joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb7cf10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xb919fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xb7d002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00b80dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xb7d002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00b786e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00b8120b
push 0x10
call fcn.00b811d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xb7cfc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00b6d1c0
jmp 0xb7cfc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00b7cb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xb7cff0
mov ecx, edi
call fcn.00b6d2c0
push edi
call fcn.00b811c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xb7d021
inc ebx
cmp ebx, 0x20
jb 0xb7cf3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xb7e250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb92808
push 0xb82288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xb7e329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xb7e329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00b811d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xb7e329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xb7e329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xb7e32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00b7e351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb7ed20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb7ed58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xb7ed60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb7ed94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xb7ed94
push eax
push esi
call fcn.00b8120b
add esp, 8
pop esi
ret 0x10

Function at 0xb7eda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb7ee22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xb7ee15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xb97320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00b80dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xb7edda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xb7ee30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb7eec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xb7eeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xb97320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00b80dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xb7eeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xb7ee6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xb7f000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xb7f131
push esi
call fcn.00b82145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00b71080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xb7f131
push 0
push ebp
call fcn.00b713a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00b71260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xb7f08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00b712f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xb7f121
push 0xb97918
push edi
call fcn.00b803f0
push eax
push ebx
push esi
call fcn.00b7ef60
push 0xb978f8
push edi
call fcn.00b803f0
push eax
push ebx
push esi
call fcn.00b7ef60
push 0xb978d8
push edi
call fcn.00b803f0
push eax
push ebx
push esi
call fcn.00b7ef60
push 0xb978c0
push edi
call fcn.00b803f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00b7ef60
push 0xb978a0
push edi
call fcn.00b803f0
push eax
push ebx
push esi
call fcn.00b7ef60
push 0xb97888
push edi
call fcn.00b803f0
push eax
push ebx
push esi
call fcn.00b7ef60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xb801b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00b80140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00b80140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00b80140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00b80140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xb80bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb80c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xb9287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xb80c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xb80c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x273310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [esp + 0x14], edx
lea esi, [ecx + 4]
mov edx, dword [ecx]
add esi, 4
xor eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
push edi
movd xmm0, edx
mov edi, eax
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x20], xmm0
test al, 3
je 0x273350
and edi, 0xfffffffc
add edi, 4
mov eax, dword [0x27dea8]
test eax, eax
jne 0x273374
mov ecx, 0xbb398380
call fcn.00273f20
mov edx, 0x97f883e
mov ecx, eax
call fcn.00273e80
mov dword [0x27dea8], eax
call eax
mov ebx, eax
mov eax, dword [0x27dcec]
test eax, eax
jne 0x27339c
mov ecx, 0xbb398380
call fcn.00273f20
mov edx, 0xe9233692
mov ecx, eax
call fcn.00273e80
mov dword [0x27dcec], eax
push edi
push 8
push ebx
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x273452
shr edi, 2
xor edx, edx
lea ecx, [esi + edi*4]
mov edi, eax
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
mov ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x273442
cmp ebx, 8
jb 0x273427
lea eax, [esi - 4]
lea eax, [eax + ebx*4]
cmp ecx, eax
ja 0x2733e6
lea eax, [ecx - 4]
lea eax, [eax + ebx*4]
cmp eax, esi
jae 0x273427
movdqa xmm1, xmmword [esp + 0x20]
mov eax, ebx
and eax, 7
mov dword [esp + 0xc], ebx
sub dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea ecx, [ecx]
movdqu xmm0, xmmword [esi]
add edx, 8
pxor xmm0, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movdqu xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, eax
jb 0x273400
cmp edx, ebx
jae 0x273442
sub edi, esi
lea ecx, [ecx]
mov eax, dword [esi]
lea esi, [esi + 4]
xor eax, dword [esp + 0x14]
inc edx
mov dword [edi + esi - 4], eax
cmp edx, ebx
jb 0x273430
mov edx, dword [esp + 0x18]
test edx, edx
je 0x273450
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x2734c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x2734e9
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x27dea8]
test eax, eax
jne 0x27350d
mov ecx, 0xbb398380
call fcn.00273f20
mov edx, 0x97f883e
mov ecx, eax
call fcn.00273e80
mov dword [0x27dea8], eax
call eax
mov edi, eax
mov eax, dword [0x27dcec]
test eax, eax
jne 0x273535
mov ecx, 0xbb398380
call fcn.00273f20
mov edx, 0xe9233692
mov ecx, eax
call fcn.00273e80
mov dword [0x27dcec], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x2735b5
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x2735aa
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x273570
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x2735c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x2735ea
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x27dea8]
test eax, eax
jne 0x27360e
mov ecx, 0xbb398380
call fcn.00273f20
mov edx, 0x97f883e
mov ecx, eax
call fcn.00273e80
mov dword [0x27dea8], eax
call eax
mov edi, eax
mov eax, dword [0x27dcec]
test eax, eax
jne 0x273636
mov ecx, 0xbb398380
call fcn.00273f20
mov edx, 0xe9233692
mov ecx, eax
call fcn.00273e80
mov dword [0x27dcec], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x2736a2
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x27369a
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x273670
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x273ba0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp + 4], 0x9c4e
add dword [esp + 4], 0x4464
shr dword [esp + 4], 1
add dword [esp + 4], 0xffff87db
add dword [esp + 4], 0xffff18d7
add dword [esp + 4], 0xffff529c
add dword [esp + 4], 0xffff507b
or dword [esp + 4], 0x3b9f69dc
xor dword [esp + 4], 0xfffffdfe
mov dword [esp], 0x31f8
imul eax, dword [esp], 0x75
push ebx
mov ebx, ecx
mov dword [esp + 4], eax
xor dword [esp + 4], 0x67893507
xor dword [esp + 4], 0x679fe359
mov dword [esp + 4], 0x4955
xor dword [esp + 4], 0xa8908194
shr dword [esp + 4], 8
add dword [esp + 4], 0xffffdf1d
add dword [esp + 4], 0xfffff42f
or dword [esp + 4], 0x2e6e862
add dword [esp + 4], 0xa6c2
xor dword [esp + 4], 0xe36c9a70
xor dword [esp + 4], 0xe1830958
cmp byte [ebx], 0
je 0x273d02
push esi
push edi
lea esp, [esp]
mov edi, dword [esp + 0x10]
lea ebx, [ebx + 1]
mov dword [esp + 0xc], 0x31f8
imul eax, dword [esp + 0xc], 0x75
mov dword [esp + 0xc], eax
xor dword [esp + 0xc], 0x67893507
xor dword [esp + 0xc], 0x679fe359
movzx ecx, byte [esp + 0xc]
mov esi, dword [esp + 0x10]
mov dword [esp + 0xc], 0x4955
xor dword [esp + 0xc], 0xa8908194
shr dword [esp + 0xc], 8
add dword [esp + 0xc], 0xffffdf1d
add dword [esp + 0xc], 0xfffff42f
or dword [esp + 0xc], 0x2e6e862
add dword [esp + 0xc], 0xa6c2
xor dword [esp + 0xc], 0xe36c9a70
xor dword [esp + 0xc], 0xe1830958
shl esi, cl
movzx ecx, byte [esp + 0xc]
mov edx, dword [esp + 0x10]
movsx eax, byte [ebx - 1]
mov dword [esp + 0x10], eax
add dword [esp + 0x10], esi
shl edx, cl
add dword [esp + 0x10], edx
sub dword [esp + 0x10], edi
cmp byte [ebx], 0
jne 0x273c60
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebx
add esp, 8
ret
Function at 0x273e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, 0x78
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax]
mov eax, dword [edi + ebx + 0x1c]
add edi, ebx
add eax, ebx
mov dword [esp + 0x18], eax
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], esi
jbe 0x273edc
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
add ecx, ebx
call fcn.00273ba0
xor eax, 0x4d4a679b
cmp eax, dword [esp + 0x10]
je 0x273ee6
inc esi
cmp esi, dword [edi + 0x18]
jb 0x273ec0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jb 0x273f14
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, edi
cmp ecx, eax
jae 0x273f14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x2740e0
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
sub esp, 0x104
lea edx, [esp]
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x274106
cmp al, 0x2e
je 0x274103
inc esi
mov byte [edx], al
inc edx
mov al, byte [esi]
test al, al
jne 0x2740f3
jmp 0x274106
mov byte [edx], 0
mov eax, dword [0x27e15c]
test eax, eax
jne 0x27412a
mov ecx, 0xbb398380
call fcn.00273f20
mov edx, 0xba72d8ac
mov ecx, eax
call fcn.00273e80
mov dword [0x27e15c], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x274171
mov eax, dword [0x27dbfc]
test eax, eax
jne 0x27415b
mov ecx, 0xbb398380
call fcn.00273f20
mov edx, 0x9261dc77
mov ecx, eax
call fcn.00273e80
mov dword [0x27dbfc], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x274171
pop edi
pop esi
add esp, 0x104
ret
lea ecx, [esi + 1]
call fcn.00273ba0
xor eax, 0x4d4a679b
mov ecx, edi
mov edx, eax
call fcn.00273e80
pop edi
pop esi
add esp, 0x104
ret
Function at 0x273f20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x30]
mov dword [esp + 0xc], ecx
push ebx
push ebp
mov ecx, dword [eax + 0xc]
add ecx, 0xc
push esi
push edi
mov dword [esp + 0x18], ecx
mov ebp, dword [ecx]
cmp ebp, ecx
je 0x2740cb
mov edx, dword [ebp + 0x30]
mov dword [esp + 0x14], 0x9c4e
add dword [esp + 0x14], 0x4464
shr dword [esp + 0x14], 1
add dword [esp + 0x14], 0xffff87db
add dword [esp + 0x14], 0xffff18d7
add dword [esp + 0x14], 0xffff529c
add dword [esp + 0x14], 0xffff507b
or dword [esp + 0x14], 0x3b9f69dc
xor dword [esp + 0x14], 0xfffffdfe
mov dword [esp + 0x10], 0x31f8
imul eax, dword [esp + 0x10], 0x75
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x67893507
xor dword [esp + 0x10], 0x679fe359
mov dword [esp + 0x10], 0x4955
xor dword [esp + 0x10], 0xa8908194
shr dword [esp + 0x10], 8
add dword [esp + 0x10], 0xffffdf1d
add dword [esp + 0x10], 0xfffff42f
or dword [esp + 0x10], 0x2e6e862
add dword [esp + 0x10], 0xa6c2
xor dword [esp + 0x10], 0xe36c9a70
xor dword [esp + 0x10], 0xe1830958
cmp word [edx], 0
je 0x2740b1
lea esp, [esp]
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], 0x31f8
imul eax, dword [esp + 0x10], 0x75
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x67893507
xor dword [esp + 0x10], 0x679fe359
movzx ecx, byte [esp + 0x10]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], 0x4955
xor dword [esp + 0x10], 0xa8908194
shr dword [esp + 0x10], 8
add dword [esp + 0x10], 0xffffdf1d
add dword [esp + 0x10], 0xfffff42f
or dword [esp + 0x10], 0x2e6e862
add dword [esp + 0x10], 0xa6c2
xor dword [esp + 0x10], 0xe36c9a70
xor dword [esp + 0x10], 0xe1830958
shl esi, cl
movzx ecx, byte [esp + 0x10]
mov edi, dword [esp + 0x14]
movzx eax, word [edx]
shl edi, cl
cmp eax, 0x41
jb 0x274090
cmp eax, 0x5a
ja 0x274090
add eax, 0x20
mov dword [esp + 0x14], eax
add edx, 2
add dword [esp + 0x14], esi
add dword [esp + 0x14], edi
sub dword [esp + 0x14], ebx
cmp word [edx], 0
jne 0x274000
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor eax, 0x344765f2
cmp eax, dword [esp + 0x1c]
je 0x2740d5
mov ebp, dword [ebp]
cmp ebp, ecx
jne 0x273f45
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x2743a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov dword [esp + 0x10], ebp
push edi
cmp edx, 0x40
jb 0x27453e
mov eax, 0x5a4d
cmp word [ebp], ax
jne 0x27453e
mov edi, dword [ebp + 0x3c]
add edi, ebp
mov dword [esp + 0x18], edi
cmp dword [edi], 0x4550
jne 0x27453e
mov eax, 0x10b
cmp word [edi + 0x18], ax
jne 0x27453e
mov eax, dword [0x27dd28]
test eax, eax
jne 0x27440b
mov ecx, 0xbb398380
call fcn.00273f20
mov edx, 0x749bc1d1
mov ecx, eax
call fcn.00273e80
mov dword [0x27dd28], eax
push ebx
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
call eax
mov ebx, eax
test ebx, ebx
je 0x274535
movzx ecx, word [edi + 0x14]
push esi
lea esi, [edi + 0x18]
add esi, ecx
movzx ecx, word [edi + 6]
mov dword [esp + 0x18], esi
lea ecx, [ecx + ecx*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [0x27daac]
test eax, eax
jne 0x27446b
mov ecx, 0xe66945e6
call fcn.00273f20
mov edx, 0x70f7b8ec
mov ecx, eax
call fcn.00273e80
mov dword [0x27daac], eax
push dword [esp + 0x10]
push ebp
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp esi, ecx
jae 0x2744ee
sub ecx, dword [esp + 0x18]
mov eax, 0xcccccccd
dec ecx
add esi, 0x10
mul ecx
mov ecx, edx
shr ecx, 5
inc ecx
mov edi, ecx
mov ebp, dword [esi]
cmp dword [esi - 8], ebp
mov eax, dword [esi + 4]
cmovb ebp, dword [esi - 8]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esi - 4]
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [0x27daac]
test eax, eax
jne 0x2744d6
mov ecx, 0xe66945e6
call fcn.00273f20
mov edx, 0x70f7b8ec
mov ecx, eax
call fcn.00273e80
mov dword [0x27daac], eax
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call eax
add esp, 0xc
add esi, 0x28
dec edi
jne 0x274495
mov edi, dword [esp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.00274670
mov edx, edi
mov ecx, ebx
call fcn.00274580
pop esi
test eax, eax
jne 0x274535
mov eax, dword [0x27e29c]
test eax, eax
jne 0x274529
mov ecx, 0xbb398380
call fcn.00273f20
mov edx, 0xb7b8b8cc
mov ecx, eax
call fcn.00273e80
mov dword [0x27e29c], eax
push 0x8000
push 0
push ebx
call eax
xor ebx, ebx
mov eax, ebx
pop ebx
pop edi
pop ebp
add esp, 0x14
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret