joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fd80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [0x6a1494]
movzx ecx, byte [eax + 0x581]
test ecx, ecx
jne 0x46fe33
mov edx, dword [ebp - 4]
mov byte [edx + 0xb9], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0046d810
movzx edx, al
test edx, edx
je 0x46fdc6
mov ecx, dword [ebp - 4]
call fcn.0046fce0
jmp 0x46fe15
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xb8]
test ecx, ecx
je 0x46fe15
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0xb9]
test eax, eax
jne 0x46fe15
push 0
push 0
push 0
push 0
push str.FailureReason
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
mov byte [ecx + 0xba], al
mov edx, dword [ebp - 4]
mov byte [edx + 0xb9], 1
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xb9]
test ecx, ecx
je 0x46fe2b
mov ecx, dword [ebp - 4]
call fcn.0046d3f0
mov ecx, dword [ebp - 4]
call fcn.0046e600
mov edx, dword [ebp - 4]
add edx, 0x78
push edx
mov ecx, dword [0x6a1494]
call fcn.004ce060
mov eax, dword [ebp - 4]
add eax, 0x94
push eax
mov ecx, dword [0x6a1494]
call fcn.004ce060
mov ecx, dword [ebp - 4]
add ecx, 0xba
push ecx
mov ecx, dword [0x6a1494]
call fcn.004ce130
mov esp, ebp
pop ebp
ret 8
Function at 0x4a0dc0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f86bb
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x654c54]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2c]
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
je 0x4a0e3b
mov ecx, dword [ebp - 0x10]
call fcn.004a0770
mov eax, 1
and eax, 1
je 0x4a0e33
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.005cb017
add esp, 4
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x6c], edx
jmp 0x4a0e42
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x68]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x34], 0
je 0x4a0ea0
push 0x40
call fcn.005cb847
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0
je 0x4a0e83
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004a0630
mov dword [ebp - 0x70], eax
jmp 0x4a0e8a
mov dword [ebp - 0x70], 0
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x18]
mov dword [edx + 0x34], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ceae0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
movzx ecx, byte [eax + 0x420]
test ecx, ecx
je 0x4ceb25
mov edx, dword [ebp - 0x54]
add edx, 0x424
push edx
mov ecx, dword [ebp + 8]
call fcn.00436b00
neg eax
sbb eax, eax
add eax, 1
movzx eax, al
neg eax
sbb eax, eax
add eax, 1
movzx ecx, al
test ecx, ecx
je 0x4cebbc
mov edx, dword [ebp - 0x54]
mov al, byte [ebp + 0xc]
mov byte [edx + 0x421], al
mov ecx, dword [ebp - 0x54]
mov byte [ecx + 0x420], 1
mov edx, dword [0x611c1c]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x54]
add ecx, 0x424
call fcn.0040aae0
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, dword [ebp - 0x54]
mov dword [ecx + 0x440], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x18], 0x10
jb 0x4ceb79
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x58], ecx
jmp 0x4ceb82
mov edx, dword [ebp + 8]
add edx, 4
mov dword [ebp - 0x58], edx
push 1
push 0
push 0
mov eax, dword [ebp - 0x58]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
cmp eax, 0x20
jle 0x4ceba4
mov al, 1
jmp 0x4cebbe
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x54]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x54]
mov edx, dword [eax + 0x8c]
call edx
xor al, al
jmp 0x4cebbe
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x4d49f0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x654c54]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6a1488], 0
jne 0x4d4a60
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.gPakInterfaceP__d
lea eax, [ebp - 0x108]
push eax
call fcn.005cc868
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov dword [0x6a1488], eax
push 4
push 0
push 0
push 0xf001f
mov edx, dword [0x6a1488]
push edx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [0x6a148c], eax
mov eax, dword [0x6a148c]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cbcb1
mov esp, ebp
pop ebp
ret

Function at 0x4d4b70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
call fcn.004d49f0
test eax, eax
je 0x4d4ba4
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x6a148c]
mov edx, dword [ecx]
mov eax, dword [0x6a148c]
mov ecx, dword [eax]
mov edx, dword [edx]
mov eax, dword [edx + 0x14]
call eax
jmp 0x4d4bbf
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005cd555
add esp, 0x10
pop ebp
ret

Function at 0x4d4ce0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x581]
test ecx, ecx
je 0x4d4cfb
mov al, 1
jmp 0x4d4d28
mov edx, dword [ebp + 8]
cmp dword [edx + 0x18], 0x10
jb 0x4d4d0f
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 8], ecx
jmp 0x4d4d18
mov edx, dword [ebp + 8]
add edx, 4
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4d4d30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
sub esp, 8
fldz
fstp qword [esp]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0xf0]
call eax
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x374]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
mov byte [eax + 0x364], 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
call eax
mov esp, ebp
pop ebp
ret
Function at 0x4d52c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x360], 0
je 0x4d52f3
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx + 0x360]
je 0x4d52f3
mov edx, dword [ebp - 4]
mov byte [edx + 0x56d], 1
jmp 0x4d5440
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x365]
test ecx, ecx
jne 0x4d5440
mov edx, dword [ebp - 4]
mov byte [edx + 0x366], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x365], 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x50]
call eax
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x581]
test edx, edx
je 0x4d5372
mov eax, dword [ebp - 4]
sub esp, 8
fld qword [eax + 0xe0]
fstp qword [esp]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0xf0]
call eax
mov ecx, dword [ebp - 4]
sub esp, 8
fld qword [ecx + 0xe8]
fstp qword [esp]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0xf4]
call edx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x56e]
test ecx, ecx
je 0x4d538a
push 0xa
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4d5372
mov edx, dword [ebp - 4]
cmp dword [edx + 0x3a8], 0
je 0x4d53b1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3a8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3a8]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x368]
test edx, edx
jne 0x4d53fa
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3a0], 0
je 0x4d53fa
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x3a0]
cmp dword [edx + 0x58], 0
je 0x4d53fa
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3a0]
mov edx, dword [ecx + 0x58]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3a0]
mov eax, dword [ecx + 0x58]
mov ecx, dword [edx]
push eax
mov edx, dword [ecx + 0x4c]
call edx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x374], 0
je 0x4d5418
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x374]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
call fcn.004d5450
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x3ac]
test ecx, ecx
je 0x4d543b
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x5c]
call edx
call fcn.0055e1e0
mov esp, ebp
pop ebp
ret
Function at 0x4dd590
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x569]
test ecx, ecx
jne 0x4dd5db
mov edx, dword [ebp - 4]
mov byte [edx + 0x56c], 1
push 1
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov eax, dword [ebp - 4]
mov byte [eax + 0x569], 1
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x4dd520
call fcn.005cd7b1
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x4dd760
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x56e]
test ecx, ecx
jne 0x4dd7a1
mov edx, dword [ebp - 4]
mov byte [edx + 0x56e], 1
push 1
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov eax, dword [ebp - 4]
push eax
push 0
push 0x4dd740
call fcn.005cd7b1
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4dfb10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb518
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x654c54]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x98], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ecx]
cmp edx, 0x22
jne 0x4dfb7b
push 0x22
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
call fcn.005d13e0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4dfb7b
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x4dfbdb
push 0x20
mov edx, dword [ebp - 0x10]
push edx
call fcn.005d13e0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4dfbdb
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
lea ecx, [ebp - 0x30]
call fcn.0040dbc0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x98]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x98]
mov edx, dword [eax + 0xb0]
call edx
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004079f0
mov eax, dword [ebp - 0x98]
mov byte [eax + 0xf2], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4e2100
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
movzx ecx, byte [eax + 0x581]
test ecx, ecx
je 0x4e211c
jmp 0x4e228a
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x374]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4e228a
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, 1
push eax
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.kernel32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x18], 0x10
jb 0x4e2179
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
jmp 0x4e2182
mov edx, dword [ebp + 8]
add edx, 4
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005d14a0
add esp, 8
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.kernel32.dll_GlobalUnlock]
mov eax, dword [ebp - 0xc]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, dword [ebp - 0xc]
push ecx
push 7
call dword [sym.imp.USER32.dll_SetClipboardData]
mov edx, dword [ebp - 0xc]
push edx
push 0x10
call dword [sym.imp.USER32.dll_SetClipboardData]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x18], 0x10
jb 0x4e21dd
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x28], ecx
jmp 0x4e21e6
mov edx, dword [ebp + 8]
add edx, 4
mov dword [ebp - 0x28], edx
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
push 1
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
lea eax, [edx + edx + 2]
push eax
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.kernel32.dll_GlobalLock]
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0x10
jb 0x4e223f
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x2c], eax
jmp 0x4e2248
mov ecx, dword [ebp + 8]
add ecx, 4
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 1
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0xc]
push ecx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esp, ebp
pop ebp
ret 4
Function at 0x4e2290
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb811
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x654c54]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x41]
mov dword [ebp - 0x40], eax
push 0
push 0
lea ecx, [ebp - 0x2c]
call fcn.004079f0
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0xb4]
movzx edx, byte [ecx + 0x581]
test edx, edx
jne 0x4e235c
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax + 0x374]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4e235c
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4e2356
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.kernel32.dll_GlobalLock]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4e2356
mov eax, dword [ebp - 0x34]
push eax
call fcn.005cdf90
add esp, 4
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0040b080
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.kernel32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0xb4]
call fcn.004ce060
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.004079f0
mov edx, dword [0x611c1c]
push edx
push 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040aae0
mov ecx, dword [ebp - 0x38]
or ecx, 1
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004079f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005cbcb1
mov esp, ebp
pop ebp
ret 4
Function at 0x516790
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x654c54]
xor eax, ebp
mov dword [ebp - 4], eax
push str.DBGHELP.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [0x6a1a98], eax
cmp dword [0x6a1a98], 0
jne 0x5167dc
push str.IMAGEHLP.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [0x6a1a98], eax
cmp dword [0x6a1a98], 0
jne 0x5167dc
xor al, al
jmp 0x5169dc
push str.SymInitialize
mov eax, dword [0x6a1a98]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6a1a9c], eax
cmp dword [0x6a1a9c], 0
jne 0x516802
xor al, al
jmp 0x5169dc
push str.SymSetOptions
mov ecx, dword [0x6a1a98]
push ecx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6a1aa0], eax
cmp dword [0x6a1aa0], 0
jne 0x516829
xor al, al
jmp 0x5169dc
push str.SymCleanup
mov edx, dword [0x6a1a98]
push edx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6a1aa8], eax
cmp dword [0x6a1aa8], 0
jne 0x516850
xor al, al
jmp 0x5169dc
push str.UnDecorateSymbolName
mov eax, dword [0x6a1a98]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6a1aa4], eax
cmp dword [0x6a1aa4], 0
jne 0x516876
xor al, al
jmp 0x5169dc
push str.StackWalk
mov ecx, dword [0x6a1a98]
push ecx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6a1aac], eax
cmp dword [0x6a1aac], 0
jne 0x51689d
xor al, al
jmp 0x5169dc
push str.SymFunctionTableAccess
mov edx, dword [0x6a1a98]
push edx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6a1ab0], eax
cmp dword [0x6a1ab0], 0
jne 0x5168c4
xor al, al
jmp 0x5169dc
push str.SymGetModuleBase
mov eax, dword [0x6a1a98]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6a1ab4], eax
cmp dword [0x6a1ab4], 0
jne 0x5168ea
xor al, al
jmp 0x5169dc
push str.SymGetSymFromAddr
mov ecx, dword [0x6a1a98]
push ecx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6a1ab8], eax
cmp dword [0x6a1ab8], 0
jne 0x516911
xor al, al
jmp 0x5169dc
push str.SymGetLineFromAddr
mov edx, dword [0x6a1a98]
push edx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6a1abc], eax
push 4
call dword [0x6a1aa0]
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
mov dword [ebp - 0x118], eax
push 0x2f
lea ecx, [ebp - 0x110]
push ecx
call fcn.005d2210
add esp, 8
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x516981
push 0x5c
lea edx, [ebp - 0x110]
push edx
call fcn.005d2210
add esp, 8
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x516993
mov eax, dword [ebp - 0x114]
mov byte [eax], 0
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x11c], ecx
lea edx, [ebp - 0x110]
push edx
call fcn.005cdf90
add esp, 4
test eax, eax
jne 0x5169bc
mov dword [ebp - 0x11c], 0
push 1
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [0x6a1a9c]
test eax, eax
jne 0x5169da
xor al, al
jmp 0x5169dc
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cbcb1
mov esp, ebp
pop ebp
ret
Function at 0x518a90
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0x1c
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
jne 0x518ab1
xor al, al
jmp 0x518b89
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x518ad4
xor al, al
jmp 0x518b89
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x34], 0
jmp 0x518b1b
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x14]
add eax, 0x28
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x34], edx
jae 0x518b87
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [edx + 0x10]
cmp ecx, dword [eax + 8]
jbe 0x518b49
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x40], eax
jmp 0x518b52
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x38]
jb 0x518b85
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x3c]
ja 0x518b85
mov eax, dword [ebp - 0x34]
add eax, 1
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x38]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov al, 1
jmp 0x518b89
jmp 0x518b09
xor al, al
mov esp, ebp
pop ebp
ret