joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7b2e72
Capabilities:
Encode data using xor

Disassembly:
sal si, 0xc1
add edx, esp
rol si, 0xed
mov esi, dword [edx + esi - 0x7ad389fa]
call fcn.007b48e1
cmp byte [edx], dh
ja 0x716d53
xor dword [esi + esi*8 - 0x1b], 0xad3e677
or byte [ebp - 0x70], dh
js 0x716d27
cwde
test eax, 0x8cea8041
dec ebp
pop edi
cli
invalid
aad 0x5c
cmp al, 0x31
inc ebx
fidiv word [edx + 0x481ca5bb]
dec ecx
add edx, dword [esi + 0x3e]
jmp 0x716db1
adc ecx, dword [edi + 0x6d41109e]
movsb byte es:[edi], byte [esi]
stosb byte es:[edi], al
and ebp, edi
push es
nop
int1
aad 0xc4
ret 0x3f53
call fcn.00a864e3
xor dl, bl
sub dl, 0xbe
mov esi, 0xfba17086
sar si, 0xed
neg dl
inc si
jns 0xa76788
push esp
outsb dx, byte [esi]
ja 0x7b2eef
push 0x68
arpl word [ecx + ebp*4], ax
int1
clc
xor cl, bl
mov eax, 0xb83d0896
dec cl
lea eax, [eax*2 + 0x4137548f]
rol cl, 1
sal dword [esp], 0x93
not cl
lea eax, [eax + eax + 0x2695f2a7]
sar byte [esp + 1], 0xe3
add dword [esp], eax
inc cl
sar ax, 0xc6
xor bl, cl
lea ecx, [esp + ecx + 4]
movzx ax, byte [ecx]
sub esi, 2
push 0x7097490a
mov word [esi], ax
push 0xe78fed8e
not dword [esp + 1]
lea esp, [esp + 0xc]
jmp fcn.006d418b
cwde
adc dh, dl
invalid
ror dl, 1
ror si, 0xf
neg esi
lea esi, [esi + esi*2 - 0x22752c6e]
add dl, 0x85
ror dl, 1
bswap esi
xor bl, dl
jmp 0xa8999e
jmp 0x716cfa

Function at 0x7b7a08
Capabilities:
Encode data using xor

Disassembly:
inc edi
xor al, 0x38
insd dword es:[edi], dx
or ah, byte ds:[ecx + 0xe]
outsb dx, byte [esi]
into
push cs
invalid
xchg byte [edi], ah
dec ecx
pushal
mov al, byte [0x127a3b4d]
invalid
jl 0x80af0c
cmp cl, byte [eax - 0x34896b23]
scasb al, byte es:[edi]
sahf
jo 0x7b7a5d
inc edi
in al, dx
scasb al, byte es:[edi]
fsubr qword [edx - 0x261056e8]
jb 0x7b79b2
leave
push 0x6d68d133
aaa
adc byte ss:[esi + 0xd], ah
jo 0x7b79f6
invalid
xor dword [eax], ebx
xor byte [0x7f8e8a37], ah
fnsave dword [eax + 0x124305d4]
xor bh, bh
mov eax, dword [0xbb8580d8]
loop 0x7b7ae9
push edi
and bl, cl
inc esp
mov byte [0x2bea2bc3], al
jle 0x7b7ac3
add eax, 0x3bdf5c0
and eax, 0x8c7d9fc4
cmc
mov ebp, 0x9fc42503
jge 0x7b7a15
stc
cmp byte [edx], ch
cmpsd dword [esi], dword es:[edi]
loop 0x7b7a30
in al, dx
push 0x4b
mov ebx, 0x5c7e286a
or eax, 0xbb66fdc8
jns 0x7b7b16
pop ds
inc edi
sub bl, byte [ebx]
out 0xcd, al
sbb edi, dword [ecx + 0x7dcc988]
add al, 0xac
xor edi, 0xbc6e8d85
inc esi
sbb eax, dword [ebx]
invalid
invalid
push edi
scasd eax, dword es:[edi]
scasb al, byte es:[edi]
mov esi, 0xeca4cfa3
lodsd eax, dword [esi]
scasd eax, dword es:[edi]
aaa
adc eax, 0x5fdd7677
jae 0x7b7a81
fcmovnu st(0), st(2)
xor al, 0x31
adc esi, dword [esi - 0x58]
adc ah, dh
sbb esi, dword [edi - 0x7a]
int3
in eax, dx
push esi
rcr byte [eax + 0x5b], 0x94
in eax, 0xbe
xchg ebx, eax
outsb dx, byte [esi]
in eax, 0x6e
add byte [ecx + 0x27b7a5c], 0x43
invalid
adc edi, 6
mov byte [ecx], dl
call fcn.006c7979
push 0x59848e2c
inc bp
mov esi, dword [esi]
dec eax
lea esp, [esp + 8]
jmp fcn.00a56768
Function at 0x7f2be6
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor edx, dword [edi + edx*2]
add edi, 2
call fcn.006edfd6
xchg dx, dx
push 0x8515681d
call fcn.00a61044
push ebp
out 0x36, eax
arpl word [esi + 0x77c51816], si
pop ss
sub al, 0xa
pushal
inc ecx
push edi
add dword [edx + 0x78a00147], ebx
cdq
add byte [ebp + 7], 0x16
cmp edi, dword [esi - 0x20522fa3]
aam 0x56
pop es
mov dl, 0x13
inc ecx
fistp qword [ecx + 0x16]
jae 0x7f2c9a
movsb byte es:[edi], byte [esi]
in al, dx
cli
lea ebp, [ebx - 0x528ea277]
sbb bh, byte [eax - 0x53]
out 0xfa, al
jb 0x7f2bcd
inc esp
popfd
jnp 0x7f2bf9
add byte [edx - 0x3555401], bl
invalid
adc ebx, dword [edx + 0x4e]
invalid

Function at 0x7f3534
Capabilities:
Encode data using xor

Disassembly:
neg cl
dec eax
ror cl, 1
ror word [esp + 6], 1
pop eax
mov eax, dword [esp]
dec cl
call fcn.00ab7048
call fcn.007bfef6
ror byte [eax], 0x1a
cld
inc eax
or byte [edx], bl
xchg edx, eax
mov edi, 0x31d902da
xor eax, 0x54d4fee4
dec ebp
fdivr st(0)
loopne 0x7f354c
sbb dword [edx - 0x565b7764], ebp
insd dword es:[edi], dx
int3

Function at 0x80c712
Capabilities:
Encode data using xor

Disassembly:
xor edi, 0x9f943a0c
inc edi
dec bp
rol edi, 3
add edi, ecx
push ebp
movsx eax, byte [esp + ebx*2 - 0x14804]
lea ebp, [esp + edx - 0x6708ac04]
jmp 0x7b5254
sub dword [esp + edx - 0x6708ac0b], 0x70bd51a
lea edx, [ebp + edx - 0x6708ace0]
call fcn.007e798e
mov dword [esp + ebp - 0x74ad70e4], ebx
and dx, si
lea edi, [ebx + edi - 0xd2e6255]
and ebx, edx
not edi
sar byte [esp + edx - 0x6708ac09], 0xe1
jle 0x6f6016
fcom dword [ecx - 0x45599943]
ja 0x80c792
arpl bx, sp
retf 0x67af
mov dl, 0xd9
cmp byte [ecx - 0x4c], ch
sub eax, 0x5492bfa0
xchg edx, eax
push esp
xor ecx, dword [ebx]
stosd dword es:[edi], eax
pop ss
dec ebx
mov bh, 7
and ebp, esi
loop 0x80c79b
sbb eax, 0x4a661e9e
scasb al, byte es:[edi]
sbb byte [esi], 0xd7
into
mov dword [0xc7aa8477], eax
mov edx, 0xb31673ea
mov ch, 0x81
mov byte [0x86c05c77], al
jg 0x80c7bb
mov bl, 0xb5
and dword [edx - 0x793fa389], 0xdde5f67f
in eax, 0xdd
inc ecx
inc esp
dec ebx
fld xword [ecx]
pop esp
mov eax, dword [0x88ec13c9]
ja 0x80c80b
xor byte [esi - 0x4ca5619c], ah
and dword [edi - 0x20], ebx
adc ebx, 0x9f5177c8
ljmp 0x789d
stosd dword es:[edi], eax
sbb dword [eax + 0x38], edx
pop es
fiadd dword [edi]
pop es
fadd dword [di + 0x76c7]
lcall 0xe916, 0x72b1785f
sub dword [edx - 0x4906d68a], esi
dec ebx
jecxz 0x80c811
loope 0x80c874
sub eax, 0xc7f9d383
jbe 0x80c838
jo 0x80c86c
nop
ficomp word [edi]
mov esi, 0x6a2f1407
loopne 0x80c86c
adc al, 0x2f
push 0xffffffffffffffe0
das
invalid
fcom qword [edi + 0x76b26565]
pop ebp
push esi
xor dword [ecx - 0x439f6062], ebx
invalid
cdq
ror dword [ebp + 0x73], 0x1b
invalid
mov eax, dword [0x54f6a272]
sub dh, byte [ecx]
pop edx
mov word [ebx + 0x62610f8], cs
and eax, 0xcb1e8d19
rcl ebx, 1
sbb esi, dword [eax*4 - 0x36d3f262]
loope 0x80c845
insd dword es:[edi], dx
test eax, 0x1a886d71
add edi, ebx
xlatb
sbb dh, byte [ebp + ecx*2 - 0x27a7c6b4]
ret 0xff27
Function at 0xa57d0f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov edx, dword [esp + edx - 0x5801ff8]
mov dword [esp + 8], 0x1d1e5dd7
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.00781dc1
syscall
push 0x22b20aad
dec eax
mov dword [esp], 0xd69f7c9e
call fcn.007f2be6

Function at 0xa67a5c
Capabilities:
Encode data using xor

Disassembly:
lea eax, [esp + eax + 8]
jmp 0x6a4f51
adc edi, 1
xor al, bl
not al
mov dword [esp], 0x168aa2ab
add al, 0x22
not al
push 0xd4bd0f0a
xor al, 0xac
sub al, 0xb9
xor bl, al
jmp 0x6d75b2

Function at 0xaa046e
Capabilities:
Encode data using xor

Disassembly:
push 0x64a7699a
shr bp, cl
push 0x672d39bc
call fcn.006fdf0a
loopne 0xaa04a3
stc
mov byte [0x5071692], al
and esp, dword [ebx - 0x37e40866]
sbb al, 8
rcr dword [ebx - 0x77], 1
sbb al, 0x79
sbb edx, 0x573cdae2
adc byte [di + 0x5b], 0x37
mov bl, 0xdf
punpckhwd mm6, qword [ecx + 0x6154f887]
fld dword [esi + eax*8]
stosb byte es:[edi], al
fisttp word [edi]
imul esi, dword [ecx + 0x6154f887], 0x64c604d9
stosb byte es:[edi], al
xor dword [0x2659e9c3], 0x33
loop 0xaa048e
mov bl, 0x75
fisttp qword [0xd35b71c5]
jne 0xaa04fa
fidiv word gs:[ebx]
xchg ebx, eax
div byte [esi - 0x5d65420c]
ja 0xaa04ca
hlt
int 0x8d
jne 0xaa0548
retf
cmp edi, dword [esi + 0x65719546]
mov esp, 0xd9151bdd
adc eax, 0x4e956d08
cmpsb byte [esi], byte es:[edi]
dec edi
out dx, eax
fld dword [eax - 0x3b]
movsb byte es:[edi], byte [esi]
mov ah, 3
cmc
scasd eax, dword es:[edi]
sub esp, ecx
sub byte [ebx - 0x5c], 0xee
xchg ecx, eax
in eax, 0xdc
or eax, 0x5b04ddc5
jge 0xaa0556
inc eax
lds esp, [esp + esi*4 + 0x29aff503]
int3
lodsd eax, dword [esi]
mov byte [eax + 0x50], cl
cmp al, 0xe4
loopne 0xaa04e5
add cl, dh
leave
inc esp
inc edx
lodsd eax, dword [esi]
pop ecx
or eax, 0x731dc1e5
invalid
inc esi
into
mov al, byte [0x3ce8939a]
loope 0xaa0515
invalid
push 0x8dd8f766
mov esp, 0xffa11107
xchg edi, eax

Function at 0xaab7fe
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
je 0xaab83e
mov esi, 0xc400c23f
movzx esi, byte [eax]
push 0xd795f62c
xor esi, ecx
and esi, 0xff
neg dword [esp]
mov esi, dword [esi*4 + 0x6f69b0]
shr ecx, 8
xor ecx, esi
inc eax
xor ecx, 0x25bdab32
dec edx
lea esp, [esp + 4]
jne 0xaab808
push 0x8a103d88
not ecx
mov dword [ebp], ecx
lea esp, [esp + 4]
jmp fcn.00708ceb
Function at 0x46457c
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004643f3

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x209e3f38
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..text
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x5b3e1a9d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40fe60
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x8cbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41002b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40fe89
mov eax, 0x7000000
jmp 0x40fe91
test eax, eax
je 0x410006
mov dword [esp + 0x14], eax
mov ecx, dword [0x8cbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x94], ebx
mov dword [ecx + 0x98], ebp
mov dword [esp], edx
call fcn.0046be60
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x28]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x890440]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x41001e
cmp edx, 0x21
jae 0x410012
movsd qword [esp + 0x18], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], ebp
mov dword [esp], ecx
call fcn.00463850
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00463920
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x701380]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x7013b8]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40ffe1
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x7013f8]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.0046bf40
mov eax, edx
mov ecx, 0x21
call fcn.0046c000
nop
call fcn.0046aab0
jmp fcn.0040fe60
Function at 0x41a770
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x8cbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41a97e
sub esp, 0x18
mov eax, dword [0x8cbe6c]
test eax, eax
jne 0x41a967
nop
nop
lea eax, [0x8cbe5c]
mov dword [esp], eax
call fcn.0040db50
mov eax, dword [0x8cbe60]
test eax, eax
je 0x41a7b8
cmp dword [eax + 8], 0xcc
jne 0x41a82e
mov edx, dword [0x8cbe64]
test edx, edx
jne 0x41a810
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x8d0770]
mov dword [esp + 8], eax
call fcn.00410040
mov eax, dword [esp + 0xc]
mov dword [0x8cbe64], eax
mov ecx, dword [0x8cbe68]
mov dword [eax], ecx
mov eax, dword [0x8cbe64]
mov dword [0x8cbe68], eax
movzx eax, byte [0x8cc3a0]
test al, al
jne 0x41a810
xor eax, eax
jmp 0x41a938
mov edx, dword [0x8cbe64]
mov ebx, dword [edx + 4]
mov dword [0x8cbe64], ebx
mov ebx, dword [0x8cbe60]
mov dword [edx + 4], ebx
mov dword [0x8cbe60], edx
mov edx, dword [0x8cbe60]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x41a917
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00406690
mov eax, dword [0x8cc0e0]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x41a878
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
jmp 0x41a88e
call fcn.0046bec0
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [0x8cc0e0]
test eax, eax
jne 0x41a8b2
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
jmp 0x41a8e0
call fcn.0046bf00
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov ebx, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x14], esi
mov dword [edx + ecx*4 + 0x1c], eax
mov dword [edx + ecx*4 + 0x20], ebx
mov dword [edx + ecx*4 + 0x14], ebp
nop
nop
lea eax, [0x8cbe5c]
mov dword [esp], eax
call fcn.0040dd50
nop
lea eax, [0x8cbe58]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00406810
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.0046bf40
lea edx, [0x88c3ec]
movzx ebx, byte [edx + eax]
lea ebp, [0x8cc3a0]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x41a810
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x41a921
mov ecx, 5
call fcn.0046bf30
lea eax, [0x6852a6]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0043ca60
nop
call fcn.0046aab0
jmp fcn.0041a770
Function at 0x428690
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x8cbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x428793
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x42878d
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call fcn.00428ae0
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x10], ax
mov word [esp + 0x12], cx
mov dword [esp + 0x14], edx
mov byte [esp + 0x18], bl
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00428bc0
movzx eax, byte [esp + 0x18]
test al, 2
je 0x428741
cmp word [esp + 0x10], 0x1f0
jbe 0x428741
and eax, 0xfffffffd
nop
mov byte [esp + 0x18], al
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx + 0x30]
test bl, bl
jne 0x428745
mov ebx, dword [esp + 0x28]
cmp ebx, 0x200
jae 0x428745
nop
jmp 0x428745
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x428788
mov ecx, dword [edx]
lea eax, [ecx + eax*8]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x12]
mov ebx, dword [esp + 0x14]
movzx ebp, byte [esp + 0x18]
mov dword [esp], eax
mov word [esp + 4], cx
mov word [esp + 6], dx
mov dword [esp + 8], ebx
xchg ebp, eax
mov byte [esp + 0xc], al
xchg ebp, eax
call fcn.00428b50
add esp, 0x1c
ret
call fcn.0046bf40
call fcn.0046bf40
nop
call fcn.0046aab0
jmp fcn.00428690
Function at 0x4287a0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x8cbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4288d4
sub esp, 0x20
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jae 0x4288ce
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call fcn.00428ae0
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x14]
mov dword [esp], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00428cb0
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x28]
cmp edx, ecx
jae 0x4288c7
mov ecx, dword [eax]
lea ecx, [ecx + edx*8]
movzx ebx, word [esp + 0x14]
movzx ebp, word [esp + 0x16]
mov esi, dword [esp + 0x18]
movzx edi, byte [esp + 0x1c]
mov dword [esp], ecx
mov word [esp + 4], bx
mov word [esp + 6], bp
mov dword [esp + 8], esi
xchg edi, eax
mov byte [esp + 0xc], al
xchg edi, eax
call fcn.00428b50
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
lea eax, [ecx + eax - 1]
shl eax, 0xd
mov ecx, dword [esp + 0x28]
shl ecx, 0x16
add eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 0x28], eax
jae 0x42888a
mov dword [ecx + 0x28], eax
lea eax, [ecx + 0x20]
mov dword [esp], eax
call fcn.00435210
mov eax, dword [esp + 0x10]
cmp dword [esp + 4], eax
jae 0x4288c3
mov ecx, dword [esp + 0x24]
add ecx, 0x20
nop
mov dword [esp], ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0
sbb eax, 0
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call fcn.004065d0
add esp, 0x20
ret
mov eax, edx
call fcn.0046bf40
call fcn.0046bf40
nop
call fcn.0046aab0
jmp fcn.004287a0
Function at 0x42e340
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x8cbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42e484
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.0042c1a0
mov eax, dword [esp + 4]
test eax, eax
je 0x42e46d
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x4c]
mov dword [esp + 0x18], ecx
mov edx, dword [0x8cbf38]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov ebx, dword [edx + 0x18]
nop
inc dword [ebx + 0x7c]
mov edx, dword [edx + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call fcn.00429dc0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xa], bl
nop
mov ebp, dword [esp + 0x18]
mov dword [esp], ebp
call fcn.0040db50
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x50]
mov edx, dword [esp + 0x10]
movzx ebx, byte [esp + 0xa]
jmp 0x42e3d7
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42e402
movzx esi, word [ebp + 4]
cmp esi, edx
jne 0x42e3ec
cmp byte [ebp + 6], bl
je 0x42e3f7
cmp esi, edx
ja 0x42e3fe
jne 0x42e3d5
cmp byte [ebp + 6], bl
jbe 0x42e3d5
jmp 0x42e3fe
mov ebx, 1
jmp 0x42e404
xor ebx, ebx
jmp 0x42e404
xor ebx, ebx
mov byte [esp + 0xb], bl
test bl, bl
jne 0x42e422
mov ebx, dword [esp + 0x24]
mov word [ebx + 4], dx
mov edx, dword [ecx]
mov dword [ebx], edx
mov dword [ecx], ebx
mov dword [esp], eax
call fcn.0042e240
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040dd50
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x7c]
lea edx, [ecx - 1]
nop
mov ebx, dword [0x8cbf38]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
mov dword [eax + 0x7c], edx
cmp ecx, 1
jne 0x42e45d
movzx eax, byte [ebx + 0x65]
test al, al
je 0x42e45d
mov dword [ebx + 8], 0xfffffade
movzx eax, byte [esp + 0xb]
xor eax, 1
mov byte [esp + 0x28], al
add esp, 0x1c
ret
lea eax, [0x6877d5]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.0043ca60
nop
call fcn.0046aab0
jmp fcn.0042e340
Function at 0x42e910
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x8cbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42ea80
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42ea10
cmp cl, 1
je 0x42e9a2
cmp cl, 2
jne 0x42ea69
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00433f50
nop
nop
lea eax, [0x8b03e0]
mov dword [esp], eax
call fcn.0040db50
mov eax, dword [0x8b0384]
sub eax, dword [0x8b0368]
nop
mov dword [0x8b0384], eax
mov eax, dword [0x8b0374]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x8b0374], ecx
nop
lea eax, [0x8b03e0]
mov dword [esp], eax
call fcn.0040dd50
jmp 0x42ea65
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.0041a770
nop
nop
lea eax, [0x8b03e0]
mov dword [esp], eax
call fcn.0040db50
mov eax, dword [0x8b035c]
sub eax, dword [0x8b0340]
nop
mov dword [0x8b035c], eax
mov eax, dword [0x8b034c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x8b034c], ecx
nop
lea eax, [0x8b03e0]
mov dword [esp], eax
call fcn.0040dd50
jmp 0x42ea65
cmp cl, 3
jne 0x42ea1b
mov byte [eax + 8], 1
jmp 0x42ea65
cmp cl, 4
jne 0x42ea69
nop
nop
lea eax, [0x8b03e0]
mov dword [esp], eax
call fcn.0040db50
mov eax, dword [0x8b03d4]
sub eax, dword [0x8b03b8]
nop
mov dword [0x8b03d4], eax
mov eax, dword [0x8b03c4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x8b03c4], ecx
nop
nop
lea eax, [0x8b03e0]
mov dword [esp], eax
call fcn.0040dd50
add esp, 0x14
ret
lea eax, [0x6814c5]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0043ca60
nop
call fcn.0046aab0
jmp fcn.0042e910
Function at 0x4349d0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x8cbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x434a91
sub esp, 0x2c
movzx ecx, byte [esp + 0x3c]
test cl, cl
je 0x4349fe
mov byte [esp], 6
call fcn.004416c0
movzx ecx, byte [esp + 0x3c]
mov dword [esp + 4], 0
mov edx, dword [esp + 0x34]
test edx, edx
jne 0x434a12
test cl, cl
jmp 0x434a7e
mov ebx, dword [0x8cbf38]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
lea ebp, [esp + 0x30]
lea edi, [esp + 8]
xor eax, eax
call fcn.0046c0b7
lea ecx, [0x434aa0]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebp
movzx ecx, byte [esp + 0x3c]
mov byte [esp + 0x24], cl
lea edx, [esp + 4]
mov dword [esp + 0x28], edx
lea edx, [esp + 8]
mov dword [esp], edx
call fcn.0046a9c0
movzx ecx, byte [esp + 0x3c]
test cl, cl
je 0x434a85
call fcn.00441820
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
add esp, 0x2c
ret
call fcn.0046aab0
jmp fcn.004349d0