joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4633d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov esi, esp
mov dword [esi + 8], ebp
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x14], ecx
mov eax, esp
mov dword [esi + 0x4c], eax
mov dword [esi + 0x58], 0xffffffff
lea eax, [esi + 0x50]
mov dword [esi + 0x54], 0x46f2c0
mov edx, dword fs:[0]
mov dword [esi + 0x50], edx
mov dword fs:[0], eax
add ecx, 0x10
mov eax, esp
mov dword [eax + 4], ecx
lea ecx, [esi + 0x28]
mov dword [eax], ecx
call fcn.004a85d0
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x28]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x34]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x24], eax
mov dword [esi + 0x58], 0
mov eax, esp
mov dword [eax + 4], ecx
lea ecx, [esi + 0x3c]
mov dword [eax], ecx
call fcn.004e96d0
jmp 0x46345b
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x24]
mov edi, dword [esi + 0x20]
mov ebx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x1c], edi
mov dword [ecx + 0x18], edx
movsd xmm0, qword [esi + 0x3c]
movsd xmm1, qword [esi + 0x44]
movsd qword [ecx + 8], xmm1
movsd qword [ecx], xmm0
mov ecx, dword [esi + 0x50]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4634b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov esi, esp
mov dword [esi + 4], ebp
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, esp
mov dword [esi + 0x54], eax
mov dword [esi + 0x60], 0xffffffff
lea eax, [esi + 0x58]
mov dword [esi + 0x5c], 0x46f2e0
mov ecx, dword fs:[0]
mov dword [esi + 0x58], ecx
mov dword fs:[0], eax
mov eax, esp
lea ecx, [esi + 0x20]
mov dword [eax], ecx
call fcn.004a8e60
mov eax, dword [esi + 0x28]
mov dword [esi + 0x10], eax
mov ecx, dword [esi + 0x2c]
mov dword [esi + 0x14], ecx
mov edx, dword [esi + 0x20]
mov dword [esi + 0x18], edx
mov edi, dword [esi + 0x24]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x48], eax
mov dword [esi + 0x60], 0
call fcn.004407f0
jmp 0x46352e
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x10]
mov edi, dword [esi + 0x14]
mov ebx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
movsd xmm0, qword [0x5fe068]
movsd qword [esi + 0x38], xmm0
movsd xmm0, qword [0x5fe060]
movsd qword [esi + 0x30], xmm0
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x1c], edi
mov dword [ecx + 0x18], edx
movsd xmm0, qword [esi + 0x30]
movsd xmm1, qword [esi + 0x38]
movsd qword [ecx + 8], xmm1
movsd qword [ecx], xmm0
mov ecx, dword [esi + 0x58]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x474000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
sub esp, 0x68
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x74]
mov dword [esp + 0x20], eax
mov esi, dword [esp + 0x70]
mov dword [esp + 0x24], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ecx
cmp eax, ecx
jne 0x474056
mov eax, dword [esp + 0x20]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], eax
jmp 0x47405d
mov byte [esp + 0x2b], 0
jmp 0x4740d1
lea eax, [esp + 0x2c]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x2c]
add eax, 4
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x2c]
cmp eax, dword [esp + 0x30]
jb 0x474089
mov byte [esp + 0x2b], 1
jmp 0x4740d1
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x60], eax
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0040d910
mov ecx, dword [esp + 0x20]
mov edx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], 1
mov eax, dword [esp + 0x38]
mov dword [esp + 0x14], eax
mov dword [esp + 0x64], eax
cmp eax, ecx
jb 0x4740dc
jmp 0x4740f9
mov al, byte [esp + 0x2b]
and al, 1
add esp, 0x68
pop esi
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov esi, eax
shl esi, 3
add edx, esi
mov dword [esp + 0xc], edx
cmp eax, ecx
jb 0x474114
jmp 0x474137
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
mov dword [eax + 8], 0x5fea78
call fcn.005f6c04
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
shl edx, 3
add eax, edx
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0043e990
test al, 1
jne 0x474157
jmp 0x474152
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
mov dword [eax + 8], 0x5fea88
call fcn.005f6c04
jmp 0x47405d
mov byte [esp + 0x2b], 0
jmp 0x4740d1
Function at 0x479b80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, esp
mov dword [esi + 0xc], ebp
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov ecx, dword [ebp + 8]
mov ecx, esp
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x48], 0xffffffff
lea ecx, [esi + 0x40]
mov dword [esi + 0x44], 0x47f970
mov edx, dword fs:[0]
mov dword [esi + 0x40], edx
mov dword fs:[0], ecx
add eax, 0x30
mov dword [esi + 0x18], eax
mov eax, esp
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], ecx
mov dword [eax], ecx
call fcn.0047f3b0
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x48], 0
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.0047e5d0
mov byte [esi + 0x1e], al
jmp 0x479bf4
mov al, byte [esi + 0x1e]
test al, 1
jne 0x479c15
jmp 0x479bfd
mov dword [esi + 0x48], 0xffffffff
lea eax, [esi + 0x20]
mov dword [esp], eax
call fcn.00410940
mov byte [esi + 0x1f], 0
jmp 0x479c47
mov dword [esi + 0x48], 0xffffffff
lea eax, [esi + 0x20]
mov dword [esp], eax
call fcn.00410940
mov ecx, dword [esi + 0x10]
add ecx, 0x158
lea eax, [0x5feb5c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0046ec60
and al, 1
mov byte [esi + 0x1f], al
mov al, byte [esi + 0x1f]
mov ecx, dword [esi + 0x40]
mov dword fs:[0], ecx
and al, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x479c80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 8], ebp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov ecx, esp
mov dword [esi + 0x34], ecx
mov dword [esi + 0x40], 0xffffffff
lea ecx, [esi + 0x38]
mov dword [esi + 0x3c], 0x47f990
mov edx, dword fs:[0]
mov dword [esi + 0x38], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
add eax, 0x30
mov dword [esi + 0x10], eax
mov eax, esp
lea ecx, [esi + 0x18]
mov dword [esi + 0xc], ecx
mov dword [eax], ecx
call fcn.0047f3b0
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x40], 0
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.0047e5d0
mov byte [esi + 0x17], al
jmp 0x479cf3
mov dword [esi + 0x40], 0xffffffff
mov eax, esp
lea ecx, [esi + 0x18]
mov dword [eax], ecx
call fcn.00410940
mov al, byte [esi + 0x17]
mov ecx, dword [esi + 0x38]
mov dword fs:[0], ecx
and al, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x479d40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, esp
mov dword [esi + 0xc], ebp
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov ecx, dword [ebp + 8]
mov ecx, esp
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x48], 0xffffffff
lea ecx, [esi + 0x40]
mov dword [esi + 0x44], 0x47f9b0
mov edx, dword fs:[0]
mov dword [esi + 0x40], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
add eax, 0x30
mov dword [esi + 0x18], eax
mov eax, esp
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], ecx
mov dword [eax], ecx
call fcn.0047f3b0
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x48], 0
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.004704c0
mov byte [esi + 0x1e], al
jmp 0x479db6
mov al, byte [esi + 0x1e]
test al, 1
jne 0x479dd7
jmp 0x479dbf
mov dword [esi + 0x48], 0xffffffff
lea eax, [esi + 0x20]
mov dword [esp], eax
call fcn.00410940
mov byte [esi + 0x1f], 0
jmp 0x479e0b
mov dword [esi + 0x48], 0xffffffff
lea eax, [esi + 0x20]
mov dword [esp], eax
call fcn.00410940
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
add ecx, 0x98
lea eax, [0x5fee18]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0054a8b0
and al, 1
mov byte [esi + 0x1f], al
mov al, byte [esi + 0x1f]
mov ecx, dword [esi + 0x40]
mov dword fs:[0], ecx
and al, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x479eb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 8], ebp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov ecx, esp
mov dword [esi + 0x34], ecx
mov dword [esi + 0x40], 0xffffffff
lea ecx, [esi + 0x38]
mov dword [esi + 0x3c], 0x47f9d0
mov edx, dword fs:[0]
mov dword [esi + 0x38], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
add eax, 0x30
mov dword [esi + 0x10], eax
mov eax, esp
lea ecx, [esi + 0x18]
mov dword [esi + 0xc], ecx
mov dword [eax], ecx
call fcn.0047f3b0
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x40], 0
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.0047e5d0
mov byte [esi + 0x17], al
jmp 0x479f23
mov dword [esi + 0x40], 0xffffffff
mov eax, esp
lea ecx, [esi + 0x18]
mov dword [eax], ecx
call fcn.00410940
mov al, byte [esi + 0x17]
mov ecx, dword [esi + 0x38]
mov dword fs:[0], ecx
and al, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47a0b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, esp
mov dword [esi + 0xc], ebp
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov ecx, dword [ebp + 8]
mov ecx, esp
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x48], 0xffffffff
lea ecx, [esi + 0x40]
mov dword [esi + 0x44], 0x47fa10
mov edx, dword fs:[0]
mov dword [esi + 0x40], edx
mov dword fs:[0], ecx
add eax, 0x30
mov dword [esi + 0x18], eax
mov eax, esp
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], ecx
mov dword [eax], ecx
call fcn.0047f410
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x48], 0
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.0047e5d0
mov byte [esi + 0x1e], al
jmp 0x47a124
mov al, byte [esi + 0x1e]
test al, 1
jne 0x47a145
jmp 0x47a12d
mov dword [esi + 0x48], 0xffffffff
lea eax, [esi + 0x20]
mov dword [esp], eax
call fcn.00410940
mov byte [esi + 0x1f], 0
jmp 0x47a177
mov dword [esi + 0x48], 0xffffffff
lea eax, [esi + 0x20]
mov dword [esp], eax
call fcn.00410940
mov ecx, dword [esi + 0x10]
add ecx, 0x158
lea eax, [0x5feb5c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0046ec60
and al, 1
mov byte [esi + 0x1f], al
mov al, byte [esi + 0x1f]
mov ecx, dword [esi + 0x40]
mov dword fs:[0], ecx
and al, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x47a1b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, esp
mov dword [esi + 0xc], ebp
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov ecx, dword [ebp + 8]
mov ecx, esp
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x48], 0xffffffff
lea ecx, [esi + 0x40]
mov dword [esi + 0x44], 0x47fa30
mov edx, dword fs:[0]
mov dword [esi + 0x40], edx
mov dword fs:[0], ecx
add eax, 0x30
mov dword [esi + 0x18], eax
mov eax, esp
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], ecx
mov dword [eax], ecx
call fcn.0047f410
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x48], 0
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.0047e5d0
mov byte [esi + 0x1e], al
jmp 0x47a224
mov al, byte [esi + 0x1e]
test al, 1
jne 0x47a245
jmp 0x47a22d
mov dword [esi + 0x48], 0xffffffff
lea eax, [esi + 0x20]
mov dword [esp], eax
call fcn.00410940
mov byte [esi + 0x1f], 0
jmp 0x47a26b
mov dword [esi + 0x48], 0xffffffff
mov eax, esp
lea ecx, [esi + 0x20]
mov dword [eax], ecx
call fcn.00410940
mov eax, dword [esi + 0x10]
movzx eax, byte [eax + 0x158]
sub eax, 2
jb 0x47a284
jmp 0x47a269
jmp 0x47a28a
mov al, byte [esi + 0x1f]
mov ecx, dword [esi + 0x40]
mov dword fs:[0], ecx
and al, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x1f], 1
jmp 0x47a26b
mov byte [esi + 0x1f], 0
jmp 0x47a26b
Function at 0x47a2e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 8], ebp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov ecx, esp
mov dword [esi + 0x34], ecx
mov dword [esi + 0x40], 0xffffffff
lea ecx, [esi + 0x38]
mov dword [esi + 0x3c], 0x47fa50
mov edx, dword fs:[0]
mov dword [esi + 0x38], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
add eax, 0x30
mov dword [esi + 0x10], eax
mov eax, esp
lea ecx, [esi + 0x18]
mov dword [esi + 0xc], ecx
mov dword [eax], ecx
call fcn.0047f410
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x40], 0
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.0047e5d0
mov byte [esi + 0x17], al
jmp 0x47a353
mov dword [esi + 0x40], 0xffffffff
mov eax, esp
lea ecx, [esi + 0x18]
mov dword [eax], ecx
call fcn.00410940
mov al, byte [esi + 0x17]
mov ecx, dword [esi + 0x38]
mov dword fs:[0], ecx
and al, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x482d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
sub esp, 0x7c
mov esi, dword [esp + 0x98]
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x94]
mov dword [esp + 0x28], eax
mov edi, dword [esp + 0x90]
mov dword [esp + 0x30], edi
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], eax
xor eax, eax
lea eax, [0x5ff970]
mov dword [esp], 0
mov dword [esp + 4], esi
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.00496020
mov ecx, dword [esp + 0x28]
mov edi, eax
mov dword [esp + 0x2c], edi
mov eax, edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x34], eax
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], eax
xor eax, eax
lea eax, [0x5ff980]
mov dword [esp], 0
mov dword [esp + 4], esi
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.00496020
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], edx
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x40], eax
jb 0x482e30
add esp, 0x7c
pop esi
pop edi
ret
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
cmp eax, ecx
jae 0x482e71
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x20]
shl esi, 4
add edx, esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x64], edx
sub eax, 1
sub eax, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
cmp eax, ecx
jb 0x482e8c
jmp 0x482f01
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x34]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
mov dword [eax + 8], 0x5ff990
call fcn.005f6c04
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x1c]
shl edx, 4
add eax, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x68], eax
mov edx, dword [ecx]
mov dword [esp + 0x6c], edx
mov edx, dword [ecx + 4]
mov dword [esp + 0x70], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x74], edx
mov edx, dword [ecx + 0xc]
mov dword [esp + 0x78], edx
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, dword [eax + 0xc]
mov dword [ecx + 0xc], edx
mov ecx, dword [esp + 0x6c]
mov dword [eax], ecx
mov ecx, dword [esp + 0x70]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x74]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x78]
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x40]
add eax, 1
mov dword [esp + 0x40], eax
jmp 0x482e20
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x3c]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
mov dword [eax + 8], 0x5ff9a0
call fcn.005f6c04
int3
Function at 0x49f470
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov esi, esp
mov dword [esi + 8], ebp
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x18], ecx
mov eax, esp
mov dword [esi + 0x7c], eax
mov dword [esi + 0x88], 0xffffffff
lea eax, [esi + 0x80]
mov dword [esi + 0x84], 0x4a06e0
mov edx, dword fs:[0]
mov dword [esi + 0x80], edx
mov dword fs:[0], eax
mov eax, esp
mov dword [eax], ecx
call fcn.00469980
mov cl, al
mov byte [esi + 0x17], cl
mov byte [esi + 0x7b], al
mov byte [esi + 0x23], 3
mov eax, esp
lea ecx, [esi + 0x24]
mov dword [eax], ecx
call fcn.005421e0
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x88], 0
mov eax, esp
mov dword [eax], ecx
call fcn.004696c0
mov dword [esi + 0x1c], eax
jmp 0x49f501
mov ecx, dword [esi + 0x1c]
mov eax, esp
mov dword [eax + 4], ecx
lea ecx, [esi + 0x48]
mov dword [eax], ecx
call fcn.00485f40
jmp 0x49f515
movsd xmm0, qword [esi + 0x58]
movsd qword [esi + 0x40], xmm0
movsd xmm0, qword [esi + 0x48]
movsd xmm1, qword [esi + 0x50]
movsd qword [esi + 0x38], xmm1
movsd qword [esi + 0x30], xmm0
mov eax, esp
lea ecx, [esi + 0x60]
mov dword [eax], ecx
call fcn.004b39f0
jmp 0x49f541
mov dword [esi + 0x88], 1
mov eax, esp
lea ecx, [esi + 0x6c]
mov dword [eax], ecx
call fcn.004b3930
jmp 0x49f559
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov dl, byte [esi + 0x17]
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dh, byte [esi + 0x23]
mov byte [ecx + 0x44], dh
mov edi, dword [esi + 0x2c]
mov dword [ecx + 0x28], edi
movsd xmm0, qword [esi + 0x24]
movsd qword [ecx + 0x20], xmm0
movsd xmm0, qword [esi + 0x40]
movsd qword [ecx + 0x18], xmm0
movsd xmm0, qword [esi + 0x30]
movsd xmm1, qword [esi + 0x38]
movsd qword [ecx + 0x10], xmm1
movsd qword [ecx + 8], xmm0
mov edi, dword [esi + 0x68]
mov dword [ecx + 0x34], edi
movsd xmm0, qword [esi + 0x60]
movsd qword [ecx + 0x2c], xmm0
mov edi, dword [esi + 0x74]
mov dword [ecx + 0x40], edi
movsd xmm0, qword [esi + 0x6c]
movsd qword [ecx + 0x38], xmm0
and dl, 1
mov byte [ecx + 0x45], dl
mov ecx, dword [esi + 0x80]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49f620
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov esi, esp
mov dword [esi + 4], ebp
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, esp
mov dword [esi + 0x54], eax
mov dword [esi + 0x60], 0xffffffff
lea eax, [esi + 0x58]
mov dword [esi + 0x5c], 0x4a0700
mov ecx, dword fs:[0]
mov dword [esi + 0x58], ecx
mov dword fs:[0], eax
mov byte [esi + 0x53], 0
mov byte [esi + 0x13], 3
mov eax, esp
lea ecx, [esi + 0x14]
mov dword [eax], ecx
call fcn.005421e0
mov dword [esi + 0x20], 0
mov dword [esi + 0x60], 0
mov eax, esp
lea ecx, [esi + 0x38]
mov dword [eax], ecx
call fcn.004b39f0
jmp 0x49f690
mov dword [esi + 0x60], 1
mov eax, esp
lea ecx, [esi + 0x44]
mov dword [eax], ecx
call fcn.004b3930
jmp 0x49f6a5
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dl, byte [esi + 0x13]
mov byte [ecx + 0x44], dl
mov edx, dword [esi + 0x1c]
mov dword [ecx + 0x28], edx
movsd xmm0, qword [esi + 0x14]
movsd qword [ecx + 0x20], xmm0
movsd xmm0, qword [esi + 0x30]
movsd qword [ecx + 0x18], xmm0
movsd xmm0, qword [esi + 0x20]
movsd xmm1, qword [esi + 0x28]
movsd qword [ecx + 0x10], xmm1
movsd qword [ecx + 8], xmm0
mov edx, dword [esi + 0x40]
mov dword [ecx + 0x34], edx
movsd xmm0, qword [esi + 0x38]
movsd qword [ecx + 0x2c], xmm0
mov edx, dword [esi + 0x4c]
mov dword [ecx + 0x40], edx
movsd xmm0, qword [esi + 0x44]
movsd qword [ecx + 0x38], xmm0
mov byte [ecx + 0x45], 0
mov ecx, dword [esi + 0x58]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4a49b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
sub esp, 0x84
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x9c]
mov eax, dword [esp + 0x98]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x38], eax
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], 1
mov dword [esp + 0x54], 1
mov dword [esp + 0x58], 1
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x28]
add eax, 0xffffffe8
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x24]
add eax, 0xffffffe8
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x20]
add eax, 0xffffffe8
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x9c], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0049ef60
mov byte [esp + 0x1f], al
mov cl, al
and cl, 1
mov byte [esp + 0x6b], cl
test al, 1
jne 0x4a4a9b
mov eax, dword [esp + 0x40]
mov dword [esp + 0x48], eax
jmp 0x4a4aa3
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 8
mov dword [esp + 0x10], 1
call fcn.00480ae0
mov bl, byte [esp + 0x1f]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x74], edx
mov bh, bl
xor bh, 0xff
and bh, 1
movzx esi, bh
mov dword [esp + 0x78], esi
imul esi, esi, 0x18
add edx, esi
mov dword [eax + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x7c], edx
and bl, 1
movzx esi, bl
mov dword [esp + 0x80], esi
imul esi, esi, 0x18
add edx, esi
mov dword [eax + 4], edx
cmp dword [eax + 8], ecx
je 0x4a4b60
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
cmp dword [eax + 4], ecx
jne 0x4a4b69
add esp, 0x84
pop esi
pop ebx
ret
jmp 0x4a4a0b