joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423e8e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x423e9d
pop dword [ebp - 0x14]
mov eax, 0x6d32a99f
add eax, 0x930f94fe
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x640b1490
sub dword [ebp - 0x24], 0x15b8cf45
mov dword [ebp - 0x20], 0xc993b477
sub dword [ebp - 0x20], 0x97606832
mov dword [ebp - 0x1c], 0x3eded73c
add dword [ebp - 0x1c], 0xd6d6cf2
mov dword [ebp - 0x18], 0x9e9ff441
add dword [ebp - 0x18], 0x61600bbf
lea eax, [ebp - 0x24]
push eax
mov eax, 0xafeee121
add eax, 0x505480bf
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xfafb7e73
sub dword [ebp - 0x24], 0x8689151d
mov dword [ebp - 0x20], 0x345c4093
add dword [ebp - 0x20], 0xd1020e2
mov dword [ebp - 0x1c], 0xa3341acd
add dword [ebp - 0x1c], 0xc03b519f
mov dword [ebp - 0x18], 0x52a64bcb
add dword [ebp - 0x18], 0xad59b435
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xcb3a1746
sub eax, 0xcaf6b516
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x462ea
push 0
call eax
mov ecx, 0x9e9c2a3c
sub ecx, 0x9e9bd5a3
mov edi, eax
mov ebx, 0xe0c5b0c9
sub ebx, 0xe07fe8c9
add ebx, dword [ebp - 0x14]
mov esi, 0xcda00a48
sub esi, 0x174cfc6a
add dword [ebp - 0xc], ebx
mov edx, dword [ebx]
sub dword [ebp - 8], esi
add edx, esi
add dword [ebp - 8], 0x26a53659
mov dword [edi], edx
xor dword [ebp - 4], 0xf4d86abf
add edi, 4
add ebx, 0x262f6be9
add ebx, 0xd9d0941b
loop 0x423fbf
add eax, 0x14537
mov ebx, eax
add eax, 0xe2bc4c2f
sub eax, 0xe2bc4c2a
mov ecx, 0xf4664bec
sub ecx, 0xf4264bec
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x403200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ebx, edx
jmp 0x403211
mov ecx, dword [eax + 0x18]
nop
jmp 0x403221
push eax
jmp 0x40322f
test ecx, ecx
nop
jmp 0x403240
je 0x4033a8
jmp 0x403252
jmp 0x40325c
dec ecx
jmp 0x403268
mov esi, dword [ebx + ecx*4]
jmp 0x403279
xor edi, edi
nop
add esi, edx
nop
nop
jmp 0x40328e
xor eax, eax
nop
jmp 0x4032a0
ror edi, 0xd
nop
lodsb al, byte [esi]
nop
add edi, eax
nop
jmp 0x4032b8
cmp al, ah
nop
jmp 0x4032c6
jne 0x40327f
jmp 0x4032db
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
nop
jne 0x403222
nop
jmp 0x4032f9
nop
pop eax
nop
jmp 0x403310
mov ebx, dword [eax + 0x24]
nop
jmp 0x403325
add ebx, edx
mov cx, word [ebx + ecx*2]
nop
jmp 0x40333f
mov ebx, dword [eax + 0x1c]
nop
jmp 0x403350
add ebx, edx
nop
mov eax, dword [ebx + ecx*4]
add eax, edx
nop
mov dword [esp + 0x24], eax
nop
jmp 0x40336b
pop ebx
pop ebx
nop
jmp 0x40337b
popal
jmp 0x40338c
pop ecx
pop edx
nop
push ecx
nop
jmp eax
pop eax
nop
jmp 0x4033bd
Function at 0x40102f
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
push edi
push 0x40
push 0x3000
push dword [0x4100ec]
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40106b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401163
push eax
push str.ERROR__allocating_negative_control___s_n
call fcn.0040134c
add esp, 0xc
xor eax, eax
jmp 0x4010ab
mov eax, dword [0x4100ec]
mov edx, esi
add eax, esi
mov ecx, eax
sub ecx, esi
add ecx, 3
push ebx
xor ebx, ebx
shr ecx, 2
cmp esi, eax
cmova ecx, ebx
pop ebx
test ecx, ecx
je 0x401099
inc edi
mov dword [edx], 0xc3c3c3c3
lea edx, [edx + 4]
cmp edi, ecx
jb 0x40108b
push esi
push 8
push str.INFO__negative_control_allocated_at_0x_.x_n
call fcn.0040134c
add esp, 0xc
mov eax, esi
pop edi
pop esi
ret

Function at 0x40129e
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push 0x4100d0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.0040102f
push 1
push 0x2000
push dword [0x4100ec]
mov ebx, eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4012ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401163
push eax
push str.ERROR__allocating_positive_control___s_n
call fcn.0040134c
add esp, 0xc
jmp 0x4012fa
push esi
push 8
push str.INFO__positive_control_allocated_at_0x_.x_n
call fcn.0040134c
add esp, 0xc
call fcn.004010ae
mov edi, eax
test ebx, ebx
je 0x401345
test esi, esi
je 0x401345
test edi, edi
je 0x401345
push 1
push ebx
push str.negative_control
call fcn.004011b6
push 0
push esi
push str.positive_control
mov bl, al
call fcn.004011b6
push 0
push edi
push str.poison_area
or bl, al
call fcn.004011b6
add esp, 0x24
or al, bl
push 0
pop eax
setne al
jmp 0x401348
push 2
pop eax
pop edi
pop esi
pop ebx
ret

Function at 0x406db6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x406dfa
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x406dc9
jmp 0x406dfa
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x406dea
pop esi
pop ebp
ret
Function at 0x407832
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x407867
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x407891
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x407891
test edi, edi
je 0x40785e
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40785e
test edi, edi
je 0x407899
mov eax, edi
jmp 0x407860
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x407860
int3
Function at 0x40a40d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestPoisonArea.exe_gMozillaPoisonSize], eax
call fcn.00407832
pop ecx
mov ecx, dword [sym.TestPoisonArea.exe_gMozillaPoisonSize]
mov dword [sym.TestPoisonArea.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40a445
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestPoisonArea.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x403f3d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00404bf5
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0040409d
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x404087
test ebx, ebx
jl 0x40402b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcba3a1
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40404c
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x40403e
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00405a0d
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00405a0d
add esp, 8
mov ebx, 0x80070057
jmp 0x40402b
Function at 0x41af0d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0041bbc5
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0041b06d
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41b057
test ebx, ebx
jl 0x41affb
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcd1371
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41b01c
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x41b00e
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0041c9dd
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0041c9dd
add esp, 8
mov ebx, 0x80070057
jmp 0x41affb
Function at 0x431f9d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00432c55
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004320fd
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4320e7
test ebx, ebx
jl 0x43208b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce8401
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4320ac
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x43209e
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00433a6d
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00433a6d
add esp, 8
mov ebx, 0x80070057
jmp 0x43208b
Function at 0x445901
Capabilities:
Authenticate hmac

Disassembly:
pop ecx
test eax, 0xfaf57b4d
cmp dl, byte [esi + 0x3b6afbc5]
sub al, 0x96
cmp byte [eax], bl
cmpsd dword [esi], dword es:[edi]
sbb byte [edx + 0x3a18385d], al
xor al, 0x66
loop 0x445991
add al, 0x36
mov bh, 0x63
cmp eax, 0x9b2d59ac
xchg ecx, eax
invalid
jl 0x4459c5
pop ss
mov cl, 0x62
sbb ebx, dword [ebx + 0x77835575]
sbb ch, byte [edx + ecx*2 - 0x5d2f4da8]
jle 0x4459b6
lea edx, [edx - 0x78]
and byte [ecx - 0x2f], ch
aad 0x23
popfd
adc byte [ebp + eax - 0x11], ah
imul edx, ecx, 0x109d23d5
add eax, 0xb28bcbef
mov dh, 0xfa
pop edx
imul edi, dword [edi + ecx*2 + 0x50355bc7], 0xfffffff9
lodsb al, byte [esi]
push 0x3dde304d
mov ebp, dword [edi + esi + 0x53ed5b8f]
retf
cld
xor esp, ebp
rcl dword [ebx + 0x44fe42ed], 0x9c
push 0xffffffffffffff8b
jo 0x44599a
stosb byte es:[edi], al
and al, 0xf0
adc al, 0x89
or ah, byte [esi + 0x6084c332]
pop dword [ebp + 0x53]
mov esi, 0x4371f297
ficom word [edx + 0x4d520aab]
clc
loope 0x445a09
mov edx, 0xb4bb19b7
jge 0x445979
sbb dword [0x62a1bf46], ecx
mov ch, 0x5c
adc al, 0xc3
movsd dword es:[edi], dword [esi]
pushal
jns 0x445a12
cdq
mov edi, 0xb623a30
pop esp
mov al, 0xff
pop ebx
int3
aaa
and dh, 0xdc
mov ah, 0x9d
xor eax, 0x86d2db0b
push 3
int 0x3c
rol byte [esi + 0x3ccd036a], cl
pop es
sbb eax, 0x6bd78f11
jp 0x7aa01366
dec esp
sub dl, 0x67
mov byte [0xd30f4f6f], al
sti
jbe 0x445a90
rcr dword [ebp + ecx*8 - 0xa], 1
lcall 0x7c2f, 0x7c1a3284
out 0x9d, eax
mov ebp, 0x7d788818
nop
ficomp dword [edx + 0x69646c47]
pop eax
pushfd
mov byte [edx - 0x4d76f266], al
pop ecx
xor eax, 0x538dd75a
nop
dec ebp
iretd
pop ebx
movsb byte es:[edi], byte [esi]
jg 0x445a52
and ebp, esp
push ebx
and edx, dword [esi - 0x34]
dec esi
iretd
je 0x445a6b
in eax, 0x3a
test al, 0xcd
loop 0x445b15
and al, 0xd0
call fcn.00442f26
sub dh, byte [esp + eax*8 - 0x6a]
sti
outsd dx, dword [esi]
cwde
pop ebx
wait
dec esp
rcr dword [ebx], 0xb2
insd dword es:[edi], dx
jle 0x445b09
jecxz 0x445a8e
dec eax
or ebp, dword [edx + 0x2d]
retf 0x4564
invalid
adc cl, bh
cmp eax, 0xa1c43d73
add eax, 0xe4949262
or dh, byte [ebp + 0x3ac682d]
pop ebp
sbb dword [edi - 0x4da1cf30], edi
pop dword [edi + 0x39f113d6]
shr ebp, 1
mov esp, dword [eax - 0x19]
invalid
Function at 0x448bdd
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00449895
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00448d3d
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x448d27
test ebx, ebx
jl 0x448ccb
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcff041
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x448cec
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x448cde
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0044a6ad
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0044a6ad
add esp, 8
mov ebx, 0x80070057
jmp 0x448ccb
Function at 0x45f83d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004604f5
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0045f99d
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45f987
test ebx, ebx
jl 0x45f92b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd15ca1
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45f94c
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x45f93e
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0046130d
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0046130d
add esp, 8
mov ebx, 0x80070057
jmp 0x45f92b
Function at 0x47683d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004774f5
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0047699d
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x476987
test ebx, ebx
jl 0x47692b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2cca1
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x47694c
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x47693e
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0047830d
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0047830d
add esp, 8
mov ebx, 0x80070057
jmp 0x47692b
Function at 0x48dead
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0048eb65
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0048e00d
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x48dff7
test ebx, ebx
jl 0x48df9b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd44311
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48dfbc
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x48dfae
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0048f97d
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0048f97d
add esp, 8
mov ebx, 0x80070057
jmp 0x48df9b