joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4358c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462439
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
mov edi, dword [ebp + 8]
mov dword [esi], 0x478dbc
xor eax, eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov ebx, dword [0x469700]
mov dword [ebp - 4], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
mov edx, dword [edi + 0x14]
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0xc], ecx
mov dl, byte [edi + 0x18]
mov byte [esi + 0x18], dl
mov al, byte [edi + 0x2c]
mov byte [esi + 0x2c], al
mov ecx, dword [edi + 0x1c]
push ecx
mov ecx, esi
call ebx
mov dword [esi + 0x1c], eax
mov edx, dword [edi + 0x20]
push edx
mov ecx, esi
call ebx
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
push eax
mov ecx, esi
call ebx
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x28]
push ecx
mov ecx, esi
call ebx
mov dword [esi + 0x28], eax
fld qword [edi + 0x40]
fstp qword [esi + 0x40]
mov eax, esi
fld qword [edi + 0x48]
fstp qword [esi + 0x48]
fld qword [edi + 0x50]
fstp qword [esi + 0x50]
fld qword [edi + 0x58]
fstp qword [esi + 0x58]
fld qword [edi + 0x60]
fstp qword [esi + 0x60]
fld qword [edi + 0x68]
fstp qword [esi + 0x68]
fld qword [edi + 0x70]
mov dword [esi + 0x78], 0
fstp qword [esi + 0x70]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x436ab0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4642f2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
call dword [0x4696ec]
mov edi, dword [ebp + 8]
mov dword [esi], 0x478dbc
xor eax, eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 4], 0xffffffff
cmp dword [edi + 0x4fc], eax
mov dword [ebp - 4], eax
setne cl
mov byte [esi + 0x2c], cl
mov edx, dword [edi + 0x504]
mov dword [esi + 0x10], edx
mov ecx, dword [edi + 0x500]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0x508]
mov dword [esi + 0x30], edx
mov ecx, dword [edi + 0x520]
mov dword [esi + 0xc], ecx
cmp dword [edi + 0x51c], eax
lea ecx, [ebp - 0x10]
setne dl
mov byte [esi + 0x18], dl
call dword [0x46a760]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00432e00
mov ebx, dword [0x4696fc]
push eax
mov ecx, esi
call ebx
lea ecx, [edi + 0x4f0]
push ecx
mov ecx, esi
mov dword [esi + 0x24], eax
call ebx
lea edx, [edi + 0x4ec]
push edx
mov ecx, esi
mov dword [esi + 0x1c], eax
call ebx
mov dword [esi + 0x20], eax
lea eax, [edi + 0x4f4]
push eax
mov ecx, esi
call ebx
push 0
mov dword [esi + 0x28], eax
call dword [0x4690ec]
fldz
fst qword [esi + 0x40]
mov dword [esi + 0x34], eax
fst qword [esi + 0x48]
mov dword [esi + 0x38], edx
fst qword [esi + 0x50]
add esp, 4
fst qword [esi + 0x58]
lea ecx, [ebp - 0x10]
fst qword [esi + 0x60]
fstp qword [esi + 0x68]
fld qword [edi + 0x528]
fstp qword [esi + 0x70]
mov dword [esi + 0x78], 0
call dword [0x46a768]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x439d10
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4649a8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x30]
test eax, eax
je 0x439d93
lea ecx, [ebp - 0x44]
call fcn.00451f90
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
mov ecx, edi
mov dword [ebp - 4], 0
call edx
push eax
push 0x65
push 0x64
lea ecx, [ebp - 0x44]
call fcn.004524d0
lea ecx, [ebp - 0x44]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00451fd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
mov ecx, edi
call edx
push eax
lea eax, [esi + 0xc]
push 0x47ad38
push eax
call dword [0x46a6f0]
add esp, 0xc
push 0x47ad28
lea ecx, [esi + 0x10]
call dword [0x46a764]
mov edx, dword [esi]
mov eax, dword [edx + 0x38]
mov ecx, esi
mov dword [ebp - 4], 1
call eax
cmp dword [esi + 0xc8], 0
jne 0x439e01
mov esi, dword [esi + 0x144]
mov eax, 0x66666667
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x442630
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462439
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
mov edi, dword [ebp + 8]
mov ebx, dword [0x469700]
mov dword [esi], 0x47cd9c
mov eax, dword [edi + 0xc]
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call ebx
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
push ecx
mov ecx, esi
call ebx
mov dword [esi + 0x10], eax
mov edx, dword [edi + 0x14]
push edx
mov ecx, esi
call ebx
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
push eax
mov ecx, esi
call ebx
mov dword [esi + 0x18], eax
mov ecx, dword [edi + 0x1c]
push ecx
mov ecx, esi
call ebx
mov dword [esi + 0x1c], eax
mov edx, dword [edi + 0x20]
push edx
mov ecx, esi
call ebx
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
push eax
mov ecx, esi
call ebx
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4426f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462439
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
mov edi, dword [ebp + 8]
mov ebx, dword [0x4696fc]
lea ecx, [edi + 0x124]
mov dword [esi], 0x47cd9c
mov eax, dword [edi + 0x114]
push ecx
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [esi + 4], eax
call ebx
lea edx, [edi + 0x128]
push edx
mov ecx, esi
mov dword [esi + 0xc], eax
call ebx
mov dword [esi + 0x10], eax
lea eax, [edi + 0x12c]
push eax
mov ecx, esi
call ebx
lea ecx, [edi + 0x130]
push ecx
mov ecx, esi
mov dword [esi + 0x14], eax
call ebx
lea edx, [edi + 0x148]
push edx
mov ecx, esi
mov dword [esi + 0x18], eax
call ebx
mov dword [esi + 0x24], eax
lea eax, [edi + 0x134]
push eax
mov ecx, esi
call ebx
lea ecx, [edi + 0x138]
push ecx
mov ecx, esi
mov dword [esi + 0x1c], eax
call ebx
mov dword [esi + 0x20], eax
mov edx, dword [edi + 0x13c]
mov dword [esi + 0x28], edx
mov eax, dword [edi + 0x140]
mov dword [esi + 0x2c], eax
mov ecx, dword [edi + 0x144]
mov dword [esi + 0x30], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x442c80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462439
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
mov edi, dword [ebp + 8]
mov ebx, dword [0x469700]
mov dword [esi], 0x47d094
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov cl, byte [edi + 0x10]
mov byte [esi + 0x10], cl
fld qword [edi + 0x18]
fstp qword [esi + 0x18]
mov edx, dword [edi + 0x20]
push edx
mov ecx, esi
mov dword [ebp - 4], 0
call ebx
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
push eax
mov ecx, esi
call ebx
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x28]
push ecx
mov ecx, esi
call ebx
mov dword [esi + 0x28], eax
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov ecx, dword [edi + 0x30]
push ecx
mov ecx, esi
call ebx
mov dword [esi + 0x30], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x442d30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462439
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
mov edi, dword [ebp + 8]
mov ebx, dword [0x469700]
mov dword [esi], 0x47d094
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov cl, byte [edi + 0x10]
mov byte [esi + 0x10], cl
fld qword [edi + 0x18]
lea edx, [edi + 0x8e]
fstp qword [esi + 0x18]
push edx
mov ecx, esi
mov dword [ebp - 4], 0
call ebx
mov dword [esi + 0x20], eax
lea eax, [edi + 0x48]
push eax
mov ecx, esi
call ebx
lea ecx, [edi + 0x20]
push ecx
mov ecx, esi
mov dword [esi + 0x24], eax
call ebx
mov dword [esi + 0x28], eax
mov edx, dword [edi]
mov dword [esi + 4], edx
mov eax, dword [edi + 8]
add edi, 0x98
push edi
mov ecx, esi
mov dword [esi + 0x2c], eax
call ebx
mov dword [esi + 0x30], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x442de0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462439
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
mov edi, dword [ebp + 8]
mov ebx, dword [0x469700]
mov dword [esi], 0x47d094
mov eax, dword [edi]
mov dword [esi + 0xc], eax
mov cl, byte [edi + 4]
mov byte [esi + 0x10], cl
fld qword [edi + 8]
lea edx, [edi + 0x10]
fstp qword [esi + 0x18]
push edx
mov ecx, esi
mov dword [ebp - 4], 0
call ebx
mov dword [esi + 0x20], eax
lea eax, [edi + 0x1b]
push eax
mov ecx, esi
call ebx
lea ecx, [edi + 0x62]
push ecx
mov ecx, esi
mov dword [esi + 0x24], eax
call ebx
mov dword [esi + 0x28], eax
mov edx, dword [edi + 0xac]
mov dword [esi + 4], edx
mov eax, dword [edi + 0xb4]
push 0x46ac00
mov ecx, esi
mov dword [esi + 0x2c], eax
call dword [0x4698dc]
mov dword [esi + 0x30], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x442ea0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462439
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
mov edi, dword [ebp + 8]
mov ebx, dword [0x4696fc]
mov dword [esi], 0x47d094
mov eax, dword [edi + 0x130]
mov dword [esi + 0xc], eax
mov cl, byte [edi + 0x138]
mov byte [esi + 0x10], cl
fld qword [edi + 0x128]
lea edx, [edi + 0x134]
fstp qword [esi + 0x18]
push edx
mov ecx, esi
mov dword [ebp - 4], 0
call ebx
mov dword [esi + 0x20], eax
lea eax, [edi + 0x13c]
push eax
mov ecx, esi
call ebx
lea ecx, [edi + 0x140]
push ecx
mov ecx, esi
mov dword [esi + 0x24], eax
call ebx
mov dword [esi + 0x28], eax
mov edx, dword [edi + 0x114]
mov dword [esi + 4], edx
mov eax, dword [edi + 0x144]
add edi, 0x148
push edi
mov ecx, esi
mov dword [esi + 0x2c], eax
call ebx
mov dword [esi + 0x30], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x442f70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462439
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
mov edi, dword [ebp + 8]
mov ebx, dword [0x4696fc]
mov dword [esi], 0x47d094
movzx eax, byte [edi + 0xa0]
mov dword [esi + 0xc], eax
mov cl, byte [edi + 0xa8]
mov byte [esi + 0x10], cl
lea edx, [edi + 0xa4]
fld qword [edi + 0x98]
push edx
mov ecx, esi
fstp qword [esi + 0x18]
mov dword [ebp - 4], 0
call ebx
mov dword [esi + 0x20], eax
lea eax, [edi + 0xac]
push eax
mov ecx, esi
call ebx
lea ecx, [edi + 0xb0]
push ecx
mov ecx, esi
mov dword [esi + 0x24], eax
call ebx
mov dword [esi + 0x28], eax
mov edx, dword [edi + 0xb4]
add edi, 0xb8
push edi
mov ecx, esi
mov dword [esi + 0x2c], edx
call ebx
mov dword [esi + 0x30], eax
mov dword [esi + 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x444650
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ed39
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x49f94c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, ecx
mov eax, dword [edi + 0x1c]
push eax
lea ecx, [ebp - 0x24]
call dword [0x469eac]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
mov eax, dword [0x4699dc]
mov dword [ebp - 0x18], 0x2bc
mov ecx, dword [eax]
push ecx
mov ecx, esi
call edx
mov ebx, dword [esi]
mov dword [ebp - 0x2c], eax
push 0x410
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
call dword [0x469e78]
push eax
lea ecx, [ebp - 0x24]
call dword [0x46a710]
mov edx, dword [ebx + 0x70]
push eax
mov ecx, esi
call edx
mov ebx, eax
mov eax, dword [edi + 0x18]
push eax
lea ecx, [ebp - 0x24]
call dword [0x46a764]
mov ecx, dword [esi]
push 0x410
lea edx, [ebp - 0x20]
mov dword [ebp - 0x28], ecx
push edx
lea ecx, [ebp - 0x24]
call dword [0x469e78]
push eax
lea ecx, [ebp - 0x24]
call dword [0x46a710]
push eax
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x70]
mov ecx, esi
call edx
mov edi, dword [edi + 0x10]
cmp byte [edi], 0
mov ecx, eax
mov dword [ebp - 0x28], ecx
je 0x44477c
push edi
lea ecx, [ebp - 0x24]
call dword [0x46a764]
mov edi, dword [esi]
push 0x410
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x20], 0x64
mov dword [ebp - 0x18], 0x190
call dword [0x469e78]
push eax
lea ecx, [ebp - 0x24]
call dword [0x46a710]
mov edx, dword [edi + 0x70]
push eax
mov ecx, esi
call edx
mov ecx, eax
mov eax, dword [0x4699d0]
mov eax, dword [eax]
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, ecx
add dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, ecx
cdq
mov edi, eax
xor edi, edx
sub edi, edx
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp edi, eax
jle 0x444792
mov ebx, ecx
cmp ebx, 0xffffff88
jle 0x44479c
mov ebx, 0xffffff88
mov ecx, dword [0x469a60]
mov eax, dword [ecx]
lea eax, [eax + eax*4]
cdq
sub eax, edx
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
sar eax, 1
add ebx, eax
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, esi
call edx
lea ecx, [ebp - 0x24]
call dword [0x46a768]
mov eax, ebx
neg eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045dff2
mov esp, ebp
pop ebp
ret 4
Function at 0x446ce0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465f64
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
push 0xa
lea ecx, [esi + 0x48]
mov dword [ebp - 4], 0
mov dword [esi], 0x47e674
call fcn.0045d8fc
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov ebx, dword [0x469700]
mov dword [esi + 4], eax
mov ecx, dword [edi + 0xc]
push ecx
mov ecx, esi
mov byte [ebp - 4], 1
call ebx
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0x10]
push edx
mov ecx, esi
call ebx
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
push eax
mov ecx, esi
call ebx
mov dword [esi + 0x14], eax
mov ecx, dword [edi + 0x18]
push ecx
mov ecx, esi
call ebx
mov dword [esi + 0x18], eax
mov edx, dword [edi + 0x1c]
push edx
mov ecx, esi
call ebx
mov dword [esi + 0x1c], eax
fld qword [edi + 0x20]
fstp qword [esi + 0x20]
fld qword [edi + 0x28]
fstp qword [esi + 0x28]
fld qword [edi + 0x30]
fstp qword [esi + 0x30]
mov al, byte [edi + 0x38]
mov byte [esi + 0x38], al
mov cl, byte [edi + 0x39]
mov byte [esi + 0x39], cl
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x44], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x446dd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f5f9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
xor ebx, ebx
push 0xa
lea ecx, [esi + 0x48]
mov dword [ebp - 4], ebx
mov dword [esi], 0x47e674
call fcn.0045d8fc
fldz
fst qword [esi + 0x20]
mov dword [esi + 4], 0xffffffff
fst qword [esi + 0x28]
mov dword [esi + 0xc], ebx
fstp qword [esi + 0x30]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov word [esi + 0x38], bx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446f10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465f64
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
push 0xa
lea ecx, [esi + 0x48]
mov dword [ebp - 4], 0
mov dword [esi], 0x47e674
call fcn.0045d8fc
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x114]
mov ebx, dword [0x4696fc]
lea ecx, [edi + 0x130]
push ecx
mov ecx, esi
mov byte [ebp - 4], 1
mov dword [esi + 4], eax
call ebx
lea edx, [edi + 0x134]
push edx
mov ecx, esi
mov dword [esi + 0xc], eax
call ebx
mov dword [esi + 0x10], eax
lea eax, [edi + 0x144]
push eax
mov ecx, esi
call ebx
lea ecx, [edi + 0x154]
push ecx
mov ecx, esi
mov dword [esi + 0x14], eax
call ebx
lea edx, [edi + 0x150]
push edx
mov ecx, esi
mov dword [esi + 0x18], eax
call ebx
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x140]
mov dword [esi + 0x3c], eax
mov ecx, dword [edi + 0x160]
mov dword [esi + 0x40], ecx
fld qword [edi + 0x148]
fstp qword [esi + 0x20]
fld qword [edi + 0x158]
fstp qword [esi + 0x28]
fld qword [edi + 0x138]
fstp qword [esi + 0x30]
cmp dword [edi + 0x12c], 0
setne dl
mov byte [esi + 0x38], dl
cmp dword [edi + 0x128], 0
setne al
mov byte [esi + 0x39], al
mov ecx, dword [edi + 0x124]
mov dword [esi + 0x44], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x447710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462439
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49f94c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [0x4696ec]
mov edi, dword [ebp + 8]
mov ebx, dword [0x4696fc]
lea eax, [edi + 0x134]
push eax
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [esi], 0x47e9f4
call ebx
lea ecx, [edi + 0x138]
push ecx
mov ecx, esi
mov dword [esi + 0xc], eax
call ebx
lea edx, [edi + 0x144]
push edx
mov ecx, esi
mov dword [esi + 0x10], eax
call ebx
lea ecx, [edi + 0x13c]
push 0x20
mov dword [esi + 0x1c], eax
call dword [0x46a524]
lea eax, [edi + 0x13c]
push eax
mov ecx, esi
call ebx
lea ecx, [edi + 0x140]
push 0x20
mov dword [esi + 0x14], eax
call dword [0x46a524]
lea eax, [edi + 0x140]
push eax
mov ecx, esi
call ebx
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x12c]
lea ecx, [edi + 0x130]
push 0x20
mov dword [esi + 0x24], eax
call dword [0x46a524]
lea eax, [edi + 0x130]
push eax
mov ecx, esi
call ebx
lea ecx, [edi + 0x150]
push 0x20
mov dword [esi + 0x28], eax
call dword [0x46a524]
lea eax, [edi + 0x150]
push eax
mov ecx, esi
call ebx
lea ecx, [edi + 0x154]
push 0x20
mov dword [esi + 0x20], eax
call dword [0x46a524]
lea eax, [edi + 0x154]
push eax
mov ecx, esi
call ebx
lea ecx, [edi + 0x17c]
push 0x20
mov dword [esi + 0x2c], eax
call dword [0x46a524]
lea eax, [edi + 0x17c]
push eax
mov ecx, esi
call ebx
mov dword [esi + 0x64], eax
fld qword [edi + 0x148]
fstp qword [esi + 0x38]
mov ecx, dword [edi + 0x114]
mov dword [esi + 4], ecx
mov edx, dword [edi + 0x118]
mov dword [esi + 0x30], edx
mov eax, dword [edi + 0x11c]
mov dword [esi + 0x34], eax
cmp eax, 0x989680
jle 0x447864
mov dword [esi + 0x34], 0
lea ecx, [edi + 0x178]
push 0x20
call dword [0x46a524]
lea eax, [edi + 0x178]
push eax
mov ecx, esi
call ebx
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x158]
mov dword [esi + 0x40], eax
mov ecx, dword [edi + 0x15c]
mov dword [esi + 0x44], ecx
mov edx, dword [edi + 0x160]
mov dword [esi + 0x48], edx
fld qword [edi + 0x168]
fstp qword [esi + 0x50]
mov eax, esi
fld qword [edi + 0x170]
fstp qword [esi + 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4