joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d35
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x41b3ce
call fcn.0040f3e4
sub esp, 0x1c
push ebx
push esi
push edi
push str.196BB40D_1578_3D01_B289_BEFC77A11A1E
call sub.msi.dll_MsiRecordGetStringA
push 5
pop ebx
cmp eax, ebx
je 0x407e8b
push str.DA5E371C_6333_3D8A_93A4_6FD5B20BCC6E
call sub.msi.dll_MsiRecordGetStringA
cmp eax, ebx
je 0x407e8b
push str.F0C3E5D1_1ADE_321E_8167_68EF0DE699A5
call sub.msi.dll_MsiRecordGetStringA
cmp eax, ebx
je 0x407e8b
push str.1D8E6291_B0D5_35EC_8441_6616F567A0F7
call sub.msi.dll_MsiRecordGetStringA
cmp eax, ebx
je 0x407e8b
push str._vcredist_x86.exe
lea eax, [ebp - 0x10]
push 0x451b40
push eax
call fcn.00401b32
add esp, 0xc
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x407e7e
mov eax, dword [ebp + 8]
push 0x451c8c
push 0x451c90
mov edi, dword [eax]
lea eax, [ebp - 0x18]
push eax
call fcn.00401ab6
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 1
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push str._download_updates_vcredist_x86.exe
mov esi, eax
lea eax, [ebp - 0x14]
push 0x451b44
push eax
call fcn.00401b32
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Upgrading_library
mov ebx, eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__15]
push edi
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Please_wait.
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__15]
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.Upgrading_Microsoft_runtime_library_for_the_first_running..
mov byte [ebp - 4], 4
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__15]
push ecx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 5
mov ecx, esp
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
push ebx
mov ecx, 0x450a78
mov byte [ebp - 4], 2
call fcn.0040b958
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
xor eax, eax
jmp 0x407e8e
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x40a3f7
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x41b7b8
call fcn.0040f3e4
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
push ecx
xor esi, esi
mov dword [ebp - 0x10], edi
lea eax, [ebp + 0xc]
mov ecx, esp
inc esi
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov ecx, ebx
call 0x40a278
mov dword [ebp - 0x1c], eax
push 2
pop ecx
cmp eax, esi
je 0x40a436
cmp eax, ecx
jne 0x40a459
lea ecx, [ebx + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
push edi
push eax
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebx], eax
test eax, eax
je 0x40a46b
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
jmp 0x40a510
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
lea ecx, [ebp - 0x10]
push ecx
push edi
lea ecx, [ebp - 0x1c]
push ecx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push dword [ebp - 0x18]
call edi
mov eax, dword [ebp - 0x10]
xor ecx, ecx
add eax, 2
mov dword [ebp - 0x10], eax
push 2
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc140u.dll_operator_1
pop ecx
lea ecx, [ebp + 0xc]
mov esi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
lea ecx, [ebp - 0x10]
push ecx
push esi
lea ecx, [ebp - 0x1c]
push ecx
push 0
push eax
push dword [ebp - 0x18]
call edi
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 2
pop eax
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], al
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push esi
call sub.mfc140u.dll_operator
mov esi, dword [ebx]
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x10]
test esi, esi
jne 0x40a500
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp + 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
Function at 0x40a683
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push edi
lea ecx, [ebx + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
lea ecx, [ebp - 4]
xor edi, edi
push ecx
push 0x20006
push edi
push eax
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a6ea
push esi
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push 4
lea ecx, [ebp + 0xc]
push ecx
push 3
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb esi, esi
cmp dword [ebx + 8], edi
jne 0x40a6dd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esi + 1]
pop esi
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, edi
pop edi
pop ebx
leave
ret 8

Function at 0x40a6fd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push edi
lea ecx, [ebx + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
lea ecx, [ebp - 4]
xor edi, edi
push ecx
push 0x20006
push edi
push eax
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a764
push esi
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push 4
lea ecx, [ebp + 0xc]
push ecx
push 3
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb esi, esi
cmp dword [ebx + 8], edi
jne 0x40a757
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esi + 1]
pop esi
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, edi
pop edi
pop ebx
leave
ret 8
Function at 0x40fd29
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40fd68
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40fd68
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40fd68
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40fd68
cmp dword [ecx + 0x74], 0xe
jbe 0x40fd68
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x411bd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41beb4
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x42d340]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
test eax, eax
js 0x411cc5
push 0
push 0
push 0
push 0
push dword [ebp + 0xc]
push eax
push 1
call sub.mfc140u.dll_CListCtrl::InsertItem
mov edi, eax
test edi, edi
js 0x411cc8
mov ecx, ebx
call fcn.00411820
mov esi, eax
xor ecx, ecx
mov edx, 0x4c
mov dword [ebp + 8], esi
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call sub.mfc140u.dll_operator_1
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x411c7a
push 0x410510
push 0x410380
push dword [ebp + 8]
mov dword [eax], esi
lea esi, [eax + 4]
push 0x4c
push esi
call fcn.0040f470
jmp 0x411c7c
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x411cc5
mov eax, dword [ebp + 0x10]
mov ecx, ebx
push esi
push 0
push 0
push 0
push 0
push 4
push 0
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0xc], 0xffffffff
call sub.mfc140u.dll_CListCtrl::SetItem
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40f0e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40f11e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40f116
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40f120
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40f106
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40f200
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40f231
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40f231
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40f231
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4c6f71
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4ce378
cmp edx, dword [eax]
je 0x4c6f93
add eax, 8
inc ecx
cmp eax, 0x4ce408
jl 0x4c6f84
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4ce378]
jne 0x4c70c1
mov eax, dword [0x4d3da0]
cmp eax, 1
je 0x4c709b
test eax, eax
jne 0x4c6fc4
cmp dword [0x4ce2a4], 1
je 0x4c709b
cmp edx, 0xfc
je 0x4c70c1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c6ffb
lea eax, [ebp - 0x1a4]
push 0x4cc6c0
push eax
call fcn.004c7950
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c7de0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c703e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c7de0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cc6bc
push edi
call fcn.004c9cb0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4cc6a0
push eax
call fcn.004c7950
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c7960
lea eax, [ebp - 0xa0]
push 0x4cc69c
push eax
call fcn.004c7960
push dword [esi + 0x4ce37c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c7960
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4cc674
push eax
call fcn.004c9c24
add esp, 0x2c
pop edi
jmp 0x4c70c1
lea eax, [ebp + 8]
lea esi, [esi + 0x4ce37c]
push 0
push eax
push dword [esi]
call fcn.004c7de0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x417990
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437038]
jne 0x41799a
repz ret
jmp fcn.004198d0
Function at 0x42e080
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x437038]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x40c], ecx
cmp dword [0x4494ac], 0x9a3
jne 0x42e0ce
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push 0
lea ecx, [ebp - 0x408]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov edx, dword [0x448228]
add edx, dword [ebp - 0x410]
mov eax, dword [ebp - 0x40c]
add eax, dword [ebp - 0x410]
mov cl, byte [eax + 0xd0f5]
mov byte [edx], cl
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00417990
mov esp, ebp
pop ebp
ret

Function at 0x42e190
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x4074d4
push 0x448480
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x448480
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
push 0x4074f0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 4]
push ecx
push 0x40
mov edx, dword [0x4494ac]
push edx
mov eax, dword [0x448228]
push eax
call dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4269c9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x426a08
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426a08
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426a08
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x426a08
cmp dword [ecx + 0x74], 0xe
jbe 0x426a08
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x438db0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438ddd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438ddd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4018f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x40be30
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40bffe
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40be5b
mov eax, 0x7000000
jmp 0x40be63
test eax, eax
je 0x40bfd9
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.00463630
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x83f120]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40bff1
cmp ecx, 0x21
jae 0x40bfe5
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0045cdf0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.0045cec0
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x6cebe0]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x6cecb0]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40bfb4
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x6ced18]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00463710
mov eax, ecx
mov ecx, 0x21
call fcn.004637e0
nop
call fcn.00462270
jmp fcn.0040be30
Function at 0x414a70
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x414c94
sub esp, 0x18
mov eax, dword [0x89393c]
test eax, eax
jne 0x414c7d
nop
lea eax, [0x893928]
mov dword [esp], eax
call fcn.00409c20
mov eax, dword [0x89392c]
test eax, eax
je 0x414ab9
cmp dword [eax + 8], 0xcc
jne 0x414b2f
mov edx, dword [0x893920]
test edx, edx
jne 0x414b11
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x8983f0]
mov dword [esp + 8], eax
call fcn.0040c010
mov eax, dword [esp + 0xc]
mov dword [0x893920], eax
mov ecx, dword [0x8938e4]
mov dword [eax], ecx
mov eax, dword [0x893920]
mov dword [0x8938e4], eax
movzx eax, byte [0x894000]
test al, al
jne 0x414b11
xor eax, eax
jmp 0x414c29
mov edx, dword [0x893920]
mov ebx, dword [edx + 4]
mov dword [0x893920], ebx
mov ebx, dword [0x89392c]
mov dword [edx + 4], ebx
mov dword [0x89392c], edx
mov edx, dword [0x89392c]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x414c11
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402140
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x893c80]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x414b8d
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x414b9a
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00463680
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x893c80]
test edx, edx
jne 0x414bc6
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x414be7
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00463680
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00463680
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00463680
nop
lea eax, [0x893928]
mov dword [esp], eax
call fcn.00409e20
nop
lea eax, [0x893924]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.004022c0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00463710
lea esi, [0x894000]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x414b11
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x414c73
lea edx, [0x8388cc]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x414c1b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00463700
mov ecx, 5
call fcn.00463700
lea eax, [0x675cf6]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004362e0
nop
call fcn.00462270
jmp fcn.00414a70
Function at 0x428090
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x428200
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00425e20
mov eax, dword [esp + 4]
test eax, eax
je 0x4281e9
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.00423ba0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00409c20
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x428127
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42818d
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x42813c
cmp byte [ebp + 6], dl
je 0x428147
cmp esi, ebx
ja 0x42818d
jne 0x428125
cmp byte [ebp + 6], dl
jbe 0x428125
jmp 0x42818d
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409e20
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x428184
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x428184
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.00427f90
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409e20
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x4281e0
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x4281e0
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x6782a0]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.004362e0
nop
call fcn.00462270
jmp fcn.00428090
Function at 0x428680
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42879c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x428715
cmp cl, 2
je 0x4286bd
cmp cl, 3
jne 0x428785
mov byte [eax + 8], 1
jmp 0x428781
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042d8b0
nop
lea eax, [0x877ed8]
mov dword [esp], eax
call fcn.00409c20
nop
mov eax, dword [0x877ea4]
sub eax, dword [0x877e88]
mov dword [0x877ea4], eax
mov eax, dword [0x877e94]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x877e94], ecx
nop
lea eax, [0x877ed8]
mov dword [esp], eax
call fcn.00409e20
jmp 0x428781
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00414a70
nop
lea eax, [0x877ed8]
mov dword [esp], eax
call fcn.00409c20
nop
mov eax, dword [0x877e7c]
sub eax, dword [0x877e60]
mov dword [0x877e7c], eax
mov eax, dword [0x877e6c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x877e6c], ecx
nop
nop
lea eax, [0x877ed8]
mov dword [esp], eax
call fcn.00409e20
add esp, 0x14
ret
lea eax, [0x671329]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004362e0
nop
call fcn.00462270
jmp fcn.00428680
Function at 0x42e2a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42e372
sub esp, 0x30
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x42e2dd
lea eax, [0x66e7b1]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043af60
movzx ecx, byte [esp + 0x40]
mov dword [esp + 8], 0
mov edx, dword [esp + 0x38]
test edx, edx
jne 0x42e2f1
test cl, cl
jmp 0x42e35f
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00463917
lea ecx, [0x42e380]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], ecx
movzx ecx, byte [esp + 0x40]
mov byte [esp + 0x28], cl
lea edx, [esp + 8]
mov dword [esp + 0x2c], edx
lea edx, [esp + 0xc]
mov dword [esp], edx
call fcn.00462160
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x42e366
call fcn.0043b090
mov eax, dword [esp + 8]
mov dword [esp + 0x44], eax
add esp, 0x30
ret
call fcn.00462270
jmp fcn.0042e2a0