joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4101b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x586ba0
push 0x50ae80
mov eax, dword fs:[0]
mov eax, dword [pe_dos_header]
push eax
sub esp, 0x20
mov eax, dword [0x59e554]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
xor bl, bl
test eax, eax
je 0x41036d
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41036d
cmp byte [eax], bl
je 0x41036d
test ecx, ecx
je 0x41036d
cmp byte [ecx], bl
je 0x41036d
test edi, edi
je 0x41036d
cmp dword [ebp + 0x18], 0
je 0x41036d
push ecx
call dword [0x5481b8]
test eax, eax
je 0x41036d
push 0
push 0x40
push edi
call fcn.004103c0
add esp, 0xc
test al, al
je 0x41036d
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x41036d
mov esi, dword [edi + 0x3c]
add esi, edi
mov dword [ebp - 0x24], esi
push 0
push 0xf8
push esi
call fcn.004103c0
add esp, 0xc
test al, al
je 0x41036d
cmp dword [esi], 0x4550
jne 0x41036d
mov esi, dword [esi + 0x80]
add esi, edi
cmp esi, dword [ebp - 0x24]
je 0x410393
mov edx, dword [ebp - 0x2c]
mov edi, edx
lea ecx, [edi + 1]
nop
mov al, byte [edi]
inc edi
test al, al
jne 0x4102b0
sub edi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4102df
add eax, dword [ebp - 0x20]
push edi
push edx
push eax
call fcn.0041062e
add esp, 0xc
test eax, eax
je 0x4102df
add esi, 0x14
mov eax, dword [esi + 0xc]
test eax, eax
mov edx, dword [ebp - 0x2c]
jne 0x4102c0
cmp dword [esi + 0xc], 0
je 0x410393
mov esi, dword [esi + 0x10]
add esi, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x2c], esi
mov eax, dword [esi]
test eax, eax
je 0x41036d
cmp eax, ecx
jne 0x41038b
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 0x80
push 4
push esi
mov edi, dword [0x54835c]
call edi
test eax, eax
je 0x41036d
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
xchg dword [esi], eax
mov bl, 1
mov byte [ebp - 0x25], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x41035a
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004016a0
mov esp, ebp
pop ebp
ret
add esi, 4
jmp 0x4102f2
xor al, al
jmp 0x41036f
Function at 0x4101c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x586ba0
push 0x50ae80
mov eax, dword fs:[0]
mov eax, dword [pe_dos_header]
push eax
sub esp, 0x20
mov eax, dword [0x59e554]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
xor bl, bl
test eax, eax
je 0x41036d
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41036d
cmp byte [eax], bl
je 0x41036d
test ecx, ecx
je 0x41036d
cmp byte [ecx], bl
je 0x41036d
test edi, edi
je 0x41036d
cmp dword [ebp + 0x18], 0
je 0x41036d
push ecx
call dword [0x5481b8]
test eax, eax
je 0x41036d
push 0
push 0x40
push edi
call fcn.004103c0
add esp, 0xc
test al, al
je 0x41036d
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x41036d
mov esi, dword [edi + 0x3c]
add esi, edi
mov dword [ebp - 0x24], esi
push 0
push 0xf8
push esi
call fcn.004103c0
add esp, 0xc
test al, al
je 0x41036d
cmp dword [esi], 0x4550
jne 0x41036d
mov esi, dword [esi + 0x80]
add esi, edi
cmp esi, dword [ebp - 0x24]
je 0x410393
mov edx, dword [ebp - 0x2c]
mov edi, edx
lea ecx, [edi + 1]
nop
mov al, byte [edi]
inc edi
test al, al
jne 0x4102b0
sub edi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4102df
add eax, dword [ebp - 0x20]
push edi
push edx
push eax
call fcn.0041062e
add esp, 0xc
test eax, eax
je 0x4102df
add esi, 0x14
mov eax, dword [esi + 0xc]
test eax, eax
mov edx, dword [ebp - 0x2c]
jne 0x4102c0
cmp dword [esi + 0xc], 0
je 0x410393
mov esi, dword [esi + 0x10]
add esi, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x2c], esi
mov eax, dword [esi]
test eax, eax
je 0x41036d
cmp eax, ecx
jne 0x41038b
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 0x80
push 4
push esi
mov edi, dword [0x54835c]
call edi
test eax, eax
je 0x41036d
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
xchg dword [esi], eax
mov bl, 1
mov byte [ebp - 0x25], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x41035a
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004016a0
mov esp, ebp
pop ebp
ret
add esi, 4
jmp 0x4102f2
xor al, al
jmp 0x41036f
Function at 0x41fb80
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor dl, dl
push edi
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x41fd5e
mov eax, ecx
cmp eax, 0x7c
je 0x41fd5e
cmp eax, 0x29
jne 0x41fbc3
cmp dword [esi + 0x10], 0
jne 0x41fd5e
cmp eax, eax
jne 0x41fbc3
test dword [esi + 0x50], 0x10000000
je 0x41fd6b
jmp 0x41fd15
cmp eax, 0x2e
jne 0x41fc24
push 5
lea ecx, [esi + 0x24]
call fcn.0041ff50
mov ecx, dword [esi]
mov edx, dword [esi + 8]
cmp ecx, edx
je 0x41fc18
cmp word [ecx], 0x5c
jne 0x41fc13
lea eax, [ecx + 2]
cmp eax, edx
je 0x41fc13
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x41fbfd
movzx edi, word [eax]
cmp edi, 0x28
je 0x41fc0f
cmp edi, 0x29
je 0x41fc0f
test dl, 0x10
jne 0x41fc13
movzx edx, word [eax]
cmp edx, 0x7b
je 0x41fc0f
cmp edx, 0x7d
jne 0x41fc13
mov dword [esi], eax
mov ecx, eax
lea eax, [ecx + 2]
mov dword [esi], eax
mov ecx, esi
call fcn.0041d090
jmp 0x41fd47
cmp eax, 0x5c
jne 0x41fc83
mov ecx, esi
call fcn.0041fb30
test byte [esi + 0x50], 0x80
je 0x41fc77
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x41fc55
push 4
lea ecx, [esi + 0x24]
call fcn.0041ff50
mov ecx, esi
call fcn.0041fb30
jmp 0x41fd4e
cmp eax, 0x42
jne 0x41fc77
push 4
lea ecx, [esi + 0x24]
call fcn.0041ff50
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0041fb30
jmp 0x41fd4e
mov ecx, esi
call fcn.00421bf0
jmp 0x41fd47
cmp eax, 0x5b
jne 0x41fca5
mov ecx, esi
call fcn.0041fb30
mov ecx, esi
call fcn.00421b40
cmp dword [esi + 0x4c], 0x5d
jne 0x41fd72
jmp 0x41fd40
cmp eax, 0x28
jne 0x41fcd1
mov ecx, esi
call fcn.0041fb30
mov ecx, esi
call fcn.00421da0
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x41fd6b
mov ecx, esi
call fcn.0041fb30
test bl, bl
je 0x41fd4e
jmp 0x41fd47
cmp eax, 0x5e
jne 0x41fce9
push 2
lea ecx, [esi + 0x24]
call fcn.0041ff50
mov ecx, esi
call fcn.0041fb30
jmp 0x41fd4e
cmp eax, 0x24
jne 0x41fd01
push 3
lea ecx, [esi + 0x24]
call fcn.0041ff50
mov ecx, esi
call fcn.0041fb30
jmp 0x41fd4e
cmp eax, 0x2a
je 0x41fd64
cmp eax, 0x2b
je 0x41fd64
cmp eax, 0x3f
je 0x41fd64
cmp eax, 0x7b
je 0x41fd64
cmp ecx, 0x7d
jne 0x41fd25
test dword [esi + 0x50], 0x10000000
je 0x41fd79
jmp 0x41fd33
cmp ecx, 0x5d
jne 0x41fd33
test dword [esi + 0x50], 0x10000000
je 0x41fd72
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00421fc0
mov ecx, esi
call fcn.0041fb30
mov ecx, esi
call fcn.00421e60
mov ecx, dword [esi + 0x4c]
mov dl, 1
mov eax, ecx
cmp ecx, 0xffffffff
jne 0x41fb95
pop edi
pop esi
mov al, dl
pop ebx
ret
push 0xa
call fcn.0041d080
push 5
call fcn.0041d080
push 4
call fcn.0041d080
push 6
call fcn.0041d080
int3

Function at 0x4421f0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x442223
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x442223
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x442223
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x442223
mov al, 1
ret
xor al, al
ret
Function at 0x443000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
mov edx, dword [eax + 0x3c]
add edx, eax
mov eax, dword [edi]
push dword [edx + 0x78]
call dword [eax]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4430d2
mov ecx, dword [edi + 4]
mov esi, dword [edi]
mov edx, dword [ecx + 0x3c]
push dword [edx + ecx + 0x78]
mov ecx, edi
call dword [esi]
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x4430d2
mov eax, dword [ebp + 8]
cmp eax, 0xffff
jbe 0x4430f7
mov eax, dword [edi]
mov ecx, edi
push dword [ebx + 0x20]
call dword [eax]
mov ecx, dword [ebx + 0x18]
mov edx, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
lea ebx, [eax + ecx*4]
cmp eax, ebx
je 0x4430d2
nop dword [eax + eax]
mov eax, ebx
sub eax, edx
sar eax, 2
mov eax, eax
test eax, eax
jns 0x443080
add eax, 1
sar eax, 1
push dword [edx + eax*4]
lea esi, [edx + eax*4]
mov ecx, edi
mov eax, dword [edi]
mov dword [ebp - 8], esi
call dword [eax]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx]
test dl, dl
je 0x4430b5
mov esi, dword [ebp + 8]
mov cl, dl
sub esi, eax
mov dl, cl
cmp cl, byte [eax]
jne 0x4430b2
mov cl, byte [esi + eax + 1]
inc eax
mov dl, cl
test cl, cl
jne 0x4430a1
mov esi, dword [ebp - 8]
movzx eax, byte [eax]
movzx ecx, dl
sub ecx, eax
je 0x4430dd
test ecx, ecx
lea edx, [esi + 4]
cmovle edx, dword [ebp - 4]
cmovle ebx, esi
mov dword [ebp - 4], edx
cmp edx, ebx
jne 0x443070
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp - 0xc]
mov ecx, edi
mov eax, dword [edi]
push dword [ebx + 0x24]
call dword [eax]
sub esi, dword [ebp - 0x10]
sar esi, 2
mov ax, word [eax + esi*2]
add ax, word [ebx + 0x10]
mov ebx, dword [ebp - 0x14]
mov ecx, edi
movzx esi, ax
mov eax, dword [edi]
push dword [ebx + 0x1c]
call dword [eax]
movzx ecx, si
sub ecx, dword [ebx + 0x10]
pop edi
pop esi
pop ebx
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret 4
Function at 0x4503c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x586ba0
push 0x50ae80
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x59e554]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
xor bl, bl
test eax, eax
je 0x45057d
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45057d
cmp byte [eax], bl
je 0x45057d
test ecx, ecx
je 0x45057d
cmp byte [ecx], bl
je 0x45057d
test edi, edi
je 0x45057d
cmp dword [ebp + 0x18], 0
je 0x45057d
push ecx
call dword [0x5481b8]
test eax, eax
je 0x45057d
push 0
push 0x40
push edi
call fcn.004505d0
add esp, 0xc
test al, al
je 0x45057d
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x45057d
mov esi, dword [edi + 0x3c]
add esi, edi
mov dword [ebp - 0x24], esi
push 0
push 0xf8
push esi
call fcn.004505d0
add esp, 0xc
test al, al
je 0x45057d
cmp dword [esi], 0x4550
jne 0x45057d
mov esi, dword [esi + 0x80]
add esi, edi
cmp esi, dword [ebp - 0x24]
je 0x4505a3
mov edx, dword [ebp - 0x2c]
mov edi, edx
lea ecx, [edi + 1]
nop
mov al, byte [edi]
inc edi
test al, al
jne 0x4504c0
sub edi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4504ef
add eax, dword [ebp - 0x20]
push edi
push edx
push eax
call fcn.0045083e
add esp, 0xc
test eax, eax
je 0x4504ef
add esi, 0x14
mov eax, dword [esi + 0xc]
test eax, eax
mov edx, dword [ebp - 0x2c]
jne 0x4504d0
cmp dword [esi + 0xc], 0
je 0x4505a3
mov esi, dword [esi + 0x10]
add esi, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x2c], esi
mov eax, dword [esi]
test eax, eax
je 0x45057d
cmp eax, ecx
jne 0x45059b
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 0x80
push 4
push esi
mov edi, dword [0x54835c]
call edi
test eax, eax
je 0x45057d
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
xchg dword [esi], eax
mov bl, 1
mov byte [ebp - 0x25], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x45056a
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004418b0
mov esp, ebp
pop ebp
ret
add esi, 4
jmp 0x450502
xor al, al
jmp 0x45057f
Function at 0x48eee0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53bf0e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x59e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.004460e0
mov dword [edi], eax
lea esi, [edi + 0x10]
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004460e0
mov dword [esi], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
lea eax, [edi + 0x38]
mov byte [ebp - 4], 2
push eax
call dword [0x548290]
mov dword [edi + 8], 0
mov eax, edi
mov dword [edi + 0xc], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x18], 0
mov byte [edi + 0x50], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4955f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537eb0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x59e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00446079
mov edi, eax
add esp, 4
test edi, edi
je 0x4956a2
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004956ba
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a0ce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d3b6
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x59e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x30]
mov byte [edi], 0
mov dword [edi + 4], 0
mov ecx, esi
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov byte [edi + 0x2c], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004460e0
mov dword [esi], eax
lea esi, [edi + 0x54]
mov dword [edi + 0x50], 0
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004460e0
mov dword [esi], eax
mov esi, dword [0x548290]
lea eax, [edi + 0x38]
push eax
mov byte [ebp - 4], 1
call esi
lea eax, [edi + 0x14]
push eax
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a2f40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d5cc
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x59e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x38]
mov ecx, esi
mov dword [esi], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0
call fcn.004460e0
mov dword [esi], eax
xor eax, eax
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 7
mov dword [ebp - 4], 0
mov word [edi + 0x40], ax
xor ecx, ecx
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], 7
mov word [edi + 0x58], cx
mov dword [edi + 0x80], ecx
mov dword [edi + 0x84], 7
mov word [edi + 0x70], ax
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
lea eax, [edi + 0x14]
push eax
mov byte [ebp - 4], 3
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], ecx
mov dword [edi + 0x34], ecx
mov dword [edi], ecx
mov byte [edi + 0xc], cl
mov byte [edi + 0x88], cl
mov dword [edi + 0x8c], ecx
mov dword [edi + 0x90], ecx
call dword [0x548290]
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4a3029
mov edx, esi
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4a3010
sub edx, ecx
lea ecx, [edi + 0x40]
sar edx, 1
push edx
push esi
call fcn.00447870
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4a304e
mov edx, esi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4a3035
sub edx, ecx
lea ecx, [edi + 0x58]
sar edx, 1
push edx
push esi
call fcn.00447870
call fcn.004a2aa0
cmp eax, 0x68
jl 0x4a308b
push 0x548a1c
call dword [0x54820c]
mov ebx, eax
test ebx, ebx
je 0x4a308b
mov esi, dword [0x5482f8]
push 0x548a38
push ebx
call esi
push 0x548a54
push ebx
mov dword [edi + 0x8c], eax
call esi
mov dword [edi + 0x90], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e6990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540cb8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x59e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0xc]
mov dword [edi], 0x563800
mov word [edi + 4], 0
mov ecx, esi
mov byte [edi + 6], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004460e0
mov dword [esi], eax
lea eax, [edi + 0x14]
push eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
call dword [0x548290]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4f9e60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5425c8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x59e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00446079
mov edi, eax
add esp, 4
test edi, edi
je 0x4f9f04
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004956ba
add esp, 4
mov dword [edi + 4], eax
jmp 0x4f9f06
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.004a7da0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4f9f67
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x4f9f67
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x4f9fce
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
je 0x4f9fce
push 1
test cl, 4
jne 0x4f9ff1
test cl, 2
je 0x4f9faa
lea eax, [ebp - 0x14]
push eax
call fcn.004a6b20
add esp, 8
push eax
push 0x548dd8
jmp 0x4fa003
lea eax, [ebp - 0x1c]
push eax
call fcn.004a6b20
add esp, 8
lea ecx, [ebp - 0x44]
push eax
push 0x548df0
call fcn.004a4e20
push 0x58d09c
lea eax, [ebp - 0x44]
jmp 0x4fa013
cmp byte [ebp + 0xc], 0
je 0x4f9fdd
push esi
call fcn.00547fdb
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x14]
push eax
call fcn.004a6b20
add esp, 8
push eax
push 0x548dc0
lea ecx, [ebp - 0x30]
call fcn.004a4e20
push 0x58d09c
lea eax, [ebp - 0x30]
push eax
call 0x549f25
int3
Function at 0x543ee0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54746c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x59e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0x574040
xor eax, eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov byte [edi + 0x14], 1
mov dword [edi + 0x18], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 7
mov dword [ebp - 4], 0
mov word [edi + 0x1c], ax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], 7
mov word [edi + 0x34], ax
mov dword [edi + 0x5c], eax
mov dword [edi + 0x60], 7
mov word [edi + 0x4c], ax
mov dword [edi + 0x74], eax
mov dword [edi + 0x78], 0xf
mov byte [edi + 0x64], al
mov dword [edi + 0x8c], eax
mov dword [edi + 0x90], 0xf
mov byte [edi + 0x7c], al
mov dword [edi + 0xa4], eax
mov dword [edi + 0xa8], 0xf
mov byte [edi + 0x94], al
push 0x573fb8
mov byte [ebp - 4], 6
mov dword [edi + 0xac], eax
mov dword [edi + 0xb0], eax
mov dword [edi + 0xb4], eax
mov dword [edi + 0xb8], eax
mov dword [edi + 0xbc], eax
mov dword [edi + 0xc0], eax
mov dword [edi + 0xc4], eax
mov dword [edi + 0xc8], eax
mov dword [edi + 0xcc], eax
mov dword [edi + 0xd0], eax
mov dword [edi + 0xd4], eax
mov dword [edi + 0xd8], eax
mov dword [edi + 0xdc], eax
mov dword [edi + 0xe0], eax
call fcn.00476830
add esp, 4
mov dword [edi + 0xe0], eax
test eax, eax
je 0x5440c8
push 8
call fcn.00446079
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov esi, dword [0x5482f8]
mov byte [ebp - 4], 7
test ebx, ebx
je 0x54406b
xorps xmm0, xmm0
push 0x574008
movq qword [ebx], xmm0
push dword [edi + 0xe0]
call esi
push 0x574050
push dword [edi + 0xe0]
mov esi, eax
call dword [0x5482f8]
mov dword [ebx + 4], esi
mov esi, dword [0x5482f8]
mov dword [ebx], eax
jmp 0x54406d
xor ebx, ebx
push 0x574064
push dword [edi + 0xe0]
mov byte [ebp - 4], 6
mov dword [edi + 0xac], ebx
call esi
push 0x574074
push dword [edi + 0xe0]
mov dword [edi + 4], eax
call esi
mov ecx, dword [edi + 4]
mov dword [edi + 8], eax
test ecx, ecx
je 0x5440c8
test eax, eax
je 0x5440c8
push 0
call ecx
test eax, eax
mov eax, edi
js 0x5440d4
mov dword [edi + 0xb8], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
mov dword [edi + 0xb8], 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret