joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e0b0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x69a939
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi], 0x6ac870
mov dword [esp + 0x18], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
push fcn.00516950
push fcn.005167e0
push 8
push 0x4d4
lea eax, [esi + 0x64]
push eax
mov byte [esp + 0x2c], 3
call fcn.005b9dbb
lea ecx, [esi + 0x2708]
mov byte [esp + 0x18], 4
call fcn.00421bb0
lea ecx, [esi + 0x27bc]
mov byte [esp + 0x18], 5
call fcn.005167e0
push 0x3dc
mov byte [esp + 0x1c], 6
mov dword [esi + 0x2704], edi
mov dword [esi + 0xc], 0x288
mov dword [esi + 0x10], 0x200
mov dword [esi + 0x60], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x58], edi
call fcn.005b8072
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, edi
mov byte [esp + 0x18], 7
je 0x47e1a3
mov ecx, eax
call fcn.00414a90
jmp 0x47e1a5
xor eax, eax
mov dword [esi + 0x2cbc], eax
mov dword [eax + 0x17c], 2
mov edx, dword [0x8507f4]
mov ecx, dword [esi + 0x2cbc]
mov dword [ecx + 0x34], edx
mov eax, dword [esi + 0x2cbc]
mov byte [eax + 0x25c], 1
mov ecx, dword [esi + 0x2cbc]
mov dl, byte [0x21e6a42]
mov byte [ecx + 0x276], dl
mov eax, dword [esi + 0x2cbc]
mov cl, byte [0x851b1d]
mov byte [eax + 0x277], cl
mov edx, dword [esi + 0x2cbc]
mov al, byte [0x851b1f]
mov byte [edx + 0x174], al
mov ecx, dword [esi + 0x2cbc]
mov dl, byte [0x851b20]
mov byte [ecx + 0x175], dl
mov eax, dword [esi + 0x2cbc]
mov cl, byte [0x851b21]
mov byte [eax + 0x176], cl
mov edx, dword [esi + 0x2cbc]
mov al, byte [0x852b24]
mov byte [edx + 0x177], al
mov ecx, dword [esi + 0x2cbc]
mov dl, byte [0x851b22]
mov byte [ecx + 0x178], dl
mov eax, dword [esi + 0x2cbc]
mov cl, byte [0x851b1e]
mov byte [eax + 0x278], cl
mov edx, dword [esi + 0x2cbc]
mov eax, dword [0x852b2c]
add edx, 0x180
mov dword [edx], eax
mov ecx, dword [0x852b30]
mov dword [edx + 4], ecx
mov eax, dword [0x852b34]
mov dword [edx + 8], eax
mov cl, byte [0x852b38]
mov byte [edx + 0xc], cl
mov edx, dword [esi + 0x2cbc]
mov eax, dword [0x852b39]
add edx, 0x18d
mov dword [edx], eax
mov ecx, dword [0x852b3d]
mov dword [edx + 4], ecx
mov eax, dword [0x852b41]
mov dword [edx + 8], eax
mov cl, byte [0x852b45]
mov byte [edx + 0xc], cl
mov edx, dword [esi + 0x2cbc]
mov eax, dword [0x21e7c9f]
add edx, 0x384
mov dword [edx], eax
mov cx, word [0x21e7ca3]
mov word [edx + 4], cx
mov ecx, dword [esi + 0x2cbc]
mov byte [esp + 0x18], 6
call fcn.00414fe0
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x485f00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69ab50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi], 0x6acc28
mov dword [esp + 0x14], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
push fcn.00516950
push fcn.005167e0
push 3
push 0x4d4
lea eax, [esi + 0x48]
push eax
mov byte [esp + 0x28], 2
call fcn.005b9dbb
lea ecx, [esi + 0xec4]
mov byte [esp + 0x14], 3
call fcn.0051c930
push fcn.0051b2f0
push fcn.0051a260
push 2
push 0xf50
lea ecx, [esi + 0xf34]
push ecx
mov byte [esp + 0x28], 4
call fcn.005b9dbb
lea ecx, [esi + 0x2dec]
mov byte [esp + 0x14], 5
call fcn.005167e0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2dd4], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x48a650
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69adf7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov ecx, 1
mov dword [esp + 4], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi], 0x6ace9c
mov dword [esp + 0x10], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
push fcn.00516950
push fcn.005167e0
push 4
push 0x4d4
lea eax, [esi + 0x38]
push eax
mov byte [esp + 0x24], cl
call fcn.005b9dbb
push fcn.00516950
push fcn.005167e0
push 4
push 0x4d4
lea ecx, [esi + 0x1388]
push ecx
mov byte [esp + 0x24], 2
call fcn.005b9dbb
lea ecx, [esi + 0x26d8]
mov byte [esp + 0x10], 3
call fcn.005167e0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x48a8b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69aec3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov ebx, 1
mov dword [esp + 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edi
mov dword [esi], 0x6aceb8
mov dword [esp + 0x1c], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
lea ecx, [esi + 0x48]
mov byte [esp + 0x1c], 2
call fcn.00421bb0
lea ebp, [esi + 0x110]
mov ecx, ebp
mov byte [esp + 0x1c], 3
call fcn.005167e0
lea ecx, [esi + 0x5e4]
mov byte [esp + 0x1c], 4
call fcn.005167e0
lea ecx, [esi + 0xab8]
mov byte [esp + 0x1c], 5
call fcn.005167e0
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x3f800000
push edi
push 0x3f400000
push 0x3f000000
push 0x3f800000
push edi
push 0x3f000000
push 0x3e800000
mov eax, 0xff
push 0x3f800000
mov byte [esp + 0x60], 6
mov dword [esi + 0x20], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x159
mov dword [esi + 0xf8], edi
mov byte [esi + 0xfc], al
mov byte [esi + 0xfd], bl
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x108], edi
mov dword [esi + 0x10c], edi
mov byte [esi + 0xfe], al
mov byte [esi + 0xff], bl
push edi
push 0x3e800000
push edi
push ebx
push 0x20
push 0x80
push str.talk1_close_button.tga
push edi
push 0x16
push 0x16
push 0x20
push 0x20
push 6
push 0xe5
push edi
push edi
mov ecx, ebp
call fcn.00517f80
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xf8c], edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x48ab90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69af68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi], 0x6aced4
mov dword [esp + 0x14], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 2
call fcn.005167e0
push fcn.0051b2f0
push fcn.0051a260
push 5
push 0xf50
lea eax, [esi + 0x51c]
push eax
mov byte [esp + 0x28], 3
call fcn.005b9dbb
lea ecx, [esi + 0x51ac]
mov byte [esp + 0x14], 4
call fcn.005167e0
lea ecx, [esi + 0x5680]
mov byte [esp + 0x14], 5
call fcn.005167e0
lea ecx, [esi + 0x5b54]
mov byte [esp + 0x14], 6
call fcn.005167e0
lea ecx, [esi + 0x6028]
mov byte [esp + 0x14], 7
call fcn.005167e0
lea ecx, [esi + 0x64fc]
mov byte [esp + 0x14], 8
call fcn.005167e0
lea ecx, [esi + 0x69d0]
mov byte [esp + 0x14], 9
call fcn.005167e0
lea ecx, [esi + 0x8178]
mov byte [esp + 0x14], 0xa
call fcn.00421bb0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x6ea4], edi
mov dword [esi + 0x822c], edi
mov dword [esi + 0x8230], edi
mov dword [esi + 0x8228], 0xffffffff
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x494490
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69b501
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6acf80
mov dword [esp + 0x18], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
push fcn.00516950
push fcn.005167e0
push 3
push 0x4d4
lea eax, [esi + 0x48]
push eax
mov byte [esp + 0x2c], 2
call fcn.005b9dbb
lea ecx, [esi + 0xec4]
mov byte [esp + 0x18], 3
call fcn.005167e0
lea ecx, [esi + 0x1398]
mov byte [esp + 0x18], 4
call fcn.0051c930
lea ecx, [esi + 0x1408]
mov byte [esp + 0x18], 5
call fcn.0051a260
lea ecx, [esi + 0x2364]
mov byte [esp + 0x18], 6
call fcn.00421bb0
mov al, 0xff
mov byte [esi + 0x2417], al
mov byte [esi + 0x2418], al
mov byte [esi + 0x241b], al
xor eax, eax
mov dword [esi + 0x2358], ebx
mov byte [esi + 0x2416], 1
mov byte [esi + 0x2415], bl
mov byte [esi + 0x2419], bl
mov byte [esi + 0x241a], bl
mov byte [esi + 0x241c], bl
mov byte [esi + 0x241e], bl
mov byte [esi + 0x241f], bl
mov byte [esi + 0x2420], bl
mov dword [esi + 0xc], 0x1f9
mov dword [esi + 0x10], 0x16b
mov ecx, 0x20
lea edi, [esi + 0x2429]
rep stosd dword es:[edi], eax
mov ecx, 0x20
lea edi, [esi + 0x24a9]
rep stosd dword es:[edi], eax
mov dword [esi + 0x235c], ebx
mov byte [esi + 0x2360], bl
mov byte [esi + 0x2421], bl
mov dword [esi + 0x2424], 0xffffffff
mov word [esi + 0x2422], bx
mov byte [esi + 0x2428], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x494f70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69b5cf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6acfbc
mov dword [esp + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
lea ecx, [esi + 0x68]
mov byte [esp + 0x14], 4
call fcn.005167e0
lea ecx, [esi + 0x53c]
mov byte [esp + 0x14], 5
call fcn.00421bb0
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x5ec], 1
mov byte [esi + 0x5ed], 0xff
mov dword [esi + 0x5f0], 1
mov dword [esi + 0xc], 0x14d
mov dword [esi + 0x10], 0x13a
mov eax, esi
pop esi
mov byte [0x21e7c9d], bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x49a630
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
push esi
push edi
push 0x7034e0
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 0x6a75d5
push str.SHOW_MESSAGE_STORE
push str.INTERFACE
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x49a68e
mov edi, str.TRUE
lea esi, [esp + 8]
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
sete al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x7034e0
lea eax, [esp + 0xc]
push eax
push str.SHOW_MESSAGE_STORE
push str.INTERFACE
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49c550
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69ba0a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov edi, 1
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6ad200
mov dword [esp + 0x18], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
lea ecx, [esi + 0x78]
mov byte [esp + 0x18], 5
call fcn.005167e0
lea ecx, [esi + 0x54c]
mov byte [esp + 0x18], 6
call fcn.00421bb0
mov dword [esi + 0x824], edi
mov byte [0x21ea260], bl
cmp dword [esi + 0x824], ebx
mov byte [esi + 0x600], 1
mov byte [esi + 0x601], 0xff
mov byte [esi + 0x602], bl
mov dword [esi + 0x604], ebx
mov dword [esi + 0x718], edi
mov dword [esi + 0x5fc], ebx
mov dword [esi + 0x71c], ebx
je 0x49c644
mov dword [esi + 0xc], 0x14d
mov dword [esi + 0x10], 0x17c
jmp 0x49c652
mov dword [esi + 0xc], 0xfb
mov dword [esi + 0x10], 0x152
xor eax, eax
lea edi, [esi + 0x724]
mov ecx, 0x20
rep stosd dword es:[edi], eax
lea edi, [esi + 0x7a4]
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a31d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69baae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6ad560
mov dword [esp + 0x18], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 1
call fcn.005167e0
lea ecx, [esi + 0x50c]
mov byte [esp + 0x18], 2
call fcn.00421bb0
mov edx, 0x20
xor eax, eax
mov byte [esi + 0x5c2], bl
mov dword [esi + 0x5c4], ebx
mov dword [esi + 0x5bc], ebx
mov byte [esi + 0x5c0], 1
mov byte [esi + 0x5c1], 0xff
lea edi, [esi + 0x6dc]
mov ecx, edx
rep stosd dword es:[edi], eax
lea edi, [esi + 0x75c]
mov ecx, edx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov eax, 7
mov dword [esi + 0x7fc], eax
mov dword [esi + 0x800], eax
mov eax, 6
mov dword [esi + 0x80c], eax
mov dword [esi + 0x810], eax
pop edi
mov dword [esi + 0x7dc], 0x100
mov dword [esi + 0x7e0], 0x200
mov dword [esi + 0xc], 0xfe
mov dword [esi + 0x10], 0x124
mov dword [esi + 0x7f4], edx
mov dword [esi + 0x7f8], edx
mov dword [esi + 0x7e4], 0xf
mov dword [esi + 0x7e8], edx
mov dword [esi + 0x7ec], 0xf2
mov dword [esi + 0x7f0], 0x103
mov dword [esi + 0x804], 0xe7
mov dword [esi + 0x808], 1
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a40f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x69bb6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6ad5f0
mov dword [esp + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
push fcn.00516950
push fcn.005167e0
push 2
push 0x4d4
lea eax, [esi + 0x48]
push eax
mov byte [esp + 0x28], 2
call fcn.005b9dbb
lea ecx, [esi + 0x9f0]
mov byte [esp + 0x14], 3
call fcn.005167e0
lea ecx, [esi + 0xec4]
mov byte [esp + 0x14], 4
call fcn.0051c930
lea ecx, [esi + 0xf34]
mov byte [esp + 0x14], 5
call fcn.0051a260
mov dword [esi + 0x1e88], ebx
mov dword [esi + 0x1e84], ebx
mov dword [esi + 0x1e8c], ebx
mov dword [esi + 0x1e90], ebx
mov byte [esi + 0x1e9c], 0xff
mov byte [esi + 0x1e9d], bl
mov dword [esi + 0x1ea0], ebx
mov dword [esi + 0x1ea4], ebx
mov dword [esi + 0x1ea8], ebx
mov dword [esi + 0x1eac], ebx
lea eax, [esi + 0x1e9c]
mov byte [eax + 0x14], 0xff
mov byte [eax + 0x15], bl
add eax, 0x14
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
add eax, 0x14
mov byte [eax], 0xff
mov byte [eax + 1], bl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea ecx, [esi + 0x1fe0]
mov byte [esp + 0x14], 7
mov dword [eax + 0x10], ebx
call fcn.00421bb0
mov byte [0x21e7246], bl
mov dword [0x21e7248], ebx
mov byte [0x21ea818], bl
mov dword [esi + 0x1e94], ebx
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x1edd], bl
mov dword [esi + 0x2094], ebx
mov byte [esi + 0x2090], bl
mov byte [esi + 0x1ed8], bl
mov byte [esi + 0x1ed9], bl
mov byte [esi + 0x1eda], 1
mov byte [esi + 0x1edb], 0xff
mov byte [esi + 0x1edc], 0xff
mov dword [esi + 0xc], 0x1f9
mov dword [esi + 0x10], 0x16b
mov dword [esi + 0x1e98], 0xffffffff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a5c60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x69bc7f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6ad62c
mov dword [esp + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
push fcn.00516950
push fcn.005167e0
push 2
push 0x4d4
lea eax, [esi + 0x48]
push eax
mov byte [esp + 0x28], 2
call fcn.005b9dbb
lea ecx, [esi + 0x9f0]
mov byte [esp + 0x14], 3
call fcn.005167e0
lea ecx, [esi + 0xec4]
mov byte [esp + 0x14], 4
call fcn.0051c930
lea ecx, [esi + 0xf34]
mov byte [esp + 0x14], 5
call fcn.0051a260
mov dword [esi + 0x1e88], ebx
mov dword [esi + 0x1e84], ebx
mov dword [esi + 0x1e8c], ebx
mov dword [esi + 0x1e90], ebx
mov byte [esi + 0x1e9c], 0xff
mov byte [esi + 0x1e9d], bl
mov dword [esi + 0x1ea0], ebx
mov dword [esi + 0x1ea4], ebx
mov dword [esi + 0x1ea8], ebx
mov dword [esi + 0x1eac], ebx
lea eax, [esi + 0x1e9c]
mov byte [eax + 0x14], 0xff
mov byte [eax + 0x15], bl
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
add eax, 0x14
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov byte [eax + 0x14], 0xff
add eax, 0x14
mov byte [eax + 1], bl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
add eax, 0x14
mov byte [eax], 0xff
mov byte [eax + 1], bl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov byte [esp + 0x14], 7
mov dword [eax + 0xc], ebx
lea ecx, [esi + 0x1ff4]
mov dword [eax + 0x10], ebx
call fcn.00421bb0
mov ecx, dword [esp + 0xc]
mov byte [0x21e724c], bl
mov byte [0x21e7246], bl
mov dword [0x21e7248], ebx
mov byte [0x21ea818], bl
or eax, 0xffffffff
mov dword [0x21e7250], eax
mov dword [0x21e7254], eax
mov dword [esi + 0x1e98], eax
mov dword [esi + 0x1e94], ebx
mov byte [esi + 0x1ef1], bl
mov dword [esi + 0x20a8], ebx
mov byte [esi + 0x20a4], bl
mov byte [esi + 0x1eec], bl
mov byte [esi + 0x1eed], bl
mov byte [esi + 0x1eee], 1
mov byte [esi + 0x1eef], 0xff
mov byte [esi + 0x1ef0], 0xff
mov dword [esi + 0xc], 0x1f9
mov dword [esi + 0x10], 0x16b
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a6570
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69bd65
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6ad660
mov dword [esp + 0x14], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
push fcn.00516950
push fcn.005167e0
push 3
push 0x4d4
lea eax, [esi + 0x54]
push eax
mov byte [esp + 0x28], 2
call fcn.005b9dbb
lea ecx, [esi + 0xed0]
mov byte [esp + 0x14], 3
call fcn.0051c930
lea ecx, [esi + 0xf40]
mov byte [esp + 0x14], 4
call fcn.0051a260
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x30], bl
mov dword [esi + 0x1e94], ebx
mov byte [esi + 0x1f98], bl
mov dword [esi + 0xc], 0xfa
mov dword [esi + 0x10], 0x17e
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret