joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405f4d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x19b0], edx
mov eax, dword [ebp - 0x19b0]
mov dword [ebp - 0x15e4], eax
push ecx
add ecx, 0x17711
or ecx, 0xef0d
sub ecx, 0x3681
pop ecx
push ecx
push ecx
add esp, 4
and ecx, 0x2181
or ecx, 0xa49
pop ecx
push edx
push ecx
add esp, 4
xor edx, 0x20c7
pop edx
cmp dword [ebp - 0x15e4], 0
jne 0x405dcc
mov dword [ebp - 0x750], 0
jmp 0x406088
mov ecx, dword [ebp - 0x15e4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xca4], eax
push edx
push esi
add esp, 4
add edx, 0x1459e
or edx, 0x9171
xor edx, 0x4e92
add edx, 0x1055f
pop edx
push edx
xor edx, 0x5623
pop edx
push eax
push edx
add esp, 4
add eax, 0x1287a
pop eax
cmp dword [ebp - 0xca4], 0
jne 0x405e28
mov dword [ebp - 0x750], 0
jmp 0x406088
mov ecx, dword [ebp - 0xca4]
mov dword [ebp - 0x508], ecx
push edi
push eax
add esp, 4
and edi, 0x660e
pop edi
push edi
or edi, 0x664
xor edi, 0x93a3
pop edi
push edx
push edx
add esp, 4
sub edx, 0x84c
and edx, 0x1609b
add edx, 0x16906
pop edx
lea edx, [ebp - 0x1754]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc9c], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push eax
push edi
add esp, 4
or eax, 0x139e3
add eax, 0x140a4
call 0x405eb2
add byte [ebx], dh
cmp byte [edi + 0x43], cl
dec esp
inc ebx
aas
inc eax
add esp, 4
call 0x405ec1
add byte [eax + 0x4c], dl
inc eax
xor esi, dword [0x4c48341]
pop eax
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
xchg ebp, eax
retf 0xffef
dec dword [ebx - 0xc9b7b]
inc dword [ebx - 0x7a76fd40]
invalid
invalid
invalid
jmp dword [esi - 0x75]
invalid
retf 0xffef
jmp dword [esi - 0x77]
invalid
in al, dx
std
invalid
dec dword [ebx - 0xc9f6b]
jmp dword [esi - 0x75]
add ah, byte [esi - 0x77]
test eax, ecx
out dx, eax
invalid
dec dword [ebx - 0xc9f73]
inc dword [ebx - 0x7276fd3f]
pushal
invalid
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
enter 0xffffffffffffffef, 0xffffffffffffffff
mov word [ebp - 0x110], dx
push esi
add esi, 0x1413c
xor esi, 0x6225
add esi, 0x123f8
or esi, 0x6420
pop esi
push ebx
push eax
add esp, 4
call 0x405f4d
add byte [0x3247333a], bh
dec edx
cmp eax, 0xc4834445
add al, 0x5b
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x405f74
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
invalid
invalid
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x405e93
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x405e93
movzx ecx, word [ebp - 0x214]
invalid
mov bh, 0x95
invalid
invalid
invalid

Function at 0x405fe0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0x108c1
sub eax, 0x112da
jmp 0x405ff6
or eax, 0x10910
pop eax
push esi
push ecx
add esp, 4
or esi, 0x13e7e
jmp 0x406011
pop esi
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x406088
Function at 0x406060
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x40607e
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x405e34
mov dword [ebp - 0x750], 0
Function at 0x406398
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x758]
add edx, 1
mov dword [ebp - 0x758], edx
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 0x758]
cmp ecx, dword [eax + 0x18]
jae 0x40645a
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x19b4]
mov ecx, dword [ebp - 0x320]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x75c], ecx
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x19b8]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x19bc]
inc esp
out 0xff, al
dec dword [ebx - 0x31f7b]
inc dword [ebx]
add al, 0x8a
mov dword [ebp - 0x19c0], eax
mov dword [ebp - 0x198], 0
jmp 0x4062be
mov ecx, dword [ebp - 0x198]
add ecx, 1
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x75c]
add edx, dword [ebp - 0x198]
movsx eax, byte [edx]
test eax, eax
je 0x406370
mov ecx, dword [ebp - 0x198]
movsx edx, byte [ebp + ecx - 0x894]
test edx, edx
je 0x406370
push ecx
xor ecx, 0xf409
and ecx, 0x6ff2
xor ecx, 0x4ebc
add ecx, 0x1539d
popfd
push ebx
add dword [eax], eax
popfd
push ebx
add dword [eax], eax
pop ecx
push eax
push ecx
add esp, 4
add eax, 0xee76
sub eax, 0xfd15
and eax, 0x4836
pop eax
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x198]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x198]
movsx eax, byte [ebp + edx - 0x894]
cmp ecx, eax
je 0x406362
mov ecx, dword [ebp - 0x75c]
add ecx, dword [ebp - 0x198]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x198]
movsx ecx, byte [ebp + eax - 0x894]
cmp edx, ecx
jne 0x406369
jmp 0x4062af
jmp 0x406370
push edx
push eax
add esp, 4
call 0x406385
add byte [ecx], bh
inc ebp
xor al, 0x50
inc ebx
cmp dword [edx + 0x49], eax
dec ebx
inc eax
add esp, 4
call 0x406398
add byte [eax + 0x37], dl
inc ecx
xor cl, byte [ebx + 0x4b]
push eax
inc eax
aas
xor al, byte [ebx - 0x3d7efb3c]
in eax, 0xe3
add byte [eax], al
pop edx
mov edx, dword [ebp - 0x75c]
add edx, dword [ebp - 0x198]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x198]
movsx edx, byte [ebp + ecx - 0x894]
cmp eax, edx
jne 0x4063cf
mov dword [ebp - 0xca8], 0
jmp 0x40643e
push esi
sub esi, 0x14026
pop esi
push esi
push ecx
add esp, 4
add esi, 0xd3d5
sub esi, 0x140b7
jmp 0x4063ee
add esi, 0x12f42
pop esi
push esi
push edx
add esp, 4
sub esi, 0xb327
pop esi
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x198]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x198]
movsx eax, byte [ebp + edx - 0x894]
or eax, 0x20
cmp ecx, eax
jge 0x406434
mov dword [ebp - 0xca8], 0xffffffff
jmp 0x40643e
mov dword [ebp - 0xca8], 1
cmp dword [ebp - 0xca8], 0
jne 0x406455
mov ecx, dword [ebp - 0x19c0]
mov dword [ebp - 0x3f4], ecx
jmp 0x406466
jmp 0x40623f
mov edx, dword [ebp - 0x760]
cmp dword [ebp - 0x3f4], 0
je 0x406541
push eax
push ebx
add esp, 4
xor eax, 0x1388
sub eax, 0x3250
call 0x406491
add byte [ecx + 0x4c], al
cmp byte ds:[ebx], bh
inc esi
add esp, 4
call 0x4064a1
add byte [edi], bh
inc edi
inc ecx
xor eax, 0x834b404e
dec ebx
add esp, 4
pop eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x19c4], eax
call dword [esi + 0x57]
push eax
push edi
Function at 0x40652e
Capabilities:
Get number of processors

Disassembly:
add esp, 4
pop edi
mov dword [ebp - 0x79c], 0
jmp 0x406c2b
invalid
Function at 0x4067b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x4067c4
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x4067ce
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
Function at 0x406d60
Capabilities:
Get number of processors

Disassembly:
les eax, [ecx + eax*4]
neg edx
mov edi, 0x515f0000

Function at 0x406d80
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
pop ecx
push edi
or edi, 0x8ec3
add edi, 0xc80
pop edi
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
invalid
test dword [esi], ebp

Function at 0x406da0
Capabilities:
Get number of processors

Disassembly:
idiv bh
push dword [edx - 0x3a]
test dword [edi], ebp
idiv bh
push dword [esi + eax*8 - 0x7b]
xor dh, dh
invalid

Function at 0x406dc0
Capabilities:
Get number of processors

Disassembly:
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
invalid
test dword [edi], esi
invalid

Function at 0x407390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
sub eax, 0x8e0f
sub eax, 0xb45e
call fcn.0040739e
add byte [esi + 0x4e], cl
cmp dword [edi], esi
push eax
cmp cl, byte [edx + 0x36]
dec ecx
dec ecx
add esp, 4
call 0x4073af
add byte [edi], bh
aas
inc ebx
cmp ecx, dword [edx + 0x45]
xor al, 0x50
add esp, 4
pop eax
lea eax, [ebp - 0x1770]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
jmp 0x4073e3
xor ebx, 0x10008
sub ebx, 0x11dbb
and ebx, 0xf01f
pop ebx
push edx
push eax
add esp, 4
jmp 0x407402
pop edx
push edx
push ecx
add esp, 4
sub edx, 0xbe33
pop edx
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push eax
push ecx
add esp, 4
add eax, 0x576c
or eax, 0x14f32
call 0x407486
add byte [esi], dh
inc ecx
cmp cl, byte [esi + 0x4a]
inc eax
inc eax
cmp al, 0x4e
add esp, 4
pop eax
push esi
and esi, 0x1370a
add esi, 0x2a7a
pop esi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x4074b5
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1668], edx
jmp 0x40750f
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x4073dd
movzx eax, word [ebp - 0x220]
invalid
Function at 0x40739e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
sub eax, 0x8e0f
sub eax, 0xb45e
call fcn.0040739e
add byte [esi + 0x4e], cl
cmp dword [edi], esi
push eax
cmp cl, byte [edx + 0x36]
dec ecx
dec ecx
add esp, 4
call 0x4073af
add byte [edi], bh
aas
inc ebx
cmp ecx, dword [edx + 0x45]
xor al, 0x50
add esp, 4
pop eax
lea eax, [ebp - 0x1770]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
jmp 0x4073e3
xor ebx, 0x10008
sub ebx, 0x11dbb
and ebx, 0xf01f
pop ebx
push edx
push eax
add esp, 4
jmp 0x407402
pop edx
push edx
push ecx
add esp, 4
sub edx, 0xbe33
pop edx
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push eax
push ecx
add esp, 4
add eax, 0x576c
or eax, 0x14f32
call 0x407486
add byte [esi], dh
inc ecx
cmp cl, byte [esi + 0x4a]
inc eax
inc eax
cmp al, 0x4e
add esp, 4
pop eax
push esi
and esi, 0x1370a
add esi, 0x2a7a
pop esi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x4074b5
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1668], edx
jmp 0x40750f
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x4073dd
movzx eax, word [ebp - 0x220]
invalid
Function at 0x4073af
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
sub eax, 0x8e0f
sub eax, 0xb45e
call fcn.0040739e
add byte [esi + 0x4e], cl
cmp dword [edi], esi
push eax
cmp cl, byte [edx + 0x36]
dec ecx
dec ecx
add esp, 4
call 0x4073af
add byte [edi], bh
aas
inc ebx
cmp ecx, dword [edx + 0x45]
xor al, 0x50
add esp, 4
pop eax
lea eax, [ebp - 0x1770]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
jmp 0x4073e3
xor ebx, 0x10008
sub ebx, 0x11dbb
and ebx, 0xf01f
pop ebx
push edx
push eax
add esp, 4
jmp 0x407402
pop edx
push edx
push ecx
add esp, 4
sub edx, 0xbe33
pop edx
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push eax
push ecx
add esp, 4
add eax, 0x576c
or eax, 0x14f32
call 0x407486
add byte [esi], dh
inc ecx
cmp cl, byte [esi + 0x4a]
inc eax
inc eax
cmp al, 0x4e
add esp, 4
pop eax
push esi
and esi, 0x1370a
add esi, 0x2a7a
pop esi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x4074b5
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1668], edx
jmp 0x40750f
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x4073dd
movzx eax, word [ebp - 0x220]
invalid
Function at 0x407486
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
sub eax, 0x8e0f
sub eax, 0xb45e
call fcn.0040739e
add byte [esi + 0x4e], cl
cmp dword [edi], esi
push eax
cmp cl, byte [edx + 0x36]
dec ecx
dec ecx
add esp, 4
call 0x4073af
add byte [edi], bh
aas
inc ebx
cmp ecx, dword [edx + 0x45]
xor al, 0x50
add esp, 4
pop eax
lea eax, [ebp - 0x1770]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
jmp 0x4073e3
xor ebx, 0x10008
sub ebx, 0x11dbb
and ebx, 0xf01f
pop ebx
push edx
push eax
add esp, 4
jmp 0x407402
pop edx
push edx
push ecx
add esp, 4
sub edx, 0xbe33
pop edx
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push eax
push ecx
add esp, 4
add eax, 0x576c
or eax, 0x14f32
call 0x407486
add byte [esi], dh
inc ecx
cmp cl, byte [esi + 0x4a]
inc eax
inc eax
cmp al, 0x4e
add esp, 4
pop eax
push esi
and esi, 0x1370a
add esi, 0x2a7a
pop esi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x4074b5
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1668], edx
jmp 0x40750f
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x4073dd
movzx eax, word [ebp - 0x220]
invalid
Function at 0x413de0
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x5807f886
add eax, 0x86566005
out 0x48, al
les eax, [0xb0e68605]
pop eax
push es
add eax, 0x6ffece86
push es
add eax, 0xb457ce86
add eax, 0x90695e05
adc bl, byte [0x8e050505]
xchg edx, eax
in eax, 0xe8
add al, 4
nop
lcall 0x4790, 0x404e8e5
xor eax, 0xe8e18a8e
add al, 4
nop
xchg edx, eax
loope 0x413e0a
add al, 4
mov ss, word [edx + 0x404f1dd]
pop esp
pop ebx
mov cl, cl
or dword [esi + 0x5227eec], eax
add eax, 0xafffc86
add eax, 0x5c566405
mov cl, cl
or dword [esi + 0x5315cc6], eax
add eax, 0xb10dc686
add eax, 0x15c68605
push ds
add eax, 0x86555e05
in eax, 0x84
loopne 0x413e5f
add eax, 0xddc2885d
int1
add al, 4
add eax, 0x8acc147a
std
add dword [esp + eax], eax
add eax, 0xee050505
rol dword [edi], 5
add eax, 0xf1dd9a90
add al, 4
nop
inc edi
adc dword [eax - 0x6d71eeb3], edx
mov cl, 0xf6
add al, 4
pop eax
pop eax
mov cl, cl
or dword [esi + 0x56a01d0], eax
add eax, 0x6fd0f886
add eax, 0xd0c88605
dec edx
push es
add eax, 0x3659e886
add eax, 0xed5c6005
syscall
add eax, 0x4f3c0505
inc ebp
push edx
push edx
inc ebx
dec edx
cmp byte [eax - 0x779bf637], cl
ret 0xf6b1
Function at 0x445210
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x715cd6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, ecx
xor ecx, ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x1c], 0x3f800000
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0xc], ecx
mov word [eax + 2], cx
mov word [eax], 1
inc dword [0x7a8a08]
mov dword [eax + 0x10], ecx
mov edx, ecx
mov dword [eax + 0x14], edx
mov dword [esp], ecx
mov dword [esp], 0x3f800000
mov edx, dword [esp]
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], ecx
mov edx, ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x24], edx
mov dword [eax + 0x28], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
inc dword [0x7a8a0c]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4

Function at 0x445720
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x715de5
push eax
mov eax, ecx
xor ecx, ecx
mov dword fs:[0], esp
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x54], ecx
mov dword [eax + 0x64], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x60], ecx
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret

Function at 0x4457a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x715df8
push eax
mov dword fs:[0], esp
mov eax, ecx
xor ecx, ecx
mov dword [eax], 0x740ae8
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x18], ecx
mov edx, 0x3f800000
mov dword [eax + 0x14], edx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x24], edx
mov edx, dword [esp + 0x10]
mov dword [eax + 4], edx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x44], ecx
inc dword [0x7a8a10]
mov dword [eax + 0x28], ecx
mov byte [eax + 0x2c], cl
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret 4
Function at 0x44a900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x716296
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x30], ebx
mov dword [esp + 0x18], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x20]
mov dl, 1
lea edi, [esi + 8]
mov byte [esp + 0x18], dl
sub edi, eax
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
cmp cl, bl
jne 0x44a946
mov dword [esi + 0x28], ebx
mov byte [esi + 0x4c], dl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x2c], ebx
mov eax, dword [esi + 0x3c]
cmp eax, ebx
je 0x44a96f
push eax
call fcn.006fa390
add esp, 4
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov eax, dword [esi + 0x30]
cmp eax, ebx
je 0x44a988
push eax
call fcn.006fa390
add esp, 4
mov dword [esi + 0x30], ebx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
pop edi
mov dword [esi], 0x44a8e0
mov dword [esi + 4], 0x43e190
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4578f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x7167a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 8], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x38], eax
mov edx, dword [esp + 0x18]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi], edx
mov edx, dword [esp + 0x1c]
mov cl, 1
mov dword [esi + 4], edx
mov edx, dword [esp + 0x20]
mov byte [esp + 0x10], cl
mov byte [esi + 0x5d], cl
mov ecx, esi
mov dword [esi + 0x14], edx
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], eax
mov byte [esi + 0x5c], al
mov byte [esi + 0x5e], al
mov byte [esi + 0x5f], al
mov byte [esi + 0x60], al
call fcn.00456a60
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x457908
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x7167a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 8], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x38], eax
mov edx, dword [esp + 0x18]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi], edx
mov edx, dword [esp + 0x1c]
mov cl, 1
mov dword [esi + 4], edx
mov edx, dword [esp + 0x20]
mov byte [esp + 0x10], cl
mov byte [esi + 0x5d], cl
mov ecx, esi
mov dword [esi + 0x14], edx
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], eax
mov byte [esi + 0x5c], al
mov byte [esi + 0x5e], al
mov byte [esi + 0x5f], al
mov byte [esi + 0x60], al
call fcn.00456a60
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc