joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e2a6
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x467e38
call fcn.0042ea90
push 1
call fcn.0042e574
pop ecx
test al, al
jne 0x42e15d
push 7
call fcn.0042e88a
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0042e53f
mov byte [ebp - 0x24], al
mov eax, dword [0x46ade4]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x42e156
test eax, eax
jne 0x42e1c7
mov dword [0x46ade4], ecx
push 0x44b434
push 0x44b418
call fcn.00434748
pop ecx
pop ecx
test eax, eax
je 0x42e1aa
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x42e2a0
push 0x44b414
push 0x44b3e4
call fcn.004346ec
pop ecx
pop ecx
mov dword [0x46ade4], 2
jmp 0x42e1cc
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0042e6e1
pop ecx
call fcn.0042e87e
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x42e1fc
push esi
call fcn.0042e657
pop ecx
test al, al
je 0x42e1fc
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0042ea87
call esi
call fcn.0042e884
mov esi, eax
cmp dword [esi], edi
je 0x42e21a
push esi
call fcn.0042e657
pop ecx
test al, al
je 0x42e21a
push dword [esi]
call fcn.00434a0a
pop ecx
call fcn.0042e9a6
movzx eax, ax
push eax
call fcn.004346a6
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00434919
test al, al
jne 0x42e245
push esi
call fcn.00434a42
test bl, bl
jne 0x42e24e
call fcn.004349e5
push edi
push 1
call fcn.0042e6fe
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x42e2a0
call fcn.0042ead6
ret
call fcn.0042e7c5
jmp 0x42e13e

Function at 0x4305d5
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x14]
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xc]
mov edi, dword [esp + 0x18]
add ebx, 0xc
lea esi, [esi]
add byte [eax], al
invalid
nop
Function at 0x430645
Capabilities:
Access peb ldr_data
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x430658
mov eax, dword [eax + 0x18]
mov dword [esp + 4], 0
mov dword [esp + 0x1c], eax
mov eax, dword [0x466a30]
mov dword [esp], eax
call fcn.004305d5
mov ecx, dword [0x466a60]
mov edi, eax
mov eax, dword [ecx]
test eax, eax
je 0x4306e1
movzx edx, word [esi]
movzx ebp, byte [ecx]
test dx, dx
je 0x430808
xor eax, eax
lea esi, [esi]
nop
add eax, 1
cmp word [esi + eax*2], 0
jne 0x4306a5
mov ebx, ebp
cmp al, bl
je 0x4306be
cmp byte [ecx + 1], al
jne 0x4307fb
lea eax, [esi + 2]
xor esi, esi
nop
add eax, 2
add esi, edx
movzx edx, word [eax - 2]
test dx, dx
jne 0x4306c5
cmp dword [ecx + 4], esi
je 0x4306e1
cmp dword [ecx + 8], esi
jne 0x4307fb
mov eax, dword [0x466a38]
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x1000
mov dword [esp], 0
and al, 0
add byte [eax], al
add byte [ecx - 0xfbdbbc], cl
adc eax, sym.imp.KERNEL32.dll_VirtualAlloc
mov ecx, dword [0x466a54]
xor edx, edx
sub esp, 0x10
test ecx, ecx
je 0x430743
lea esi, [esi]
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [eax + edx], ecx
mov ecx, dword [0x466a4c]
add edx, ecx
mov ecx, dword [0x466a54]
cmp ecx, edx
ja 0x430725
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00430485
mov edi, eax
test eax, eax
je 0x4307fb
mov esi, dword [0x466a3c]
lea ebp, [esp + 0x2c]
mov edx, dword [0x466a54]
mov dword [esp + 0xc], ebp
mov eax, dword [0x466a44]
mov dword [esp], esi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call edi
mov eax, dword [0x466a34]
sub esp, 0x10
mov edx, dword [0x466a44]
mov ebx, dword [esp + 0x1c]
add ebx, eax
mov eax, 8
mov ecx, dword [ebx + 4]
cmp edx, 8
jbe 0x4307bf
lea esi, [esi]
nop
mov edx, dword [ebx + eax]
add edx, ecx
mov dword [esi + eax], edx
mov edx, dword [0x466a4c]
add eax, edx
mov edx, dword [0x466a44]
cmp edx, eax
ja 0x4307a5
mov eax, dword [0x466a5c]
mov edx, dword [esp + 0x2c]
mov dword [esi + 8], eax
mov eax, dword [0x466a44]
mov dword [esp + 8], edx
mov dword [esp], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
call edi
mov eax, dword [0x466a50]
mov edx, dword [0x466a50]
sub esp, 0x10
add eax, dword [esi + 0xc]
add eax, esi
add esi, edx
mov dword [esp], esi
call eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, ebp
test al, al
je 0x430814
cmp byte [ecx + 1], 0
jne 0x4307fb
xor esi, esi
jmp 0x4306d3
Function at 0x445dae
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
xor eax, eax
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
push dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push str._ls.R
push edi
call fcn.00401f13
mov esi, eax
add esp, 0xc
test esi, esi
js 0x445eba
push 0
push 0x80
push 4
push 0
push 4
push 0xc0000000
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x445e38
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x445e1c
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x445e23
mov esi, 0x80004005
push esi
push 0xc1
push 0x466a4c
call fcn.00403821
jmp 0x445eba
mov ecx, dword [ebp - 4]
push 0
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, ecx
push eax
lea eax, [ecx + ebx]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x445e80
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
cmp dword [ebp - 8], 0
mov dword [ebp - 4], ecx
je 0x445e6a
cmp ecx, 8
jb 0x445e3b
cmp ecx, 8
je 0x445e76
and dword [ebx], 0
and dword [ebx + 4], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
or edi, 0xffffffff
jmp 0x445eae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x445e97
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x445e9e
mov esi, 0x80004005
push esi
push 0xc8
push 0x466a4c
call fcn.00403821
cmp edi, 0xffffffff
je 0x445eba
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x446357
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
push 0
push dword [edi + 4]
push dword [edi]
push dword [ebp + 0xc]
call fcn.0044490d
mov esi, eax
test esi, esi
js 0x4464ad
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x44647e
cmp dword [ebp - 4], 0
je 0x4464ac
xor ebx, ebx
and dword [ebp + 0x10], ebx
push 0
lea eax, [ebp + 0x10]
push eax
mov eax, dword [ebp - 4]
sub eax, ebx
push eax
mov eax, dword [ebp + 0x20]
add eax, ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x446458
add ebx, dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0
je 0x4463dc
cmp ebx, dword [ebp - 4]
jb 0x4463ab
add dword [edi], ebx
push 0
pop eax
adc dword [edi + 4], eax
cmp dword [ebp + 0x14], 0xffffffff
je 0x446426
push eax
push eax
push eax
push eax
push dword [ebp + 0x14]
mov ebx, eax
mov dword [ebp - 8], eax
call fcn.0044490d
test eax, eax
js 0x446426
push 0
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, ebx
push eax
lea eax, [edi + ebx*8]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add ebx, dword [ebp - 8]
cmp dword [ebp - 8], 0
je 0x446426
cmp ebx, 8
jb 0x4463ff
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x44644c
cmp dword [eax], 0
je 0x44644c
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [edi + 4]
push dword [edi]
push eax
call fcn.00445c8a
mov esi, eax
test esi, esi
js 0x4464ac
cmp dword [ebp - 4], 0
jne 0x446381
jmp 0x4464ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44646f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x446476
mov esi, 0x80004005
push esi
push 0x1a6
jmp 0x4464a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x446495
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x44649c
mov esi, 0x80004005
push esi
push 0x19a
push 0x466a4c
call fcn.00403821
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x24
Function at 0x4464b7
Capabilities:
Create http request
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
or dword [ebp - 0xc], 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
push dword [ebx]
mov dword [ebp - 8], eax
mov edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
push eax
call fcn.00402195
mov esi, eax
test esi, esi
js 0x44661f
xor eax, eax
push eax
push eax
push eax
push eax
push 0x466a40
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
jne 0x446546
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44652a
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x446531
mov esi, 0x80004005
push esi
push 0x84
push 0x466a4c
call fcn.00403821
jmp 0x44661f
lea eax, [ebp - 4]
push eax
push 0x78
push 0x466a58
push str.WiXBurn
call fcn.004457fa
mov eax, dword [ebp - 4]
test eax, eax
je 0x446592
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 2
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 5
push edi
call esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call fcn.00445d03
mov esi, eax
test esi, esi
js 0x44661f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
call fcn.00445dae
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call fcn.00445a5e
mov esi, eax
test esi, esi
js 0x446610
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x446610
xor ecx, ecx
cmp word [eax], cx
je 0x446610
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xc], 0xffffffff
je 0x44661f
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x44662c
push eax
call fcn.00445636
test edi, edi
je 0x446637
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 8], 0
je 0x446645
push dword [ebp - 8]
call fcn.00445636
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x407e17
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407e86
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x407e62
push ebx
push edi
push eax
call fcn.0040ba60
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x407e7d
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret

Function at 0x41159b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4115aa
pop dword [ebp - 0x4c]
mov eax, 0x344edd0f
sub eax, 0x340dc765
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3edce
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x4cca
mov esi, eax
mov edi, 0x72c1059c
sub edi, 0x727d539c
add edi, dword [ebp - 0x4c]
mov ebx, 0x68d1b4b5
add ebx, 0x897c321a
mov dword [ebp - 0x24], 0xee11e342
mov edx, dword [edi]
mov dword [ebp - 0x18], 0x33098a4a
xor edx, ebx
sub dword [ebp - 0x44], ebx
mov dword [esi], edx
add dword [ebp - 0x1c], edi
add esi, 4
add edi, 0xe8ea1119
sub edi, 0xe8ea1115
loop 0x4115fe
add eax, 0x647597a
sub eax, 0x646337f
mov ebx, eax
add eax, 0x27aa1090
add eax, 0xd855ef75
mov ecx, 0x5910b21f
add ecx, 0xa72f4de1
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405369
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x54210f
call fcn.004c7c10
sub esp, 0x10
and dword [ebp - 0x1c], 0
push ebx
push esi
push edi
push dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
call fcn.0052c9f3
mov eax, dword [0x64b0c8]
push 1
pop ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
push dword [ebp + 0x14]
mov edi, 0x58a81c
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
push eax
call fcn.005257c9
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x4053d5
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0052c6ec
mov dword [ebp - 0x1c], ebx
jmp 0x40542b
push ebx
mov dword [ebp - 0x18], ebx
push dword [ebp + 0x10]
mov ebx, str._s___d_
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.005257c9
add esp, 0x10
lea eax, [ebp - 0x14]
push dword [ebp + 0x14]
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
push eax
call fcn.005257c9
add esp, 0x14
push dword [ebp - 0x14]
call esi
test eax, eax
je 0x405418
inc dword [ebp - 0x18]
push dword [ebp - 0x18]
push dword [ebp + 0x10]
jmp 0x4053e1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0052c6ec
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0052c97f
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0052c97f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405455
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x542143
call fcn.004c7c10
sub esp, 0x10
and dword [ebp - 0x1c], 0
push ebx
push esi
push edi
push dword [ebp + 0x10]
lea ecx, [ebp - 0x14]
call fcn.0052c9f3
mov eax, dword [0x64b0c8]
push 1
pop ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
push dword [ebp + 0x14]
mov edi, 0x58a81c
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push dword [ebp - 0x14]
push dword [ebp + 0xc]
push edi
push eax
call fcn.005257c9
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x4054c1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0052c6ec
mov dword [ebp - 0x1c], ebx
jmp 0x405517
push ebx
mov dword [ebp - 0x18], ebx
push dword [ebp + 0x10]
mov ebx, str._s___d_
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.005257c9
add esp, 0x10
lea eax, [ebp - 0x10]
push dword [ebp + 0x14]
push dword [ebp - 0x14]
push dword [ebp + 0xc]
push edi
push eax
call fcn.005257c9
add esp, 0x14
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x405504
inc dword [ebp - 0x18]
push dword [ebp - 0x18]
push dword [ebp + 0x10]
jmp 0x4054cd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0052c6ec
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0052c97f
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0052c97f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4059a1
Capabilities:
Check if file exists

Disassembly:
push dword [0x6535ac]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4059c6
push 0
push 0x414
push dword [0x6535ac]
call fcn.00421c4c
add esp, 0xc
ret

Function at 0x40a388
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x54271d
call fcn.004c7c10
push ecx
mov eax, dword [0x64b0c8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], eax
mov ecx, dword [0x64b0c8]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], ecx
mov ecx, dword [0x64b0c8]
mov dword [esi + 0x2c], ecx
mov ecx, dword [0x64b0c8]
mov dword [esi + 0x30], ecx
mov ecx, dword [0x64b0c8]
mov dword [esi + 0x38], ecx
mov ecx, dword [0x64b0c8]
mov dword [esi + 0x40], ecx
mov ecx, dword [0x64b0c8]
mov dword [esi + 0x44], ecx
mov ecx, esi
mov byte [ebp - 4], 6
mov dword [esi], 0x554fc0
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
call fcn.0040a49d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40a40e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x542775
call fcn.004c7c10
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x554fc0
mov ecx, dword [esi + 0x84]
mov dword [ebp - 4], 6
test ecx, ecx
je 0x40a43c
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 5
call fcn.0052c97f
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call fcn.0052c97f
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 3
call fcn.0052c97f
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0052c97f
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 1
call fcn.0052c97f
and byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.0052c97f
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.0052c97f
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40b969
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x54291f
call fcn.004c7c10
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea edi, [esi + 0x30]
mov dword [ebp - 0x14], edi
mov dword [edi], method.CPtrArray.virtual_0
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.0048c042
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.0052781d
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 3
call fcn.0052c97f
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 2
call fcn.0052c97f
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.0052c97f
and byte [ebp - 4], 0
lea ecx, [esi + 0x20]
call fcn.0052c97f
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.0052c97f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40bcfc
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x542afd
call fcn.004c7c10
push ecx
mov eax, dword [0x64b0c8]
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], eax
mov eax, dword [0x64b0c8]
and dword [ebp - 4], 0
mov dword [esi + 0x10], eax
mov eax, dword [0x64b0c8]
mov dword [esi + 0x14], eax
mov eax, dword [0x64b0c8]
mov dword [esi + 0x1c], eax
mov eax, dword [0x64b0c8]
mov dword [esi + 0x30], eax
mov eax, dword [0x64b0c8]
mov dword [esi + 0x44], eax
mov eax, dword [0x64b0c8]
mov dword [esi + 0x54], eax
mov eax, dword [0x64b0c8]
mov dword [esi + 0x58], eax
mov eax, dword [0x64b0c8]
mov dword [esi + 0x5c], eax
mov eax, dword [0x64b0c8]
mov dword [esi + 0x60], eax
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 9
call fcn.0040bdf9
mov eax, dword [0x64b0c8]
lea edi, [esi + 0x120]
mov dword [edi], eax
push 0
lea ecx, [esi + 0x124]
mov byte [ebp - 4], 0xb
call fcn.004aad00
push 0x6534f4
mov ecx, edi
mov byte [ebp - 4], 0xc
mov dword [esi], 0x555304
call fcn.0052cb16
mov ecx, esi
call fcn.0040b769
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40c19f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x542d13
call fcn.004c7c10
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x555304
lea edi, [esi + 0x124]
mov dword [ebp - 4], 0xb
mov ecx, edi
mov dword [edi], 0x555308
call fcn.004aadd0
mov ecx, edi
call fcn.004aad20
lea ecx, [esi + 0x120]
mov byte [ebp - 4], 0xa
call fcn.0052c97f
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 9
call fcn.0040c08b
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 8
call fcn.0052c97f
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 7
call fcn.0052c97f
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 6
call fcn.0052c97f
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 5
call fcn.0052c97f
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 4
call fcn.0052c97f
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0052c97f
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 2
call fcn.0052c97f
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 1
call fcn.0052c97f
and byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.0052c97f
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.0052c97f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40c1aa
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x542d13
call fcn.004c7c10
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x555304
lea edi, [esi + 0x124]
mov dword [ebp - 4], 0xb
mov ecx, edi
mov dword [edi], 0x555308
call fcn.004aadd0
mov ecx, edi
call fcn.004aad20
lea ecx, [esi + 0x120]
mov byte [ebp - 4], 0xa
call fcn.0052c97f
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 9
call fcn.0040c08b
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 8
call fcn.0052c97f
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 7
call fcn.0052c97f
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 6
call fcn.0052c97f
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 5
call fcn.0052c97f
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 4
call fcn.0052c97f
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0052c97f
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 2
call fcn.0052c97f
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 1
call fcn.0052c97f
and byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.0052c97f
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.0052c97f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret