joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413cf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460398
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword fs:[0x18]
push ebx
push esi
push edi
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], ecx
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x1c]
xor eax, eax
mov word [ebp - 0x2c], ax
mov edx, dword [edi + 0x20]
cmp word [edx], ax
jne 0x413d40
xor ecx, ecx
jmp 0x413d54
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413d45
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.00403750
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
call fcn.00413ab0
mov ebx, eax
and ebx, 0x1f
cmp dword [ebp - 0x18], 8
jb 0x413d85
push dword [ebp - 0x2c]
call dword [0x46a2c4]
add esp, 4
mov esi, dword [edi + 0x10]
lea ecx, [edi + 0x2c]
mov edx, dword [edi + 8]
dec esi
mov eax, dword [ecx]
add esi, edx
mov byte [ebp - 0xd], 0
cmp eax, ecx
je 0x413dae
jmp 0x413da0
cmp eax, edx
jb 0x413da8
cmp eax, esi
jb 0x413dc2
mov eax, dword [eax]
cmp eax, ecx
jne 0x413da0
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebx*8]
mov dl, 1
sub eax, ecx
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov dword [ecx + 4], eax
mov al, dl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x415410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x460539
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov dword [esp + 8], 0
xorps xmm0, xmm0
push esi
push 0x19
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x1c]
push 0x54f6c8
mov dword [esp + 0x38], 0
movdqu xmmword [esp + 0x3c], xmm0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
call fcn.004034c0
mov dword [esp + 0x54], 0
push 0x574f58
mov dword [esp + 0x10], 1
call dword [0x46a134]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.004075d0
mov eax, dword [esp + 0x10]
push 0x574f58
cmp eax, dword [0x574f70]
je 0x4154f1
mov esi, dword [eax + 0x20]
call dword [0x46a130]
test esi, esi
je 0x4154f7
lea eax, [esp + 0x14]
push eax
push 0x18
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x14]
push 0
push dword [eax + 4]
call esi
test eax, eax
js 0x4154f7
cmp dword [ebp + 8], 0
je 0x4154f7
mov byte [esp + 7], 1
jmp 0x4154fc
call dword [0x46a130]
mov byte [esp + 7], 0
cmp dword [esp + 0x2c], 0x10
jb 0x415510
push dword [esp + 0x18]
call dword [0x46a2c4]
add esp, 4
cmp byte [esp + 7], 0
je 0x415532
mov eax, dword [esp + 8]
push 0
push 0x248
push dword [ebp + 8]
push dword [esp + 0x40]
push dword [eax + 4]
call dword [0x46a0c8]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x4c]
cdq
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4156c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x460599
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
mov dword [esp + 4], 0
xorps xmm0, xmm0
push esi
push 0x18
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x1c]
push 0x54f704
mov dword [esp + 0x38], 0
movdqu xmmword [esp + 0x40], xmm0
mov dword [esp + 0x18], 0
movdqu xmmword [esp + 0x50], xmm0
mov dword [esp + 0x34], 0xf
movq qword [esp + 0x60], xmm0
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
call fcn.004034c0
mov dword [esp + 0x6c], 0
push 0x574f58
mov dword [esp + 0xc], 1
call dword [0x46a134]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004075d0
mov eax, dword [esp + 0xc]
push 0x574f58
cmp eax, dword [0x574f70]
je 0x4157a1
mov esi, dword [eax + 0x20]
call dword [0x46a130]
test esi, esi
je 0x4157a7
lea eax, [esp + 0x10]
push eax
push 0x30
lea eax, [esp + 0x38]
push eax
push 0
push dword [ebp + 8]
call esi
test eax, eax
js 0x4157a7
cmp dword [ebp + 0xc], 0
je 0x4157a7
mov byte [esp + 7], 1
jmp 0x4157ac
call dword [0x46a130]
mov byte [esp + 7], 0
cmp dword [esp + 0x2c], 0x10
jb 0x4157c0
push dword [esp + 0x18]
call dword [0x46a2c4]
add esp, 4
cmp byte [esp + 7], 0
je 0x4157e2
mov eax, dword [esp + 0x14]
push 0
push 0x1838
push dword [ebp + 0xc]
push dword [esp + 0x44]
push dword [eax + 4]
call dword [0x46a0c8]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41eb30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x460838
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push esi
push edi
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push 0x14
mov edi, ecx
movq qword [esp + 0x3c], xmm0
push 0x54fc24
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xf
movdqu xmmword [esp + 0x30], xmm0
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.004034c0
push 0x574f58
mov dword [esp + 0x50], 0
call dword [0x46a134]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.004075d0
mov eax, dword [esp + 8]
push 0x574f58
cmp eax, dword [0x574f70]
je 0x41ebe5
mov esi, dword [eax + 0x20]
call dword [0x46a130]
test esi, esi
je 0x41ebeb
push 0
push 0x1c
lea eax, [esp + 0x2c]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 4]
call esi
mov esi, eax
jmp 0x41ebf0
call dword [0x46a130]
mov esi, 0xc0000138
cmp dword [esp + 0x20], 0x10
jb 0x41ec04
push dword [esp + 0xc]
call dword [0x46a2c4]
add esp, 4
test esi, esi
je 0x41ec1d
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov eax, dword [esp + 0x28]
cdq
pop edi
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x28]
mov dword [ecx + 0x10], eax
mov eax, dword [esp + 0x20]
mov dword [ecx + 0xc], edx
cdq
mov dword [ecx], eax
mov eax, dword [esp + 0x34]
mov dword [ecx + 0x24], eax
mov eax, dword [esp + 0x2c]
mov dword [ecx + 0x18], eax
mov eax, dword [esp + 0x30]
mov dword [ecx + 0x20], eax
mov eax, dword [esp + 0x38]
mov dword [ecx + 0x28], eax
xor eax, eax
mov dword [ecx + 4], edx
mov dword [ecx + 0x1c], 0
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41ec90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x460539
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov dword [esp + 8], 0
xorps xmm0, xmm0
push esi
push 0x19
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x1c]
push 0x54fc3c
mov dword [esp + 0x38], 0
movdqu xmmword [esp + 0x3c], xmm0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
call fcn.004034c0
mov dword [esp + 0x54], 0
push 0x574f58
mov dword [esp + 0x10], 1
call dword [0x46a134]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.004075d0
mov eax, dword [esp + 0x10]
push 0x574f58
cmp eax, dword [0x574f70]
je 0x41ed71
mov esi, dword [eax + 0x20]
call dword [0x46a130]
test esi, esi
je 0x41ed77
lea eax, [esp + 0x14]
push eax
push 0x18
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x14]
push 0
push dword [eax + 4]
call esi
test eax, eax
js 0x41ed77
cmp dword [ebp + 8], 0
je 0x41ed77
mov byte [esp + 7], 1
jmp 0x41ed7c
call dword [0x46a130]
mov byte [esp + 7], 0
cmp dword [esp + 0x2c], 0x10
jb 0x41ed90
push dword [esp + 0x18]
call dword [0x46a2c4]
add esp, 4
cmp byte [esp + 7], 0
je 0x41edb2
mov eax, dword [esp + 8]
push 0
push 0x248
push dword [ebp + 8]
push dword [esp + 0x40]
push dword [eax + 4]
call dword [0x46a0c8]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x4c]
cdq
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x41f590
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4604d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword [ebp + 0x18]
xorps xmm0, xmm0
push ebx
push esi
push edi
test eax, eax
movlpd qword [esp + 0x10], xmm0
push 0x1a
mov ebx, ecx
mov dword [esp + 0x30], 0xf
lea edi, [esp + 0x14]
mov dword [esp + 0x2c], 0
push 0x54fd94
lea ecx, [esp + 0x20]
mov byte [esp + 0x20], 0
cmovne edi, eax
call fcn.004034c0
push 0x574f58
mov dword [esp + 0x40], 0
call dword [0x46a134]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004075d0
mov eax, dword [esp + 0xc]
push 0x574f58
cmp eax, dword [0x574f70]
je 0x41f645
mov esi, dword [eax + 0x20]
call dword [0x46a130]
test esi, esi
je 0x41f64b
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebx + 4]
call esi
mov esi, eax
jmp 0x41f650
call dword [0x46a130]
mov esi, 0xc0000138
cmp dword [esp + 0x2c], 0x10
jb 0x41f664
push dword [esp + 0x18]
call dword [0x46a2c4]
add esp, 4
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x41f680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4604d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword [ebp + 0x18]
xorps xmm0, xmm0
push ebx
push esi
push edi
test eax, eax
movlpd qword [esp + 0x10], xmm0
push 0x1b
mov ebx, ecx
mov dword [esp + 0x30], 0xf
lea edi, [esp + 0x14]
mov dword [esp + 0x2c], 0
push str.NtWow64WriteVirtualMemory64
lea ecx, [esp + 0x20]
mov byte [esp + 0x20], 0
cmovne edi, eax
call fcn.004034c0
push 0x574f58
mov dword [esp + 0x40], 0
call dword [0x46a134]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004075d0
mov eax, dword [esp + 0xc]
push 0x574f58
cmp eax, dword [0x574f70]
je 0x41f735
mov esi, dword [eax + 0x20]
call dword [0x46a130]
test esi, esi
je 0x41f73b
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebx + 4]
call esi
mov esi, eax
jmp 0x41f740
call dword [0x46a130]
mov esi, 0xc0000138
cmp dword [esp + 0x2c], 0x10
jb 0x41f754
push dword [esp + 0x18]
call dword [0x46a2c4]
add esp, 4
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x420300
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x48]
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x74], edx
cdq
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x1c]
push ebx
push esi
mov esi, dword [0x575108]
mov dword [ebp - 0x6c], edx
cdq
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x20]
push edi
push dword [ebp + 0x10]
mov edi, dword [0x57510c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x78]
movlpd qword [ebp - 0x68], xmm0
push eax
push 0
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
call fcn.00421010
mov ebx, dword [ebp - 0x48]
xorps xmm0, xmm0
mov dword [ebp - 8], 2
mov dword [ebp - 4], 0
mov dword [ebp - 0x48], esi
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebx + 0x20]
cdq
movlpd qword [ebp - 0x10], xmm0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x44], edi
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x10], esp
and esp, 0xfffffff0
push 0x33
call 0x4203eb
add dword [esp], 5
retf
Function at 0x420480
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x48]
cdq
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x64], edx
cdq
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [0x575118]
push edi
push dword [ebp + 0x10]
mov edi, dword [0x57511c]
mov dword [ebp - 0x5c], edx
cdq
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x54], edx
push eax
push 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
call fcn.00421010
mov ebx, dword [ebp - 0x48]
xorps xmm0, xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], esi
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x24], eax
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x2c], edi
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x10], esp
and esp, 0xfffffff0
push 0x33
call 0x420548
add dword [esp], 5
retf

Function at 0x4205e0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x44]
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [0x5750b8]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x20]
push edi
push dword [ebp + 0x10]
mov edi, dword [0x5750bc]
mov dword [ebp - 0x70], edx
cdq
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x74]
movlpd qword [ebp - 0x64], xmm0
push eax
push 0
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], 0x30
mov dword [ebp - 0x50], 0
movlpd qword [ebp - 0x4c], xmm0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
call fcn.00421010
mov ebx, dword [ebp - 0x44]
xorps xmm0, xmm0
mov dword [ebp + 0x14], 2
mov dword [ebp + 0x18], 0
mov dword [ebp - 0x44], esi
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebx + 0x20]
cdq
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x40], edi
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x10], esp
and esp, 0xfffffff0
push 0x33
call 0x4206c6
add dword [esp], 5
retf
Function at 0x420760
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x44]
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov dword [ebp - 0x70], edx
cdq
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x20]
push esi
mov esi, dword [0x5750e8]
push edi
push dword [ebp + 0x10]
mov edi, dword [0x5750ec]
mov dword [ebp - 0x60], edx
cdq
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x74]
mov dword [ebp - 0x58], edx
push eax
push 0
mov dword [ebp - 0x50], 0
movlpd qword [ebp - 0x4c], xmm0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
call fcn.00421010
mov ebx, dword [ebp - 0x44]
xorps xmm0, xmm0
mov dword [ebp + 0x14], 2
mov dword [ebp + 0x18], 0
mov dword [ebp - 0x44], esi
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebx + 0x20]
cdq
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x40], edi
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x10], esp
and esp, 0xfffffff0
push 0x33
call 0x42084a
add dword [esp], 5
retf
Function at 0x4208e0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x4c]
cdq
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x70], edx
cdq
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x18]
push ebx
mov dword [ebp - 0x68], edx
cdq
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [0x5750f0]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x20]
push edi
push dword [ebp + 0x10]
mov edi, dword [0x5750f4]
mov dword [ebp - 0x60], edx
cdq
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x74]
mov dword [ebp - 0x58], 0
push eax
push 0
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
call fcn.00421010
mov ebx, dword [ebp - 0x4c]
xorps xmm0, xmm0
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x4c], esi
mov eax, dword [ebx]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x30], eax
lea eax, [ebx + 0x20]
cdq
movlpd qword [ebp - 0x14], xmm0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x48], edi
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x10], esp
and esp, 0xfffffff0
push 0x33
call 0x4209c0
add dword [esp], 5
retf

Function at 0x420a50
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x48]
cdq
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x64], edx
cdq
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [0x5750a8]
push edi
push dword [ebp + 0x10]
mov edi, dword [0x5750ac]
mov dword [ebp - 0x5c], edx
cdq
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x54], edx
push eax
push 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
call fcn.00421010
mov ebx, dword [ebp - 0x48]
xorps xmm0, xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], esi
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x24], eax
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x2c], edi
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x10], esp
and esp, 0xfffffff0
push 0x33
call 0x420b18
add dword [esp], 5
retf
Function at 0x420bb0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x14]
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x94], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x90], edx
cdq
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x28]
push ebx
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x2c]
push esi
mov esi, dword [0x5750d0]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x30]
push edi
push dword [ebp + 0x10]
mov edi, dword [0x5750d4]
mov dword [ebp - 0x78], edx
cdq
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x88], 0
push eax
push 0
movlpd qword [ebp - 0x84], xmm0
mov dword [ebp - 0x60], edx
movlpd qword [ebp - 0x5c], xmm0
mov dword [ebp - 0x54], 0x1000
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0x100000
mov dword [ebp - 0x48], 0
movlpd qword [ebp - 0x44], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call fcn.00421010
mov ebx, dword [ebp - 0x14]
xorps xmm0, xmm0
mov dword [ebp + 0x20], 7
mov dword [ebp + 0x24], 0
mov dword [ebp - 0x14], esi
mov eax, dword [ebx]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebx + 0x20]
cdq
movlpd qword [ebp + 0x28], xmm0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], edi
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x10], esp
and esp, 0xfffffff0
push 0x33
call 0x420ce1
add dword [esp], 5
retf