joyce8/EMBER2024-capa huggingface dataset:
Function at 0x79558a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7955af
pop word [esp]
lea esp, [esp + 2]
lea esp, [esp + 1]
mov dword [esp + 0x18], edx
pushal
jmp 0x795643
pop word [esp]
call fcn.007955fa

Function at 0x7955a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x1c], ecx
push bp
lea esp, [esp + 1]
call fcn.0079558a

Function at 0x7955fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], esp
pushfd
push ebp
jmp 0x7955e0

Function at 0x79560a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0x79562d

Function at 0x892a0a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
std
sub esp, 6
pop word [esp]
pop word [esp]
lea esp, [esp + 2]
jmp 0x8929ba
call 0x892a0a
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor al, 0x2e
xor byte [esi], ch
xor byte [eax], al
jmp 0x8929d0

Function at 0x8932ac
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0x20], ah
bsf esi, eax
neg ebx
xor si, di
jmp 0x8932f4
push dword [esp + 0x29]
mov word [esp + 1], ax
xchg cx, ax
mov dword [esp + 0xe], ebx
jmp 0x89333a
xchg byte [esp + 6], bh
lea esi, [ecx*4]
push edx
mov cx, word [esp + 0x2b]
mov dl, bh
btr di, bp
jmp 0x8932de
rdtsc
mov eax, 0xd991949f
rdtsc
xchg word [esp + 3], si
mov dx, 0x5846
mov si, sp
jmp 0x893324
Function at 0x8933b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
jmp 0x893317
mov edi, dword [esp + 0xc]
mov dword [esp + 0x12], ebx
call fcn.008932ac
add esp, 0x29
bsr ax, ax
rdtsc
mov ax, si
jmp 0x893367
mov word [esp], dx
xchg ah, cl
mov edx, ebp
bswap ebx
xchg al, bl
xchg byte [esp], ah
jmp 0x8933cd
pop word [esp + 1]
xchg byte [esp + 3], ch
shr bh, 1
mov dx, 0x98e2
pop ebx
mov dl, 0x33
jmp 0x893351
add esp, 1
mov cx, word [esp]
stc
rdtsc
neg ebx
call 0x8933b3
neg dx
jmp 0x8933f3
lea esp, [esp]
xchg bp, bx
btr esi, ecx
bswap edx
cld
not ecx
jmp 0x8933a1
mov cx, 0x4113
lea esp, [esp]
pop dx
not dl
xchg byte [esp + 1], ch
jmp 0x893446
setne cl
mov dx, word [esp + 4]
cld
mov byte [esp + 1], dl
mov dword [esp], edi
lea ecx, [edx*4]
jmp 0x8933dd
mov esi, 0x9c302778
pop dword [esp + 2]
mov di, dx
xchg cl, bh
not eax
jmp 0x893458
rdtsc
mov ecx, 0x9e50363e
mov bh, byte [esp + 4]
mov di, word [esp + 1]
xchg ebp, edx
sub esp, 0xd
jmp 0x89340c
sub esp, 1
rdtsc
inc ax
not cl
xchg al, ch
push word [esp + 2]
jmp 0x893422
mov ebp, eax
mov di, word [esp + 0xe]
dec ecx
clc
cpuid
push word [esp + 6]
jmp 0x89366e
xchg si, ax
mov esi, ecx
push dword [esp]
lea esi, [edx*4]
jmp 0x8934de
mov bx, word [esp + 1]
rdtsc
setg bh
xchg esi, ebp
inc edi
mov esi, dword [esp + 9]
jmp 0x893498
lea esi, [ecx + edi]
push word [esp + 1]
clc
ror ebx, cl
push ebp
xchg word [esp + 2], di
jmp 0x8934ae
lea ecx, [eax + edx]
inc di
call fcn.0089354d
xor esi, dword [edx + reloc.PSAPI.DLL_GetMappedFileNameW]
aaa
mov bh, 0x27
inc edx
mov cl, 0x56
sub al, byte [ebp - 0xc]
dec cx
mov bp, 0xa1d1
mov cl, 0x94
push word [esp]
mov al, 0xca
cpuid
jmp 0x8934cb
bswap esi
neg bx
lea esp, [esp + 1]
mov ebp, esi
bts bp, dx
lea ebp, [ebp*4]
jmp 0x8934f7
add dh, dh
bswap edi
setnp dh
mov ebx, edi
mov edx, ecx
mov byte [esp], ch
jmp 0x893592
btc ebp, esi
pop esi
lea ebx, [eax + 0xb0]
mov al, 0xb9
push eax
mov si, di
jmp 0x8935c1
setb ch
add esp, 0xf
xchg byte [esp], ch
xchg esi, eax
push word [esp]
mov edx, dword [esp + 2]
jmp 0x893616

Function at 0x893748
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pop edi
pop dword [esp + 1]
mov si, bx
lea esp, [esp + 0x10]
jmp 0x89376d
lea esp, [esp + 2]
mov bp, 0x4961
mov word [esp + 1], ax
jmp 0x893732
xchg bx, cx
seto al
setge ah
xchg edi, ebp
mov bx, ax
jmp 0x8937b3
mov word [esp + 4], bx
mov ch, 0x60
lea edx, reloc.PSAPI.DLL_GetMappedFileNameW
mov di, 0x55c7
dec dl
cld
jmp 0x893757
xchg byte [esp + 8], bl
mov ch, byte [esp + 0xa]
bswap edi
inc ecx
xchg bl, ah
mov bx, 0xb06f
jmp 0x89379d

Function at 0x893a27
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.008930e1
mov dword [esp], edx
mov word [esp], dx
jmp 0x893a34
pushal
pop word [esp + 0x14]
lea esp, [esp + 2]
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x893a84
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x8930dc
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x893a60
Function at 0x402dbc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00403a74
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00402f1c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x402f06
test ebx, ebx
jl 0x402eaa
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcb9220
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x402ecb
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x402ebd
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0040488c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0040488c
add esp, 8
mov ebx, 0x80070057
jmp 0x402eaa
Function at 0x419dbc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0041aa74
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00419f1c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x419f06
test ebx, ebx
jl 0x419eaa
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcd0220
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x419ecb
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x419ebd
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0041b88c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0041b88c
add esp, 8
mov ebx, 0x80070057
jmp 0x419eaa
Function at 0x430e4c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00431b04
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00430fac
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x430f96
test ebx, ebx
jl 0x430f3a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce72b0
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x430f5b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x430f4d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0043291c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0043291c
add esp, 8
mov ebx, 0x80070057
jmp 0x430f3a
Function at 0x447a8c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00448744
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00447bec
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x447bd6
test ebx, ebx
jl 0x447b7a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcfdef0
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x447b9b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x447b8d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0044955c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0044955c
add esp, 8
mov ebx, 0x80070057
jmp 0x447b7a
Function at 0x45e6ec
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0045f3a4
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0045e84c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45e836
test ebx, ebx
jl 0x45e7da
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd14b50
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45e7fb
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x45e7ed
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004601bc
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004601bc
add esp, 8
mov ebx, 0x80070057
jmp 0x45e7da
Function at 0x4756ec
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004763a4
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0047584c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x475836
test ebx, ebx
jl 0x4757da
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2bb50
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4757fb
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4757ed
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004771bc
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004771bc
add esp, 8
mov ebx, 0x80070057
jmp 0x4757da
Function at 0x48cf6c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0048dc24
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0048d0cc
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x48d0b6
test ebx, ebx
jl 0x48d05a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd433d0
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48d07b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x48d06d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0048ea3c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0048ea3c
add esp, 8
mov ebx, 0x80070057
jmp 0x48d05a
Function at 0x4a402c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004a4ce4
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004a418c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a4176
test ebx, ebx
jl 0x4a411a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd5a490
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a413b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4a412d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004a5afc
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004a5afc
add esp, 8
mov ebx, 0x80070057
jmp 0x4a411a
Function at 0x4ba4a9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23b8
cmp edx, dword [eax]
je 0x4ba4cb
add eax, 8
inc ecx
cmp eax, 0x4c2448
jl 0x4ba4bc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23b8]
jne 0x4ba5f9
mov eax, dword [0x4c6d3c]
cmp eax, 1
je 0x4ba5d3
test eax, eax
jne 0x4ba4fc
cmp dword [0x4c22e0], 1
je 0x4ba5d3
cmp edx, 0xfc
je 0x4ba5f9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba533
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bae90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb320
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba576
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb320
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf93c
push edi
call fcn.004bd1f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bae90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baea0
lea eax, [ebp - 0xa0]
push 0x4bf91c
push eax
call fcn.004baea0
push dword [esi + 0x4c23bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baea0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd164
add esp, 0x2c
pop edi
jmp 0x4ba5f9
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23bc]
push 0
push eax
push dword [esi]
call fcn.004bb320
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret