joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4467bf
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x758]
add edx, 1
mov dword [ebp - 0x758], edx
outsd dx, dword [esi]
push ebx
call 0x4467a1
add byte [eax + 0x3a], cl
cmp byte [edx + 0x34], al
cmp byte [edi + eax*2 + 0x32], cl
add esp, 4
jmp 0x4467aa
sub ebx, 0x10b9e
call 0x4467bf
add byte [0x4b32413e], bh
dec esp
inc edx
dec edx
add esp, 4
pop ebx
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x198]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x198]
movsx eax, byte [ebp + edx - 0x894]
or eax, 0x20
cmp ecx, eax
jge 0x4467f6
mov dword [ebp - 0xca8], 0xffffffff
jmp 0x446800
mov dword [ebp - 0xca8], 1
cmp dword [ebp - 0xca8], 0
jne 0x446817
mov ecx, dword [ebp - 0x1970]
mov dword [ebp - 0x3f4], ecx
jmp 0x446828
jmp 0x446601
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], edx
cmp dword [ebp - 0x3f4], 0
je 0x446903
push edx
sub edx, 0x7d9b
pop edx
push eax
push esi
add esp, 4
xor eax, 0x48fa
or eax, 0xc476
pop eax
push ecx
push ebx
add esp, 4
and ecx, 0x1766f
and ecx, 0x182e9
xor ecx, 0x3098
pop ecx
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x1974], eax
push esi
push edx
add esp, 4
and esi, 0xeedf
add esi, 0x18ef
jmp 0x44688d
jmp 0x446896
pop esi
push edi
xor edi, 0x59ec
sub edi, 0x165b6
mov dh, 0x65
add dword [eax], eax
pop edi
mov ecx, dword [ebp - 0x1974]
mov dword [ebp - 0x1978], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x1978]
test eax, eax
jne 0x446903
push edx
jmp 0x4468c9
jmp 0x4468ce
call 0x4468de
add byte [eax + edx*2 + 0x41], cl
cmp byte [esi + 0x50], al
inc edx
inc edx
dec eax
aas
add esp, 4
pop edx
push ecx
push edx
add esp, 4
add ecx, 0xbca5
and ecx, 0x13c2f
pop ecx
mov dword [ebp - 0x79c], 0
jmp 0x446fed
Function at 0x4468de
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x758]
add edx, 1
mov dword [ebp - 0x758], edx
outsd dx, dword [esi]
push ebx
call 0x4467a1
add byte [eax + 0x3a], cl
cmp byte [edx + 0x34], al
cmp byte [edi + eax*2 + 0x32], cl
add esp, 4
jmp 0x4467aa
sub ebx, 0x10b9e
call 0x4467bf
add byte [0x4b32413e], bh
dec esp
inc edx
dec edx
add esp, 4
pop ebx
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x198]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x198]
movsx eax, byte [ebp + edx - 0x894]
or eax, 0x20
cmp ecx, eax
jge 0x4467f6
mov dword [ebp - 0xca8], 0xffffffff
jmp 0x446800
mov dword [ebp - 0xca8], 1
cmp dword [ebp - 0xca8], 0
jne 0x446817
mov ecx, dword [ebp - 0x1970]
mov dword [ebp - 0x3f4], ecx
jmp 0x446828
jmp 0x446601
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], edx
cmp dword [ebp - 0x3f4], 0
je 0x446903
push edx
sub edx, 0x7d9b
pop edx
push eax
push esi
add esp, 4
xor eax, 0x48fa
or eax, 0xc476
pop eax
push ecx
push ebx
add esp, 4
and ecx, 0x1766f
and ecx, 0x182e9
xor ecx, 0x3098
pop ecx
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x1974], eax
push esi
push edx
add esp, 4
and esi, 0xeedf
add esi, 0x18ef
jmp 0x44688d
jmp 0x446896
pop esi
push edi
xor edi, 0x59ec
sub edi, 0x165b6
mov dh, 0x65
add dword [eax], eax
pop edi
mov ecx, dword [ebp - 0x1974]
mov dword [ebp - 0x1978], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x1978]
test eax, eax
jne 0x446903
push edx
jmp 0x4468c9
jmp 0x4468ce
call 0x4468de
add byte [eax + edx*2 + 0x41], cl
cmp byte [esi + 0x50], al
inc edx
inc edx
dec eax
aas
add esp, 4
pop edx
push ecx
push edx
add esp, 4
add ecx, 0xbca5
and ecx, 0x13c2f
pop ecx
mov dword [ebp - 0x79c], 0
jmp 0x446fed
Function at 0x446f00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax + 0x18]
jae 0x446fd5
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1984]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1988]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d10]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x198c], eax
mov dword [ebp - 0x19c], 0
jmp 0x446e39
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x446eeb
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
test edx, edx
je 0x446eeb
push ebx
or ebx, 0xf4bf
sub ebx, 0x449f
and ebx, 0xb46
add ebx, 0x7a99
pop ebx
push edi
push eax
add esp, 4
xor edi, 0x144a
sub edi, 0x102cd
or edi, 0xfc16
pop edi
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
cmp ecx, eax
je 0x446edd
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x446ee4
jmp 0x446e2a
jmp 0x446eeb
push ecx
or ecx, 0xfe0c
pop ecx
push ecx
add ecx, 0xc9e6
pop ecx
push eax
push eax
add esp, 4
jmp 0x446f08
jmp 0x446f10
sub eax, 0x1854a
add eax, 0xc20f
pop eax
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x446f4a
mov dword [ebp - 0xcb8], 0
jmp 0x446fb9
push edi
xor edi, 0x30e0
sub edi, 0x1bd7
call 0x446f63
add byte [edi + 0x48], al
xor al, 0x50
dec ebx
xor al, byte [ebx - 0x87efb3c]
mov edi, 0x5f000110
push esi
jmp 0x446f75
or esi, 0x837f
pop esi
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
invalid
xchg ebp, eax
Function at 0x446f63
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax + 0x18]
jae 0x446fd5
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1984]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1988]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d10]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x198c], eax
mov dword [ebp - 0x19c], 0
jmp 0x446e39
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x446eeb
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
test edx, edx
je 0x446eeb
push ebx
or ebx, 0xf4bf
sub ebx, 0x449f
and ebx, 0xb46
add ebx, 0x7a99
pop ebx
push edi
push eax
add esp, 4
xor edi, 0x144a
sub edi, 0x102cd
or edi, 0xfc16
pop edi
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
cmp ecx, eax
je 0x446edd
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x446ee4
jmp 0x446e2a
jmp 0x446eeb
push ecx
or ecx, 0xfe0c
pop ecx
push ecx
add ecx, 0xc9e6
pop ecx
push eax
push eax
add esp, 4
jmp 0x446f08
jmp 0x446f10
sub eax, 0x1854a
add eax, 0xc20f
pop eax
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x446f4a
mov dword [ebp - 0xcb8], 0
jmp 0x446fb9
push edi
xor edi, 0x30e0
sub edi, 0x1bd7
call 0x446f63
add byte [edi + 0x48], al
xor al, 0x50
dec ebx
xor al, byte [ebx - 0x87efb3c]
mov edi, 0x5f000110
push esi
jmp 0x446f75
or esi, 0x837f
pop esi
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
invalid
xchg ebp, eax
Function at 0x447cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cld
jb 0x447cd4
add byte [ecx + 0x4beacf], al
add byte [ecx + 0xe784c7], al
add byte [edi + 0x51], bl
pop edi
push ecx

Function at 0x447ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cld
jb 0x447cd4
add byte [ecx + 0x4beacf], al
add byte [ecx + 0xe784c7], al
add byte [edi + 0x51], bl
pop edi
push ecx
Function at 0x447f50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop ecx
push ebx
and ebx, 0x1072a
or ebx, 0x6c13
pop ebx
push edx
add edx, 0x1403f
and edx, 0x4f10
or edx, 0x102c5
xor edx, 0x2663
pop edx
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push esi
xor esi, 0x97c
pop esi
push ebx
push edi
add esp, 4
or ebx, 0x15280
and ebx, 0x17921
sub ebx, 0x15505
call fcn.00447fd1
add byte [ebp + 0x42], al
dec esp
inc ebp
cmp dword [ebx + 0x4e], eax
dec esp
inc edx

Function at 0x447fd1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
jmp fcn.00447f50
add esp, 4
pop ebx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
test dword [edx - 0x74000011], edi
lea ebp, [eax]
invalid
invalid
inc dword [ebx - 0x7276fd3f]
sub bl, dh
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
mov edx, 0x66ffffef
mov dword [ebp - 0x224], edx
invalid
dec dword [ebx - 0xcdb7b]
jmp dword [esi - 0x75]
or byte [esi - 0x77], ah
invalid
invalid
out dx, eax
Function at 0x44eab0
Capabilities:
Encode data using xor

Disassembly:
add dword [ecx], eax
xor bl, 0xbe
pop ebp
add al, byte [ecx]
xor bl, 0x4e
cmp byte [edx], al
add dword [ebx - 0x39], ebx
xchg ch, al
cmc
add byte [eax], al
push ebx
mov dword [esi + 0xf5c6], 0xc786c775
cmc
add byte [eax], al
insd dword es:[edi], dx
mov dword [esi + 0xf5c8], 0xc986c74a
cmc
add byte [eax], al
outsd dx, dword [esi]
mov dword [esi + 0xf5ca], 0xcb86c76a
cmc
add byte [eax], al
jne 0x44eab8
xchg ah, cl
cmc
add byte [eax], al
push esi
mov dword [esi + 0xf5cd], 0xce86c76f
cmc
add byte [eax], al
push 0xffffffffffffffc7
xchg bh, cl
mov dword [esi + 0xf5ce], 0xcf86c76a
cmc
add byte [eax], al
mov dword fs:[esi + 0xf5d0], 0xd186c770
cmc
add byte [eax], al
mov dword gs:[esi + 0xf5d2], 0xd386c766
cmc
add byte [eax], al
push esp
mov dword [esi + 0xf5d4], 0xd586c775
cmc
add byte [eax], al
jae 0x44eafe
xchg dh, dl
cmc
add byte [eax], al
push 0xffffffffffffffc7
xchg bh, dl
cmc
add byte [eax], al
outsd dx, dword [esi]
mov dword [esi + 0xf5d8], 0xd986c768
cmc
add byte [eax], al
add dword [ecx + 0x53], edx
test ch, al
add eax, 0x186ee982
add al, byte [ecx]
pop ecx
push edi
sbb byte [edx], al
add dword [ecx + 0x57], ebx
push esp
test ch, al
add eax, 0x373704ec
inc edx
in al, dx
or byte [eax + ecx*2 + 0x4b], cl
dec edi
aaa
xor eax, dword [esi - 0x7e]
out 9, eax
sub eax, dword [edx]
add dword [edi + 0x53], ebx
push edi
test ch, al
add eax, 0xf32ae382
add dword [ecx], eax
pop ebx
mov dword [esi + 0xf565], 0x6686c753
cmc
add byte [eax], al
jne 0x44eb5a
xchg byte [edi - 0xb], ah
add byte [eax], al
insd dword es:[edi], dx
mov dword [esi + 0xf568], 0x6986c756
cmc
add byte [eax], al
jno 0x44eb6f
xchg byte [edx - 0xb], ch
add byte [eax], al
mov dword fs:[esi + 0xf56b], 0x6c86c762
cmc
add byte [eax], al
je 0x44eb84
xchg byte [ebp - 0xb], ch
add byte [eax], al
mov word [esi + 0xf56e], 0xc756
xchg byte [edi - 0xb], ch
add byte [eax], al
outsd dx, dword [esi]
mov dword [esi + 0xf570], 0x7186c76a
cmc
add byte [eax], al
mov dword fs:[esi + 0xf572], 0x7386c770
cmc
add byte [eax], al
mov dword gs:[esi + 0xf574], 0x7586c766
cmc
add byte [eax], al
push esp
mov dword [esi + 0xf576], 0x7786c775
cmc
add byte [eax], al
jae 0x44ebd1
xchg byte [eax - 0xb], bh
add byte [eax], al
push 0xffffffffffffffc7
xchg byte [ecx - 0xb], bh
add byte [eax], al
outsd dx, dword [esi]
mov dword [esi + 0xf57a], 0x7b86c768
cmc
add byte [eax], al
add dword [eax + 0x58], ebx
test ch, al
add eax, 0xf983c882
add dword [ecx], eax
in al, dx
or byte [eax + 0x3f], dl
dec ebp
push eax
dec edx
cmp byte [eax + 0x57], ah
jmp 0x145ed48

Function at 0x457ca0
Capabilities:
Encode data using xor

Disassembly:
dec esp
inc ecx
cmp al, 0x3d
cmp byte [ebp + eax*8 - 0x7973a4fb], al
dec ecx
sti
add byte [eax], al
add al, 0x86
invalid
Function at 0x4640d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5e1a48
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov ecx, esi
call fcn.005b3ad0
mov eax, dword [0x6ccb48]
mov ecx, dword [0x6ccb44]
xor ebx, ebx
lea edx, [esi + 0x38]
push edx
mov edi, 0x6ccb50
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.MouthFlapper.0
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], 0xbf800000
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
call fcn.00464530
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x54], bl
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x468d60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5e3ed8
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [esp + 0x18]
mov eax, esi
call fcn.00468700
mov eax, dword [esp + 0x1c]
mov cx, word [esp + 0x20]
xor ebx, ebx
mov dword [esi + 8], eax
mov word [esi + 0xc], cx
or eax, 0xffffffff
mov dword [esi], vtable.CGuiMenu.0
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], eax
mov byte [esi + 0x1c], bl
mov dword [esi + 0x20], 0xc00000ff
mov dl, byte [esi + 0x28]
and dl, 0xfe
or dl, 2
mov byte [esi + 0x28], dl
mov dword [esi + 0x24], ebx
mov ecx, dword [0x6555b0]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], 0xc0ff0000
mov cl, byte [esi + 0x34]
lea edx, [edi*4]
or cl, 1
push edx
mov dword [esp + 0x14], ebx
mov byte [esi + 0x34], cl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov word [esi + 0x40], ax
call fcn.00445250
mov dword [esi + 0x10], eax
add esp, 4
xor eax, eax
cmp edi, ebx
jle 0x468e0b
nop
mov ecx, dword [esi + 0x10]
mov dword [ecx + eax*4], ebx
inc eax
cmp eax, edi
jl 0x468e00
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x49ced0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e3248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], vtable.BoxPts.0
mov eax, dword [edi]
lea ecx, [esp + 8]
push ecx
mov ecx, edi
mov dword [esp + 0x48], 0
mov dword [esp + 0xc], 0x501502f9
mov dword [esp + 0x10], 0x501502f9
mov dword [esp + 0x14], 0x501502f9
mov dword [esp + 0x18], 0xd01502f9
mov dword [esp + 0x1c], 0xd01502f9
mov dword [esp + 0x20], 0xd01502f9
call dword [eax + 0x14]
fld dword [esp + 8]
fadd dword [esi + 0x60]
lea edx, [esp + 0x20]
push edx
lea ebx, [esi + 4]
fstp dword [esp + 0x28]
xor eax, eax
fld dword [esp + 0x10]
fadd dword [esi + 0x64]
fstp dword [esp + 0x2c]
fld dword [esp + 0x14]
fadd dword [esi + 0x68]
fstp dword [esp + 0x30]
fld dword [esp + 0x18]
fsub dword [esi + 0x60]
fstp dword [esp + 0x34]
fld dword [esp + 0x1c]
fsub dword [esi + 0x64]
fstp dword [esp + 0x38]
fld dword [esp + 0x20]
fsub dword [esi + 0x68]
fstp dword [esp + 0x3c]
call fcn.0049a2d0
mov ecx, dword [eax + 0xc]
cmp ecx, dword [eax + 8]
jge 0x49cfae
mov edx, dword [eax + 0x10]
mov dword [edx + ecx*4], edi
inc dword [eax + 0xc]
mov dword [edi + 0x24], eax
pop esi
pop ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
mov esi, dword [esi + 0x28]
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
jge 0x49cf9d
mov ecx, dword [esi + 0x10]
mov dword [ecx + eax*4], edi
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x3c]
inc eax
mov dword [esi + 0xc], eax
mov dword [edi + 0x24], esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret

Function at 0x49cfe0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5e3248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
mov dword [esp + 0x1c], vtable.BoxPts.0
mov eax, dword [edi]
lea ecx, [esp + 4]
push ecx
mov ecx, edi
mov dword [esp + 0x44], 0
mov dword [esp + 8], 0x501502f9
mov dword [esp + 0xc], 0x501502f9
mov dword [esp + 0x10], 0x501502f9
mov dword [esp + 0x14], 0xd01502f9
mov dword [esp + 0x18], 0xd01502f9
mov dword [esp + 0x1c], 0xd01502f9
call dword [eax + 0x14]
fld dword [esp + 4]
fadd dword [esi + 0x60]
lea edx, [esp + 0x1c]
push edx
lea ebx, [esi + 4]
fstp dword [esp + 0x24]
xor eax, eax
fld dword [esp + 0xc]
fadd dword [esi + 0x64]
fstp dword [esp + 0x28]
fld dword [esp + 0x10]
fadd dword [esi + 0x68]
fstp dword [esp + 0x2c]
fld dword [esp + 0x14]
fsub dword [esi + 0x60]
fstp dword [esp + 0x30]
fld dword [esp + 0x18]
fsub dword [esi + 0x64]
fstp dword [esp + 0x34]
fld dword [esp + 0x1c]
fsub dword [esi + 0x68]
fstp dword [esp + 0x38]
call fcn.0049a2d0
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
mov dword [edx + ecx*4], edi
inc dword [eax + 0x1c]
mov ecx, dword [esp + 0x38]
mov dword [edi + 0x24], eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x49d0c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e3248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], vtable.BoxPts.0
mov eax, dword [edi]
lea ecx, [esp + 8]
push ecx
mov ecx, edi
mov dword [esp + 0x48], 0
mov dword [esp + 0xc], 0x501502f9
mov dword [esp + 0x10], 0x501502f9
mov dword [esp + 0x14], 0x501502f9
mov dword [esp + 0x18], 0xd01502f9
mov dword [esp + 0x1c], 0xd01502f9
mov dword [esp + 0x20], 0xd01502f9
call dword [eax + 0x14]
fld dword [esp + 8]
fadd dword [esi + 0x60]
lea edx, [esp + 0x20]
push edx
lea ebx, [esi + 4]
fstp dword [esp + 0x28]
xor eax, eax
fld dword [esp + 0x10]
fadd dword [esi + 0x64]
fstp dword [esp + 0x2c]
fld dword [esp + 0x14]
fadd dword [esi + 0x68]
fstp dword [esp + 0x30]
fld dword [esp + 0x18]
fsub dword [esi + 0x60]
fstp dword [esp + 0x34]
fld dword [esp + 0x1c]
fsub dword [esi + 0x64]
fstp dword [esp + 0x38]
fld dword [esp + 0x20]
fsub dword [esi + 0x68]
fstp dword [esp + 0x3c]
call fcn.0049a2d0
mov ecx, dword [eax + 0x3c]
cmp ecx, dword [eax + 0x38]
jge 0x49d19e
mov edx, dword [eax + 0x40]
mov dword [edx + ecx*4], edi
inc dword [eax + 0x3c]
mov dword [edi + 0x24], eax
pop esi
pop ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
mov esi, dword [esi + 0x28]
mov eax, dword [esi + 0x3c]
cmp eax, dword [esi + 0x38]
jge 0x49d18d
mov ecx, dword [esi + 0x40]
mov dword [ecx + eax*4], edi
mov eax, dword [esi + 0x3c]
mov ecx, dword [esp + 0x3c]
inc eax
mov dword [esi + 0x3c], eax
mov dword [edi + 0x24], esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x49d2b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e3248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], vtable.BoxPts.0
mov eax, dword [edi]
lea ecx, [esp + 8]
push ecx
mov ecx, edi
mov dword [esp + 0x48], 0
mov dword [esp + 0xc], 0x501502f9
mov dword [esp + 0x10], 0x501502f9
mov dword [esp + 0x14], 0x501502f9
mov dword [esp + 0x18], 0xd01502f9
mov dword [esp + 0x1c], 0xd01502f9
mov dword [esp + 0x20], 0xd01502f9
call dword [eax + 0x14]
fld dword [esp + 8]
fadd dword [esi + 0x60]
lea edx, [esp + 0x20]
push edx
lea ebx, [esi + 4]
fstp dword [esp + 0x28]
xor eax, eax
fld dword [esp + 0x10]
fadd dword [esi + 0x64]
fstp dword [esp + 0x2c]
fld dword [esp + 0x14]
fadd dword [esi + 0x68]
fstp dword [esp + 0x30]
fld dword [esp + 0x18]
fsub dword [esi + 0x60]
fstp dword [esp + 0x34]
fld dword [esp + 0x1c]
fsub dword [esi + 0x64]
fstp dword [esp + 0x38]
fld dword [esp + 0x20]
fsub dword [esi + 0x68]
fstp dword [esp + 0x3c]
call fcn.0049a2d0
mov ecx, dword [eax + 0x5c]
cmp ecx, dword [eax + 0x58]
jge 0x49d38e
mov edx, dword [eax + 0x60]
mov dword [edx + ecx*4], edi
inc dword [eax + 0x5c]
mov dword [edi + 0x24], eax
pop esi
pop ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
mov esi, dword [esi + 0x28]
mov eax, dword [esi + 0x5c]
cmp eax, dword [esi + 0x58]
jge 0x49d37d
mov ecx, dword [esi + 0x60]
mov dword [ecx + eax*4], edi
mov eax, dword [esi + 0x5c]
mov ecx, dword [esp + 0x3c]
inc eax
mov dword [esi + 0x5c], eax
mov dword [edi + 0x24], esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x49d3c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e3248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], vtable.BoxPts.0
mov eax, dword [edi]
lea ecx, [esp + 8]
push ecx
mov ecx, edi
mov dword [esp + 0x48], 0
mov dword [esp + 0xc], 0x501502f9
mov dword [esp + 0x10], 0x501502f9
mov dword [esp + 0x14], 0x501502f9
mov dword [esp + 0x18], 0xd01502f9
mov dword [esp + 0x1c], 0xd01502f9
mov dword [esp + 0x20], 0xd01502f9
call dword [eax + 0x14]
fld dword [esp + 8]
fadd dword [esi + 0x60]
lea edx, [esp + 0x20]
push edx
lea ebx, [esi + 4]
fstp dword [esp + 0x28]
xor eax, eax
fld dword [esp + 0x10]
fadd dword [esi + 0x64]
fstp dword [esp + 0x2c]
fld dword [esp + 0x14]
fadd dword [esi + 0x68]
fstp dword [esp + 0x30]
fld dword [esp + 0x18]
fsub dword [esi + 0x60]
fstp dword [esp + 0x34]
fld dword [esp + 0x1c]
fsub dword [esi + 0x64]
fstp dword [esp + 0x38]
fld dword [esp + 0x20]
fsub dword [esi + 0x68]
fstp dword [esp + 0x3c]
call fcn.0049a2d0
mov ecx, dword [eax + 0x6c]
cmp ecx, dword [eax + 0x68]
jge 0x49d49e
mov edx, dword [eax + 0x70]
mov dword [edx + ecx*4], edi
inc dword [eax + 0x6c]
mov dword [edi + 0x24], eax
pop esi
pop ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
mov esi, dword [esi + 0x28]
mov eax, dword [esi + 0x6c]
cmp eax, dword [esi + 0x68]
jge 0x49d48d
mov ecx, dword [esi + 0x70]
mov dword [ecx + eax*4], edi
mov eax, dword [esi + 0x6c]
mov ecx, dword [esp + 0x3c]
inc eax
mov dword [esi + 0x6c], eax
mov dword [edi + 0x24], esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret

Function at 0x49d4d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5e3248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
mov dword [esp + 0x1c], vtable.BoxPts.0
mov eax, dword [edi]
lea ecx, [esp + 4]
push ecx
mov ecx, edi
mov dword [esp + 0x44], 0
mov dword [esp + 8], 0x501502f9
mov dword [esp + 0xc], 0x501502f9
mov dword [esp + 0x10], 0x501502f9
mov dword [esp + 0x14], 0xd01502f9
mov dword [esp + 0x18], 0xd01502f9
mov dword [esp + 0x1c], 0xd01502f9
call dword [eax + 0x14]
fld dword [esp + 4]
fadd dword [esi + 0x60]
lea edx, [esp + 0x1c]
push edx
lea ebx, [esi + 4]
fstp dword [esp + 0x24]
xor eax, eax
fld dword [esp + 0xc]
fadd dword [esi + 0x64]
fstp dword [esp + 0x28]
fld dword [esp + 0x10]
fadd dword [esi + 0x68]
fstp dword [esp + 0x2c]
fld dword [esp + 0x14]
fsub dword [esi + 0x60]
fstp dword [esp + 0x30]
fld dword [esp + 0x18]
fsub dword [esi + 0x64]
fstp dword [esp + 0x34]
fld dword [esp + 0x1c]
fsub dword [esi + 0x68]
fstp dword [esp + 0x38]
call fcn.0049a2d0
mov ecx, dword [eax + 0x7c]
mov edx, dword [eax + 0x80]
mov dword [edx + ecx*4], edi
inc dword [eax + 0x7c]
mov ecx, dword [esp + 0x38]
mov dword [edi + 0x24], eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret