joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bdc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x42bdf2
jl 0x42bde5
test ecx, ecx
jne 0x42bdf2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x42bed9
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x42be22
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x42be24
xor eax, eax
cdq
mov dword [esp + 0x1c], edx
mov esi, eax
test edx, edx
jl 0x42be78
jg 0x42be35
test esi, esi
je 0x42be78
mov eax, dword [esp + 0x10]
cmp eax, edx
jg 0x42be49
jl 0x42be43
cmp ecx, esi
jae 0x42be49
mov esi, ecx
mov dword [esp + 0x1c], eax
push esi
push dword [esp + 0x1c]
push edi
call fcn.004622c0
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub ecx, esi
mov eax, dword [eax]
sbb edx, dword [esp + 0x1c]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x14]
jmp 0x42bea6
mov eax, dword [ebx]
mov esi, dword [eax + 0x1c]
mov ecx, esi
call dword [0x49446c]
mov ecx, ebx
call esi
mov edx, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x42bec2
mov ecx, dword [esp + 0xc]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
lea eax, [ebx + 0x2c]
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
test edx, edx
jg 0x42be07
jl 0x42bec2
test ecx, ecx
jne 0x42be07
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x42bf17
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x42bf17
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.004622c0
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x42bf87
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x42bf3d
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x42bf72
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.00474423
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x42bf87
cmp edi, eax
ja 0x42bf50
test edi, edi
je 0x42bf87
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.00474423
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x436680
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bf80
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4b3100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.00460b38
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0045eec4
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00436620
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4370e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bf80
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4b3100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.00460b38
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0045eec4
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00436620
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x439120
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49055d
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4b3100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0xc
call fcn.00460b38
mov ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov al, byte [eax]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0x4217f0
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push ecx
push 0x450ab0
push 0
push 0
call fcn.0046f25c
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x4391b2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00460925
mov esp, ebp
pop ebp
ret 0xc
push 6
mov dword [edi], 0
call fcn.0045e996
int3
Function at 0x439fd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490865
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4b3100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], edx
cmp dword [edx + 0x14], 0xf
mov dword [ebp - 0x1c], edx
jbe 0x43a014
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x43a038
mov edi, dword [ebp - 0x1c]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x43a023
mov edi, dword [ebp - 0x24]
push esi
push edx
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.00447b40
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43a068
mov dword [edi], eax
mov eax, edi
mov byte [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x43a1be
lea eax, [ebx + 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x28], 0
call fcn.00460b38
add esp, 4
mov edi, eax
mov dword [ebp - 0x28], edi
push dword [ebp - 0x14]
lea ecx, [edi + 8]
call fcn.00430460
mov byte [edi + 0x20], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4a7050]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x4a7050]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x43a160
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.00489f50
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.0048bb30
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x43a144
cmp eax, 0x200
jae 0x43a142
shl eax, 3
cmp eax, ecx
jae 0x43a144
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00444220
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00447b40
mov edx, dword [eax]
jmp 0x43a163
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x43a18b
mov dword [ecx + eax*8], edi
jmp 0x43a19d
cmp esi, edx
jne 0x43a194
mov dword [ecx + eax*8], edi
jmp 0x43a1a1
mov edx, dword [ebp - 0x14]
cmp dword [ecx + eax*8 + 4], edx
jne 0x43a1a1
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp - 0x24]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0045ecd7
int3
Function at 0x43ab30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490985
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4b3100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x4b60d0]
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
mov eax, dword [ecx + 4]
lea ecx, [ebx + 0x10]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
cmp byte [eax + 0xd], 0
mov dword [ebp - 0x14], ecx
jne 0x43abdf
mov esi, eax
mov eax, dword [ecx]
mov dword [ebp - 0x20], eax
nop dword [eax]
cmp dword [ebx + 0x14], 0xf
lea ecx, [esi + 0x10]
mov dword [ebp - 0x18], esi
mov eax, ebx
jbe 0x43aba0
mov eax, dword [ebx]
cmp dword [ecx + 0x14], 0xf
mov edx, dword [ecx + 0x10]
jbe 0x43abab
mov ecx, dword [ecx]
push dword [ebp - 0x20]
push eax
call fcn.0044d840
add esp, 8
test eax, eax
je 0x43abc9
jns 0x43abc9
mov esi, dword [esi + 8]
mov dword [ebp - 0x10], 0
jmp 0x43abd4
mov edi, esi
mov dword [ebp - 0x10], 1
mov esi, dword [esi]
cmp byte [esi + 0xd], 0
je 0x43ab90
mov esi, dword [ebp - 0x1c]
jmp 0x43abe2
mov dword [ebp - 0x14], ecx
cmp byte [edi + 0xd], 0
jne 0x43ac31
cmp dword [edi + 0x24], 0xf
lea eax, [edi + 0x10]
mov edx, dword [eax + 0x10]
jbe 0x43abf6
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0xf
mov ecx, ebx
jbe 0x43ac00
mov ecx, dword [ebx]
push edx
mov edx, dword [ebp - 0x14]
push eax
mov edx, dword [edx]
call fcn.0044d840
add esp, 8
test eax, eax
je 0x43ac15
js 0x43ac31
mov dword [esi], edi
mov eax, esi
mov byte [esi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x4b60d4], 0x4ec4ec4
je 0x43acd9
mov dword [ebp - 0x24], 0x4b60d0
mov dword [ebp - 4], 0
push 0x34
mov dword [ebp - 0x20], 0
call fcn.00460b38
mov edi, eax
add esp, 4
mov dword [ebp - 0x20], edi
push ebx
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 1
call fcn.00430460
mov eax, dword [ebp - 0x28]
mov ecx, 0x4b60d0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push edi
push dword [ebp - 0x10]
mov dword [edi + 0x28], 0
push dword [ebp - 0x18]
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov word [edi + 0xc], 0
call fcn.004429a0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.004053c0
int3

Function at 0x43e3b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x43e3e1
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x43e3d0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x43e540
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
sar esi, 1
add esi, esi
je 0x43e571
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x43e560
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x440d20
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49117d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4b3100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 4]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x49446c]
mov ecx, edi
call esi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
call fcn.00437800
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x440dc1
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x49446c]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x440dc1
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x49446c]
mov ecx, edi
call esi
push dword [ebp - 0x10]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
push eax
push 0x270f
push 0
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.0044d070
mov ecx, dword [ebp - 0x1c]
add esp, 0x1c
or dword [ecx], eax
test al, 2
jne 0x440e1f
cmp dword [ebp - 0x10], 2
jg 0x440e13
mov eax, dword [ebp - 0x14]
cmp eax, 0x45
jge 0x440e09
add eax, 0x64
mov dword [ebx + 0x14], eax
jmp 0x440e1f
cmp eax, 0x64
jge 0x440e1f
mov dword [ebx + 0x14], eax
jmp 0x440e1f
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffff894
mov dword [ebx + 0x14], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4435b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49134c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b3100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea ecx, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], ecx
mov dword [ecx + 0x24], 0
mov byte [ebp - 4], 4
mov eax, dword [ebp + 0x30]
test eax, eax
je 0x443671
mov eax, dword [eax]
push ecx
mov esi, dword [eax]
mov ecx, esi
call dword [0x49446c]
mov ecx, dword [ebp + 0x30]
call esi
mov dword [edi + 0x5c], eax
mov al, byte [ebp + 0x34]
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.00433dc0
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x10]
mov byte [ebp - 0xd], 1
call fcn.00444b50
mov ebx, dword [ebp + 0x30]
test ebx, ebx
je 0x4436c1
mov esi, dword [ebx]
lea eax, [ebp + 0xc]
cmp ebx, eax
setne dl
mov esi, dword [esi + 0x10]
mov ecx, esi
movzx edx, dl
push edx
call dword [0x49446c]
mov ecx, ebx
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x448450
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4917ad
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4b3100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
push 0xf8
mov dword [edi + 4], 0
call fcn.00460b38
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [edi + 4], esi
push 0xd4
push 0
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov dword [esi + 0x10], ecx
lea ecx, [esi + 0x24]
push ecx
call fcn.00463f40
xorps xmm0, xmm0
mov ecx, dword [ebp + 0xc]
movups xmmword [esi + 0x14], xmm0
mov dword [esi + 0x24], 0
add esp, 0x10
mov dword [esi + 0x28], 0xf
mov byte [esi + 0x14], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
movups xmmword [esi + 0x50], xmm0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0xf
mov byte [esi + 0x50], 0
movups xmmword [esi + 0x68], xmm0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0xf
mov byte [esi + 0x68], 0
movups xmmword [esi + 0x80], xmm0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0xf
mov byte [esi + 0x80], 0
movups xmmword [esi + 0x98], xmm0
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0xf
mov byte [esi + 0x98], 0
movups xmmword [esi + 0xb0], xmm0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xc4], 0xf
mov byte [esi + 0xb0], 0
movups xmmword [esi + 0xc8], xmm0
mov dword [esi + 0xd8], 0
mov dword [esi + 0xdc], 0xf
mov byte [esi + 0xc8], 0
movups xmmword [esi + 0xe0], xmm0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0xf
mov byte [esi + 0xe0], 0
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov eax, dword [edi + 4]
mov dword [eax + 4], ecx
mov eax, dword [edi + 4]
mov dword [eax + 8], ecx
mov eax, dword [edi + 4]
mov byte [eax + 0xc], 0
mov eax, dword [edi + 4]
mov byte [eax + 0xd], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4561c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4921d3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b3100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], ebx
call fcn.00430460
lea eax, [edi + 0x18]
mov dword [ebp - 4], 0
lea ecx, [ebx + 0x18]
push eax
call fcn.00456480
lea eax, [edi + 0x24]
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x24]
push eax
call fcn.0042e5f0
mov byte [ebp - 4], 2
lea ecx, [ebx + 0x3c]
mov eax, dword [edi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [ebx + 0x38], eax
lea eax, [edi + 0x3c]
push eax
call fcn.00430460
lea eax, [edi + 0x54]
mov byte [ebp - 4], 3
lea ecx, [ebx + 0x54]
push eax
call fcn.0042e5f0
lea eax, [edi + 0x60]
mov byte [ebp - 4], 4
lea ecx, [ebx + 0x60]
push eax
call fcn.00430460
lea eax, [edi + 0x78]
mov byte [ebp - 4], 5
lea ecx, [ebx + 0x78]
push eax
call fcn.00430460
lea eax, [edi + 0x90]
mov byte [ebp - 4], 6
lea ecx, [ebx + 0x90]
push eax
call fcn.00456480
mov byte [ebp - 4], 7
lea ecx, [ebx + 0xa0]
movzx eax, byte [edi + 0x9c]
mov byte [ebx + 0x9c], al
movzx eax, byte [edi + 0x9d]
mov byte [ebx + 0x9d], al
lea eax, [edi + 0xa0]
push eax
call fcn.0042fd70
mov byte [ebp - 4], 8
lea esi, [ebx + 0xc4]
mov eax, dword [edi + 0xb8]
mov dword [ebx + 0xb8], eax
mov eax, dword [edi + 0xbc]
mov dword [ebx + 0xbc], eax
movzx eax, byte [edi + 0xc0]
mov byte [ebx + 0xc0], al
movzx eax, byte [edi + 0xc1]
mov byte [ebx + 0xc1], al
push 0xf8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.00460b38
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea edx, [edi + 0xc4]
mov byte [ebp - 4], 9
push edx
mov ecx, esi
call fcn.0043cf70
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x458620
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492341
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4b3100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], edx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
push 0xf8
mov dword [ebp - 0x14], 0
call fcn.00460b38
mov ecx, dword [esi]
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
add esi, 4
lea edi, [ebx + 0x14]
mov dword [ebx + 0x10], ecx
push esi
mov ecx, edi
mov dword [ebp - 0x1c], edi
call fcn.00430460
lea eax, [esi + 0x18]
mov byte [ebp - 4], 1
lea ecx, [edi + 0x18]
push eax
call fcn.00456480
lea eax, [esi + 0x24]
mov byte [ebp - 4], 2
lea ecx, [edi + 0x24]
push eax
call fcn.00456480
lea eax, [esi + 0x30]
mov byte [ebp - 4], 3
lea ecx, [edi + 0x30]
push eax
call fcn.00456480
lea eax, [esi + 0x3c]
mov byte [ebp - 4], 4
lea ecx, [edi + 0x3c]
push eax
call fcn.00430460
lea eax, [esi + 0x54]
mov byte [ebp - 4], 5
lea ecx, [edi + 0x54]
push eax
call fcn.00430460
lea eax, [esi + 0x6c]
mov byte [ebp - 4], 6
lea ecx, [edi + 0x6c]
push eax
call fcn.00430460
lea eax, [esi + 0x84]
mov byte [ebp - 4], 7
lea ecx, [edi + 0x84]
push eax
call fcn.00430460
lea eax, [esi + 0x9c]
mov byte [ebp - 4], 8
lea ecx, [edi + 0x9c]
push eax
call fcn.00430460
lea eax, [esi + 0xb4]
mov byte [ebp - 4], 9
lea ecx, [edi + 0xb4]
push eax
call fcn.00430460
lea eax, [esi + 0xcc]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [edi + 0xcc]
call fcn.00430460
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov eax, ebx
mov word [ebx + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret