joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4314d2
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x4509f8]
xor eax, ebp
mov dword [ebp + 0x3a0], eax
push ebx
push esi
push edi
mov edi, dword [0x450c60]
mov eax, 0x104
push eax
mov dword [ebp - 0x80], eax
xor ebx, ebx
lea eax, [ebp + 0x198]
push eax
push ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov esi, 0x208
test eax, eax
jne 0x431534
push esi
lea eax, [ebp + 0x198]
push ebx
push eax
call fcn.00408720
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x198]
push eax
call main
test eax, eax
jns 0x431552
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.kernel32.dll_GetComputerNameW]
test eax, eax
jne 0x43156d
lea eax, [ebp - 0x70]
mov byte [eax], bl
inc eax
dec esi
jne 0x431567
push ebx
lea eax, [ebp - 0x74]
push eax
call main
push dword [ebp - 0x74]
xor esi, esi
push 0x44cd5e
inc esi
push esi
call fcn.0043144a
mov eax, dword [ebp - 0x7c]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x78]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
lea eax, [ebp + 0x198]
push eax
push 0x44cd40
push esi
call fcn.0043144a
lea eax, [ebp - 0x70]
push eax
push 0x44cd30
push esi
call fcn.0043144a
mov eax, dword [0x450c5c]
add esp, 0x34
sub eax, ebx
je 0x4315ec
dec eax
je 0x4315e4
dec eax
je 0x4315dc
dec eax
jne 0x4315f2
mov edi, dword [0x450c6c]
jmp 0x4315f2
mov edi, dword [0x450c68]
jmp 0x4315f2
mov edi, dword [0x450c64]
jmp 0x4315f2
mov edi, dword [0x450c70]
push edi
push 0x44cd14
push esi
call fcn.0043144a
add esp, 0xc
cmp dword [ebp - 0x74], ebx
pop edi
pop esi
pop ebx
je 0x431611
push dword [ebp - 0x74]
call fcn.0042ee18
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
xor eax, eax
call fcn.00408498
add ebp, 0x3a4
leave
ret
Function at 0x434bd6
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x120
mov eax, dword [0x4509f8]
xor eax, ebp
mov dword [ebp + 0x6c], eax
push ebx
mov ebx, dword [ebp + 0x7c]
push edi
mov edi, dword [ebp + 0x78]
push 0x11c
lea eax, [ebp - 0xb0]
push 0
push eax
call fcn.00408720
add esp, 0xc
cmp dword [0x451c50], 0
jne 0x434ce7
lea eax, [ebp - 0xb0]
push eax
mov dword [ebp - 0xb0], 0x11c
call dword [sym.imp.kernel32.dll_GetVersionExW]
movzx eax, word [ebp + 0x64]
movzx ecx, word [ebp + 0x66]
shl eax, 0x10
or eax, ecx
cmp dword [ebp - 0xac], 4
mov dword [0x451c54], eax
jne 0x434c59
mov dword [0x451c50], 1
jmp 0x434ce7
cmp dword [ebp - 0xac], 5
jne 0x434ca6
cmp dword [ebp - 0xa8], 0
jne 0x434c77
mov dword [0x451c50], 2
jmp 0x434ce7
cmp dword [ebp - 0xa8], 1
jne 0x434c8c
mov dword [0x451c50], 3
jmp 0x434ce7
xor eax, eax
cmp dword [ebp - 0xa8], 2
setne al
dec eax
and eax, 0xfffffffb
add eax, 9
mov dword [0x451c50], eax
jmp 0x434ce7
cmp dword [ebp - 0xac], 6
jne 0x434cdd
cmp dword [ebp - 0xa8], 0
jne 0x434cc6
xor eax, eax
cmp byte [ebp + 0x6a], 1
setne al
add eax, 5
jmp 0x434c9f
cmp dword [ebp - 0xa8], 1
jne 0x434cdd
xor eax, eax
cmp byte [ebp + 0x6a], 1
setne al
add eax, 7
jmp 0x434c9f
mov dword [0x451c50], 9
mov eax, dword [0x451c50]
mov ecx, dword [ebp + 0x6c]
mov dword [edi], eax
mov eax, dword [0x451c54]
pop edi
mov dword [ebx], eax
xor ecx, ebp
pop ebx
call fcn.00408498
add ebp, 0x70
leave
ret 8
Function at 0x434f34
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0xf98]
mov eax, 0x1018
call fcn.0040b8c0
mov eax, dword [0x4509f8]
xor eax, ebp
mov dword [ebp + 0xf94], eax
mov eax, dword [ebp + 0xfa0]
push ebx
mov ebx, dword [ebp + 0xfb0]
push esi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0xfa4]
xor esi, esi
push edi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], esi
xor edi, edi
mov ecx, dword [ebp + 0xfa8]
xor edx, edx
cmp ecx, edx
jne 0x434f94
cmp dword [ebp + 0xfac], edx
jne 0x434f94
mov dword [ebp - 0x74], 0x1000
jmp 0x434fbc
mov eax, dword [ebp + 0xfac]
sub ecx, edi
sbb eax, esi
cmp eax, edx
jb 0x434fb6
ja 0x434fac
cmp ecx, 0x1000
jbe 0x434fb6
mov ecx, 0x1000
mov dword [ebp - 0x74], edx
jmp 0x434fb9
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x74], ecx
push edx
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x435039
cmp dword [ebp - 0x74], 0
je 0x434ff1
push dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x80]
call main
mov dword [ebp - 0x70], eax
test eax, eax
js 0x43501c
add edi, dword [ebp - 0x74]
adc esi, 0
cmp esi, dword [ebp + 0xfac]
ja 0x435013
jb 0x435009
cmp edi, dword [ebp + 0xfa8]
jae 0x435013
cmp dword [ebp - 0x74], 0
jne 0x434f77
test ebx, ebx
je 0x43501c
mov dword [ebx], edi
mov dword [ebx + 4], esi
mov ecx, dword [ebp + 0xf94]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408498
add ebp, 0xf98
leave
ret 0x14
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jle 0x43504d
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x70], eax
test eax, eax
jl 0x43505b
mov dword [ebp - 0x70], 0x80004005
push dword [ebp - 0x70]
push 0x36c
push 0x44d0b8
call fcn.0043180e
jmp 0x43501c

Function at 0x435a6c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push dword [esp + 8]
xor esi, esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x435a91
test al, 0x10
je 0x435a91
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x435a8e
mov dword [ecx], eax
xor esi, esi
inc esi
mov eax, esi
pop esi
ret 8
Function at 0x435a98
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push ebp
push ebx
xor esi, esi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
jne 0x435b5f
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x435b5f
cmp eax, 3
je 0x435adc
push esi
push ebx
call fcn.00435a6c
test eax, eax
jne 0x435b5f
movzx eax, word [ebx]
push edi
xor edi, edi
mov ecx, ebx
test ax, ax
je 0x435b00
cmp ax, 0x5c
jne 0x435af1
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x435ae9
test edi, edi
jne 0x435b14
mov esi, 0x80070003
push esi
push 0x7a
push 0x44d0ec
call fcn.0043180e
jmp 0x435b5e
push ebp
xor eax, eax
push ebx
mov word [edi], ax
call fcn.00435a98
mov esi, eax
push 0x5c
pop eax
mov word [edi], ax
test esi, esi
js 0x435b5e
push ebp
push ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
jne 0x435b5c
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x435b4a
xor esi, esi
inc esi
jmp 0x435b5e
test eax, eax
jle 0x435b58
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x435b5e
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x436e9a
Capabilities:
Parse url

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x23f0]
mov eax, 0x2470
call fcn.0040b8c0
mov eax, dword [0x4509f8]
xor eax, ebp
mov dword [ebp + 0x23ec], eax
mov eax, dword [ebp + 0x23f8]
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x2404]
push ebx
mov ebx, dword [ebp + 0x23fc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x2408]
push esi
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x240c]
push edi
mov edi, dword [ebp + 0x2400]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x2410]
push 0x3c
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x2414]
pop esi
push esi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00408720
mov dword [ebp - 0x80], esi
xor esi, esi
add esp, 0xc
cmp edi, esi
je 0x436f2f
lea eax, [ebp + 0x1fe0]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 0x101
mov eax, 0x81
cmp dword [ebp - 0x38], esi
je 0x436f45
lea ecx, [ebp + 0x22e8]
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x34], esi
je 0x436f56
lea ecx, [ebp + 0x21e4]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], eax
mov eax, 0x801
cmp dword [ebp - 0x3c], esi
je 0x436f6c
lea ecx, [ebp + 0xfdc]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x30], esi
je 0x436f7a
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x80]
push eax
push 0x90000000
push esi
push dword [ebp - 0x44]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x436fc7
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, esi
jle 0x436fa5
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x2c], eax
cmp eax, esi
jl 0x436fb3
mov dword [ebp - 0x2c], 0x80004005
push dword [ebp - 0x2c]
push 0x5e
push 0x44d2c4
call fcn.0043180e
jmp 0x437059
cmp ebx, esi
je 0x436fd0
mov eax, dword [ebp - 0x74]
mov dword [ebx], eax
cmp edi, esi
je 0x436fe7
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push edi
call main
mov dword [ebp - 0x2c], eax
cmp eax, esi
jl 0x437059
mov eax, dword [ebp - 0x40]
cmp eax, esi
je 0x436ff5
mov cx, word [ebp - 0x68]
mov word [eax], cx
cmp dword [ebp - 0x38], esi
je 0x43700f
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push dword [ebp - 0x38]
call main
mov dword [ebp - 0x2c], eax
cmp eax, esi
jl 0x437059
cmp dword [ebp - 0x34], esi
je 0x437029
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x34]
call main
mov dword [ebp - 0x2c], eax
cmp eax, esi
jl 0x437059
cmp dword [ebp - 0x3c], esi
je 0x437043
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebp - 0x3c]
call main
mov dword [ebp - 0x2c], eax
cmp eax, esi
jl 0x437059
cmp dword [ebp - 0x30], esi
je 0x437059
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x30]
call main
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 0x23ec]
mov eax, dword [ebp - 0x2c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408498
add ebp, 0x23f0
leave
ret 0x20
Function at 0x40e440
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x40e471
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x40e460
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x410f60
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x41116f
cmp eax, 0x7c
je 0x41116f
cmp eax, 0x29
jne 0x410f98
cmp dword [esi + 0x10], 0
jne 0x41116f
test dword [esi + 0x50], 0x10000000
je 0x41117c
cmp eax, 0x2e
jne 0x410ff5
push 5
lea ecx, [esi + 0x24]
call fcn.00411360
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x410fe9
cmp word [eax], 0x5c
jne 0x410fe6
add eax, 2
cmp eax, ecx
je 0x410fe6
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x410fd2
movzx edx, word [eax]
cmp edx, 0x28
je 0x410fe4
cmp edx, 0x29
je 0x410fe4
test cl, 0x10
jne 0x410fe6
movzx ecx, word [eax]
cmp ecx, 0x7b
je 0x410fe4
cmp ecx, 0x7d
jne 0x410fe6
mov dword [esi], eax
add dword [esi], 2
mov ecx, esi
call fcn.0040ff50
jmp 0x41115a
cmp eax, 0x5c
jne 0x41105c
mov ecx, esi
call fcn.00410f10
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x411028
cmp word [esi + 0x48], 0x62
jne 0x411028
push 4
lea ecx, [esi + 0x24]
call fcn.00411360
mov ecx, esi
call fcn.00410f10
jmp 0x411161
test eax, eax
je 0x411050
cmp word [esi + 0x48], 0x42
jne 0x411050
push 4
lea ecx, [esi + 0x24]
call fcn.00411360
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00410f10
jmp 0x411161
mov ecx, esi
call fcn.00412260
jmp 0x41115a
cmp eax, 0x5b
jne 0x4110ba
mov ecx, esi
call fcn.00410f10
lea ecx, [esi + 0x24]
call fcn.00412e00
cmp dword [esi + 0x4c], 0x5e
jne 0x411084
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00410f10
test dword [esi + 0x50], 0x20000000
je 0x4110a4
cmp dword [esi + 0x4c], 0x5d
jne 0x4110a4
push 0x5d
lea ecx, [esi + 0x24]
call fcn.004138c0
mov ecx, esi
call fcn.00410f10
mov ecx, esi
call fcn.004129f0
cmp dword [esi + 0x4c], 0x5d
je 0x411153
jmp 0x411175
cmp eax, 0x28
jne 0x4110e6
mov ecx, esi
call fcn.00410f10
mov ecx, esi
call fcn.004123b0
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x41117c
mov ecx, esi
call fcn.00410f10
test bl, bl
je 0x411161
jmp 0x41115a
cmp eax, 0x5e
jne 0x4110fe
push 2
lea ecx, [esi + 0x24]
call fcn.00411360
mov ecx, esi
call fcn.00410f10
jmp 0x411161
cmp eax, 0x24
jne 0x411116
push 3
lea ecx, [esi + 0x24]
call fcn.00411360
mov ecx, esi
call fcn.00410f10
jmp 0x411161
cmp eax, 0x2a
je 0x41118a
cmp eax, 0x2b
je 0x41118a
cmp eax, 0x3f
je 0x41118a
cmp eax, 0x7b
je 0x41118a
cmp eax, 0x7d
jne 0x411138
test dword [esi + 0x50], 0x10000000
je 0x411183
cmp eax, 0x5d
jne 0x411146
test dword [esi + 0x50], 0x10000000
je 0x411175
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004125b0
mov ecx, esi
call fcn.00410f10
mov ecx, esi
call fcn.00412470
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x410f73
pop edi
pop esi
mov al, cl
pop ebx
ret
push 4
call fcn.0053ea28
push 5
call fcn.0053ea28
push 6
call fcn.0053ea28
push 0xa
call fcn.0053ea28
int3
Function at 0x415320
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x648322
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x6dc0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0
call fcn.0053efc8
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
jne 0x4153b4
mov dword [ebp - 0x18], str.bad_locale_name
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.004152f0
push eax
push esi
call fcn.0053ed19
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x416310
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6484cb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6dc0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0x6aa5dc
mov dword [esi + 8], 0
mov dword [esi], 0x6aa614
mov dword [esi + 4], 0x6aa630
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 0
push 8
mov dword [esi + 0x18], 0
call fcn.00545b74
mov dword [esi + 0x18], eax
add esp, 4
mov dword [esi + 0x1c], 0
xor ecx, ecx
mov dword [esi + 0x20], 3
mov word [eax], cx
mov eax, esi
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], ecx
mov word [esi + 0x58], cx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a4e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x648b76
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6dc0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov edx, 2
mov eax, dword [ebx]
mov dword [edi], eax
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0x1c], eax
mov esi, dword [ebx + 0x24]
mov dword [edi + 0x20], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], esi
mov dword [edi + 0x28], esi
mov ecx, dword [ebx + 0x24]
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebx + 0x20]
push eax
call fcn.005e0850
add esp, 0x10
mov dword [ebp - 4], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov esi, dword [ebx + 0x30]
test esi, esi
je 0x41a5b4
push esi
call fcn.00545b74
push esi
mov dword [edi + 0x2c], eax
push dword [ebx + 0x2c]
push eax
call fcn.005e0850
add esp, 0x10
mov dword [edi + 0x30], esi
mov byte [ebp - 4], 1
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov esi, dword [ebx + 0x38]
test esi, esi
je 0x41a5e6
push esi
call fcn.00545b74
push esi
mov dword [edi + 0x34], eax
push dword [ebx + 0x34]
push eax
call fcn.005e0850
add esp, 0x10
mov dword [edi + 0x38], esi
mov eax, dword [ebx + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [ebx + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [ebx + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [ebx + 0x48]
mov dword [edi + 0x48], eax
mov al, byte [ebx + 0x4c]
mov byte [edi + 0x4c], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41e400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64920f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6dc0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 8
mov dword [esi], 0
call fcn.00545b74
xor ecx, ecx
mov dword [esi], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 3
mov word [eax], cx
mov dword [ebp - 4], ecx
push 8
mov dword [esi + 0xc], ecx
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 3
mov word [eax], cx
mov byte [ebp - 4], 1
push 8
mov dword [esi + 0x18], ecx
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 3
mov word [eax], cx
mov byte [ebp - 4], 2
push 8
mov dword [esi + 0x24], ecx
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 3
mov word [eax], cx
mov byte [ebp - 4], 3
push 8
mov dword [esi + 0x30], ecx
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 3
mov word [eax], cx
mov byte [ebp - 4], 4
mov byte [esi + 0x3c], cl
push 8
mov dword [esi + 0x40], ecx
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 3
mov word [eax], cx
mov byte [ebp - 4], 5
push 8
mov dword [esi + 0x4c], ecx
call fcn.00545b74
add esp, 0x1c
mov dword [esi + 0x4c], eax
xor ecx, ecx
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 3
mov word [eax], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4218a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6496ff
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6dc0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
xor ecx, ecx
mov edx, 2
mov esi, dword [edi + 4]
mov dword [ebx], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [ebx], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov ecx, dword [edi + 4]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi]
push eax
call fcn.005e0850
mov dword [ebp - 4], 0
xor ecx, ecx
mov esi, dword [edi + 0x10]
mov edx, 2
mov dword [ebx + 0xc], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], esi
mov ecx, dword [edi + 0x10]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi + 0xc]
push eax
call fcn.005e0850
mov byte [ebp - 4], 1
xor ecx, ecx
mov esi, dword [edi + 0x1c]
mov edx, 2
mov dword [ebx + 0x18], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], esi
mov ecx, dword [edi + 0x1c]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi + 0x18]
push eax
call fcn.005e0850
mov byte [ebp - 4], 2
xor ecx, ecx
mov esi, dword [edi + 0x28]
mov edx, 2
mov dword [ebx + 0x24], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], esi
mov dword [ebx + 0x2c], esi
mov ecx, dword [edi + 0x28]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi + 0x24]
push eax
call fcn.005e0850
add esp, 0x40
mov byte [ebp - 4], 3
xor ecx, ecx
mov esi, dword [edi + 0x34]
mov edx, 2
mov dword [ebx + 0x30], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x38], esi
mov ecx, dword [edi + 0x34]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi + 0x30]
push eax
call fcn.005e0850
mov byte [ebp - 4], 4
xor ecx, ecx
mov al, byte [edi + 0x3c]
mov edx, 2
mov byte [ebx + 0x3c], al
mov esi, dword [edi + 0x44]
mov dword [ebx + 0x40], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], esi
mov dword [ebx + 0x48], esi
mov ecx, dword [edi + 0x44]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi + 0x40]
push eax
call fcn.005e0850
mov byte [ebp - 4], 5
xor ecx, ecx
mov esi, dword [edi + 0x50]
mov edx, 2
mov dword [ebx + 0x4c], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x50], esi
mov dword [ebx + 0x54], esi
mov ecx, dword [edi + 0x50]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi + 0x4c]
push eax
call fcn.005e0850
add esp, 0x30
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4