joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55bd40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e5016
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x20]
lea ecx, [edi + 0x10]
mov dword [edi], 0x52f978
mov dword [edi + 8], eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.0055f150
mov dword [edi + 0x10], eax
lea ecx, [edi + 0x30]
mov dword [esp + 0x18], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [edi + 0xc], 0
mov byte [edi + 4], 0
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
mov byte [esp + 0x18], 1
cmp eax, 0x400
jae 0x55bdd4
push 0x400
call fcn.0059c400
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x55bf30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e50b1
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov byte [esi], 0
lea ecx, [esi + 0x30]
mov eax, dword [esi + 4]
mov dword [esp + 0x14], 2
mov dword [esi + 8], eax
call fcn.0055c090
lea ecx, [esi + 0x20]
mov byte [esp + 0x14], 1
call fcn.0055bfd0
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 0
call fcn.0055bfd0
mov eax, dword [esi + 4]
test eax, eax
je 0x55bfb0
push eax
call fcn.005c40d3
add esp, 4
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x55cee0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5e52db
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5fc7d0]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [edi + 0x11c]
cmp eax, 0x3d0
jbe 0x55d12e
call esi
mov ebx, dword [edi + 0xa8]
add ebx, 0x3f4
mov dword [edi + 0x11c], eax
mov ecx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call fcn.005510b0
mov dword [esp + 0x50], 0
call fcn.0054ce70
mov esi, eax
add edi, 0x120
mov dword [esp + 0x10], esi
mov ebx, 2
mov dword [esp + 0x14], edi
mov ecx, edi
call fcn.005512b0
test al, al
je 0x55d10f
push dword [edi + 8]
call fcn.005511f0
add esp, 4
test al, al
je 0x55d0c3
lea esp, [esp]
mov ecx, edi
call fcn.00551310
test eax, eax
je 0x55d10f
cmp eax, 0xffffffff
jne 0x55d01b
mov esi, dword [0x602da0]
test esi, esi
jne 0x55d007
push 0x4e4
call fcn.005c4082
mov esi, eax
add esp, 4
mov dword [esp + 0x3c], esi
test esi, esi
je 0x55cffa
push 0x4e4
push 0
push esi
call fcn.005c55e0
add esp, 0xc
mov ecx, esi
call fcn.00541540
mov ecx, esi
mov byte [esp + 0x50], 2
call fcn.0054f600
jmp 0x55cffc
xor esi, esi
mov byte [esp + 0x50], 0
mov dword [0x602da0], esi
mov eax, dword [esi + 0x3e8]
call eax
mov esi, dword [esp + 0x10]
test eax, eax
je 0x55d10f
mov eax, dword [edi + 8]
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x40], eax
push ecx
lea ecx, [esi + 8]
call fcn.0055f210
push dword [esp + 0x18]
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x40]
mov esi, dword [esp + 0x24]
push eax
push edi
push esi
mov dword [esp + 0x4c], 0
call fcn.0055b1e0
add esp, 0x10
lea eax, [esp + 0x28]
push edi
push esi
mov esi, dword [esp + 0x18]
push eax
lea ecx, [esi + 8]
call fcn.005b17a0
mov edi, dword [esp + 0x14]
mov ecx, edi
call fcn.005513d0
mov ecx, edi
call fcn.00551130
push edi
push 0x563e00
mov ecx, edi
call fcn.00551170
test al, al
je 0x55d0b0
mov eax, dword [edi + 8]
lea ecx, [esi + 8]
mov dword [esp + 0x3c], eax
movzx eax, byte [0x6023c4]
push eax
lea eax, [esp + 0x40]
push eax
push 0
lea eax, [esp + 0x38]
push eax
call fcn.0054b360
push dword [edi + 8]
call fcn.005511f0
add esp, 4
test al, al
jne 0x55cfa0
push dword [edi + 8]
mov ecx, esi
call fcn.0055d300
mov ecx, edi
call fcn.005513d0
mov ecx, edi
call fcn.00551130
push edi
push 0x563e00
mov ecx, edi
call fcn.00551170
test al, al
je 0x55d10f
mov eax, dword [edi + 8]
lea ecx, [esi + 8]
mov dword [esp + 0x3c], eax
movzx eax, byte [0x6023c4]
push eax
lea eax, [esp + 0x40]
push eax
push 0
lea eax, [esp + 0x40]
push eax
call fcn.0054b360
add edi, 0x14
mov dword [esp + 0x14], edi
dec ebx
jne 0x55cf77
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x50], 0xffffffff
call fcn.00551110
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005c4b26
mov esp, ebp
pop ebp
ret
Function at 0x5623b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5e5ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5fc7d0]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov ebp, ecx
mov esi, dword [esp + 0x74]
lea eax, [esp + 0x1c]
mov edi, dword [esp + 0x78]
mov ebx, dword [esp + 0x7c]
push 0x44
push 0
push eax
call fcn.005c55e0
add esp, 0xc
mov dword [esp + 0x1c], 0x52fa48
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
mov dword [esp + 0x28], 0x52f2f8
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], 0
mov byte [esp + 0x48], 0
mov dword [esp + 0x44], 0x52f2f8
push ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x70], 0
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
call fcn.005975c0
movzx eax, byte [0x6023d4]
lea ecx, [ebp + 0x38]
push eax
lea eax, [esp + 0x20]
push eax
push 0
lea eax, [esp + 0x20]
push eax
call fcn.005600d0
lea ecx, [esp + 0x1c]
call fcn.00560610
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.005c4b26
add esp, 0x5c
ret 0xc

Function at 0x5624b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5e5b18
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5fc7d0]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov ebp, ecx
mov esi, dword [esp + 0x74]
lea eax, [esp + 0x1c]
mov edi, dword [esp + 0x78]
mov ebx, dword [esp + 0x7c]
push 0x44
push 0
push eax
call fcn.005c55e0
xor eax, eax
mov dword [esp + 0x28], 0x52fa50
add esp, 0xc
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
mov dword [esp + 0x28], 0x52f604
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], eax
mov word [esp + 0x48], ax
mov dword [esp + 0x44], 0x52f604
push ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
call fcn.00597670
movzx eax, byte [0x6023d4]
lea ecx, [ebp + 0x40]
push eax
lea eax, [esp + 0x20]
push eax
push 0
lea eax, [esp + 0x20]
push eax
call fcn.005601e0
lea ecx, [esp + 0x1c]
call fcn.00560670
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.005c4b26
add esp, 0x5c
ret 0xc
Function at 0x562da0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5e5c03
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
push 0
mov dword [edi], 0x52fa9c
lea ecx, [edi + 8]
push 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.00562aa0
mov dword [edi + 8], eax
push 0
push 0
lea ecx, [edi + 0x10]
mov dword [esp + 0x20], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.00562aa0
mov dword [edi + 0x10], eax
push 0
push 0
lea ecx, [edi + 0x18]
mov byte [esp + 0x20], 1
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call fcn.00562aa0
mov dword [edi + 0x18], eax
push 0
push 0
lea ecx, [edi + 0x20]
mov byte [esp + 0x20], 2
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call fcn.00562aa0
mov dword [edi + 0x20], eax
push 0
push 0
lea ecx, [edi + 0x28]
mov byte [esp + 0x20], 3
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.00562a60
mov dword [edi + 0x28], eax
push 0
push 0
lea ecx, [edi + 0x30]
mov byte [esp + 0x20], 4
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
call fcn.00562a60
mov dword [edi + 0x30], eax
lea ecx, [edi + 0x38]
mov byte [esp + 0x18], 5
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
call fcn.00563530
mov dword [edi + 0x38], eax
lea ecx, [edi + 0x40]
mov byte [esp + 0x18], 6
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
call fcn.00563530
mov dword [edi + 0x40], eax
lea ecx, [edi + 0x48]
mov byte [esp + 0x18], 7
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
call fcn.00546650
mov dword [edi + 0x48], eax
mov ecx, edi
mov byte [esp + 0x18], 8
call fcn.005625a0
mov byte [edi + 4], al
mov ecx, edi
mov byte [edi + 5], 0
call fcn.00562660
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x564270
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e5dbc
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x52fb4c
lea ecx, [edi + 4]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.00564bd0
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov dword [esp + 0x18], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.00564bd0
mov dword [edi + 0xc], eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
lea ecx, [edi + 0x24]
mov byte [esp + 0x18], 2
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
call fcn.00564ba0
mov dword [edi + 0x24], eax
lea ecx, [edi + 0x2c]
mov byte [esp + 0x18], 3
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.00564ba0
mov dword [edi + 0x2c], eax
mov eax, edi
mov dword [edi + 0x14], 0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x569650
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x5e6490
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0
push 0xac8
push 0xa
push 0xa
lea ecx, [esp + 0x30]
call fcn.0059bbe0
mov ebx, eax
mov ecx, dword [esp + 0x40]
push 0
mov dword [esp + 0x3c], 0
movzx edx, word [ecx + 4]
movzx eax, word [ecx + 2]
movzx edi, word [ecx]
lea ecx, [esp + 0x14]
push edx
push eax
push edi
call fcn.0059bbe0
push ebx
mov ecx, eax
mov byte [esp + 0x3c], 1
call fcn.0059bc00
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
mov bl, al
call fcn.0059d680
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.0059d680
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x575e50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e7358
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
xorps xmm0, xmm0
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
movdqu xmmword [esp + 0xc], xmm0
mov dword [esp + 0xc], 0x52fd84
mov edi, dword [ecx + 0x28]
mov dword [esp + 0x10], esi
lea esi, [ecx + 0x28]
mov dword [esp + 0x18], eax
mov ecx, esi
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 0
push eax
push dword [edi + 4]
mov dword [esp + 0x1c], edx
push edi
call fcn.00574f70
mov edx, eax
mov ecx, 0xaaaaaa9
mov eax, dword [esi + 4]
sub ecx, eax
cmp ecx, 1
jae 0x575ed7
push 0x52f648
call fcn.005c36d7
inc eax
mov dword [esi + 4], eax
mov dword [edi + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 0xc
Function at 0x576e50
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5e74b4
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x24c]
lea edi, [esi + 0x244]
sub eax, dword [edi]
sar eax, 2
cmp eax, 0x20
jae 0x576e97
push 0x20
mov ecx, edi
call fcn.005832d0
push 0x30
call fcn.005c4082
mov ebx, eax
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x38], 0
test ebx, ebx
je 0x576ecd
push 0x30
push 0
push ebx
call fcn.005c55e0
add esp, 0xc
lea eax, [esi + 4]
mov ecx, ebx
push eax
call fcn.00576900
jmp 0x576ecf
xor eax, eax
mov dword [esp + 0x10], eax
mov ecx, edi
lea eax, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
push eax
call fcn.0059ba40
push 0x30
call fcn.005c4082
mov ebx, eax
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x38], 1
test ebx, ebx
je 0x576f1d
push 0x30
push 0
push ebx
call fcn.005c55e0
add esp, 0xc
lea eax, [esi + 0x34]
mov ecx, ebx
push eax
call fcn.00576900
jmp 0x576f1f
xor eax, eax
mov dword [esp + 0x10], eax
mov ecx, edi
lea eax, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
push eax
call fcn.0059ba40
push 0x30
call fcn.005c4082
mov ebx, eax
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x38], 2
test ebx, ebx
je 0x576f6d
push 0x30
push 0
push ebx
call fcn.005c55e0
add esp, 0xc
lea eax, [esi + 0x64]
mov ecx, ebx
push eax
call fcn.00576900
jmp 0x576f6f
xor eax, eax
mov dword [esp + 0x10], eax
mov ecx, edi
lea eax, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
push eax
call fcn.0059ba40
push 0x30
call fcn.005c4082
mov ebx, eax
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x38], 3
test ebx, ebx
je 0x576fc0
push 0x30
push 0
push ebx
call fcn.005c55e0
add esp, 0xc
lea eax, [esi + 0x94]
mov ecx, ebx
push eax
call fcn.00576900
jmp 0x576fc2
xor eax, eax
mov dword [esp + 0x10], eax
mov ecx, edi
lea eax, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
push eax
call fcn.0059ba40
call fcn.00545970
mov edi, eax
mov eax, 0x601
cmp word [edi + 6], ax
jb 0x57708f
lea eax, [esp + 0x14]
push eax
call fcn.0059c210
add esp, 4
push eax
lea ecx, [esi + 0x280]
mov dword [esp + 0x3c], 4
call fcn.005984e0
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.005685c0
lea eax, [esi + 0xc4]
mov ecx, esi
push eax
call fcn.00576b90
lea eax, [esi + 0xf4]
mov ecx, esi
push eax
call fcn.00576b90
lea eax, [esi + 0x124]
mov ecx, esi
push eax
call fcn.00576b90
lea eax, [esi + 0x184]
mov ecx, esi
push eax
call fcn.00576b90
lea eax, [esi + 0x1b4]
mov ecx, esi
push eax
call fcn.00576b90
lea eax, [esi + 0x1e4]
mov ecx, esi
push eax
call fcn.00576b90
mov eax, 0x602
cmp word [edi + 6], ax
jb 0x57708f
lea eax, [esi + 0x154]
mov ecx, esi
push eax
call fcn.00576b90
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x57d950
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e7da8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5fc7d0]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 0xc], ecx
mov esi, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
mov edi, dword [esp + 0x38]
xorps xmm0, xmm0
movdqu xmmword [esp + 0x10], xmm0
push esi
mov dword [esp + 0x24], 0
push edi
mov dword [esp + 0x18], 0x52f704
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 0
call fcn.00554d10
mov byte [esp + 0x20], al
mov eax, dword [esp + 0xc]
push esi
push edi
mov dword [esp + 0x38], 0
push dword [eax]
call fcn.005910d0
add esp, 0xc
mov dword [esp + 0x30], 0xffffffff
cmp byte [esp + 0x20], 0
mov dword [esp + 0x10], 0x52f704
je 0x57da09
lea ecx, [esp + 0x10]
call fcn.00554d60
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005c4b26
add esp, 0x28
ret 8
Function at 0x581fa0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5e84d9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
lea ecx, [esi + 0xc]
mov dword [esi], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 8], eax
mov word [ecx + 0x18], 0
call fcn.005510d0
lea ecx, [esi + 0x28]
mov dword [esp + 0x18], 0
mov word [ecx + 0x18], 0
call fcn.005510d0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov eax, dword [esp + 0x2c]
sub esp, 0x18
mov dword [esi + 0x50], eax
mov eax, esp
mov byte [esi + 0x54], 0
mov dword [eax], 0x52ff50
mov dword [eax + 4], esi
mov dword [eax + 0x10], eax
mov ecx, dword [esi]
mov byte [esp + 0x30], 2
call fcn.00580d10
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 0x10

Function at 0x582a80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e865e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x5fc7d0]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, ecx
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], 0
mov eax, dword [eax + 4]
mov dword [esp + 0x28], 0
test byte [eax + 0xd], 4
je 0x582b0d
push 0xc
call fcn.005c4082
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x28], 1
test eax, eax
je 0x582b04
push 4
mov ecx, eax
call fcn.00580270
mov esi, eax
mov byte [esp + 0x28], 0
jmp 0x582b27
xor esi, esi
mov byte [esp + 0x28], 0
jmp 0x582b27
push 4
call fcn.005c4082
mov esi, eax
add esp, 4
test esi, esi
je 0x582b25
mov dword [esi], 0x52fe58
jmp 0x582b27
xor esi, esi
mov ecx, dword [esp + 0x18]
cmp esi, ecx
je 0x582b39
test ecx, ecx
je 0x582b39
mov eax, dword [ecx]
push 1
call dword [eax]
push 0x24
mov dword [esp + 0x1c], esi
mov dword [edi], 0
call fcn.005c4082
mov edx, eax
add esp, 4
mov dword [esp + 0x10], edx
mov byte [esp + 0x28], 2
test edx, edx
je 0x582b96
mov esi, dword [esp + 0x14]
xorps xmm0, xmm0
movdqu xmmword [edx], xmm0
movdqu xmmword [edx + 0x10], xmm0
mov dword [edx + 0x20], 0
mov eax, dword [esi + 4]
lea esi, [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
mov ecx, dword [eax]
push dword [esi + 8]
push dword [eax + 8]
movzx eax, word [esi + 0x20]
push eax
push ecx
mov ecx, edx
call fcn.00581000
jmp 0x582b98
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword [edi], eax
mov dword [esp + 0x28], 0xffffffff
test ecx, ecx
je 0x582bb0
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005c4b26
add esp, 0x20
ret 4
Function at 0x5845a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x5e8908
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5fc7d0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x50]
xorps xmm0, xmm0
mov edi, dword [esp + 0x54]
movdqu xmmword [esp + 0x14], xmm0
movzx eax, word [ecx]
mov word [esp + 0xf], ax
movzx eax, word [ecx + 2]
lea ecx, [esp + 0x14]
mov word [esp + 0x11], ax
push dword [esp + 0xf]
movdqu xmmword [esp + 0x28], xmm0
movq qword [esp + 0x38], xmm0
call fcn.0058fa00
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x48], 0
mov dword [esp + 0x14], 6
test ecx, ecx
je 0x584635
mov edx, dword [ecx]
lea eax, [esp + 0x1c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov al, byte [esp + 0x13]
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], al
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x530044
mov dword [esp + 0x2c], eax
call fcn.005900e0
push eax
call fcn.00590110
add esp, 4
mov esi, eax
mov ecx, edi
push esi
call fcn.0059c540
push esi
push dword [edi]
lea eax, [esp + 0x1c]
push dword [esp + 0x60]
push eax
call fcn.00590130
mov ecx, dword [esp + 0x3c]
add esp, 0x10
mov dword [esp + 0x48], 0xffffffff
test ecx, ecx
je 0x58469f
mov edx, dword [ecx]
lea eax, [esp + 0x1c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005c4b26
add esp, 0x40
ret
Function at 0x585750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5e8ad8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x5fc7d0]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
push edi
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x8c]
lea edi, [ecx + 4]
mov esi, dword [esp + 0x88]
lea ecx, [esp + 0x18]
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
push edi
movdqu xmmword [esp + 0x1c], xmm0
movdqu xmmword [esp + 0x2c], xmm0
movq qword [esp + 0x3c], xmm0
call fcn.0058f980
mov ecx, dword [esp + 0x10]
xorps xmm0, xmm0
mov dword [esp + 0x80], 0
mov ecx, dword [ecx]
movzx eax, word [ecx + 0x1c]
mov word [esp + 0x14], ax
movzx eax, word [ecx + 0x1e]
lea ecx, [esp + 0x40]
mov word [esp + 0x16], ax
push dword [esp + 0x14]
movdqu xmmword [esp + 0x44], xmm0
movdqu xmmword [esp + 0x54], xmm0
movq qword [esp + 0x64], xmm0
call fcn.0058fa00
push esi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x84], 1
call fcn.00585090
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.00584f20
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x40]
xorps xmm0, xmm0
mov dword [esp + 0x70], 0
movq qword [esp + 0x68], xmm0
push dword [esi + 4]
push eax
lea eax, [esp + 0x70]
push eax
call fcn.00585b20
push dword [esi]
movzx eax, word [esi + 4]
push eax
lea eax, [esp + 0x7c]
mov byte [esp + 0x94], 2
push eax
mov eax, dword [esp + 0x28]
push edi
mov eax, dword [eax]
push dword [eax + 0x10]
push dword [eax + 0xc]
call fcn.00584c00
mov esi, eax
add esp, 0x24
mov eax, dword [esp + 0x68]
test eax, eax
je 0x585898
push eax
call fcn.005c40d3
add esp, 4
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x80], 0
test ecx, ecx
je 0x5858c2
mov edx, dword [ecx]
lea eax, [esp + 0x48]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [esp + 0x58], 0
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x80], 0xffffffff
test ecx, ecx
je 0x5858e7
mov edx, dword [ecx]
lea eax, [esp + 0x20]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.005c4b26
add esp, 0x78
ret 8
Function at 0x585b20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e8b19
mov eax, dword fs:[0]
push eax
push ecx
push ebx
mov eax, dword [0x5fc7d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x20]
xorps xmm0, xmm0
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x14], 0
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
call fcn.005900e0
push eax
call fcn.00590110
add esp, 4
mov ecx, ebx
push eax
call fcn.00585460
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
sub eax, ecx
mov dword [esp + 0x14], 0
push eax
push ecx
push dword [esp + 0x2c]
mov dword [esp + 0x14], 1
call fcn.00590650
add eax, dword [esp + 0x30]
add esp, 4
push eax
push dword [esp + 0x2c]
call fcn.00590130
add esp, 0x10
mov eax, ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x10
ret