joyce8/EMBER2024-capa huggingface dataset:
Function at 0x967f98
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [ebp]
mov ecx, dword ss:[edx]
mov dword [ebp], ecx
push 0x1b0755b4
push 0x1728bb99
lea esp, [esp + 0xc]
jmp fcn.009619f3

Function at 0x96bd02
Capabilities:
Check for software breakpoints

Disassembly:
rol dl, 1
add dword [esp], 0x3b39fc80
sbb byte [esp + 1], 0x89
inc dl
neg dl
shr word [esp + 2], 0x6f
xor bl, dl
lea edx, [esp + edx + 4]
push 0x319b8707
mov word [edx], si
push 0x2b0da628
jmp 0x793b0b
mov word [ebp], cx
call fcn.00992ec6
mov dword [esp], 0x8711f6ab
sub dl, 0xbc
shl byte [esp + 3], 0x25
inc dword [esp]
js 0x770373
call fcn.00768e61
mov ecx, 0x2a2b13ba
jmp 0x96bccb
xor dword [esp], ecx
mov cl, byte [esi + 2]
or word [esp], 0x7431
jl 0x95224a
adc esi, 2
not al
not cl
or al, cl
call fcn.00855555
lea esp, [esp + 0x20]
jmp fcn.009619f3
add ecx, ecx
mov ecx, dword [ecx + ebp - 0x54562774]
mov eax, 0xa731c39b
mov al, byte [ebp + 4]
push 0xdd09aa30
sbb byte [esp + 2], 0xa9
call fcn.00786bc0
mov ebp, 0x171d450b
mov ebp, dword [ebp + edi - 0x171d450b]
call fcn.0083abac
call fcn.009905e8
push 0x54221708
movzx ax, byte [esi]
mov ecx, 0x8b3150ac
jmp 0x851ee0

Function at 0x9706d6
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.009619f3
jmp 0x7c5553

Function at 0x974372
Capabilities:
Check for software breakpoints

Disassembly:
mov word [esi], dx
lea esp, [esp + 0x10]
jmp fcn.0085a49e

Function at 0x974bf8
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [ebp], edx
jmp 0x98bbaf
mov esi, 0x5828b92b
push esi
add esi, 0xaf91a0b2
movzx esi, byte [esi + eax - 0x7ba59dd]
call int.0080bce9
lea esp, [esp + 8]
jmp fcn.009619f3
push 0xea91bc31
dec ecx
lea esp, [esp + 0x20]
jne 0x7b0b13
mov esi, 0x2703a1b8
pop esi
push 0x433f85a6
push 0x8535643e
not edx
jmp 0x7a3935
not word [esp + 4]
jmp 0x811c60

Function at 0x9897d4
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [esp], 0x1c3779bb
not cl
mov word [ebp], cx
push 0xab95ad01
lea esp, [esp + 0x10]
jmp fcn.009619f3

Function at 0x9898dd
Capabilities:
Check for software breakpoints

Disassembly:
mov word [ebp], dx
not word [esp + 2]
not byte [esp + 2]
jmp 0x84bbac
jmp 0x81b73b
jmp 0x762035
lea esp, [esp + 4]
jmp fcn.009619f3
ror dl, 1
call fcn.007a5941
xor dl, bl
inc dl
call fcn.007b2205
mov eax, 0xa78b5a05
mov dx, word [ebp]
inc eax
push eax
movzx ecx, ax
mov ax, word [ebp + ecx - 0x5a04]
sal ecx, cl
inc ecx
btc cx, cx
mov cl, byte [ebp + ecx*2 - 0x2d0302]
dec dword [esp]
adc ebp, 4
sal word [esp], 0x6e
ror word [esp], 0x27
shrd dx, ax, cl
jmp 0x7b1136

Function at 0x98d736
Capabilities:
Check for software breakpoints

Disassembly:
rol si, 1
push 0xefa2f29c
call fcn.00809207
push 0x308c48b8
sub si, 0x2113
shr dword [esp + 4], 0xc1
jno 0x76f259
mov dword [eax], ecx
lea esp, [esp + 0x1c]
jmp fcn.009619f3
inc cx
xor esi, edi
jmp 0x851f7b
Function at 0x98e069
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc cx
ror eax, 1
dec eax
mov dword [esp], 0xd89990a3
dec ecx
adc ebp, 2
inc bp
xor eax, edi
inc byte [esp + 1]
jl 0x7bd968
inc ecx
mov esp, 0x47ae652b
dec edi
mov esp, dword [ecx - 0x47ae652b]
mov esi, 0xbf1aab2c
dec eax
lea esi, [esi*4 - 0x6df3da6c]
dec eax
btr esi, 0x29
dec ecx
mov esi, dword [ecx + 8]

Function at 0x98f1e2
Capabilities:
Check for software breakpoints

Disassembly:
mov word [eax], dx
push 0x45135c3e
lea esp, [esp + 0xc]
jmp fcn.009619f3

Function at 0x9920c8
Capabilities:
Check for software breakpoints

Disassembly:
add ecx, edi
mov dword [ebp], ecx
lea esp, [esp + 4]
jmp fcn.009619f3

Function at 0x992b3f
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, 0xcbbb99ad
sal edx, 0xff
mov ebp, dword [edx + esi - 0x80000000]
imul dx, dx
mov dword [esp + edx - 0x80000000], edx
mov edx, dword [esi + edx - 0x7ffffffc]
adc esi, 4
rol dword [esp], 0xf7
jae 0x7de50b

Function at 0x992c31
Capabilities:
Check for software breakpoints

Disassembly:
push 0xa39172be
lea esp, [esp + 0x18]
jmp fcn.009619f3
Function at 0x995eac
Capabilities:
Check for software breakpoints

Disassembly:
dec ebx
push 0xce2a9b3a
jmp 0x7dd34a
call fcn.007ca065
add byte [ecx + 0x44], al
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add ah, dl
int1
in al, 0xb3
pushfd
fucomp st(3)
sahf
mov esi, dword [ebp + 0x4b]
jp 0x7dd3af
movsd dword es:[edi], dword [esi]
xchg edx, eax
jbe 0x7dd3b9
dec esi
test al, 0xe6
sub dword cs:[edi + ebx*8 - 0x5f], edx
xchg edx, eax
sar esi, 0xc1
xor dword [esi], esp
mov byte [0xbc922c8c], al
or bh, byte [0x2131e4e1]
cmp byte [edx + 0x5bcc9561], 0xfb
dec ebp
and dword [edx - 0x786a9e46], eax
invalid
out dx, al
pop edi
or ebx, edx
mov bh, 0x62
add al, 0xc7
xchg edi, eax
daa
cmp al, 0xc1
mov eax, 0x2dd70112
sub byte [ebp - 0x51], dh
cmp eax, 0xb2e6177d
jb 0x7dd441
inc ebx
sub esp, dword [edx + 0x32]
in eax, dx
sahf
sbb edi, dword [edx - 0x457dcfcd]
popal
xchg ebp, eax
sal byte [eax + 0x61fb6ff5], 1
dec dword [edi + esi*2 + 0x51]
mov al, 0xa8
fst dword [ecx + 0x7e141e9]
cwde
add edx, dword [edi - 0x8993969]
lahf
xor bl, ch
add dl, ah
xor al, 0x95
outsb dx, byte [esi]
push ebp
push es
leave
push es
arpl word [ebx - 0x35035f76], bx
loopne 0x7dd402
cld
retf 0xe02e
sbb al, 0x52
jno 0x7dd460
movsd dword es:[edi], dword [esi]
mov eax, 0xd79b6306
ja 0x7dd41f
movsb byte es:[edi], byte [esi]
xchg ebp, eax
or eax, 0xff94c0ac
out dx, al
arpl word [edi - 0x6f], bx
fisttp qword [ecx + esi*8]
or al, 0xf1
dec edi
mov ebp, 0xd3e4086b
int 0xcd
iretd
stc
rcl byte [ebp + edi*4 - 0x38]
pop es
arpl word [ebx + 0x470d99e4], bx
test byte [edx], 0x14
dec edx
mov byte [0x8d89aaf6], al
sub eax, 0x6e5f4e0d
ret 0xcf3
jp 0x7dd498
or eax, 0xb6c21462
pushfd
fcmovnu st(0), st(7)
mov byte [0xb1784e0c], al
mov esp, 0x36f86aee
ret 0x8a18
dec edx
jl 0x7dd4c7
and al, 0xab
out 0x5e, al
push eax
pop esi
insd dword es:[edi], dx
out 0xd4, eax
popal
mov ebx, 0xb31fb17
sbb dword [eax + esi*8], ebp
ret 0x7c42
mov dl, 0x61
xchg ebp, eax
dec edi
fld qword [eax - 0x3fbc7c3e]
inc edx
shr cl, 0xc2
cmp eax, 0x9b639120
jns 0x7dd4a5
wait
and byte [eax + 0x3c62d49a], al
pushal
retf
jae 0x762f49
mov eax, 0xfdad8507
movsx ecx, al
rol al, cl
movzx ax, byte [ebp + ecx - 7]
shl cl, cl
setae cl
or ecx, 0x408c952a
mov cl, byte [ebp + ecx - 0x408c9528]
adc ebp, 2
push 0x3e27438e
jmp 0x7bbeee

Function at 0x997b3d
Capabilities:
Check for software breakpoints

Disassembly:
add ebp, 2
shr di, cl
mov word [ebp], di
lea esp, [esp + 8]
jmp fcn.009619f3

Function at 0x998107
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x992b71
lea esp, [esp + 0x10]
jmp fcn.009619f3
mov word [ebp], ax
push 0xb10dce96
jmp 0x84ae36
not al
jmp 0x799ed6

Function at 0x999c65
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [ebp], eax
lea esp, [esp + 4]
jmp fcn.009619f3
Function at 0x99b88f
Capabilities:
Check for software breakpoints

Disassembly:
movzx ax, byte ss:[ecx + eax - 0x603125ba]
adc edi, 1
push 0x1d18cda9
call fcn.007b95e8
shl dword [esp + 0x18], 0x70
ror al, 1
jmp 0x99b865
push 0xc1187539
mov dword [ebp], edx
push 0xae9c6189
mov dword [ebp + 4], eax
push 0x4616bea0
lea esp, [esp + 0xc]
jmp fcn.009619f3
mul edi
jmp 0x78d2a8
lea esp, [esp + 0x28]
je fcn.0080a109
sub byte [edi], cl
test byte [eax + ecx*4], dh
ljmp 0x350a
fild word [ebx + eax*4]
or dh, byte [0x19007f86]
jno 0x9618ce
pop ebp
je 0x9618b8
and dh, byte [ecx]
or al, 0x10
mov dword [0x7589311c], eax
call 0x8dbda95e
in al, 0x8d
mov al, 0x42
pop ebx
fxch st(0)
wait
lea esp, [edi + 0x68]
stc
cmc
outsd dx, dword [esi]
cmp esi, esp
in eax, dx
stosb byte es:[edi], al
jmp 0x961978
mov dword [ebp - 4], eax
neg byte [esp + 2]
ror byte [esp + 2], 7
test ebx, ebx
call fcn.00771d22
mov eax, 0x603125ba
bts eax, 0x24
mov ecx, dword [edi + eax - 0x603125ba]
push eax
jb 0x762ba5
xor bl, al
shl dword [esp + 0x18], 0xad
mov dword [esp + 0x1c], 0x34b92a22
lea eax, [esp + eax + 0x20]
push 0xeeb6ab29
push 0x808cdf23
mov byte [esp + 0x24], 0x32
mov byte [eax], dl
jp 0x9618cb
mov eax, 0xdab5c699
and eax, eax
mov edi, dword [ebp]
mov eax, dword [ebp + 4]
jl 0x7f1232
Function at 0x10625058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x106251a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1062507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1062506a
add dl, dl
jne 0x10625089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106250dc
xor eax, eax
add dl, dl
jne 0x10625096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1062517d
add dl, dl
jne 0x106250a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106250b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106250bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106250c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106250d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10625075
mov eax, 1
add dl, dl
jne 0x106250ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106250f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106250e1
sub eax, ebx
mov ebx, 1
jne 0x10625128
mov ecx, 1
add dl, dl
jne 0x1062510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10625119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10625105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10625075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1062513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1062514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10625136
cmp eax, 0x7d00
jae 0x1062516d
cmp eax, 0x500
jb 0x10625168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10625075
cmp eax, 0x7f
ja 0x10625170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10625075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1062519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10625075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40371e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004043d6
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0040387e
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x403868
test ebx, ebx
jl 0x40380c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcb9b82
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40382d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x40381f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004051ee
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004051ee
add esp, 8
mov ebx, 0x80070057
jmp 0x40380c
Function at 0x41a70e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0041b3c6
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0041a86e
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41a858
test ebx, ebx
jl 0x41a7fc
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcd0b72
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41a81d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x41a80f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0041c1de
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0041c1de
add esp, 8
mov ebx, 0x80070057
jmp 0x41a7fc
Function at 0x43179e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00432456
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004318fe
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4318e8
test ebx, ebx
jl 0x43188c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce7c02
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4318ad
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x43189f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0043326e
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0043326e
add esp, 8
mov ebx, 0x80070057
jmp 0x43188c
Function at 0x4483de
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00449096
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0044853e
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x448528
test ebx, ebx
jl 0x4484cc
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcfe842
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4484ed
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4484df
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00449eae
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00449eae
add esp, 8
mov ebx, 0x80070057
jmp 0x4484cc
Function at 0x45f03e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0045fcf6
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0045f19e
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45f188
test ebx, ebx
jl 0x45f12c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd154a2
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45f14d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x45f13f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00460b0e
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00460b0e
add esp, 8
mov ebx, 0x80070057
jmp 0x45f12c
Function at 0x47603e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00476cf6
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0047619e
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x476188
test ebx, ebx
jl 0x47612c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2c4a2
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x47614d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x47613f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00477b0e
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00477b0e
add esp, 8
mov ebx, 0x80070057
jmp 0x47612c