joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488664
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x48866c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x48885e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x488874
mov eax, esi
call fcn.004863f4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040446c
lea ecx, [ebp - 0x10]
mov edx, 0x488888
mov eax, esi
call fcn.004863f4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.0040446c
lea ecx, [ebp - 0x14]
mov edx, 0x4888a0
mov eax, esi
call fcn.004863f4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.0040446c
lea ecx, [ebp - 0x18]
mov edx, 0x4888bc
mov eax, esi
call fcn.004863f4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.0040446c
lea ecx, [ebp - 0x1c]
mov edx, 0x4888d8
mov eax, esi
call fcn.004863f4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.0040446c
lea ecx, [ebp - 0x24]
mov edx, 0x4888f0
mov eax, esi
call fcn.004863f4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00409074
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409700
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x488908
mov eax, esi
call fcn.004863f4
mov eax, dword [ebp - 0x28]
call fcn.0048550c
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x488918
mov eax, esi
call fcn.004863f4
mov eax, dword [ebp - 0x2c]
call fcn.0048550c
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x488930
mov eax, esi
call fcn.004863f4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409700
inc eax
je 0x488801
lea ecx, [ebp - 0x34]
mov edx, 0x488930
mov eax, esi
call fcn.004863f4
mov eax, dword [ebp - 0x34]
call fcn.004096c4
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040b900
fstp qword [ebp - 0x3c]
wait
call fcn.0040bc64
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x48881c
lea ecx, [ebp - 0x40]
mov edx, 0x488930
mov eax, esi
call fcn.004863f4
mov eax, dword [ebp - 0x40]
call fcn.0048550c
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x488940
mov eax, esi
call fcn.004863f4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.0040446c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488865
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0040443c
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.0040443c
ret

Function at 0x4b7bcc
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4b7bf1
cmp dword [esp + 4], 5
jb 0x4b7bf1
mov al, 1
jmp 0x4b7bf3
xor eax, eax
add esp, 0x94
ret
Function at 0x4ee258
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004ee024
test al, al
je 0x4ee341
push ebp
call fcn.004ee13c
pop ecx
mov ebx, eax
test ebx, ebx
jne 0x4ee293
mov ecx, 0x1ad
mov edx, 0x4ee350
mov eax, 0x4ee390
call fcn.00404374
push 0x20
mov ecx, 0x4ee3a8
mov edx, 0x4ee3b4
mov eax, dword [0x4f5490]
mov eax, dword [eax]
call fcn.00467bac
push 0
mov eax, dword [0x4f563c]
mov eax, dword [eax]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0047ee4c
push 0
mov eax, dword [0x4f53ac]
mov eax, dword [eax]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0047ee4c
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ee548
test al, al
je 0x4ee341
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ee4b8
test al, al
je 0x4ee341
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ee710
test al, al
je 0x4ee341
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ee40c
test al, al
je 0x4ee341
push 0x40044
mov ecx, 0x4ee3a8
mov edx, 0x4ee3e8
mov eax, dword [0x4f5490]
mov eax, dword [eax]
call fcn.00467bac
cmp eax, 6
jne 0x4ee341
push 5
mov eax, dword [0x4f4da0]
mov eax, dword [eax]
call fcn.004048d8
push eax
call sub.kernel32.dll_WinExec
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4ee40c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4ee49c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push dword [esi + 8]
push 0x4ee4b4
push dword [edi + 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404798
mov eax, dword [ebp - 4]
call fcn.00409ad4
test al, al
jne 0x4ee450
mov bl, 1
jmp 0x4ee486
push 0
mov eax, dword [ebp - 4]
call fcn.004048d8
push eax
call sub.kernel32.dll_WinExec
mov dl, 0xf
mov eax, esi
mov ecx, dword [eax]
call dword [ecx]
test al, al
je 0x4ee486
mov dl, 0x10
mov eax, esi
mov ecx, dword [eax]
call dword [ecx]
test al, al
je 0x4ee486
mov dl, 0x11
mov eax, esi
mov ecx, dword [eax]
call dword [ecx]
test al, al
je 0x4ee486
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee4a3
lea eax, [ebp - 4]
call fcn.00404418
ret
Function at 0x4ee710
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4ee7b7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push dword [esi + 8]
push 0x4ee7d0
push dword [edi + 0x14]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404798
mov eax, dword [ebp - 4]
call fcn.00409ad4
test al, al
jne 0x4ee756
mov bl, 1
jmp 0x4ee79c
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x4ee7dc
call fcn.00404724
mov eax, dword [ebp - 8]
call fcn.004048d8
push eax
call sub.kernel32.dll_WinExec
mov dl, 0xc
mov eax, esi
mov ecx, dword [eax]
call dword [ecx]
test al, al
je 0x4ee79c
mov dl, 0xd
mov eax, esi
mov ecx, dword [eax]
call dword [ecx]
test al, al
je 0x4ee79c
mov dl, 0xe
mov eax, esi
mov ecx, dword [eax]
call dword [ecx]
test al, al
je 0x4ee79c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee7be
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040443c
ret
Function at 0x40ee50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
je 0x40eefd
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xe8], 0
je 0x40ee94
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0xe8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
call fcn.00467760
add esp, 4
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0xe8], 0
mov edx, dword [ebp + 8]
push edx
call dword [0x497128]
add eax, 1
push eax
call fcn.00468207
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov dword [eax + 0xe8], ecx
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0xe8], 0
jne 0x40eee9
push 0x30
mov ecx, 0x4bd504
mov eax, dword [0x4bd504]
call dword [eax + 0xc]
push eax
push 0x49737c
push 0
call dword [0x497194]
push 0
call fcn.004681c7
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0xe8]
push eax
call dword [0x49712c]
cmp dword [ebp + 0xc], 0
je 0x40efa2
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x1dc], 0
je 0x40ef38
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x1dc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00467760
add esp, 4
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x1dc], 0
mov eax, dword [ebp + 0xc]
push eax
call dword [0x497128]
add eax, 1
push eax
call fcn.00468207
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x1dc], edx
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x1dc], 0
jne 0x40ef8e
push 0x30
mov ecx, 0x4bd504
mov edx, dword [0x4bd504]
call dword [edx + 0xc]
push eax
push 0x49737c
push 0
call dword [0x497194]
push 0
call fcn.004681c7
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x1dc]
push edx
call dword [0x49712c]
cmp dword [ebp + 0x10], 0
je 0x40f046
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x2d0], 0
je 0x40efdd
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x2d0]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.00467760
add esp, 4
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x2d0], 0
mov edx, dword [ebp + 0x10]
push edx
call dword [0x497128]
add eax, 1
push eax
call fcn.00468207
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x2d0], ecx
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x2d0], 0
jne 0x40f032
push 0x30
mov ecx, 0x4bd504
mov eax, dword [0x4bd504]
call dword [eax + 0xc]
push eax
push 0x49737c
push 0
call dword [0x497194]
push 0
call fcn.004681c7
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x2d0]
push eax
call dword [0x49712c]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x412300
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x3d0]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x3d4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x3d0], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x10]
call dword [eax + 0xc]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x10
push ecx
call dword [0x49712c]
mov edx, dword [ebp + 8]
mov dword [edx + 0xc8], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x3ec]
mov dword [eax + 0xc4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x3f8]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x3fc]
mov dword [eax + 0xc], edx
push 0x3c
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x88
push ecx
call fcn.00467bc0
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3e8]
mov dword [edx + 0x88], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3e8]
sar eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x8c], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov cl, byte [eax + 0x3f0]
mov byte [edx + 0x9c], cl
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xa54]
shl eax, 4
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xa54]
shl edx, 4
mov ecx, dword [ebp - 8]
lea ecx, [ecx + edx + 0x410]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax + 0x410]
call dword [eax + 0xc]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xa4
push ecx
call dword [0x49712c]
mov edx, dword [ebp + 8]
cmp dword [edx + 0xcc], 0
jne 0x41248c
push 0xd0
call fcn.00468207
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 0xcc], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0xcc], 0
jne 0x412473
push 0x30
mov ecx, 0x4bd504
mov eax, dword [0x4bd504]
call dword [eax + 0xc]
push eax
push 0x49737c
push 0
call dword [0x497194]
push 0
call fcn.004681c7
push 0xd0
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xcc]
push edx
call fcn.00468010
add esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xcc]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x412760
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
push 0x14
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00468010
add esp, 0xc
mov word [ebp - 0x10], 0
mov word [ebp - 0xe], 1
mov word [ebp - 0xc], 0
mov word [ebp - 0xa], 0
mov word [ebp - 8], 0
mov word [ebp - 6], 0
mov word [ebp - 4], 0
mov word [ebp - 2], 1
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00468207
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
jne 0x4127ed
push 0x30
mov ecx, 0x4bd504
mov edx, dword [0x4bd504]
call dword [edx + 0xc]
push eax
push 0x49737c
push 0
call dword [0x497194]
push 0
call fcn.004681c7
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 6
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x14]
push eax
call dword [0x49701c]
mov eax, dword [ebp + 0x18]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x419f20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4956db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x414
mov eax, dword [0x4a4194]
xor eax, dword [ebp + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x420], ecx
cmp dword [ebp + 8], 0
jne 0x419f7a
lea eax, [ebp - 0x3fc]
push eax
mov ecx, dword [ebp - 0x420]
add ecx, 4
mov edx, dword [ebp - 0x420]
mov eax, dword [edx + 4]
call dword [eax + 0x7c]
lea ecx, [ebp - 0x3fc]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x497128]
add eax, 1
push eax
call fcn.00468207
add esp, 4
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x420]
mov ecx, dword [eax + 0x39c]
mov edx, dword [ebp - 0x420]
mov eax, dword [ebp - 0x410]
mov dword [edx + ecx*4 + 0x3a0], eax
mov ecx, dword [ebp - 0x420]
mov edx, dword [ecx + 0x39c]
mov eax, dword [ebp - 0x420]
cmp dword [eax + edx*4 + 0x3a0], 0
jne 0x419ff6
push 0x30
mov ecx, 0x4bd504
mov edx, dword [0x4bd504]
call dword [edx + 0xc]
push eax
push 0x49737c
push 0
call dword [0x497194]
push 0
call fcn.004681c7
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x420]
mov edx, dword [ecx + 0x39c]
mov eax, dword [ebp - 0x420]
mov ecx, dword [eax + edx*4 + 0x3a0]
push ecx
call dword [0x49712c]
mov ecx, dword [ebp - 0x420]
add ecx, 0x30
mov edx, dword [ebp - 0x420]
mov eax, dword [edx + 0x30]
call dword [eax + 0x48]
mov ecx, dword [ebp - 0x420]
mov edx, dword [ecx + 0x39c]
mov ecx, dword [ebp - 0x420]
mov dword [ecx + edx*4 + 0x1340], eax
mov edx, dword [ebp - 0x420]
mov eax, dword [edx + 0x39c]
add eax, 1
mov ecx, dword [ebp - 0x420]
mov dword [ecx + 0x39c], eax
mov edx, dword [ebp - 0x420]
cmp dword [edx + 0x39c], 0x3e8
jne 0x41a0ee
lea ecx, [ebp - 0x40c]
call fcn.004526b0
mov dword [ebp - 4], 0
push 0x498220
lea ecx, [ebp - 0x40c]
call fcn.00452a30
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x418], eax
mov ecx, dword [0x4bd4b0]
mov dword [ebp - 0x41c], ecx
push 0
push 0x498204
mov edx, dword [ebp - 0x418]
push edx
mov eax, dword [ebp - 0x41c]
push eax
call dword [0x497194]
mov dword [ebp - 0x414], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40c]
call fcn.004526f0
mov eax, dword [ebp - 0x414]
jmp 0x41a0f3
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
call fcn.00467ff6
mov esp, ebp
pop ebp
ret 4
Function at 0x41a110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4956db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x414
mov eax, dword [0x4a4194]
xor eax, dword [ebp + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x420], ecx
cmp dword [ebp + 8], 0
jne 0x41a16a
lea eax, [ebp - 0x3fc]
push eax
mov ecx, dword [ebp - 0x420]
add ecx, 4
mov edx, dword [ebp - 0x420]
mov eax, dword [edx + 4]
call dword [eax + 0x7c]
lea ecx, [ebp - 0x3fc]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x497128]
add eax, 1
push eax
call fcn.00468207
add esp, 4
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x420]
mov ecx, dword [eax + 0x22e0]
mov edx, dword [ebp - 0x420]
mov eax, dword [ebp - 0x410]
mov dword [edx + ecx*4 + 0x22e4], eax
mov ecx, dword [ebp - 0x420]
mov edx, dword [ecx + 0x22e0]
mov eax, dword [ebp - 0x420]
cmp dword [eax + edx*4 + 0x22e4], 0
jne 0x41a1e6
push 0x30
mov ecx, 0x4bd504
mov edx, dword [0x4bd504]
call dword [edx + 0xc]
push eax
push 0x49737c
push 0
call dword [0x497194]
push 0
call fcn.004681c7
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x420]
mov edx, dword [ecx + 0x22e0]
mov eax, dword [ebp - 0x420]
mov ecx, dword [eax + edx*4 + 0x22e4]
push ecx
call dword [0x49712c]
mov ecx, dword [ebp - 0x420]
add ecx, 0x30
mov edx, dword [ebp - 0x420]
mov eax, dword [edx + 0x30]
call dword [eax + 0x48]
mov ecx, dword [ebp - 0x420]
mov edx, dword [ecx + 0x22e0]
mov ecx, dword [ebp - 0x420]
mov dword [ecx + edx*4 + 0x4224], eax
mov ecx, dword [ebp - 0x420]
add ecx, 0x30
mov edx, dword [ebp - 0x420]
mov eax, dword [edx + 0x30]
call dword [eax + 0x48]
add eax, 4
push eax
mov ecx, dword [ebp - 0x420]
add ecx, 0x30
mov edx, dword [ebp - 0x420]
mov eax, dword [edx + 0x30]
call dword [eax + 0x28]
mov ecx, dword [ebp - 0x420]
mov edx, dword [ecx + 0x22e0]
add edx, 1
mov eax, dword [ebp - 0x420]
mov dword [eax + 0x22e0], edx
mov ecx, dword [ebp - 0x420]
cmp dword [ecx + 0x22e0], 0x7d0
jne 0x41a30b
lea ecx, [ebp - 0x40c]
call fcn.004526b0
mov dword [ebp - 4], 0
push 0x498290
lea ecx, [ebp - 0x40c]
call fcn.00452a30
mov edx, dword [ebp - 0x408]
mov dword [ebp - 0x418], edx
mov eax, dword [0x4bd4b0]
mov dword [ebp - 0x41c], eax
push 0
push 0x498204
mov ecx, dword [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x41c]
push edx
call dword [0x497194]
mov dword [ebp - 0x414], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40c]
call fcn.004526f0
mov eax, dword [ebp - 0x414]
jmp 0x41a310
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
call fcn.00467ff6
mov esp, ebp
pop ebp
ret 4
Function at 0x44bf90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0xc], 0x4aecfc
mov eax, dword [ebp - 0x50]
add eax, 0x38
push eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx + 0x20]
push edx
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp - 0x50]
mov eax, dword [edx + 0x38]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
call dword [edx + 0x60]
mov eax, dword [0x4fdc64]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx + 0x18]
shl edx, 3
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
add eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
jmp 0x44bff5
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 4]
jge 0x44c14c
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0xc]
cmp dword [edx + ecx*4 + 0x2050], 1
jne 0x44c0b7
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x20]
and eax, 0x80000003
jns 0x44c027
dec eax
or eax, 0xfffffffc
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x20]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x2c]
imul ecx, ecx, 0xbb
add ecx, 0x28
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x30]
imul edx, edx, 0x9d
add edx, 0x8f
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x2c]
imul eax, eax, 0xa0
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x30]
imul ecx, ecx, 0x78
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
add edx, 0x78
push edx
mov eax, dword [ebp - 0x28]
add eax, 0xa0
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x28]
push edx
lea eax, [ebp - 0x1c]
push eax
call dword [0x497224]
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x50]
mov eax, dword [edx + 0x28]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
call dword [edx + 0x60]
jmp 0x44c147
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 8]
jge 0x44c147
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x20]
and ecx, 0x80000003
jns 0x44c0d6
dec ecx
or ecx, 0xfffffffc
inc ecx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x20]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x40]
imul edx, edx, 0xbb
add edx, 0x28
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x44]
imul eax, eax, 0x9d
add eax, 0x8f
mov dword [ebp - 0x4c], eax
push 0x2d0
push 0x238
push 0x258
push 0x198
lea ecx, [ebp - 0x1c]
push ecx
call dword [0x497224]
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax + 0x24]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
call dword [edx + 0x60]
jmp 0x44bfec
mov esp, ebp
pop ebp
ret 8
Function at 0x44dac0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00434600
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x499bdc
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004524f0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1c], 0
push 0x23b
push 0x304
push 0x99
push 0x1d4
mov eax, dword [ebp - 0x10]
add eax, 0x20
push eax
call dword [0x497224]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0xffffffff
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4524f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x495e74
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x20]
mov dword [esp + 0xc], esi
mov dword [esi], 0x499cc0
call fcn.004526b0
xor ebx, ebx
push 0x12c
lea ecx, [esi + 0x30]
mov dword [esp + 0x1c], ebx
call fcn.00452ba0
lea ecx, [esi + 0x2b0]
mov byte [esp + 0x18], 1
call fcn.004583c0
push 0x101
mov ecx, esi
mov byte [esp + 0x1c], 2
call fcn.00451610
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.004516f0
mov dword [esi + 0x14], ebx
xor eax, eax
lea edi, [esi + 0x118]
mov ecx, 0x64
rep stosd dword es:[edi], eax
mov dword [esi + 0x2a8], ebx
mov dword [esi + 0x2ac], ebx
lea ecx, [esi + 0x2b8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x454770
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x495f28
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x30]
test ebx, ebx
push esi
push edi
mov edi, ecx
je 0x4547f6
mov esi, dword [esp + 0x3c]
test esi, esi
je 0x4547f6
lea ecx, [esp + 0xc]
call fcn.00453020
push 0
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0
call fcn.00453150
mov esi, eax
test esi, esi
jne 0x4547cf
mov eax, dword [edi]
lea ecx, [esp + 0xc]
push ecx
push ebx
mov ecx, edi
call dword [eax + 0xc]
mov esi, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00453360
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov eax, 3
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8