joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f406a63
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x4f423fc8
call fcn.4f408b90
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x4f406a88
xor eax, eax
jmp 0x4f406c01
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4f406ab4
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x4f406ab4
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x4f406c01
cmp dword [esi + 0x4c], 0
je 0x4f406bfe
mov ecx, esi
call fcn.4f40638b
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x4f406ae7
push dword [esi + 0x4c]
push edi
call fcn.4f4056f8
pop ecx
pop ecx
test al, al
je 0x4f406bfe
movzx ebx, di
jmp 0x4f406bfe
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.4f406458
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x4f406b1f
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.4f408b30
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x4f406bf2
cmp eax, 1
jg 0x4f406bcd
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x4f406b68
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x4f406b95
cmp eax, 0x10
jae 0x4f406b77
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.4f4102fa
add esp, 0x10
cmp edi, eax
jne 0x4f406bc8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x4f406b98
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x4f406bc2
test edi, edi
jne 0x4f406b13
cmp dword [ebp - 0x18], 0x20
jae 0x4f406bec
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.4f4063fb
jmp 0x4f406b0d
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x4f406bec
cmp eax, 3
jne 0x4f406bf2
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.4f4056f8
pop ecx
pop ecx
test al, al
je 0x4f406bec
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.4f4038c0
mov ax, bx
call fcn.4f408b4b
ret 4

Function at 0x4f416bd4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.4f416889

Function at 0x4f416bdf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.4f416a0c
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x411d5c
call esi
push 0x411d70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40116e
push 0x800
call eax
push 0x411d8c
call esi
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011e8
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411e2c
push 0x411e3c
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411e4c
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411dfc
push 0x411e1c
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x401207
lea eax, [esp + 4]
push eax
push 0x411dfc
push 0x411e1c
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411e0c
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401a94
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ad3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ad3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ad3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ad3
cmp dword [ecx + 0x74], 0xe
jbe 0x401ad3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bf80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bfad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bfad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4028f0
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x50d234]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x402ac0
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.00461860
jmp fcn.004028f0
Function at 0x40a420
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x50d234]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a5eb
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40a449
mov eax, 0x7000000
jmp 0x40a451
test eax, eax
je 0x40a5c6
mov dword [esp + 0x34], eax
mov ecx, dword [0x50d234]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x448]
mov ebx, dword [ecx + 0x44c]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x448], ebx
mov dword [ecx + 0x44c], ebp
mov dword [esp], edx
call fcn.00462c00
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x4ea980]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40a5de
cmp edx, 0x21
jae 0x40a5d2
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.00459350
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00459420
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x4980d0]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x498118]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40a5a1
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x498148]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.00462ce0
mov eax, edx
mov ecx, 0x21
call fcn.00462d70
nop
call fcn.00461860
jmp fcn.0040a420
Function at 0x40fa00
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x50d234]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40fbfe
sub esp, 0x18
mov eax, dword [0x50d170]
test eax, eax
jne 0x40fbe7
nop
nop
lea eax, [0x50d160]
mov dword [esp], eax
call fcn.00408a70
mov eax, dword [0x50d164]
test eax, eax
je 0x40fa48
cmp dword [eax + 8], 0xcc
jne 0x40fabe
mov edx, dword [0x50d168]
test edx, edx
jne 0x40faa0
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x50f7b0]
mov dword [esp + 8], eax
call fcn.0040a600
mov eax, dword [esp + 0xc]
mov dword [0x50d168], eax
mov ecx, dword [0x50d16c]
mov dword [eax], ecx
mov eax, dword [0x50d168]
mov dword [0x50d16c], eax
movzx eax, byte [0x50d540]
test al, al
jne 0x40faa0
xor eax, eax
jmp 0x40fbb8
mov edx, dword [0x50d168]
mov ebx, dword [edx + 4]
mov dword [0x50d168], ebx
mov ebx, dword [0x50d164]
mov dword [edx + 4], ebx
mov dword [0x50d164], edx
mov edx, dword [0x50d164]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x40fb97
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00467190
mov eax, dword [0x50d2c0]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x40fb10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x40fb50
call fcn.00462cc0
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
nop
nop
lea eax, [0x50d160]
mov dword [esp], eax
call fcn.00408c90
nop
lea eax, [0x50d15c]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.004672f0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00462ce0
lea edx, [0x4ea20c]
movzx ebx, byte [edx + eax]
lea ebp, [0x50d540]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x40faa0
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x40fba1
mov ecx, 5
call fcn.00462cd0
lea eax, [0x47fcfc]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0045d710
nop
call fcn.00461860
jmp fcn.0040fa00
Function at 0x413d20
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x50d234]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x413da9
sub esp, 0x10
mov eax, dword [esp + 0x14]
test byte [eax], al
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
call fcn.00467040
movzx eax, byte [esp + 0xc]
test al, al
je 0x413d8e
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x413d92
mov dword [esp], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call fcn.00413dc0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00414370
add esp, 0x10
ret
add esp, 0x10
ret
lea eax, [0x47fd14]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0045d710
nop
call fcn.00461860
jmp fcn.00413d20
Function at 0x423420
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x50d234]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4235fa
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x423525
cmp cl, 1
je 0x4234b4
cmp cl, 2
jne 0x4235e3
mov ecx, dword [eax + 8]
test byte [ecx], al
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.004670e0
nop
nop
lea eax, [0x4f9828]
mov dword [esp], eax
call fcn.00408a70
mov eax, dword [0x4f981c]
sub eax, dword [0x4f9800]
nop
mov dword [0x4f981c], eax
mov eax, dword [0x4f980c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x4f980c], ecx
nop
lea eax, [0x4f9828]
mov dword [esp], eax
call fcn.00408c90
jmp 0x4235df
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.0040fa00
nop
nop
lea eax, [0x4f9828]
mov dword [esp], eax
call fcn.00408a70
mov eax, dword [0x4f977c]
sub eax, dword [0x4f9760]
nop
mov dword [0x4f977c], eax
mov eax, dword [0x4f976c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x4f976c], ecx
nop
lea eax, [0x4f9828]
mov dword [esp], eax
call fcn.00408c90
jmp 0x4235df
cmp cl, 3
je 0x423587
cmp cl, 4
jne 0x423538
mov byte [eax + 8], 1
jmp 0x4235df
cmp cl, 5
jne 0x4235e3
nop
nop
lea eax, [0x4f9828]
mov dword [esp], eax
call fcn.00408a70
mov eax, dword [0x4f97f4]
sub eax, dword [0x4f97d8]
nop
mov dword [0x4f97f4], eax
mov eax, dword [0x4f97e4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x4f97e4], ecx
nop
lea eax, [0x4f9828]
mov dword [esp], eax
call fcn.00408c90
jmp 0x4235df
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00428950
nop
nop
lea eax, [0x4f9828]
mov dword [esp], eax
call fcn.00408a70
mov eax, dword [0x4f97a4]
sub eax, dword [0x4f9788]
nop
mov dword [0x4f97a4], eax
mov eax, dword [0x4f9794]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x4f9794], ecx
nop
nop
lea eax, [0x4f9828]
mov dword [esp], eax
call fcn.00408c90
add esp, 0x14
ret
lea eax, [0x47e550]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0045d710
nop
call fcn.00461860
jmp fcn.00423420
Function at 0x428a20
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x50d234]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x428ba2
sub esp, 0x24
mov eax, dword [0x50d51c]
test eax, eax
je 0x428b4d
mov eax, dword [esp + 0x38]
cmp eax, 5
jg 0x428b58
mov ecx, dword [0x50d234]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov edx, dword [ecx + 0x18]
mov dword [esp + 0x20], edx
mov ebx, dword [edx + 0x50]
test ebx, ebx
je 0x428aa6
cmp ecx, ebx
je 0x428aa6
mov ecx, dword [edx + 0x17c]
mov ebp, dword [edx + 0x180]
mov esi, dword [edx + 0x178]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebp
call fcn.00450830
mov eax, dword [esp + 0x14]
jmp 0x428ad0
mov ecx, dword [edx + 0x178]
mov ebx, dword [edx + 0x17c]
mov ebp, dword [edx + 0x180]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
call fcn.00460b10
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
mov edx, dword [ebx + 0x180]
cmp eax, edx
ja 0x428b51
mov ecx, dword [ebx + 0x178]
mov ebp, dword [esp + 0x28]
mov dword [esp], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 4], ebp
mov ebp, dword [esp + 0x30]
mov dword [esp + 8], ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
call fcn.00429460
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x7c]
lea edx, [ecx - 1]
nop
mov ebx, dword [0x50d234]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
mov dword [eax + 0x7c], edx
cmp ecx, 1
jne 0x428b49
movzx eax, byte [ebx + 0x69]
test al, al
je 0x428b49
mov dword [ebx + 8], 0xfffffade
add esp, 0x24
ret
add esp, 0x24
ret
mov ecx, eax
call fcn.00462d10
call fcn.00431490
lea eax, [0x47e24f]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00431cf0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
sar eax, 0x1f
mov dword [esp + 4], eax
call fcn.00431b10
call fcn.004314f0
lea eax, [0x47eb31]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.0045d710
nop
call fcn.00461860
jmp fcn.00428a20
Function at 0x42df30
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 8
mov dword [esp + 0x30], 0
mov eax, dword [0x50d234]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x1b0], 8
lea ecx, [esp + 0x10]
mov dword [eax + 0x1b4], ecx
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0042dc10
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
add esp, 8
ret
Function at 0x44ac50
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x50d234]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44adad
sub esp, 0x14
lea eax, [0x50d534]
mov dword [esp], eax
call fcn.00467100
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
test eax, eax
je 0x44ac87
mov ecx, dword [esp + 0x18]
jmp 0x44aca3
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 6]
test dl, dl
je 0x44aca3
lea eax, [ecx + 0x30]
nop
mov dword [esp], eax
call fcn.00408a70
mov ecx, dword [esp + 0x18]
test byte [ecx], al
nop
nop
mov dword [esp], ecx
call fcn.00408a70
mov eax, dword [esp + 0x10]
test eax, eax
je 0x44acc7
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0044ab50
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 5]
test dl, 1
je 0x44ad07
mov ebx, edx
or edx, 2
mov byte [ecx + 5], dl
test dl, 4
jne 0x44ad07
or ebx, 6
mov byte [ecx + 5], bl
mov eax, dword [ecx + 0x2c]
test byte [eax], al
add eax, 0x14
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00467120
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0xc]
mov ebx, dword [ecx + 0x10]
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
test ebx, ebx
sete bl
xchg ebp, ebx
setg bl
xchg ebp, ebx
test edx, edx
seta dl
and ebx, edx
or ebx, ebp
mov byte [esp + 0xf], bl
test eax, eax
jne 0x44ad43
movzx edx, byte [ecx + 6]
test dl, dl
je 0x44ad43
inc dword [ecx + 0x28]
mov dword [esp], ecx
call fcn.0044a760
mov eax, dword [esp + 0x10]
test eax, eax
je 0x44ad5a
movzx ebx, byte [esp + 0xf]
jmp 0x44ada5
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x44ad6d
movzx ebx, byte [esp + 0xf]
jmp 0x44ada5
lea ecx, [eax + 0x30]
nop
mov dword [esp], ecx
call fcn.00408c90
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x44ad8e
call fcn.0044c970
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x24]
mov dword [esp], eax
call fcn.00404b90
movzx ebx, byte [esp + 4]
movzx eax, byte [esp + 0xf]
or ebx, eax
mov byte [esp + 0x1c], bl
add esp, 0x14
ret
call fcn.00461860
jmp fcn.0044ac50
Function at 0x44cad0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x50d234]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44cbcc
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x10], eax
test byte [eax], al
nop
nop
mov dword [esp], eax
call fcn.00408a70
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x44cb13
call fcn.0044c970
mov eax, dword [esp + 0x10]
inc dword [eax + 8]
movzx ecx, byte [eax + 5]
test cl, 1
je 0x44cb67
test cl, 4
je 0x44cb67
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
test ebx, ebx
setg bl
xchg ebp, ebx
sete bl
xchg ebp, ebx
test edx, edx
seta dl
and ebp, edx
or ebp, ebx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x44cb67
and ecx, 0xfffffffb
mov byte [eax + 5], cl
mov ecx, dword [eax + 0x2c]
test byte [ecx], al
add ecx, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0xffffffff
call fcn.00467120
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 5]
nop
test cl, 1
jne 0x44cba5
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
test edx, edx
setg dl
sete bl
test ecx, ecx
seta cl
and ebx, ecx
or ebx, edx
test bl, bl
je 0x44cba5
movzx ecx, byte [eax + 6]
test cl, cl
je 0x44cb9e
mov ecx, dword [eax + 8]
test ecx, ecx
seta cl
jmp 0x44cba7
mov ecx, 1
jmp 0x44cba7
xor ecx, ecx
mov byte [esp + 0xf], cl
mov dword [esp], eax
call fcn.0044a760
movzx eax, byte [esp + 0xf]
test al, al
je 0x44cbc8
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0044b2a0
add esp, 0x14
ret
call fcn.00461860
jmp fcn.0044cad0