joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47ee49
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x30]
push 0xffffffffffffffff
mov dword [esp + 0x18], esi
push esi
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], esi
push eax
mov ecx, edi
mov dword [esp + 0x24], edi
mov byte [edi + 4], 0
call fcn.00402d40
mov dword [esp + 0x24], esi
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov edi, edi
cmp dword [ebp + 0x18], 0x10
mov ecx, dword [ebp + 0x14]
jb 0x40387e
mov eax, dword [ebp + 4]
jmp 0x403881
lea eax, [ebp + 4]
push ecx
push eax
push edi
mov eax, esi
call fcn.004057f0
mov esi, eax
cmp esi, 0xffffffff
je 0x4038a9
mov edx, dword [esp + 0xc]
push 0
push ebx
push edx
push edi
or eax, 0xffffffff
call fcn.00405250
add esi, dword [esp + 0x10]
jmp 0x403870
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x404a80
Capabilities:
Check if file exists
Create directory
Get file attributes
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x47f75d
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x49d2b0]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0x244]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x24c], edi
mov esi, ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x24c], 2
lea ebp, [esi + 4]
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov word [ebp], ax
cmp dword [esp + 0x26c], 8
mov eax, dword [esp + 0x258]
mov dword [esp + 0x14], 1
jae 0x404b0c
lea eax, [esp + 0x258]
push 0x104
lea ecx, [esp + 0x3c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [esp + 0x38]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x404b24
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x3c]
call fcn.00402880
mov eax, dword [esi + 0x14]
lea edx, [eax - 1]
lea eax, [esp + 0x1c]
push eax
push esi
mov ecx, 1
call fcn.00401ce0
mov ecx, eax
mov byte [esp + 0x24c], 3
mov eax, dword [ecx + 0x14]
push 0x4854d8
mov edi, 1
call fcn.004020d0
test eax, eax
setne bl
mov byte [esp + 0x24c], 2
mov edi, 8
cmp dword [esp + 0x34], edi
jb 0x404b94
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0045f4bb
add esp, 4
xor edx, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], dx
test bl, bl
je 0x404bbd
push 1
push 0x4854d8
mov eax, esi
call fcn.00401d60
mov edx, dword [esp + 0x274]
cmp dword [esp + 0x288], edi
jae 0x404bd4
lea edx, [esp + 0x274]
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404be0
sub eax, edi
sar eax, 1
push eax
push edx
mov eax, esi
call fcn.00401d60
mov ebx, 8
cmp dword [esi + 0x18], ebx
jb 0x404c07
mov eax, dword [ebp]
jmp 0x404c09
mov eax, ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x404c2a
cmp dword [esi + 0x18], ebx
jb 0x404c1f
mov eax, dword [ebp]
jmp 0x404c21
mov eax, ebp
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [esp + 0x24c], 1
cmp dword [esp + 0x26c], ebx
jb 0x404c4b
mov eax, dword [esp + 0x258]
push eax
call fcn.0045f4bb
add esp, 4
xor ecx, ecx
mov edi, 7
xor ebp, ebp
mov dword [esp + 0x26c], edi
mov dword [esp + 0x268], ebp
mov word [esp + 0x258], cx
mov byte [esp + 0x24c], cl
cmp dword [esp + 0x288], ebx
jb 0x404c8a
mov edx, dword [esp + 0x274]
push edx
call fcn.0045f4bb
add esp, 4
xor eax, eax
mov dword [esp + 0x288], edi
mov dword [esp + 0x284], ebp
mov word [esp + 0x274], ax
mov eax, esi
mov ecx, dword [esp + 0x244]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0045f4ac
add esp, 0x23c
ret
Function at 0x405fd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x47cd4b
mov eax, dword fs:[0]
push eax
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [eax + 0x2c], 0xf
mov dword [eax + 0x28], ecx
mov byte [eax + 0x18], cl
mov dword [esp + 0xc], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x50], 1
mov dword [eax + 0x10], ecx
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4

Function at 0x406050
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x47ac1b
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov dword [esp + 0x18], ebx
cmp dword [esi], 1
jne 0x4060aa
push 0x3e8
mov dword [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 2
push eax
call edi
mov ecx, dword [esi + 0x34]
push 2
push ecx
call edi
mov eax, dword [esi + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x4060bd
push eax
call edi
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x4060ca
push eax
call edi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esp + 0x18], 0xffffffff
cmp dword [esi + 0x2c], 0x10
jb 0x4060ea
mov edx, dword [esi + 0x18]
push edx
call fcn.0045f4bb
add esp, 4
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], ebx
mov byte [esi + 0x18], bl
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x406110
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x47ecd0
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov esi, ecx
mov eax, dword [esi + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp eax, ebx
je 0x40614f
push eax
call edi
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x40615c
push eax
call edi
mov dword [esi + 0x34], ebx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
lea edi, [esi + 0x38]
mov dword [esi + 0x3c], ebx
mov dword [edi], ebx
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], ecx
cmp ebp, ebx
jne 0x4061b3
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x44], esp
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push 0xb
mov eax, 0x485844
mov word [esi + 4], dx
call fcn.00402880
mov dword [esp + 0x38], ebx
mov dword [esp + 0x38], 0xffffffff
call fcn.00406260
xor eax, eax
jmp 0x40623d
cmp dword [esi], 1
mov dword [esi + 0x58], ebp
jne 0x4061f1
sub esp, 0x1c
mov dword [esp + 0x44], esp
mov ecx, esp
cmp dword [esi + 8], ebx
je 0x4061dd
mov eax, 0x48585c
call fcn.00401ca0
mov dword [esp + 0x38], 1
jmp 0x40622b
mov eax, 0x485878
call fcn.00401ca0
mov dword [esp + 0x38], 2
jmp 0x40622b
push edi
push ebx
push esi
push 0x4063c0
push ebx
push ebx
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x30], eax
cmp dword [edi], ebx
je 0x406238
sub esp, 0x1c
mov eax, 0x485890
mov ecx, esp
mov dword [esi], 1
mov dword [esp + 0x44], esp
call fcn.00401ca0
mov dword [esp + 0x38], 3
mov dword [esp + 0x38], 0xffffffff
call fcn.00406260
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc

Function at 0x4062d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47da28
mov eax, dword fs:[0]
push eax
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], 0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x20]
push ecx
lea ecx, [eax + 0x14]
call fcn.00402d40
mov dword [esp + 0xc], 0xffffffff
cmp dword [esp + 0x30], 0x10
jb 0x406329
mov edx, dword [esp + 0x1c]
push edx
call fcn.0045f4bb
add esp, 4
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 0x20
Function at 0x40a0a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47f705
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
sub esp, 0x2c
mov eax, esp
xor ecx, ecx
mov dword [eax + 0x24], 0xf
mov dword [eax + 0x20], ecx
mov dword [esp + 0x30], esp
mov dword [esp + 0x34], eax
mov byte [eax + 0x10], cl
mov dword [esp + 0x40], 1
mov dword [esp + 0x40], 0xffffffff
mov ecx, dword [esp + 0x48]
call fcn.0040ad70
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret 4
Function at 0x40d590
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x47f64b
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x49d2b0]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0x13c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14c]
mov edi, dword [esp + 0x150]
mov esi, ecx
mov ebx, edx
push 0x485d98
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
call fcn.00460f86
mov ebp, eax
xor eax, eax
add esp, 8
mov dword [esp + 0x14], ebp
cmp ebp, eax
jne 0x40d65c
cmp ebx, eax
je 0x40d655
lea ecx, [esp + 0x2c]
call fcn.0040dca0
xor esi, esi
mov dword [esp + 0x144], esi
push 0xffffffffffffffff
push esi
mov ecx, ebx
call fcn.004023c0
mov dword [esp + 0x144], 0xffffffff
cmp dword [esp + 0x44], 8
jb 0x40d642
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0045f4bb
add esp, 4
xor edx, edx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], esi
mov word [esp + 0x30], dx
xor al, al
jmp 0x40d792
cmp edi, eax
je 0x40d668
mov ecx, dword [edi]
mov dword [esp + 0x18], ecx
jmp 0x40d66c
mov dword [esp + 0x18], eax
xor edx, edx
mov dword [esp + 0x4a], eax
mov dword [esp + 0x4e], eax
mov dword [esp + 0x52], eax
mov dword [esp + 0x56], eax
mov dword [esp + 0x5a], eax
mov dword [esp + 0x5e], eax
mov dword [esp + 0x62], eax
mov dword [esp + 0x66], eax
mov dword [esp + 0x6a], eax
mov word [esp + 0x6e], ax
or eax, 0xffffffff
xor ebx, ebx
mov word [esp + 0x48], dx
call fcn.00402330
push 2
push ebx
push ebp
call fcn.00461027
push ebp
call fcn.00461249
push ebx
push ebx
push ebp
mov edi, eax
call fcn.00461027
add esp, 0x1c
test edi, edi
je 0x40d737
push edi
call fcn.0045f2f1
mov ebp, eax
mov eax, dword [esp + 0x18]
push eax
push 1
push edi
push ebp
call fcn.00461557
push edi
mov edx, ebp
xor ecx, ecx
call fcn.0040da90
mov ebx, eax
xor ecx, ecx
lea eax, [ebx + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045f2f1
mov esi, eax
push edi
mov edx, ebp
mov ecx, esi
mov dword [esp + 0x48], esi
call fcn.0040da90
add esp, 0x20
mov eax, esi
mov esi, dword [esp + 0x24]
push ebx
call fcn.00402880
mov eax, dword [esp + 0x28]
push eax
call fcn.0045f84d
push ebp
call fcn.0045f84d
mov ebp, dword [esp + 0x1c]
add esp, 8
push ebx
push edi
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x7c]
push str._s_d_bytes_to__d_wide_chars
push edx
call fcn.00461574
mov esi, dword [esp + 0x30]
add esp, 0x14
test esi, esi
je 0x40d779
lea eax, [esp + 0x70]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d760
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x74]
call fcn.00402880
push ebp
call fcn.00461683
mov eax, dword [esp + 0x24]
add esp, 4
test eax, eax
je 0x40d790
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov al, 1
mov ecx, dword [esp + 0x13c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.0045f4ac
add esp, 0x134
ret
Function at 0x40f7f0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x47d991
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3c]
xor ebx, ebx
mov dword [esp + 0xc], ebx
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x18], ax
mov eax, dword [esp + 0x44]
push ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
call fcn.004023c0
mov dword [esp + 0x34], 1
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40f850
sub eax, edx
sar eax, 1
push eax
push edi
lea eax, [esp + 0x18]
call fcn.00401d60
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push 0xffffffffffffffff
mov word [esi + 4], cx
push ebx
mov ecx, esi
call fcn.004023c0
mov dword [esp + 0xc], 1
mov byte [esp + 0x34], bl
cmp dword [esp + 0x28], 8
jb 0x40f8a4
mov edx, dword [esp + 0x14]
push edx
call fcn.0045f4bb
add esp, 4
xor eax, eax
mov word [esp + 0x14], ax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x40f8d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x47db21
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0x10], ebx
xor eax, eax
mov word [esp + 0x18], ax
mov eax, 0x48ace4
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
lea edx, [eax + 2]
jmp 0x40f920
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40f920
sub eax, edx
sar eax, 1
push eax
mov eax, 0x48ace4
lea esi, [esp + 0x18]
call fcn.00402880
mov dword [esp + 0x38], 1
mov ecx, dword [esp + 0x44]
push ebx
push ecx
or eax, 0xffffffff
call fcn.00401e80
push 0xffffffffffffffff
mov esi, 7
xor edx, edx
mov dword [edi + 0x18], esi
mov dword [edi + 0x14], ebx
push ebx
mov ecx, edi
mov word [edi + 4], dx
call fcn.004023c0
mov dword [esp + 0x10], 1
mov byte [esp + 0x38], bl
cmp dword [esp + 0x2c], 8
jb 0x40f98f
mov eax, dword [esp + 0x18]
push eax
call fcn.0045f4bb
add esp, 4
xor ecx, ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], cx
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x420720
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x47e7c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [esp + 0x38]
mov ebp, dword [ebx + 0x30]
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 0
mov esi, dword [ebx + 0x30]
mov eax, dword [esi + 0x1c]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x10], edx
mov dword [esp + 0x1c], eax
mov eax, dword [edi]
mov edx, dword [eax + 8]
push ebx
mov ecx, edi
call edx
test al, al
je 0x420821
cmp dword [ebx + 0x18], 0
je 0x4207f8
mov eax, dword [esi + 0x1c]
lea ecx, [eax + 8]
mov dword [esi + 0x1c], ecx
cmp dword [esi + 0x20], ecx
jae 0x4207af
push 8
mov dword [esi + 0x1c], eax
call fcn.00429940
test eax, eax
je 0x4207b5
mov dword [eax], edi
mov dword [eax + 4], 0x4a84c8
mov edi, dword [ebx + 0x18]
mov eax, dword [edi]
mov edx, dword [eax + 8]
push ebx
mov ecx, edi
mov dword [esp + 0x3c], edi
call edx
test al, al
jne 0x420791
mov eax, dword [esp + 0x1c]
cmp eax, dword [esi + 0x1c]
je 0x420821
lea ecx, [esp + 0x38]
push ecx
call fcn.004387a0
mov edi, dword [esp + 0x38]
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
push ebx
mov ecx, edi
call eax
test al, al
je 0x4207d1
jmp 0x420791
mov dword [esp + 0x30], 0xffffffff
mov ebx, dword [esp + 0x18]
mov esi, ebp
call fcn.0041c3d0
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov dword [esp + 0x30], 0xffffffff
mov ebx, dword [esp + 0x18]
mov esi, ebp
call fcn.0041c3d0
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x420850
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x47e7c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [esp + 0x38]
mov ebp, dword [ebx + 0x30]
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 0
mov esi, dword [ebx + 0x30]
mov eax, dword [esi + 0x1c]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x10], edx
mov dword [esp + 0x1c], eax
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push ebx
mov ecx, edi
call edx
test al, al
je 0x420951
cmp dword [ebx + 0x18], 0
je 0x420928
mov eax, dword [esi + 0x1c]
lea ecx, [eax + 8]
mov dword [esi + 0x1c], ecx
cmp dword [esi + 0x20], ecx
jae 0x4208df
push 8
mov dword [esi + 0x1c], eax
call fcn.00429940
test eax, eax
je 0x4208e5
mov dword [eax], edi
mov dword [eax + 4], 0x4a84c8
mov edi, dword [ebx + 0x18]
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push ebx
mov ecx, edi
mov dword [esp + 0x3c], edi
call edx
test al, al
jne 0x4208c1
mov eax, dword [esp + 0x1c]
cmp eax, dword [esi + 0x1c]
je 0x420951
lea ecx, [esp + 0x38]
push ecx
call fcn.004387a0
mov edi, dword [esp + 0x38]
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push ebx
mov ecx, edi
call eax
test al, al
je 0x420901
jmp 0x4208c1
mov dword [esp + 0x30], 0xffffffff
mov ebx, dword [esp + 0x18]
mov esi, ebp
call fcn.0041c3d0
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov dword [esp + 0x30], 0xffffffff
mov ebx, dword [esp + 0x18]
mov esi, ebp
call fcn.0041c3d0
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x4218a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47f3da
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push edi
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
push edi
lea eax, [esp + 0x1c]
push eax
call fcn.00428960
mov dword [esp + 0x30], 0
push esi
mov ecx, edi
call fcn.004248d0
mov ecx, dword [esi + 0x10]
mov ebx, dword [esi + 0xc]
mov edx, ecx
push edx
mov dword [esp + 0x18], ecx
mov eax, ebx
push eax
mov byte [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
mov ecx, esi
call fcn.00420720
add esp, 0x10
cmp byte [edi + 0x24], al
jne 0x421953
or ecx, 0xffffffff
test al, al
je 0x42192c
cmp dword [edi + 0x10], ecx
jne 0x42192c
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
mov edi, dword [edi + 4]
mov dword [esi + 0x18], edi
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x18]
call fcn.00418bd0
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov edx, edi
call fcn.0041b9b0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00418bd0
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47f3da
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push edi
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
push edi
lea eax, [esp + 0x1c]
push eax
call fcn.00428960
mov dword [esp + 0x30], 0
push esi
mov ecx, edi
call fcn.004248d0
mov ecx, dword [esi + 0x10]
mov ebx, dword [esi + 0xc]
mov edx, ecx
push edx
mov dword [esp + 0x18], ecx
mov eax, ebx
push eax
mov byte [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
mov ecx, esi
call fcn.00420850
add esp, 0x10
cmp byte [edi + 0x24], al
jne 0x421a43
or ecx, 0xffffffff
test al, al
je 0x421a1c
cmp dword [edi + 0x10], ecx
jne 0x421a1c
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
mov edi, dword [edi + 4]
mov dword [esi + 0x18], edi
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x18]
call fcn.00418bd0
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov edx, edi
call fcn.0041b9b0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00418bd0
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4291e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47c86d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x14], edx
lea eax, [esi + 0x30]
mov dword [esp + 8], eax
mov byte [esp + 0x14], dl
mov ecx, dword [eax]
cmp ecx, edx
je 0x429226
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
push 1
call edx
mov dword [esp + 0x14], 0xffffffff
mov ecx, esi
call fcn.00418eb0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x438f50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47e568
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x49d2b0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 0x20]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 0
mov esi, dword [edi + 0x20]
mov eax, dword [esi + 0x1c]
mov dword [edi + 8], ecx
mov edx, dword [ebx]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0xc]
push edi
mov ecx, ebx
call eax
test al, al
je 0x43904e
jmp 0x438fc0
cmp dword [edi + 0x10], 0
je 0x439025
mov eax, dword [esi + 0x1c]
lea ecx, [eax + 8]
mov dword [esi + 0x1c], ecx
cmp dword [esi + 0x20], ecx
jae 0x438fde
push 8
mov dword [esi + 0x1c], eax
call fcn.00429940
test eax, eax
je 0x438fe4
mov dword [eax], ebx
mov dword [eax + 4], 0x4a843c
mov ebx, dword [edi + 0x10]
mov edx, dword [ebx]
mov eax, dword [edx + 0xc]
push edi
mov ecx, ebx
mov dword [ebp + 8], ebx
call eax
test al, al
jne 0x438fc0
nop
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esi + 0x1c]
je 0x43904e
lea edx, [ebp + 8]
push edx
call fcn.0044a660
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov edx, dword [eax + 0x14]
push edi
mov ecx, ebx
call edx
test al, al
je 0x439000
jmp 0x438fc0
mov dword [esp + 0x30], 0xffffffff
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
call fcn.0041c3d0
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x30], 0xffffffff
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
call fcn.0041c3d0
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret