joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422b20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x84ce1e
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebp, ebp
mov dword [esi], vtable.CDesignBase.0
mov dword [esp + 0x1c], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
lea edi, [esi + 0x14]
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.00609410
mov dword [edi + 4], eax
mov dword [edi + 8], ebp
lea edi, [esi + 0x20]
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.0041ec90
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x30], ebp
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret

Function at 0x422f40
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
cmp ecx, esi
je 0x422fa7
movzx edx, word [ecx + 4]
mov word [eax + 4], dx
movzx edx, word [ecx + 6]
mov word [eax + 6], dx
movzx edx, word [ecx + 8]
mov word [eax + 8], dx
movzx edx, word [ecx + 0xa]
mov word [eax + 0xa], dx
movzx edx, word [ecx + 0xc]
mov word [eax + 0xc], dx
movzx edx, word [ecx + 0xe]
mov word [eax + 0xe], dx
movzx edx, word [ecx + 0x10]
mov word [eax + 0x10], dx
movzx edx, word [ecx + 0x12]
mov word [eax + 0x12], dx
mov dl, byte [ecx + 0x14]
mov byte [eax + 0x14], dl
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x18], edx
add ecx, 0x1c
add eax, 0x1c
cmp ecx, esi
jne 0x422f51
pop esi
ret

Function at 0x422fb0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 8]
cmp esi, ecx
je 0x423017
movzx edx, word [ecx - 0x18]
sub ecx, 0x1c
sub eax, 0x1c
cmp ecx, esi
mov word [eax + 4], dx
movzx edx, word [ecx + 6]
mov word [eax + 6], dx
movzx edx, word [ecx + 8]
mov word [eax + 8], dx
movzx edx, word [ecx + 0xa]
mov word [eax + 0xa], dx
movzx edx, word [ecx + 0xc]
mov word [eax + 0xc], dx
movzx edx, word [ecx + 0xe]
mov word [eax + 0xe], dx
movzx edx, word [ecx + 0x10]
mov word [eax + 0x10], dx
movzx edx, word [ecx + 0x12]
mov word [eax + 0x12], dx
mov dl, byte [ecx + 0x14]
mov byte [eax + 0x14], dl
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x18], edx
jne 0x422fc1
pop esi
ret
Function at 0x4230d0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
cmp eax, esi
je 0x423134
mov ecx, dword [esp + 0x10]
movzx edx, word [ecx + 4]
mov word [eax + 4], dx
movzx edx, word [ecx + 6]
mov word [eax + 6], dx
movzx edx, word [ecx + 8]
mov word [eax + 8], dx
movzx edx, word [ecx + 0xa]
mov word [eax + 0xa], dx
movzx edx, word [ecx + 0xc]
mov word [eax + 0xc], dx
movzx edx, word [ecx + 0xe]
mov word [eax + 0xe], dx
movzx edx, word [ecx + 0x10]
mov word [eax + 0x10], dx
movzx edx, word [ecx + 0x12]
mov word [eax + 0x12], dx
mov dl, byte [ecx + 0x14]
mov byte [eax + 0x14], dl
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x18], edx
add eax, 0x1c
cmp eax, esi
jne 0x4230e1
pop esi
ret

Function at 0x4231b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
cmp ecx, esi
je 0x423221
test eax, eax
je 0x423217
mov dword [eax], vtable.FrameData.0
movzx edx, word [ecx + 4]
mov word [eax + 4], dx
movzx edx, word [ecx + 6]
mov word [eax + 6], dx
movzx edx, word [ecx + 8]
mov word [eax + 8], dx
movzx edx, word [ecx + 0xa]
mov word [eax + 0xa], dx
movzx edx, word [ecx + 0xc]
mov word [eax + 0xc], dx
movzx edx, word [ecx + 0xe]
mov word [eax + 0xe], dx
movzx edx, word [ecx + 0x10]
mov word [eax + 0x10], dx
movzx edx, word [ecx + 0x12]
mov word [eax + 0x12], dx
mov dl, byte [ecx + 0x14]
mov byte [eax + 0x14], dl
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x18], edx
add ecx, 0x1c
add eax, 0x1c
cmp ecx, esi
jne 0x4231c1
pop esi
ret

Function at 0x423270
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jbe 0x4232e1
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test eax, eax
je 0x4232d7
mov dword [eax], vtable.FrameData.0
movzx edx, word [ecx + 4]
mov word [eax + 4], dx
movzx edx, word [ecx + 6]
mov word [eax + 6], dx
movzx edx, word [ecx + 8]
mov word [eax + 8], dx
movzx edx, word [ecx + 0xa]
mov word [eax + 0xa], dx
movzx edx, word [ecx + 0xc]
mov word [eax + 0xc], dx
movzx edx, word [ecx + 0xe]
mov word [eax + 0xe], dx
movzx edx, word [ecx + 0x10]
mov word [eax + 0x10], dx
movzx edx, word [ecx + 0x12]
mov word [eax + 0x12], dx
mov dl, byte [ecx + 0x14]
mov byte [eax + 0x14], dl
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x18], edx
sub esi, 1
add eax, 0x1c
test esi, esi
ja 0x423281
pop esi
ret
Function at 0x423b20
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x84cfc8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x4c]
movzx ecx, word [eax + 4]
movzx edx, word [eax + 6]
mov ebp, dword [eax + 0x18]
mov word [esp + 0x20], cx
movzx ecx, word [eax + 8]
mov word [esp + 0x22], dx
movzx edx, word [eax + 0xa]
mov word [esp + 0x24], cx
movzx ecx, word [eax + 0xc]
mov word [esp + 0x26], dx
movzx edx, word [eax + 0xe]
mov word [esp + 0x28], cx
movzx ecx, word [eax + 0x10]
mov word [esp + 0x2a], dx
movzx edx, word [eax + 0x12]
mov word [esp + 0x2c], cx
mov cl, byte [eax + 0x14]
mov dword [esp + 0x1c], vtable.FrameData.0
mov word [esp + 0x2e], dx
mov byte [esp + 0x30], cl
mov dword [esp + 0x34], ebp
mov edi, dword [esi + 8]
cmp dword [esi + 4], edi
mov dword [esp + 0x40], 0
jbe 0x423bc0
call fcn.0081ff70
mov ebx, dword [esi + 4]
cmp ebx, dword [esi + 8]
jbe 0x423bcd
call fcn.0081ff70
push edi
push esi
push ebx
push esi
lea edx, [esp + 0x24]
push edx
mov ecx, esi
call fcn.004234c0
mov edi, dword [esi + 4]
cmp edi, dword [esi + 8]
jbe 0x423bea
call fcn.0081ff70
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x1c]
push eax
push ecx
push edi
push esi
mov ecx, esi
call fcn.004235d0
test ebp, ebp
je 0x423c0a
push ebp
call fcn.0081f6fa
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 8
Function at 0x42b2d0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x84db7b
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x8943b8]
xor eax, esp
mov dword [esp + 0x244], eax
push ebp
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov edi, dword [esp + 0x268]
mov esi, ecx
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0x50]
push ecx
push edi
mov ecx, 0x8a0088
call fcn.0040d350
lea edx, [esp + 0x4c]
push 0x2f
push edx
call fcn.008204c9
add esp, 8
test eax, eax
je 0x42b356
mov edi, edi
mov byte [eax], 0x5c
lea eax, [esp + 0x4c]
push 0x2f
push eax
call fcn.008204c9
add esp, 8
test eax, eax
jne 0x42b340
lea ecx, [esp + 0x4c]
push 0x2e
push ecx
call fcn.008204c9
add esp, 8
test eax, eax
je 0x42b388
cmp byte [eax + 1], 0x2e
jne 0x42b379
cmp byte [eax + 2], 0x5c
je 0x42b4e6
lea edx, [esp + 0x4c]
push 0x2e
push edx
call fcn.008204c9
add esp, 8
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.imagehlp.dll_MakeSureDirectoryPathExists]
test eax, eax
je 0x42b4e6
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edi
mov dword [esp + 0x2c], vtable.CFileWriter.0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x42b3cd
mov dword [esp + 0x14], 0
mov dword [esp + 0x260], 0
call fcn.0043dc20
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x28]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x20]
push edx
push eax
call edi
lea ecx, [esp + 0x20]
push ecx
call fcn.008207a1
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.008204dc
mov dl, byte [esp + 0x44]
mov al, byte [esi + 0x140]
mov cl, byte [esp + 0x40]
add esp, 0xc
add dl, 1
add al, 1
cmp dword [esi + 4], 0
mov byte [esi + 0xeb], cl
setne cl
add cl, cl
cmp dword [esi], 0
mov byte [esi + 0xea], dl
push 0
setne dl
mov byte [esi + 0xef], al
add cl, dl
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
mov byte [esi + 0xf0], cl
push 0xa
lea ecx, [esi + 0xe8]
push ecx
push edx
call edi
xor edi, edi
cmp byte [esi + 0xef], 0
jle 0x42b4cf
xor ebp, ebp
jmp 0x42b480
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x42b4a7
mov ecx, dword [esi + 0xfc]
sub ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x42b4ac
call fcn.0081ff70
mov ecx, dword [esi + 0xf8]
lea eax, [esp + 0x10]
push eax
add ecx, ebp
call fcn.0042b0c0
movsx ecx, byte [esi + 0xef]
add edi, 1
add ebp, 0x50
cmp edi, ecx
jl 0x42b480
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x10], vtable.CFileWriter.0
je 0x42b4e6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.0081fb35
add esp, 0x254
ret 4
Function at 0x42bf60
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x84dbb8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x8943b8]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x4c]
xor ebx, ebx
push ebx
push 0x871030
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00402200
mov eax, esi
mov dword [esp + 0x44], ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x42bfc0
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.00408620
cmp dword [esp + 0x34], 0x10
mov eax, dword [esp + 0x20]
jae 0x42bfe5
lea eax, [esp + 0x20]
push ebx
push 0x80
push 3
push ebx
push 1
push 1
push eax
mov dword [esp + 0x28], vtable.CFileReader.0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x42c010
mov dword [esp + 0x10], ebx
jmp 0x42c014
cmp eax, ebx
jne 0x42c035
cmp dword [esp + 0x34], 0x10
mov dword [esp + 0xc], vtable.CFileReader.0
jb 0x42c030
mov eax, dword [esp + 0x20]
push eax
call fcn.0081f6fa
add esp, 4
or eax, 0xffffffff
jmp 0x42c07a
push ebx
lea ecx, [esp + 0x18]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov esi, dword [esp + 0x18]
mov dword [esp + 0xc], vtable.CFileReader.0
je 0x42c064
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x34], 0x10
jb 0x42c078
mov eax, dword [esp + 0x20]
push eax
call fcn.0081f6fa
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0081fb35
add esp, 0x3c
ret 4
Function at 0x434c30
Capabilities:
Enumerate files on windows

Disassembly:
push esi
mov esi, ecx
call fcn.0043d320
cmp dword [esi + 0x14], 0
jne 0x434c4b
call fcn.0043f610
mov ecx, esi
pop esi
jmp fcn.0043d320
pop esi
ret
Function at 0x4356f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x84e2d3
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x8943b8]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xb0]
xor ebx, ebx
cmp ebp, ebx
jne 0x43573f
xor eax, eax
jmp 0x435895
mov eax, dword [esp + 0xb4]
push eax
call fcn.0043f3f0
mov esi, eax
mov ecx, esi
add esp, 4
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
lea edx, [ecx + 1]
mov al, byte [ecx]
add ecx, 1
cmp al, bl
jne 0x435766
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x50]
call fcn.00402200
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x68]
push str.data_csv_
push edx
mov dword [esp + 0xb4], ebx
call fcn.0042bea0
push str._deck.csv
push eax
lea eax, [esp + 0x94]
push eax
mov byte [esp + 0xc0], 1
call fcn.004088b0
add esp, 0x18
mov edi, 0x10
cmp dword [esp + 0x7c], edi
jb 0x4357cd
mov ecx, dword [esp + 0x68]
push ecx
call fcn.0081f6fa
add esp, 4
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
cmp dword [esp + 0x60], edi
jb 0x4357f0
mov edx, dword [esp + 0x4c]
push edx
call fcn.0081f6fa
add esp, 4
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
cmp dword [esp + 0x98], edi
mov eax, dword [esp + 0x84]
mov byte [esp + 0xa8], 5
jae 0x435837
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040f370
mov ecx, ebp
call fcn.00433a50
mov esi, 0x14
lea ecx, [ecx]
lea ecx, [esp + 0x18]
call fcn.0040f6a0
movzx eax, ax
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebp
mov dword [esp + 0x18], eax
call fcn.0042cf90
sub esi, 1
jne 0x435850
lea ecx, [esp + 0x18]
call fcn.0040ffd0
cmp dword [esp + 0x98], edi
jb 0x435893
mov edx, dword [esp + 0x84]
push edx
call fcn.0081f6fa
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.0081fb35
add esp, 0x98
ret 8
Function at 0x43a3a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_WeatherEffectObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x43a430
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_EffectObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x43c0d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x84e8ac
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
lea edi, [esi + 0x3c]
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.00439910
mov dword [edi + 4], eax
mov byte [eax + 0x21], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
lea ecx, [esi + 0x48]
mov byte [esp + 0x1c], 3
call fcn.0043a9b0
mov dword [0x8985ec], esi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x43fce0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0
push 0x898900
mov ecx, 0x899840
call fcn.004020d0
push 0xffffffffffffffff
push 0
push 0x8990ec
mov ecx, 0x89985c
call fcn.004020d0
mov ecx, 0x899840
jmp 0x4295d0
Function at 0x45a410
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x8508c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00459f10
lea eax, [edi + 0x14]
push eax
lea ecx, [esi + 0x14]
mov dword [esp + 0x1c], 0
call fcn.0045a010
fld dword [edi + 0x28]
fstp dword [esi + 0x28]
fld dword [edi + 0x2c]
fstp dword [esi + 0x2c]
fld dword [edi + 0x30]
fstp dword [esi + 0x30]
fld dword [edi + 0x34]
fstp dword [esi + 0x34]
fld dword [edi + 0x38]
fstp dword [esi + 0x38]
fld dword [edi + 0x3c]
fstp dword [esi + 0x3c]
fld dword [edi + 0x40]
fstp dword [esi + 0x40]
fld dword [edi + 0x44]
fstp dword [esi + 0x44]
fld dword [edi + 0x48]
fstp dword [esi + 0x48]
fld dword [edi + 0x4c]
fstp dword [esi + 0x4c]
fld dword [edi + 0x50]
fstp dword [esi + 0x50]
movzx ecx, byte [edi + 0x54]
mov byte [esi + 0x54], cl
movzx edx, byte [edi + 0x55]
mov byte [esi + 0x55], dl
movzx eax, byte [edi + 0x56]
mov byte [esi + 0x56], al
movzx ecx, byte [edi + 0x57]
mov byte [esi + 0x57], cl
movzx edx, byte [edi + 0x58]
mov byte [esi + 0x58], dl
movzx eax, byte [edi + 0x59]
mov byte [esi + 0x59], al
movzx ecx, byte [edi + 0x5a]
mov byte [esi + 0x5a], cl
movzx edx, byte [edi + 0x5b]
mov byte [esi + 0x5b], dl
fld dword [edi + 0x5c]
fstp dword [esi + 0x5c]
fld dword [edi + 0x60]
fstp dword [esi + 0x60]
fld dword [edi + 0x64]
fstp dword [esi + 0x64]
mov eax, dword [edi + 0x68]
mov dword [esi + 0x68], eax
mov ecx, dword [edi + 0x6c]
mov dword [esi + 0x6c], ecx
mov edx, dword [edi + 0x70]
mov dword [esi + 0x70], edx
mov eax, dword [edi + 0x74]
mov dword [esi + 0x74], eax
mov ecx, dword [edi + 0x78]
mov dword [esi + 0x78], ecx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x45e870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_SystemEffectObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x466a50
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x85116e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00422e40
mov dword [esi], vtable.CharacterFrameData.0
movzx eax, word [edi + 0x1c]
mov word [esi + 0x1c], ax
movzx ecx, word [edi + 0x1e]
mov word [esi + 0x1e], cx
movzx edx, word [edi + 0x20]
mov word [esi + 0x20], dx
movzx eax, word [edi + 0x22]
mov word [esi + 0x22], ax
movzx ecx, word [edi + 0x24]
mov word [esi + 0x24], cx
movzx edx, word [edi + 0x26]
mov word [esi + 0x26], dx
movzx eax, word [edi + 0x28]
mov word [esi + 0x28], ax
movzx ecx, word [edi + 0x2a]
mov word [esi + 0x2a], cx
movzx edx, word [edi + 0x2c]
mov word [esi + 0x2c], dx
movzx eax, word [edi + 0x2e]
mov word [esi + 0x2e], ax
movzx ecx, word [edi + 0x30]
mov word [esi + 0x30], cx
movzx edx, word [edi + 0x32]
mov word [esi + 0x32], dx
movzx eax, word [edi + 0x34]
mov word [esi + 0x34], ax
movzx ecx, word [edi + 0x36]
mov word [esi + 0x36], cx
movzx edx, word [edi + 0x38]
mov word [esi + 0x38], dx
mov dword [esp + 0x18], 0
fld dword [edi + 0x3c]
fstp dword [esi + 0x3c]
fld dword [edi + 0x40]
fstp dword [esi + 0x40]
movzx eax, word [edi + 0x44]
mov word [esi + 0x44], ax
movzx ecx, word [edi + 0x46]
mov word [esi + 0x46], cx
mov dl, byte [edi + 0x48]
mov byte [esi + 0x48], dl
mov al, byte [edi + 0x49]
mov byte [esi + 0x49], al
mov ecx, dword [edi + 0x4c]
mov dword [esi + 0x4c], ecx
mov edx, dword [edi + 0x50]
lea ecx, [edi + 0x58]
mov dword [esi + 0x50], edx
mov eax, dword [edi + 0x54]
push ecx
lea ecx, [esi + 0x58]
mov dword [esi + 0x54], eax
call fcn.00465b50
lea edx, [edi + 0x68]
push edx
lea ecx, [esi + 0x68]
mov byte [esp + 0x1c], 1
call fcn.00465b50
lea eax, [edi + 0x78]
push eax
lea ecx, [esi + 0x78]
mov byte [esp + 0x1c], 2
call fcn.00465c40
mov ecx, dword [edi + 0x88]
mov dword [esi + 0x88], ecx
mov edx, dword [edi + 0x8c]
mov dword [esi + 0x8c], edx
mov eax, dword [edi + 0x90]
mov dword [esi + 0x90], eax
mov ecx, dword [edi + 0x94]
mov dword [esi + 0x94], ecx
mov edx, dword [edi + 0x98]
mov dword [esi + 0x98], edx
mov eax, dword [edi + 0x9c]
mov dword [esi + 0x9c], eax
mov ecx, dword [edi + 0xa0]
lea eax, [edi + 0xa0]
mov dword [esi + 0xa0], ecx
movzx edx, word [eax + 4]
mov word [esi + 0xa4], dx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4