax, [0x5542fe]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00432c80
nop
call fcn.0045b540
jmp fcn.00413f70
Function at 0x4240d0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x424240
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00421ef0
mov eax, dword [esp + 4]
test eax, eax
je 0x424229
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x78]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.004200f0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00409230
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x424167
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x4241cd
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x42417c
cmp byte [ebp + 6], dl
je 0x424187
cmp esi, ebx
ja 0x4241cd
jne 0x424165
cmp byte [ebp + 6], dl
jbe 0x424165
jmp 0x4241cd
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409430
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x4241c4
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x4241c4
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.00423fd0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409430
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x424220
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x424220
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x555985]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00432c80
nop
call fcn.0045b540
jmp fcn.004240d0
Function at 0x424380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x424573
sub esp, 0x28
nop
lea eax, [0x66f0f0]
mov dword [esp], eax
call fcn.00409230
lea eax, [0x66f084]
mov dword [esp], eax
call fcn.00414d30
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
nop
nop
lea ecx, [0x66f0f0]
mov dword [esp], ecx
call fcn.00409430
mov eax, dword [esp + 0x24]
mov byte [eax + 6], 1
lea edi, [eax + 8]
mov ecx, dword [0x68ad40]
test ecx, ecx
jne 0x4243ec
mov ecx, dword [esp + 0x30]
mov dword [eax + 8], ecx
jmp 0x4243f9
mov ecx, eax
mov eax, dword [esp + 0x30]
call fcn.0045c980
mov eax, ecx
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x34]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x68ad40]
test ecx, ecx
jne 0x42441e
mov ecx, dword [esp + 0x38]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x3c]
mov dword [eax + 0x14], ecx
jmp 0x42443c
lea ecx, [eax + 0x10]
mov edi, ecx
mov ebx, eax
mov eax, dword [esp + 0x38]
call fcn.0045c980
lea edi, [ebx + 0x14]
mov eax, dword [esp + 0x3c]
call fcn.0045c980
mov eax, ebx
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004240d0
movzx eax, byte [esp + 8]
test al, al
je 0x424525
mov eax, dword [0x68ab20]
test eax, eax
je 0x42451c
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.004101f0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0xc]
nop
inc dword [ecx + 0x78]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x18], ecx
mov ebx, dword [ecx + 0x54]
test byte [ebx], al
test byte [eax], al
mov dword [esp], edx
lea eax, [ebx + 0xb84]
mov dword [esp + 0x1c], eax
mov dword [esp + 4], eax
call fcn.0041afb0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 4
lea eax, [0x6320e0]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.0041ae80
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x42451c
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x42451c
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x40], 1
add esp, 0x28
ret
nop
nop
lea eax, [0x66f0f0]
mov dword [esp], eax
call fcn.00409230
nop
mov eax, dword [0x66f09c]
sub eax, dword [0x66f084]
mov dword [0x66f09c], eax
mov eax, dword [0x66f090]
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov dword [0x66f090], ecx
nop
nop
lea eax, [0x66f0f0]
mov dword [esp], eax
call fcn.00409430
mov byte [esp + 0x40], 0
add esp, 0x28
ret
call fcn.0045b540
jmp fcn.00424380
Function at 0x4246b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4247ce
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x424746
cmp cl, 2
je 0x4246ed
cmp cl, 3
jne 0x4247b7
mov byte [eax + 8], 1
jmp 0x4247b3
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00429c30
nop
nop
lea eax, [0x66f0f0]
mov dword [esp], eax
call fcn.00409230
nop
mov eax, dword [0x66f0c0]
sub eax, dword [0x66f0a8]
mov dword [0x66f0c0], eax
mov eax, dword [0x66f0b4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x66f0b4], ecx
nop
lea eax, [0x66f0f0]
mov dword [esp], eax
call fcn.00409430
jmp 0x4247b3
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413f70
nop
nop
lea eax, [0x66f0f0]
mov dword [esp], eax
call fcn.00409230
nop
mov eax, dword [0x66f09c]
sub eax, dword [0x66f084]
mov dword [0x66f09c], eax
mov eax, dword [0x66f090]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x66f090], ecx
nop
nop
lea eax, [0x66f0f0]
mov dword [esp], eax
call fcn.00409430
add esp, 0x14
ret
lea eax, [0x550f68]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00432c80
nop
call fcn.0045b540
jmp fcn.004246b0