joyce8/EMBER2024-capa huggingface dataset:
Function at 0x589890
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x708e0c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], 0x752b14
call fcn.005bb760
fld1
mov cl, byte [esi + 8]
fst qword [esi + 0x20]
and cl, 0xe2
fst qword [esi + 0x28]
and al, 1
fst qword [esi + 0x30]
or cl, al
fst qword [esi + 0x38]
or cl, 2
fst qword [esi + 0x40]
mov ebp, 1
fstp qword [esi + 0x48]
mov byte [esi + 8], cl
lea ecx, [esi + 0x84]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x50], ebp
mov dword [esi + 0x54], ebp
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], 5
mov dword [esi + 0x7c], 0x6a
mov dword [esi + 0x80], ebp
call fcn.005c8e10
lea ecx, [esi + 0x8c]
mov byte [esp + 0x1c], 1
call fcn.005bbd40
push 8
mov byte [esp + 0x20], 2
call fcn.0058dd10
mov dword [esi + 0x94], 0x750280
mov eax, dword [eax + 4]
add esp, 4
cmp eax, ebx
mov dword [esi + 0x98], eax
je 0x589979
add dword [eax + 4], ebp
mov dword [esi + 0x94], 0x752e60
push 0xa
mov byte [esp + 0x20], 3
call fcn.0058d4e0
mov dword [esi + 0x9c], 0x750280
mov ecx, dword [eax + 4]
add esp, 4
cmp ecx, ebx
mov dword [esi + 0xa0], ecx
je 0x5899ac
add dword [ecx + 4], ebp
mov dword [esi + 0x9c], 0x750b8c
mov edx, dword [eax + 8]
mov dword [esi + 0xa4], edx
movzx ecx, byte [eax + 0xc]
mov byte [esi + 0xa8], cl
movzx edx, byte [eax + 0xd]
mov byte [esi + 0xa9], dl
movzx ecx, byte [eax + 0xe]
mov byte [esi + 0xaa], cl
movzx edx, byte [eax + 0xf]
mov byte [esi + 0xab], dl
mov al, byte [eax + 0x10]
mov byte [esi + 0xac], al
push 0x10
mov byte [esp + 0x20], 4
call fcn.0058d4e0
mov dword [esi + 0xb0], 0x750280
mov ecx, dword [eax + 4]
add esp, 4
cmp ecx, ebx
mov dword [esi + 0xb4], ecx
je 0x589a19
add dword [ecx + 4], ebp
mov dword [esi + 0xb0], 0x750b8c
mov ecx, dword [eax + 8]
mov dword [esi + 0xb8], ecx
movzx edx, byte [eax + 0xc]
mov byte [esi + 0xbc], dl
movzx ecx, byte [eax + 0xd]
mov byte [esi + 0xbd], cl
movzx edx, byte [eax + 0xe]
mov byte [esi + 0xbe], dl
movzx ecx, byte [eax + 0xf]
mov byte [esi + 0xbf], cl
movzx edx, byte [eax + 0x10]
mov byte [esi + 0xc0], dl
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xc4], 0x751ed4
lea ecx, [esi + 0xcc]
mov byte [esp + 0x1c], 6
call fcn.005c6620
and byte [esi + 8], 0xeb
mov byte [esi + 0xd4], bl
mov dword [esi + 0x64], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x68], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x58fb40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x710388
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov dword [esi], 0x754800
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esi + 0x40], edx
call fcn.0058fab0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14

Function at 0x5915a0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x7097e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor eax, eax
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov dword [esi], 0x754800
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], edi
mov edi, dword [esp + 0x38]
mov dword [esi + 0x24], edi
mov edi, dword [esp + 0x34]
mov dword [esi + 0x28], edi
mov dword [esp + 0x10], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, esi
mov dword [esi + 0x40], eax
mov dword [esp + 0x18], edx
call fcn.0058fc30
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0x18

Function at 0x592750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70bfe8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [0x84e270]
mov eax, dword [esi + 0x28]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.005fdcc0
mov dl, byte [esp + 0x44]
mov dword [esp + 0xc], 0x7529ec
mov byte [esp + 0x30], dl
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x14], esi
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x40], 0
call eax
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0xc], 0x750280
call fcn.005fd8d0
mov al, bl
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x34
ret 4
Function at 0x59a1f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70a308
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esi + 4], ebx
mov eax, dword [esp + 0x30]
cmp eax, ebx
mov dword [esp + 0x28], ebx
mov dword [esi], 0x7518b8
je 0x59a292
push eax
lea ecx, [esp + 0x14]
call fcn.005a28d0
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.005a14d0
test al, al
je 0x59a27d
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
call fcn.004075c6
cmp esi, eax
mov byte [esp + 0x28], 2
je 0x59a26f
push eax
mov ecx, esi
call fcn.005fd950
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 1
call fcn.0057d0a0
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
mov dword [esp + 0x10], 0x750280
call fcn.005fd8d0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret 4
Function at 0x5a4e40
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x70af68
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push 0x100
call fcn.00619370
push 4
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
call fcn.00557b2e
add esp, 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.005a4d70
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
lea ecx, [esp + 0x24]
call fcn.005a25d0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push 0x5a8dc0
push ecx
push edx
mov bl, al
mov dword [esp + 0x30], 0xffffffff
call fcn.006193a0
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x24], 0
call fcn.0054d3b5
add esp, 0x10
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret 0x18

Function at 0x5ab480
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x70b8fe
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], 0x75cb64
mov ecx, dword [0x829274]
mov dword [esp + 0x14], eax
mov dword [esi + 0x14], ecx
mov edx, dword [0x829274]
mov dword [esi + 0x18], edx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x30]
mov byte [esi + 0x20], al
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0x14], 2
mov dword [esi + 0x10], edx
mov byte [esi + 0x21], 1
mov dword [esi + 8], eax
mov dword [esi + 0x1c], ecx
jne 0x5ab4fe
call fcn.005a90f0
mov dword [esi + 8], eax
cmp dword [esi + 8], 0xfffffffe
jne 0x5ab50b
mov dword [esi + 0x1c], 0xffffffff
mov edx, dword [esp + 0x24]
push edx
mov ecx, esi
call fcn.005aa3f0
mov eax, dword [esp + 0x28]
push eax
mov ecx, esi
call fcn.005aa490
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18
Function at 0x5b07b0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x70bea0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [0x8249b0]
cmp eax, 0xffffffff
jne 0x5b0984
mov al, byte [0x829804]
xor ebx, ebx
mov dword [0x8249b0], ebx
mov byte [esp + 0xe], al
mov byte [0x829804], bl
mov byte [esp + 0xf], al
mov eax, dword [0x77132c]
push eax
push ebx
push 0x74c1c8
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], ebx
call fcn.005fc220
push 0x68
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 1
mov dword [esp + 0x18], ebx
call fcn.00617bc0
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
cmp eax, 0xffffffff
mov byte [esp + 0x38], 3
je 0x5b0852
add eax, 0xffffffff
cmp eax, ebx
mov dword [ecx], eax
jne 0x5b0852
call fcn.005fb120
cmp dword [esp + 0x10], ebx
jne 0x5b0865
mov dword [0x8249b0], ebx
xor eax, eax
jmp 0x5b097a
mov eax, dword [0x77132c]
push eax
push ebx
push 0x75e1ec
lea ecx, [esp + 0x24]
call fcn.005fc220
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 4
call fcn.00617b60
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff4
mov esi, eax
mov eax, dword [ecx]
cmp eax, 0xffffffff
mov byte [esp + 0x38], 3
je 0x5b08b1
add eax, 0xffffffff
cmp eax, ebx
mov dword [ecx], eax
jne 0x5b08b1
call fcn.005fb120
cmp esi, ebx
je 0x5b08da
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x14
call esi
cmp eax, ebx
jl 0x5b08da
mov eax, dword [esp + 0x20]
imul eax, eax, 0x64
add eax, dword [esp + 0x24]
mov dword [0x8249b0], eax
jmp 0x5b08df
mov eax, dword [0x8249b0]
cmp eax, ebx
jne 0x5b097a
push 0x75e1c0
lea ecx, [esp + 0x1c]
call fcn.00402474
push ebx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 5
call fcn.00617b60
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff4
mov esi, eax
mov eax, dword [ecx]
cmp eax, 0xffffffff
mov byte [esp + 0x38], 3
je 0x5b092c
add eax, 0xffffffff
cmp eax, ebx
mov dword [ecx], eax
jne 0x5b092c
call fcn.005fb120
cmp esi, ebx
jne 0x5b0937
mov eax, 0x190
jmp 0x5b0975
push 0x75e19c
lea ecx, [esp + 0x1c]
call fcn.00402474
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 6
call fcn.00617b60
lea ecx, [esp + 0x18]
mov esi, eax
mov byte [esp + 0x38], 3
call fcn.00418698
xor eax, eax
cmp esi, ebx
setne al
add eax, 0x1d6
mov dword [0x8249b0], eax
mov dl, byte [esp + 0xe]
mov byte [0x829804], dl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x5b9840
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x70c820
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0xe8]
push 1
push eax
call dword [0x7440ec]
mov ecx, dword [esi + 0xd8]
lea eax, [esp + 0x10]
push eax
call fcn.0057fd10
push 0x64
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0
call fcn.005bbd50
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x38]
mov ecx, esi
mov byte [esp + 0x30], 1
call eax
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0
call fcn.0057d0a0
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0057d0a0
mov ecx, esi
call fcn.005b6990
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret

Function at 0x5c1a30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x70d0b3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x75fe6c
mov edi, dword [esi + 0x30]
test edi, edi
mov dword [esp + 0x18], 1
je 0x5c1a7e
mov ecx, edi
call fcn.005c0710
push edi
call fcn.005416e5
add esp, 4
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx - 0xc]
sub ecx, 0xc
cmp eax, 0xffffffff
mov byte [esp + 0x18], 0
je 0x5c1a9d
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x5c1a9d
call fcn.005fb120
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
mov dword [esi], 0x750280
call fcn.005fd8d0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x5c2360
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70cf78
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [0x829274]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x75fe6c
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov edx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x50]
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], edx
call fcn.005fbb30
mov ecx, dword [esp + 0x4c]
lea edx, [esp + 8]
mov dword [esp + 0x14], ecx
push edx
mov ecx, esi
mov dword [esp + 0x14], 6
call fcn.005c22a0
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x44], 0xffffffff
call fcn.005c1a30
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x40
ret 0xc
Function at 0x5c24c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70cf78
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [0x829274]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x75fe6c
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov edx, dword [esp + 0x50]
push edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x48], eax
mov dword [esp + 0x14], 0x42
call fcn.005fbb30
mov eax, dword [esp + 0x58]
cmp eax, 0xffffffff
jle 0x5c2556
or dword [esp + 0x10], 0x20
mov dword [esp + 0x34], eax
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x54]
lea ecx, [esp + 8]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x38], eax
call fcn.005c2430
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x44], 0xffffffff
call fcn.005c1a30
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x40
ret 0x10

Function at 0x5c5910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70d341
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x760980
lea ecx, [esi + 0x120]
mov dword [esp + 0x14], 7
mov dword [ecx], 0x750280
call fcn.005fd8d0
lea ecx, [esi + 0xf8]
mov byte [esp + 0x14], 6
mov dword [ecx], 0x750280
call fcn.005fd8d0
lea ecx, [esi + 0xd0]
mov byte [esp + 0x14], 5
mov dword [ecx], 0x750280
call fcn.005fd8d0
lea ecx, [esi + 0xa8]
mov byte [esp + 0x14], 4
mov dword [ecx], 0x750280
call fcn.005fd8d0
lea ecx, [esi + 0x80]
mov byte [esp + 0x14], 3
mov dword [ecx], 0x750280
call fcn.005fd8d0
lea ecx, [esi + 0x58]
mov byte [esp + 0x14], 2
mov dword [ecx], 0x750280
call fcn.005fd8d0
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
mov dword [ecx], 0x750280
call fcn.005fd8d0
lea ecx, [esi + 8]
mov byte [esp + 0x14], 0
mov dword [ecx], 0x750280
call fcn.005fd8d0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
mov dword [esi], 0x750280
call fcn.005fd8d0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5c9400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70d773
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
mov dword [esi + 4], ebx
push 0x40
mov dword [esp + 0x28], ebx
mov dword [esi], 0x7538e8
call fcn.005416ba
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 1
je 0x5c945c
mov ecx, eax
call fcn.005c8e40
jmp 0x5c945e
xor eax, eax
mov ebp, dword [esp + 0x2c]
lea edi, [eax + 0x28]
cmp edi, ebp
mov byte [esp + 0x24], bl
mov dword [esi + 4], eax
je 0x5c9478
push ebp
mov ecx, edi
call fcn.005fd950
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
movzx ecx, byte [ebp + 0xc]
mov byte [edi + 0xc], cl
movzx edx, byte [ebp + 0xd]
mov byte [edi + 0xd], dl
mov al, byte [ebp + 0xe]
mov byte [edi + 0xe], al
movzx ecx, byte [ebp + 0xf]
mov byte [edi + 0xf], cl
movzx edx, byte [ebp + 0x10]
mov ecx, dword [esp + 0x30]
mov byte [edi + 0x10], dl
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x34]
mov dword [edx + 0xc], eax
mov ecx, dword [esi + 4]
mov dword [ecx + 0x10], 0x7a
mov edx, dword [esi + 4]
mov dword [edx + 0x14], 0x82
mov eax, dword [esi + 4]
mov dword [eax + 0x20], ebx
mov ecx, dword [esi + 4]
mov dword [ecx + 0x24], ebx
mov edx, dword [esi + 4]
mov ecx, esi
mov dword [edx + 0x3c], ebx
call fcn.005c8fd0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc

Function at 0x5d1710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70e0a1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.005d1640
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push eax
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], 1
call fcn.005e8b20
mov esi, dword [esp + 0x40]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.005fd810
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x38], 0
call fcn.005d15e0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x5e2aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70fb78
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00402168
mov ecx, esi
mov dword [esp + 0x14], 0
mov dword [esi], 0x75fe84
call fcn.005c07e0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
mov ecx, esi
call fcn.005c1d10
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c
Function at 0x604ef0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x711e28
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00604970
mov ebx, dword [esp + 0x44]
xor edi, edi
cmp ebx, edi
mov dword [esp + 0x38], edi
jne 0x604f3e
mov ebx, 0x7b6c48
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x604f43
sub eax, edx
movzx ebp, ax
mov dword [esp + 0x20], 0x75bc84
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push ecx
push edi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 1
call fcn.00627a40
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 3
call fcn.005a7e50
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
movzx ecx, word [esi + 6]
push ebp
push edx
movzx edx, word [esi + 4]
push eax
movzx eax, word [esi + 2]
push ecx
movzx ecx, word [esi]
push edx
push eax
push ecx
push 0x6054b50
lea ecx, [esp + 0x34]
call fcn.00627b60
mov ecx, eax
call fcn.00627ba0
mov ecx, eax
call fcn.00627ba0
mov ecx, eax
call fcn.00627ba0
mov ecx, eax
call fcn.00627ba0
mov ecx, eax
call fcn.00627b60
mov ecx, eax
call fcn.00627b60
mov ecx, eax
call fcn.00627ba0
mov edx, dword [edi]
mov edx, dword [edx + 0x1c]
movzx eax, bp
push eax
push ebx
mov ecx, edi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
lea ecx, [esp + 0x14]
mov bl, al
mov byte [esp + 0x38], 0
call fcn.00627a70
mov eax, dword [esp + 0x44]
push eax
call fcn.0054d3b5
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
Function at 0x607d70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x71223e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x20]
mov dword [esi], 0x773cb4
mov byte [esi + 0xc], al
mov byte [esi + 0xd], 0x1c
mov word [esi + 0xe], 0x14
mov word [esi + 0x10], ax
mov word [esi + 0x12], 0xffff
mov edx, dword [ecx]
mov dword [esi + 0x18], edx
mov ecx, dword [ecx + 4]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x30], edx
mov edx, dword [esp + 0x28]
or ecx, 0xffffffff
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x34], edx
mov edx, dword [0x829274]
mov dword [esp + 0x14], eax
mov dword [esi + 0x38], edx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov ecx, dword [0x829274]
mov dword [esi + 0x50], ecx
mov ecx, dword [esp + 0x1c]
mov word [esi + 0x54], ax
mov word [esi + 0x56], ax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov edx, dword [ecx]
cmp dword [edx - 8], eax
mov byte [esp + 0x14], 2
je 0x607e38
push eax
push ecx
mov ecx, esi
call fcn.00607ae0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10