joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d14c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40d167
test ebp, ebp
je 0x40d167
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40d16f
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40d1af
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40d20b
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40d206
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40d1f1
test dl, dl
je 0x40d1ed
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40d1f1
add ecx, 2
add eax, 2
test dl, dl
jne 0x40d1d1
xor eax, eax
jmp 0x40d1f6
sbb eax, eax
or eax, 1
test eax, eax
je 0x40d215
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40d1be
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret

Function at 0x40d22c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0040d08c
mov esi, eax
test esi, esi
je 0x40d2e8
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0040d14c
mov ebp, eax
test ebp, ebp
je 0x40d2e7
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0040d14c
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x40d2e7
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x40d2e7
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40d2e6
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x40d2cc
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret
Function at 0x40e0e2
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
nop
cmp dword [ebp - 4], esp
je 0x40e119
push 0x12
push 0x409ba30
push 6
call fcn.00443aff
add esp, 0xc
jmp 0x40e11e
mov esp, ebp
pop ebp
ret 4

Function at 0x40fc68
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
cmp dword [0x537540], 0
jle 0x40fdb2
mov dword [ebp - 8], esp
push dword [0x537540]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x40fcb4
push 0x6d
push 0x40951b0
push 6
call fcn.00443aff
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x40fd04
mov dword [ebp - 8], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
nop
nop
cmp dword [ebp - 8], esp
je 0x40fcf0
push 0xb6
push 0x40951b0
push 6
call fcn.00443aff
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
sete al
jmp 0x40fdfb
mov dword [ebp - 8], esp
push 1
push dword [0x537540]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x40fd38
push 0xe4
push 0x40951b0
push 6
call fcn.00443aff
add esp, 0xc
mov dword [ebp - 8], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
nop
nop
cmp dword [ebp - 8], esp
je 0x40fd67
push 0x132
push 0x40951b0
push 6
call fcn.00443aff
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
sete al
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0
push dword [0x537540]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x40fdad
push 0x15e
push 0x40951b0
push 6
call fcn.00443aff
add esp, 0xc
jmp 0x40fdf3
mov dword [ebp - 8], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
nop
nop
cmp dword [ebp - 8], esp
je 0x40fde1
push 0x1ad
push 0x40951b0
push 6
call fcn.00443aff
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
sete al
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x40fdfb
mov esp, ebp
pop ebp
ret 8

Function at 0x410007
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop
nop
cmp dword [ebp - 4], esp
je 0x41003c
push 0x24
push 0x40955b7
push 6
call fcn.00443aff
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x410050
mov esp, ebp
pop ebp
ret 4
Function at 0x4100a5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
call fcn.004026b1
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
call fcn.0040260e
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x410106
push 0x33
push 0x409526e
push 6
call fcn.00443aff
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x41010e
mov esp, ebp
pop ebp
ret 8

Function at 0x410114
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41015b
push 0
push 0x409526a
push 6
call fcn.00443aff
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
jmp 0x410166
mov esp, ebp
pop ebp
ret 4

Function at 0x410c5b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.00402631
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x410c9d
push ebx
call fcn.00443b05
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
call fcn.004026b1
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x410cef
push 0x70
push 0x409526f
push 6
call fcn.00443aff
add esp, 0xc
push 0x80000301
push 0
push dword [ebp - 8]
push VariantCopy
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x410d0c
mov eax, 0x47e259
push eax
push 2
mov ebx, 0x1a0
call fcn.00446610
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x410d36
push ebx
call fcn.00443b05
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x410d54
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00443af9
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x410d59
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x410d6a
push ebx
call fcn.00443b05
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x410d71
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.00410dfa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x410dac
mov eax, 0
jmp 0x410df4
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
nop
nop
cmp dword [ebp - 8], esp
je 0x410ddf
push 0xe1
push 0x409ba1e
push 6
call fcn.00443aff
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x410dec
mov eax, dword [ebp - 4]
jmp 0x410df4
mov esp, ebp
pop ebp
ret 8

Function at 0x41163b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 1
push 0x48231f
push 0x48231f
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
cmp dword [ebp - 4], esp
je 0x41168b
push 0
push 0x4094e6a
push 6
call fcn.00443aff
add esp, 0xc
mov esp, ebp
pop ebp
ret 4

Function at 0x41173d
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.004449d0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x411782
push ebx
call fcn.00443b05
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00404bb4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4117c2
push 0x73
push 0x4094fe1
push 6
call fcn.00443aff
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4117f0
mov eax, dword [ebp - 4]
test eax, eax
je 0x4117eb
push eax
mov ebx, eax
call fcn.004043c2
inc eax
push eax
call fcn.00443af9
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4117fa
mov eax, 0x48231f
jmp 0x4117fa
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41180b
push ebx
call fcn.00443b05
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4153ad
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 4
push 1
mov ebx, 0x184
call fcn.004449d0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4153f2
push ebx
call fcn.00443b05
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 4
push dword [ebp - 4]
push 0x23
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
nop
nop
cmp dword [ebp - 8], esp
je 0x415431
push 0x36
push 0x409c1b2
push 6
call fcn.00443aff
add esp, 0xc
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x415444
mov eax, 0x48231f
push eax
push 1
mov ebx, 0x9dc
call fcn.00444560
add esp, 0x10
jmp 0x41545c
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41546d
push ebx
call fcn.00443b05
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4184e3
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 2
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
nop
nop
cmp dword [ebp - 8], esp
je 0x418524
push 0x19
push 0x4094e96
push 6
call fcn.00443aff
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x41
jl 0x418542
cmp dword [ebp - 4], 0x5a
jg 0x418542
mov eax, 1
jmp 0x418547
mov eax, 0
test eax, eax
je 0x418553
add dword [ebp - 4], 0x20
mov eax, dword [ebp - 4]
jmp 0x41855b
mov esp, ebp
pop ebp
ret 4

Function at 0x418a2c
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x40
call fcn.00443af9
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], 0x40
mov dword [ebp - 8], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
nop
nop
cmp dword [ebp - 8], esp
je 0x418a8d
push 0x2c
push 0x4095abe
push 6
call fcn.00443aff
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push 0x40
call fcn.00443af9
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x418aa6
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.00443b05
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x419e51
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0041a001
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x419f4f
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x419ef2
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x419f35
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x419f09
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x419f24
test al, 0x40
je 0x419f1b
mov ecx, dword [edi + 0x20]
jmp 0x419f22
test al, 0x80
je 0x419f35
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x419f35
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x419ec1
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x42dc22
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x8000
jg 0x42dd3c
je 0x42dd33
cmp eax, 0x80
jg 0x42dcb9
je 0x42dcb0
cmp eax, 8
jg 0x42dc82
je 0x42dc79
cmp eax, 0x80000000
je 0x42dc70
cmp eax, 2
je 0x42dc67
cmp eax, 4
jne 0x42de1f
mov eax, 2
pop ebp
ret 4
mov eax, 1
pop ebp
ret 4
mov eax, 0x1f
pop ebp
ret 4
mov eax, 3
pop ebp
ret 4
cmp eax, 0x10
je 0x42dca7
cmp eax, 0x20
je 0x42dc9e
cmp eax, 0x40
jne 0x42de1f
mov eax, 6
pop ebp
ret 4
mov eax, 5
pop ebp
ret 4
mov eax, 4
pop ebp
ret 4
mov eax, 7
pop ebp
ret 4
cmp eax, 0x800
jg 0x42dcff
je 0x42dcf6
cmp eax, 0x100
je 0x42dced
cmp eax, 0x200
je 0x42dce4
cmp eax, 0x400
jne 0x42de1f
mov eax, 0xa
pop ebp
ret 4
mov eax, 9
pop ebp
ret 4
mov eax, 8
pop ebp
ret 4
mov eax, 0xb
pop ebp
ret 4
cmp eax, 0x1000
je 0x42dd2a
cmp eax, 0x2000
je 0x42dd21
cmp eax, 0x4000
jne 0x42de1f
mov eax, 0xe
pop ebp
ret 4
mov eax, 0xd
pop ebp
ret 4
mov eax, 0xc
pop ebp
ret 4
mov eax, 0xf
pop ebp
ret 4
cmp eax, 0x800000
jg 0x42ddc8
je 0x42ddbf
cmp eax, 0x80000
jg 0x42dd8f
je 0x42dd86
cmp eax, 0x10000
je 0x42dd7d
cmp eax, 0x20000
je 0x42dd74
cmp eax, 0x40000
jne 0x42de1f
mov eax, 0x12
pop ebp
ret 4
mov eax, 0x11
pop ebp
ret 4
mov eax, 0x10
pop ebp
ret 4
mov eax, 0x13
pop ebp
ret 4
cmp eax, 0x100000
je 0x42ddb6
cmp eax, 0x200000
je 0x42ddad
cmp eax, 0x400000
jne 0x42de1f
mov eax, 0x16
pop ebp
ret 4
mov eax, 0x15
pop ebp
ret 4
mov eax, 0x14
pop ebp
ret 4
mov eax, 0x17
pop ebp
ret 4
cmp eax, 0x8000000
jg 0x42de0a
je 0x42de01
cmp eax, 0x1000000
je 0x42ddf8
cmp eax, 0x2000000
je 0x42ddef
cmp eax, 0x4000000
jne 0x42de1f
mov eax, 0x1a
pop ebp
ret 4
mov eax, 0x19
pop ebp
ret 4
mov eax, 0x18
pop ebp
ret 4
mov eax, 0x1b
pop ebp
ret 4
cmp eax, 0x10000000
je 0x42de37
cmp eax, 0x20000000
je 0x42de2e
cmp eax, 0x40000000
je 0x42de25
xor eax, eax
pop ebp
ret 4
mov eax, 0x1e
pop ebp
ret 4
mov eax, 0x1d
pop ebp
ret 4
mov eax, 0x1c
pop ebp
ret 4
Function at 0x442d1f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x442df4
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x442df4
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x442df4
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x442d7a
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x442df4
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x442dbf
test dl, dl
je 0x442dbb
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x442dbf
add ecx, 2
add eax, 2
test dl, dl
jne 0x442d9f
xor eax, eax
jmp 0x442dc4
sbb eax, eax
or eax, 1
test eax, eax
jne 0x442dd6
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x442de1
inc esi
cmp esi, ebp
jae 0x442df4
mov edx, dword [esp + 0x10]
jmp 0x442d95
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x443058
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x443063
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x443077
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x44307b
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x4430b4
cmp dword [edi + ecx], 0x4550
jne 0x4430b4
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x4430b4
test byte [edi + ecx + 0x16], 2
je 0x4430b4
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x4430b9
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x4430f5
xor eax, eax
jmp 0x4430d8
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x4430fe
inc edx
movzx eax, dx
cmp eax, edi
jl 0x4430d8
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x443104
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x44313c
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x44314a
add edx, 0x20
cmp eax, edx
jne 0x44315b
test bx, bx
je 0x443190
add esi, 2
add edi, 2
jmp 0x44312c
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x443169
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x443177
add edx, 0x20
sub ecx, edx
je 0x443190
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x443125
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4431a9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x443282
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x443282
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x443282
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x443208
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x443282
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x44324d
test dl, dl
je 0x443249
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x44324d
add ecx, 2
add eax, 2
test dl, dl
jne 0x44322d
xor eax, eax
jmp 0x443252
sbb eax, eax
or eax, 1
test eax, eax
jne 0x443264
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x44326f
inc esi
cmp esi, ebp
jae 0x443282
mov edx, dword [esp + 0x10]
jmp 0x443223
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8