joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61e200
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov esi, dword [ebx + 0x47c]
push edi
xor edi, edi
xor ebp, ebp
test eax, eax
mov dword [esp + 0x10], esi
je 0x61e233
mov cl, byte [eax + 0x36]
and cl, 7
cmp cl, 3
jne 0x61e233
mov edi, eax
mov ebp, 0xf
mov ecx, esi
call fcn.00600f70
test eax, eax
je 0x61e248
cmp byte [eax + 0x10], 5
je 0x61e3d4
cmp ebp, 0x10
jge 0x61e3d4
test edi, edi
jne 0x61e266
mov eax, dword [esi + ebp*4 + 0x130]
test eax, eax
je 0x61e3c8
mov edi, eax
push 0
push 5
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
call fcn.005e4280
mov ecx, edi
call fcn.005e0170
test al, al
je 0x61e3c8
mov ecx, dword [ebx + 0x14]
test ecx, ecx
lea eax, [ecx + 0x30]
jne 0x61e292
lea eax, [ebx + 4]
fld dword [esp + 0x1c]
fcomp dword [eax + 8]
fnstsw ax
test ah, 0x41
jne 0x61e3c8
test ecx, ecx
lea eax, [ecx + 0x30]
jne 0x61e2ae
lea eax, [ebx + 4]
fld dword [eax + 8]
fadd dword [0x858ce8]
fcomp dword [esp + 0x1c]
fnstsw ax
test ah, 0x41
jne 0x61e3c8
test dword [edi + 0x474], 0x100000
je 0x61e2f2
mov eax, dword [ebx + 0x47c]
lea ecx, [eax + 4]
call fcn.006819d0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
cmp eax, 0xcd
jne 0x61e3c8
mov ecx, dword [ebx + 0x14]
test ecx, ecx
lea edx, [ecx + 0x30]
jne 0x61e2ff
lea edx, [ebx + 4]
mov esi, dword [edi + 0x14]
test esi, esi
lea eax, [esi + 0x30]
jne 0x61e30c
lea eax, [edi + 4]
fld dword [eax]
fsub dword [edx]
fld dword [eax + 4]
fsub dword [edx + 4]
fld dword [eax + 8]
fsub dword [edx + 8]
fmul dword [ecx + 0x18]
fxch st(1)
fmul dword [ecx + 0x14]
faddp st(1)
fxch st(1)
fmul dword [ecx + 0x10]
faddp st(1)
fst dword [esp + 0x24]
fcomp dword [0x858b50]
fnstsw ax
test ah, 0x41
jne 0x61e3c4
test ecx, ecx
lea edx, [ecx + 0x30]
jne 0x61e34c
lea edx, [ebx + 4]
test esi, esi
lea eax, [esi + 0x30]
jne 0x61e356
lea eax, [edi + 4]
fld dword [eax]
fsub dword [edx]
fld dword [eax + 4]
fsub dword [edx + 4]
fld st(0)
fmul st(1)
fld st(2)
fmul st(3)
faddp st(1)
fsqrt
fstp st(2)
fstp st(0)
fcomp dword [0x8d2e68]
fnstsw ax
test ah, 5
jp 0x61e3c4
test ecx, ecx
lea edx, [ecx + 0x30]
jne 0x61e387
lea edx, [ebx + 4]
test esi, esi
lea eax, [esi + 0x30]
jne 0x61e391
lea eax, [edi + 4]
fld dword [eax]
fsub dword [edx]
fld dword [eax + 4]
fsub dword [edx + 4]
fld dword [eax + 8]
fsub dword [edx + 8]
fmul dword [ecx + 8]
fxch st(1)
fmul dword [ecx + 4]
faddp st(1)
fxch st(1)
fmul dword [ecx]
faddp st(1)
fabs
fdiv dword [esp + 0x24]
fcomp dword [0x8d2e6c]
fnstsw ax
test ah, 5
jnp 0x61e3de
mov esi, dword [esp + 0x10]
xor edi, edi
inc ebp
cmp ebp, 0x10
jl 0x61e251
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
Function at 0x61f3f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x83f418
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0061a390
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
cmp ecx, ebx
mov dword [esi], 0x86d76c
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
lea eax, [esi + 0xc]
mov dword [esp + 0x14], ebx
mov byte [esi + 8], bl
mov dword [eax], ecx
je 0x61f447
push eax
call fcn.00571b70
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x61f460
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x14], edx
mov eax, dword [eax + 8]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x61f479
mov ecx, dword [eax]
mov dword [esi + 0x1c], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x20], edx
mov eax, dword [eax + 8]
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x30]
mov cl, byte [esp + 0x28]
mov dx, word [esp + 0x2c]
mov dword [esi + 0x28], eax
mov byte [esi + 0x2e], cl
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x34], ebx
mov byte [esi + 0x39], bl
mov word [esi + 0x2c], dx
mov dword [esi + 0x30], 0x3f800000
mov byte [esi + 0x38], 1
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18

Function at 0x620e30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x83f648
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0061a3b0
mov al, byte [esi + 0xc]
mov ecx, dword [esp + 0x18]
and al, 0x8f
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x20]
or al, 4
mov byte [esi + 0xc], al
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0x24]
lea eax, [esi + 0x10]
mov dword [esi + 0x18], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x1c], ecx
mov cl, byte [esp + 0x2c]
mov byte [esi + 0x20], cl
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov dword [esi + 0x28], ecx
mov dword [esi], 0x86d894
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], edx
mov byte [esi + 0x34], dl
mov byte [esi + 0x35], dl
mov ecx, dword [eax]
cmp ecx, edx
mov dword [esp + 0x10], edx
je 0x620ead
push eax
call fcn.00571b70
mov al, byte [esi + 0xc]
mov edx, dword [0xb7cb84]
mov ecx, dword [esp + 8]
and al, 0xf7
mov byte [esi + 0xc], al
mov dword [esi + 0x24], edx
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x621000
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x83f688
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0061a3b0
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 0xc], ecx
lea edx, [esi + 0xc]
or ecx, 0xffffffff
mov dword [esi], 0x86d8ec
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x34], ecx
mov ecx, dword [edx]
cmp ecx, eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
je 0x621068
push edx
call fcn.00571b70
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x621190
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x83f6c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0061a3b0
mov ecx, dword [esp + 0x18]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x20]
xor eax, eax
lea edx, [esi + 0xc]
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x24], ecx
mov cl, byte [esp + 0x28]
mov byte [esi + 0x30], cl
mov dword [esi], 0x86d918
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x32], al
mov byte [esi + 0x33], al
mov byte [esi + 0x34], al
mov byte [esi + 0x35], al
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov ecx, 0xc61c3c00
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], ecx
mov ecx, dword [edx]
cmp ecx, eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
je 0x62122b
push edx
call fcn.00571b70
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x6217d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x83f708
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0061a390
mov al, byte [esp + 0x30]
mov cl, byte [esp + 0x2c]
mov dl, byte [esp + 0x28]
xor ebx, ebx
mov byte [esi + 0xa], al
mov eax, dword [esp + 0x24]
mov byte [esi + 0x12], cl
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x20], eax
mov dword [esi + 0x34], ecx
lea eax, [esi + 0x34]
or ecx, 0xffffffff
mov byte [esi + 0x13], dl
mov dword [esi], 0x86d944
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xb], bl
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], bl
mov byte [esi + 0xe], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov byte [esi + 0x11], cl
mov byte [esi + 0x14], cl
mov word [esi + 0x16], cx
mov ecx, dword [eax]
cmp ecx, ebx
mov dl, 1
mov dword [esp + 0x14], ebx
mov byte [esi + 0x10], bl
mov byte [esi + 0xf], dl
mov dword [esi + 0x18], ebx
mov byte [esi + 0x1c], dl
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x24], 0xbf
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
je 0x621877
push eax
call fcn.00571b70
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x621890
mov edx, dword [eax]
mov dword [esi + 0x38], edx
mov ecx, dword [eax + 4]
mov dword [esi + 0x3c], ecx
mov edx, dword [eax + 8]
mov dword [esi + 0x40], edx
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18

Function at 0x621d10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x83f788
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0061a3b0
mov ecx, dword [esp + 0x18]
xor eax, eax
lea edx, [esi + 0x10]
mov dword [edx], ecx
mov dword [esi], 0x86d994
mov byte [esi + 0xc], al
mov byte [esi + 0xd], al
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov ecx, dword [edx]
cmp ecx, eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0xffffffff
je 0x621d72
push edx
call fcn.00571b70
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x633e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x8407d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0061a390
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x50]
mov ebx, dword [esp + 0x3c]
xor edx, edx
mov dword [esi + 0x2c], edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
lea edi, [esi + 0x30]
mov dword [edi], ebx
mov ebx, dword [esp + 0x40]
lea eax, [esi + 0x1c]
mov ecx, edx
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x14], 0x3d4ccccd
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov dword [edi + 8], ebx
mov bl, byte [esp + 0x48]
mov edi, dword [esp + 0x4c]
mov ecx, edx
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x30]
cmp ecx, edx
mov byte [esi + 0x58], bl
mov bl, byte [esp + 0x54]
lea eax, [esi + 0x28]
mov dword [esp + 0x24], edx
mov dword [esi], 0x86e37c
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], edx
mov dword [esi + 0x10], edx
mov word [esi + 0x18], 5
mov dword [eax], ecx
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], edx
mov byte [esi + 0x59], bl
mov dword [esi + 0x54], edx
je 0x633ebe
push eax
call fcn.00571b70
mov byte [esi + 0x40], 1
jmp 0x633ec1
mov byte [esi + 0x40], dl
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x2c

Function at 0x634150
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x840818
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0061a390
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x4c]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
xor edx, edx
mov dword [esi + 0x58], eax
neg eax
sbb eax, eax
and eax, 0xa
add eax, 0x18
mov word [esi + 0x18], ax
mov dword [esi + 0x2c], edi
mov dword [esi + 0xc], ecx
mov dword [esp + 0x10], 0x3d4ccccd
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0x1c]
mov dword [eax], ecx
lea edi, [esi + 0x30]
mov dword [edi], ebx
mov ebx, dword [esp + 0x40]
mov ecx, edx
mov dword [eax + 4], ecx
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x44]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x34]
cmp ecx, edx
mov dword [edi + 8], ebx
mov edi, dword [esp + 0x48]
lea eax, [esi + 0x28]
mov dword [esp + 0x24], edx
mov dword [esi], 0x86e3a4
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov dword [esi + 0x10], edx
mov dword [eax], ecx
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], edx
mov dword [esi + 8], 0xf423f
mov dword [esi + 0x54], edx
je 0x63420d
push eax
call fcn.00571b70
mov byte [esi + 0x40], 1
jmp 0x634210
mov byte [esi + 0x40], dl
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x24
Function at 0x634440
Capabilities:
Access peb ldr_data

Disassembly:
push eax
pushfd
clc
mov eax, dword [0x1560764]
adc eax, dword [0x15625cd]
popfd
xchg dword [esp], eax
jmp 0x634447
push 0xffffffffffffffff
jmp 0x40384f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0061a390
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0xc], edi
mov edi, dword [esp + 0x28]
mov dword [esi + 0x10], edi
lea edi, [esi + 0x14]
mov dword [edi], ebx
mov ebx, dword [esp + 0x30]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x34]
mov dword [edi + 8], ebx
mov bl, byte [esp + 0x38]
mov edi, dword [esp + 0x3c]
xor edx, edx
cmp ecx, edx
mov byte [esi + 0x20], bl
mov bl, byte [esp + 0x44]
mov dword [esi + 0x24], edi
mov edi, dword [esp + 0x40]
lea eax, [esi + 8]
mov dword [esp + 0x18], edx
mov dword [esi], 0x86e3cc
mov dword [eax], ecx
mov dword [esi + 0x28], edi
mov byte [esi + 0x2d], bl
je 0x6344ca
push eax
call fcn.00571b70
mov byte [esi + 0x2c], 1
jmp 0x6344cd
mov byte [esi + 0x2c], dl
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x63a220
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x841368
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0061a3b0
mov cl, byte [esp + 0x30]
mov dl, byte [esp + 0x2c]
mov ebp, dword [esp + 0x20]
and cl, 1
and dl, 1
shl cl, 1
or cl, dl
mov dl, byte [esp + 0x28]
and dl, 1
shl cl, 1
or cl, dl
mov dl, byte [esi + 0x10]
xor eax, eax
and dl, 0xf0
shl cl, 1
or cl, dl
mov dl, byte [esp + 0x24]
and dl, 1
or cl, dl
cmp ebp, eax
lea edi, [esi + 0xc]
mov dword [esp + 0x18], eax
mov dword [esi], 0x86e6f0
mov dword [edi], ebp
mov byte [esi + 0x10], cl
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 6
mov byte [esi + 0x28], al
mov byte [esi + 0x29], al
mov dword [esi + 0x38], eax
mov byte [esi + 0x3c], al
mov dword [esi + 0x40], eax
mov byte [esi + 0x44], al
mov dword [esi + 0x48], 0xbf800000
je 0x63a2c4
push edi
mov ecx, ebp
call fcn.00571b70
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x63b8c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x841618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0061a3b0
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x24]
xor eax, eax
cmp edi, eax
mov dword [esi + 0x14], ecx
mov cl, byte [esp + 0x28]
mov byte [esi + 0x18], cl
mov cl, byte [esp + 0x2c]
lea edx, [esi + 0xc]
mov dword [esp + 0x14], eax
mov dword [esi], 0x86e828
mov dword [edx], edi
mov byte [esi + 0x19], cl
mov byte [esi + 0x1a], al
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
mov dword [esi + 0x24], 0xf
mov dword [esi + 0x28], 0x40800000
mov dword [esi + 0x2c], 0x3f800000
mov byte [esi + 0x30], al
je 0x63b944
push edx
mov ecx, edi
call fcn.00571b70
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14

Function at 0x63bf90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
pushfd
mov ebp, dword [0x156078c]
sub ebp, dword [fcn.00628a71]
popfd
xchg dword [esp], ebp
jmp 0x63bf97
push 0xffffffffffffffff
jmp 0x403a25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0061a3b0
mov ecx, dword [esp + 0x20]
test ecx, ecx
mov edx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov dword [esi + 0x10], edx
mov dword [esi], 0x86e8ac
lea eax, [esi + 0xc]
mov dword [eax], ecx
mov ebx, dword [edi]
lea edx, [esi + 0x14]
mov dword [edx], ebx
mov ebx, dword [edi + 4]
mov dword [edx + 4], ebx
mov edi, dword [edi + 8]
mov dword [edx + 8], edi
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x20], edx
mov dl, byte [esp + 0x30]
mov dword [esp + 0x18], 0
mov byte [esi + 0x24], dl
je 0x63c001
push eax
call fcn.00571b70
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14

Function at 0x6433f6
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x8421d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0061a3b0
mov eax, dword [esp + 0x1c]
push 0x64
mov dword [esp + 0x18], 0
mov dword [esi], 0x86ebf8
mov dword [esi + 0xc], eax
call fcn.0041b7c0
mov edi, eax
add esp, 4
test edi, edi
je 0x643436
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, edi
call fcn.0063a040
jmp 0x643438
xor edi, edi
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 0x14], edx
mov edx, dword [esp + 0x30]
mov dword [esi + 0x10], edi
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], edx
mov dword [esi + 0x28], 0
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x645780
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x842398
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0061a3b0
mov ecx, dword [esp + 0x18]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x10], ecx
mov cl, byte [esp + 0x20]
mov byte [esi + 0x14], cl
mov ecx, dword [esp + 0x28]
lea edx, [esi + 0xc]
mov dword [esi + 0x18], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x30]
xor eax, eax
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi], 0x86ec4c
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ecx
mov ecx, dword [edx]
cmp ecx, eax
mov dword [esp + 0x10], eax
mov byte [esi + 0x48], al
mov byte [esi + 0x49], al
mov dword [esi + 0x4c], eax
je 0x645816
push edx
call fcn.00571b70
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20

Function at 0x645b40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x8423b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0061a390
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
xor edx, edx
cmp ecx, edx
mov dword [esi], 0x86ec78
mov byte [esi + 8], dl
mov dword [esi + 0xc], edx
lea eax, [esi + 0x10]
mov dword [eax], ecx
mov ebp, dword [ebx]
lea edi, [esi + 0x14]
mov dword [edi], ebp
mov ebp, dword [ebx + 4]
mov dword [edi + 4], ebp
mov ebx, dword [ebx + 8]
mov dword [edi + 8], ebx
mov edi, dword [esp + 0x2c]
mov dword [esi + 0x20], edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0x1c], edx
mov dword [esi + 0x24], edi
je 0x645baf
push eax
call fcn.00571b70
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x650a80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x843268
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push esi
mov esi, dword [esp + 0x84]
mov eax, dword [esi + 0x14]
push edi
mov edi, ecx
push eax
lea ecx, [esp + 0x30]
call fcn.0059bcf0
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x8c]
push eax
push ecx
push esi
lea edx, [esp + 0x20]
push edx
mov ecx, edi
mov dword [esp + 0x8c], 0
call fcn.0064fc10
mov ecx, dword [eax]
mov dword [esp + 8], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0xc], edx
mov eax, dword [eax + 8]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x30]
mov dword [esp + 0x14], eax
push edx
lea eax, [esp + 0x28]
push eax
call fcn.0059c790
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x18], edx
mov eax, dword [eax + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x14]
add esp, 0xc
test eax, eax
je 0x650b23
add eax, 0x30
jmp 0x650b26
lea eax, [esi + 4]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov esi, dword [esp + 0x84]
mov dword [esp + 0x14], ecx
fld dword [esp + 0x14]
fadd dword [esp + 8]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov ecx, esi
fstp dword [esp + 8]
mov edx, dword [esp + 8]
fld dword [esp + 0x18]
mov dword [ecx], edx
fadd dword [esp + 0xc]
mov dword [esp + 0x7c], 0xffffffff
fstp dword [esp + 0xc]
mov eax, dword [esp + 0xc]
fld dword [esp + 0x1c]
mov dword [ecx + 4], eax
fadd dword [esp + 0x10]
fstp dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov dword [ecx + 8], edx
lea ecx, [esp + 0x2c]
call fcn.0059acd0
mov ecx, dword [esp + 0x74]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x78
ret 0x10
Function at 0x654740
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x8435f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0061a3b0
mov ecx, dword [esp + 0x24]
mov dword [esi], 0x86f334
mov edx, dword [ecx]
lea eax, [esi + 0x14]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov ecx, dword [ecx + 8]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
lea edx, [esi + 0x20]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov eax, dword [eax + 8]
mov dword [edx + 8], eax
mov edx, dword [esp + 0x2c]
mov edi, dword [edx]
lea ecx, [esi + 0x2c]
mov eax, ecx
mov dword [eax], edi
mov edi, dword [edx + 4]
mov dword [eax + 4], edi
mov edx, dword [edx + 8]
mov dword [eax + 8], edx
mov al, byte [esp + 0x20]
mov dl, byte [esi + 0x49]
mov byte [esi + 0x48], al
mov al, byte [esp + 0x30]
xor ebx, ebx
and dl, 0xc0
and al, 1
or dl, al
mov dword [esp + 0x18], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x49], dl
mov byte [esi + 0x4a], bl
mov dword [esi + 0x34], ebx
call fcn.0059c910
push 0x64
call fcn.0041b7c0
add esp, 4
cmp eax, ebx
je 0x6547ef
mov dword [eax], ebx
jmp 0x6547f1
xor eax, eax
push 0x64
mov dword [esi + 0xc], eax
call fcn.0041b7c0
add esp, 4
cmp eax, ebx
je 0x654809
mov dword [eax], ebx
mov dword [esi + 0x10], eax
jmp 0x65480c
mov dword [esi + 0x10], ebx
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14