joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d69f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x71a221
push eax
mov eax, ecx
xor ecx, ecx
mov dword fs:[0], esp
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x28], ecx
mov byte [eax], cl
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret

Function at 0x4d7540
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x71a2a1
push eax
mov eax, ecx
xor ecx, ecx
mov dword fs:[0], esp
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x28], ecx
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret

Function at 0x4ef930
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x71b1d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, 0x64
push ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, dword [0x7a39fc]
push esi
mov esi, ecx
mov ecx, dword [eax + 8]
mov dword [esp + 8], 0x3f800000
call fcn.004aee70
test eax, eax
mov ecx, dword [0x7a3a28]
mov ecx, dword [ecx + 0xb8]
mov ebx, dword [ecx + 0xf0]
je 0x4efa3b
mov ecx, dword [esi + 4]
push edi
push ecx
mov ecx, eax
call fcn.005638a0
mov edi, eax
cmp edi, 0xffffffff
je 0x4ef9ee
test ebx, ebx
je 0x4ef9ee
push str.PercentXP
lea ecx, [esp + 0x10]
call fcn.005e5a90
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push edi
mov ecx, ebx
mov dword [esp + 0x38], 0
call fcn.00413660
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.005e5c20
lea ecx, [esi + 0x18]
call fcn.005e5670
fild dword [esp + 0x14]
fmul dword [0x73dfec]
fstp dword [esp + 0xc]
push str.PercentXP
lea ecx, [esp + 0x20]
call fcn.005e5a90
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push 9
mov ecx, ebx
mov dword [esp + 0x38], 1
call fcn.00413660
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0xffffffff
call fcn.005e5c20
fild dword [esp + 0x18]
pop edi
fmul dword [0x73dfec]
fmul dword [esp + 8]
fstp dword [esp + 8]
lea ecx, [esi + 0x18]
call fcn.005e5670
fild dword [esp + 0x30]
mov esi, dword [esi + 0xa74]
sub esp, 8
fmul dword [esp + 0x10]
fstp qword [esp]
call fcn.006fc880
add esp, 8
call fcn.006fae8c
push eax
mov ecx, esi
call fcn.005af6a0
mov ecx, dword [esp + 0x20]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x503f70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x71b7e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
push fcn.005e5c20
push fcn.005b3190
mov esi, ecx
push 6
push 8
lea ebp, [esi + 0x48]
push ebp
mov dword [esp + 0x24], esi
call fcn.006fb55f
mov ebx, dword [esp + 0x24]
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 0x20], edi
mov word [esi + 8], di
mov word [esi + 0xa], di
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 0x7f000000
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x24], edi
mov eax, dword [ebx + 0x30]
push eax
mov ecx, esi
mov dword [esp + 0x20], edi
call fcn.00503630
xor ecx, ecx
lea edx, [esi + 0x38]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [esp + 0x24], 6
jmp 0x504010
push 0x73d71c
mov ecx, ebp
call fcn.005e5140
mov eax, dword [esp + 0x24]
add ebp, 8
dec eax
mov dword [esp + 0x24], eax
jne 0x504010
mov eax, 0x7f000000
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], eax
mov ecx, dword [ebx]
mov dword [esi], ecx
mov edx, dword [ebx + 4]
mov dword [esi + 4], edx
mov ax, word [ebx + 0xa]
mov word [esi + 0xa], ax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0xc], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x10], edx
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x14], eax
mov ecx, dword [ebx + 0x18]
mov dword [esi + 0x18], ecx
mov edx, dword [ebx + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x88], edi
pop edi
mov dword [esi + 0x1c], edx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x506400
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x71b8a8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push 0
lea eax, [esp + 0x24]
push eax
call fcn.004bb600
test eax, eax
je 0x5064b5
mov ecx, dword [eax + 0x3c]
mov eax, dword [esp + 0x20]
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 4], eax
mov eax, dword [esp + 0x34]
mov dword [edx + 8], eax
call fcn.00581a10
push str.Walk
lea ecx, [esp + 0xc]
mov esi, eax
call fcn.005e5a90
mov ecx, dword [0x7a3a28]
mov eax, dword [ecx + 0xb8]
mov eax, dword [eax + 0x14]
lea edx, [esp + 4]
push edx
lea ecx, [esp + 0xc]
push ecx
push esi
mov ecx, eax
mov dword [esp + 0x24], 0
call fcn.00413660
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.005e5c20
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, ecx
setne al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop esi
add esp, 0x18
ret 0xc
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword fs:[0], ecx
pop esi
add esp, 0x18
ret 0xc
Function at 0x525080
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x71c588
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x14]
call fcn.005b3190
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.005b3190
push 1
mov ecx, esi
mov byte [esp + 0x40], 1
call fcn.004d6230
test eax, eax
jne 0x52516f
push 0x20
push 0x3f800000
mov ecx, esi
call fcn.004d67b0
fstp dword [esp + 0x24]
push 0x20
push 0x3f800000
mov ecx, esi
call fcn.004d67b0
fstp dword [esp + 0x28]
push 0x20
push 0x3f800000
mov ecx, esi
call fcn.004d67b0
fstp dword [esp + 0x2c]
push 0x20
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.004d67e0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 2
call fcn.005e5c50
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 1
call fcn.005e5c20
push 0x20
mov ecx, esi
call fcn.004d6780
push 1
mov ecx, esi
mov edi, eax
call fcn.004d6240
test eax, eax
jne 0x52516f
mov ecx, dword [ebp + 8]
call fcn.00561080
test eax, eax
je 0x52516f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x30]
mov ebx, eax
test ebx, ebx
je 0x52516f
lea esi, [ebx + 0x100]
test esi, esi
jne 0x5251a4
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 0
call fcn.005e5c20
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 0xffffffff
call fcn.005e5c20
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
lea eax, [esp + 0x10]
push str.NW_MAP_PIN_NTRY__i
push eax
call fcn.005e5680
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.0059a8e0
push edi
lea eax, [esp + 0x10]
push str.NW_MAP_PIN_XPOS__i
push eax
call fcn.005e5680
mov ecx, dword [esp + 0x30]
add esp, 0xc
push ecx
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.0059a8c0
push edi
lea eax, [esp + 0x10]
push str.NW_MAP_PIN_YPOS__i
push eax
call fcn.005e5680
mov ecx, dword [esp + 0x34]
add esp, 0xc
push ecx
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.0059a8c0
push edi
lea eax, [esp + 0x10]
push str.NW_MAP_PIN_ZPOS__i
push eax
call fcn.005e5680
mov ecx, dword [esp + 0x38]
add esp, 0xc
push ecx
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.0059a8c0
push edi
lea eax, [esp + 0x10]
push str.NW_MAP_PIN_AREA__i
push eax
call fcn.005e5680
add esp, 0xc
mov ecx, ebx
call fcn.004cb120
add eax, 0x11c
mov eax, dword [eax + 4]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0059a900
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 0
call fcn.005e5c20
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 0xffffffff
call fcn.005e5c20
mov ecx, dword [esp + 0x34]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x528e50
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, ebx
xor esi, esi
xor edi, edi
call fcn.005e5790
test eax, eax
jle 0x528ea3
lea esp, [esp]
push edi
mov ecx, ebx
call fcn.005e5600
movsx eax, al
push eax
call fcn.006fd268
xor eax, esi
and eax, 0xff
mov ecx, dword [ebp + eax*4 + 0xb268]
shr esi, 8
xor esi, ecx
add esp, 4
mov ecx, ebx
inc edi
call fcn.005e5790
cmp edi, eax
jl 0x528e70
mov eax, esi
xor edx, edx
mov ecx, 0x6ef
div ecx
pop edi
pop esi
pop ebp
pop ebx
mov eax, edx
ret 4

Function at 0x52ad10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x71caa0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push str.GLOBALVARS
lea ecx, [esp + 0x10]
call fcn.005e5a90
push 0x73d8f4
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0
call fcn.005e5a90
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x3c]
mov byte [esp + 0x34], 1
call fcn.005e5d10
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
mov byte [esp + 0x34], 2
call fcn.005e5d10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 6
call fcn.005e5c20
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 5
call fcn.005e5c20
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 4
call fcn.005e5c20
push 1
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.005299b0
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.005e5c20
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4

Function at 0x52b170
Capabilities:
Get number of processors
Hash data with crc32

Disassembly:
push 0xffffffffffffffff
push 0x71c868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
push fcn.004015a0
push fcn.004ca7a0
mov esi, ecx
push 0x64
push 0x18
lea ebx, [esi + 0xa8d0]
push ebx
mov dword [esp + 0x24], esi
call fcn.006fb55f
push fcn.005e5c20
push fcn.005b3190
push 5
push 8
lea ebp, [esi + 0xb230]
push ebp
mov dword [esp + 0x30], 0
call fcn.006fb55f
xor ecx, ecx
lea edx, [esi + 0xb268]
mov eax, ecx
mov edi, 8
jmp 0x52b1e0
test al, 1
je 0x52b1ed
shr eax, 1
xor eax, 0xedb88320
jmp 0x52b1ef
shr eax, 1
dec edi
jne 0x52b1e0
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 0xff
jbe 0x52b1d4
xor eax, eax
mov edi, esi
mov ecx, 0x299a
rep stosd dword es:[edi], eax
mov dword [esi + 0xb258], eax
mov dword [esi + 0xb25c], eax
mov dword [esi + 0xb260], eax
mov dword [esi + 0xb264], eax
mov dword [esi + 0xb668], eax
mov dword [esi + 0xb66c], eax
mov dword [esi + 0xb670], eax
lea edi, [esi + 0xa668]
mov ecx, 0x1c
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
lea edi, [esi + 0xa6d9]
mov ecx, 0x7d
rep stosd dword es:[edi], eax
mov edi, ebx
mov ecx, 0x258
rep stosd dword es:[edi], eax
mov edi, ebp
mov ecx, 0xa
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x552280
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x71d68c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], ebx
lea edi, [esi + 0x34]
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.005b3190
lea ebp, [esi + 0x3c]
mov ecx, ebp
mov byte [esp + 0x1c], 2
call fcn.005b3190
mov al, 3
mov byte [esp + 0x1c], al
mov byte [esi + 9], al
mov eax, 0x7f000000
push 0x73d71c
mov ecx, ebp
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 5], bl
mov byte [esi + 6], bl
mov byte [esi + 7], bl
mov byte [esi + 8], 1
mov byte [esi + 0xa], bl
mov byte [esi + 0xb], 2
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], 2
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
call fcn.005e5140
push 0x73d71c
mov ecx, edi
call fcn.005e5140
mov ecx, dword [esp + 0x14]
pop edi
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x555380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x71d9c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push str.NumDice
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.005e5a90
mov eax, dword [0x7a3a28]
mov eax, dword [eax + 0xb8]
movzx esi, word [esp + 0x30]
mov eax, dword [eax + 0xb0]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
push esi
mov ecx, eax
mov dword [esp + 0x34], 0
call fcn.00413660
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
lea ecx, [esp + 0x10]
inc bl
mov dword [esp + 0x28], 0xffffffff
call fcn.005e5c20
test bl, bl
je 0x5554aa
mov eax, dword [esp + 8]
test eax, eax
jne 0x555435
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [eax], 1
mov dword [ecx], esi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
push 0x747034
lea ecx, [esp + 0x1c]
call fcn.005e5a90
mov edx, dword [0x7a3a28]
mov eax, dword [edx + 0xb8]
mov eax, dword [eax + 0xb0]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push edx
push esi
mov ecx, eax
mov dword [esp + 0x34], 1
call fcn.00413660
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.005e5c20
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x34]
imul edx, eax
mov dword [ecx], eax
mov eax, dword [esp + 0x38]
pop esi
mov dword [eax], edx
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov dword [ecx], esi
mov ecx, dword [esp + 0x20]
mov dword [edx], esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x5554d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x71dc88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push str.EffectChance
lea ecx, [esp + 0xc]
call fcn.005e5a90
mov eax, dword [0x7a3a28]
mov eax, dword [eax + 0xb8]
movzx esi, byte [esp + 0x2c]
mov eax, dword [eax + 0xcc]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push esi
mov ecx, eax
mov dword [esp + 0x2c], 0
call fcn.00413660
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.005e5c20
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
push str.DurationRounds
lea ecx, [esp + 0xc]
call fcn.005e5a90
mov edx, dword [0x7a3a28]
mov eax, dword [edx + 0xb8]
mov eax, dword [eax + 0xcc]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push esi
mov ecx, eax
mov dword [esp + 0x2c], 1
call fcn.00413660
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.005e5c20
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x34]
mov dword [ecx], eax
push str.Value
lea ecx, [esp + 0x14]
call fcn.005e5a90
mov edx, dword [0x7a3a28]
mov ecx, dword [edx + 0xb8]
lea eax, [esp + 4]
push eax
movzx eax, word [esp + 0x2c]
lea edx, [esp + 0x14]
push edx
push eax
push 0x19
mov dword [esp + 0x30], 2
call fcn.005c49a0
mov ecx, eax
call fcn.00413660
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.005e5c20
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 4]
mov dword [ecx], edx
mov ecx, dword [esp + 0x18]
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
Function at 0x55f340
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x71f01f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
push esi
mov esi, ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 1
call fcn.005b3190
mov ecx, esi
mov byte [esp + 0x38], 2
call fcn.005b4790
cmp byte [eax + 0xac], 0x2e
je 0x55f420
mov ecx, esi
call fcn.005b4790
cmp byte [eax + 0xac], 6
je 0x55f420
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00556490
mov ecx, esi
call fcn.005b4790
cmp byte [eax + 9], bl
je 0x55f3fc
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00556de0
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.005543b0
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00558950
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00558c10
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.005544f0
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0055e930
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.005599d0
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.0055a510
lea ecx, [esp + 0x14]
call fcn.005b3190
mov eax, dword [0x7a39fc]
mov ecx, dword [eax + 4]
push ebx
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x40], 3
add esi, 0x270
call fcn.005ed4c0
push eax
mov ecx, esi
call fcn.005ea130
push 0x73d71c
lea ecx, [esp + 0x18]
call fcn.005e5290
test eax, eax
je 0x55f495
mov eax, dword [0x7a39fc]
mov ecx, dword [eax + 4]
push 0x7dac
lea edx, [esp + 0x20]
push edx
call fcn.005edeb0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 4
call fcn.005e5c50
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 3
call fcn.005e5c20
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x14]
call fcn.005e5d10
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 5
call fcn.005e5c50
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 3
call fcn.005e5c20
mov esi, dword [esp + 0x40]
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.005e5b00
lea ecx, [esp + 0x14]
mov dword [esp + 8], 1
mov byte [esp + 0x38], 2
call fcn.005e5c20
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 1
call fcn.005e5c20
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x55f35f
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x71f01f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
push esi
mov esi, ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 1
call fcn.005b3190
mov ecx, esi
mov byte [esp + 0x38], 2
call fcn.005b4790
cmp byte [eax + 0xac], 0x2e
je 0x55f420
mov ecx, esi
call fcn.005b4790
cmp byte [eax + 0xac], 6
je 0x55f420
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00556490
mov ecx, esi
call fcn.005b4790
cmp byte [eax + 9], bl
je 0x55f3fc
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00556de0
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.005543b0
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00558950
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00558c10
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.005544f0
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0055e930
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.005599d0
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.0055a510
lea ecx, [esp + 0x14]
call fcn.005b3190
mov eax, dword [0x7a39fc]
mov ecx, dword [eax + 4]
push ebx
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x40], 3
add esi, 0x270
call fcn.005ed4c0
push eax
mov ecx, esi
call fcn.005ea130
push 0x73d71c
lea ecx, [esp + 0x18]
call fcn.005e5290
test eax, eax
je 0x55f495
mov eax, dword [0x7a39fc]
mov ecx, dword [eax + 4]
push 0x7dac
lea edx, [esp + 0x20]
push edx
call fcn.005edeb0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 4
call fcn.005e5c50
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 3
call fcn.005e5c20
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x14]
call fcn.005e5d10
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 5
call fcn.005e5c50
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 3
call fcn.005e5c20
mov esi, dword [esp + 0x40]
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.005e5b00
lea ecx, [esp + 0x14]
mov dword [esp + 8], 1
mov byte [esp + 0x38], 2
call fcn.005e5c20
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 1
call fcn.005e5c20
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x579680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ecx + 0x3c]
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx]
mov dword [esp + 0xc], eax
jmp 0x5972b0
Function at 0x585350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
lea eax, [ecx + 0x90]
mov esi, dword [eax]
lea edx, [ecx + 0x3c0]
mov dword [edx], esi
mov esi, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [edx + 4], esi
mov dword [edx + 8], eax
lea edx, [ecx + 0x428]
mov esi, dword [edx]
lea eax, [ecx + 0x3d8]
mov dword [eax], esi
mov esi, dword [edx + 4]
mov dword [eax + 4], esi
mov esi, dword [edx + 8]
mov edx, dword [edx + 0xc]
mov dword [eax + 8], esi
mov dword [eax + 0xc], edx
pop esi
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx]
mov dword [esp + 0xc], eax
add ecx, 0x3a0
jmp 0x5972b0