joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d2130
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d224e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 9
call sub.user32.dll_MapVirtualKeyA
push eax
push 9
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0xd
call sub.user32.dll_MapVirtualKeyA
push eax
push 0xd
call sub.user32.dll_keybd_event
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x4d215a
call sub.user32.dll_GetDesktopWindow
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4d222d
push 5
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4d222d
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.00404d54
mov eax, dword [ebp - 0x114]
mov ecx, 2
xor edx, edx
call fcn.00405004
mov eax, dword [ebp - 0xc]
call fcn.00404fa4
mov edx, 0x4d225c
call fcn.0040a134
test eax, eax
jne 0x4d2219
push 0
push 0
push 0x10
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_PostMessageA
push 2
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d21b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2255
lea eax, [ebp - 0x114]
call fcn.00404ae4
lea eax, [ebp - 0xc]
call fcn.00404ae4
ret
Function at 0x4d2fc4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00404f94
mov eax, dword [ebp + 0xc]
call fcn.00404f94
mov eax, dword [ebp + 8]
call fcn.00404f94
xor eax, eax
push ebp
push 0x4d30ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea edx, [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004d2ee4
test al, al
je 0x4d3026
mov byte [ebp - 0xd], 1
jmp 0x4d30ba
xor eax, eax
push ebp
push 0x4d30b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, dword [0x4da6d0]
mov eax, dword [eax]
call fcn.0047c948
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00409c50
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
call fcn.00404df0
mov eax, dword [ebp - 0x14]
call fcn.00409864
test al, al
je 0x4d30a6
cmp dword [ebp + 8], 0
je 0x4d3086
push dword [ebp - 0x14]
push 0x4d3108
push dword [ebp + 8]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404e64
push 1
mov eax, dword [ebp - 0x14]
call fcn.00404fa4
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x1f
jbe 0x4d30a6
mov byte [ebp - 0xd], 1
push 0x64
call sub.kernel32.dll_Sleep_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d30ba
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d30f1
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404b08
lea eax, [ebp - 0xc]
call fcn.00404ae4
lea eax, [ebp + 8]
mov edx, 2
call fcn.00404b08
ret
Function at 0x416f00
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6a5516
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov byte [esi + 4], al
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], edi
call fcn.0060fe70
lea ecx, [esi + 0x24]
mov byte [esp + 0x18], 1
call fcn.0060fe70
lea ecx, [esi + 0x28]
mov byte [esp + 0x18], 2
call fcn.0060fe70
lea ecx, [esi + 0x2c]
mov byte [esp + 0x18], 3
call fcn.0060fe70
mov cl, byte [esp + 0xb]
mov dword [esi + 0x34], edi
mov byte [esi + 0x30], cl
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 5
call fcn.0060fe70
lea ecx, [esi + 0x44]
mov byte [esp + 0x18], 6
call fcn.0060fe70
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 7
call fcn.0060fe70
mov dl, byte [esp + 0xb]
mov dword [esi + 0x50], edi
mov byte [esi + 0x4c], dl
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
lea ecx, [esi + 0x5c]
mov byte [esp + 0x18], 9
call fcn.0060fe70
lea ecx, [esi + 0x60]
mov byte [esp + 0x18], 0xa
call fcn.0060fe70
lea ecx, [esi + 0x64]
mov byte [esp + 0x18], 0xb
call fcn.0060fe70
mov al, byte [esp + 0xb]
mov dword [esi + 0x6c], edi
mov byte [esi + 0x68], al
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea ecx, [esi + 0x78]
mov byte [esp + 0x18], 0xd
call fcn.0060fe70
lea ecx, [esi + 0x7c]
mov byte [esp + 0x18], 0xe
call fcn.0060fe70
lea ecx, [esi + 0x80]
mov byte [esp + 0x18], 0xf
call fcn.0060fe70
push fcn.0060ffb0
push fcn.0060fe70
push 5
lea ecx, [esi + 0x84]
push 4
push ecx
mov byte [esp + 0x2c], 0x10
call fcn.00698549
push fcn.0060ffb0
push fcn.0060fe70
push 5
lea edx, [esi + 0x98]
push 4
push edx
mov byte [esp + 0x2c], 0x11
call fcn.00698549
push fcn.0060ffb0
push fcn.0060fe70
push 5
lea eax, [esi + 0xac]
push 4
push eax
mov byte [esp + 0x2c], 0x12
call fcn.00698549
lea ecx, [esi + 0xc8]
mov byte [esp + 0x18], 0x13
call fcn.0060fe70
mov ecx, dword [esp + 0x10]
mov dword [esi], 0x6ce210
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x418eb9
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6a59c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.0060d180
xor ebx, ebx
push 8
push 0x7038e0
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], ebx
call fcn.0060ff10
mov eax, dword [esp + 0x40]
lea ecx, [esp + 8]
push eax
push 3
mov byte [esp + 0x40], 1
call fcn.006102b0
cmp byte [0x71bb5c], bl
je 0x418f2c
lea ecx, [esp + 8]
mov byte [esp + 0x38], bl
call fcn.0060ffb0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0060d280
xor ax, ax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x34
ret 4
push 1
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
call fcn.0060fe80
mov ecx, dword [esi + 4]
lea edx, [esp + 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
cmp ax, bx
je 0x418fb9
lea eax, [esp + 0x40]
lea ecx, [esp + 0xc]
push eax
call fcn.0060d6b0
push ebx
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], 2
call fcn.00610190
xor ecx, ecx
cmp al, 0xee
setne cl
mov esi, ecx
lea ecx, [esp + 0x40]
mov byte [esp + 0x38], 1
call fcn.0060ffb0
lea ecx, [esp + 8]
mov byte [esp + 0x38], bl
call fcn.0060ffb0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0060d280
mov ax, si
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x34
ret 4
lea ecx, [esp + 8]
mov byte [esp + 0x38], bl
call fcn.0060ffb0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0060d280
mov ecx, dword [esp + 0x30]
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret 4
Function at 0x4ea990
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x6b4746
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8c
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x1c]
call fcn.0062da70
xor ebx, ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0xa0], ebx
call fcn.0060fe70
lea ecx, [esp + 0x50]
mov byte [esp + 0xa0], 1
call fcn.0060d180
push 0x7e2
lea ecx, [esp + 0x30]
mov byte [esp + 0xa4], 2
call fcn.00541680
mov eax, dword [esi]
mov edi, dword [0x70c1d8]
mov ecx, esi
mov byte [esp + 0xa0], 3
call dword [eax + 0x18]
test ax, ax
jne 0x4eaa5a
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa0], 2
call fcn.005416b0
lea ecx, [esp + 0x50]
mov byte [esp + 0xa0], 1
call fcn.0060d280
lea ecx, [esp + 0x14]
mov byte [esp + 0xa0], bl
call fcn.0060ffb0
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa0], 0xffffffff
call fcn.0061f9a0
xor ax, ax
jmp 0x4eab04
cmp byte [esp + 0xa8], 6
jae 0x4eaaba
cmp di, bx
jle 0x4eaaba
xor esi, esi
movsx edi, di
mov cl, byte [esi + 0x70c1da]
lea eax, [esi + 0x70c1da]
mov byte [esp + 0x10], cl
push ebx
mov edx, dword [esp + 0x14]
and edx, 0xff
mov cl, byte [edx + esi + 0x70c1db]
mov byte [esp + 0x10], cl
lea ecx, [esp + 0x30]
mov edx, dword [esp + 0x10]
push edx
push eax
lea eax, [esp + 0x80]
push eax
call fcn.005436d0
lea ecx, [esp + 0x74]
call fcn.0060d280
add esi, 0xa
dec edi
jne 0x4eaa6e
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa0], 2
call fcn.005416b0
lea ecx, [esp + 0x50]
mov byte [esp + 0xa0], 1
call fcn.0060d280
lea ecx, [esp + 0x14]
mov byte [esp + 0xa0], bl
call fcn.0060ffb0
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa0], 0xffffffff
call fcn.0061f9a0
mov ax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x98
ret 4
Function at 0x4ed720
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b4a5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb8
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x78]
call fcn.0060d180
push 0x6c
push 0xf1
push 0x40
lea ecx, [esp + 0x44]
mov dword [esp + 0xd4], 0
call fcn.00548440
push 0x6c
push 0xf1
push 0xfe
lea ecx, [esp + 0x64]
mov byte [esp + 0xd4], 1
call fcn.00548440
mov al, 0x2a
mov cl, 0x14
mov byte [esp + 0xd], al
mov byte [esp + 0x14], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x22], al
mov byte [esp + 0x29], al
mov byte [esp + 0x30], al
mov eax, dword [esi]
mov dl, 6
mov byte [esp + 0xe], cl
mov ebx, 0xff
mov byte [esp + 0x15], cl
mov byte [esp + 0x1c], cl
mov byte [esp + 0x23], cl
mov byte [esp + 0x2a], cl
mov ecx, esi
mov byte [esp + 0xc8], 2
mov byte [esp + 0xa], 1
mov byte [esp + 0xb], 0x3f
mov byte [esp + 0xc], dl
mov byte [esp + 0xf], 0x20
mov byte [esp + 0x10], bl
mov byte [esp + 0x11], bl
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], dl
mov byte [esp + 0x16], 0x12
mov byte [esp + 0x17], bl
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1d], 0x10
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], dl
mov byte [esp + 0x24], 0x13
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], dl
mov byte [esp + 0x2b], 0x15
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], 2
mov byte [esp + 0x31], 0xf1
mov dword [esp + 0x32], 0
call dword [eax + 0x18]
test ax, ax
je 0x4ed8dd
mov eax, dword [esp + 0xd0]
push 0
and eax, ebx
push 0
lea ecx, [eax*8]
sub ecx, eax
lea eax, [esp + 0xa4]
lea edx, [esp + ecx + 0x14]
lea ecx, [esp + 0x40]
push edx
push eax
call fcn.00548ea0
lea ecx, [esp + 0x9c]
call fcn.0060d280
lea ecx, [esp + 0xa]
push ecx
push 0x12c
lea ecx, [esp + 0x60]
call fcn.005493e0
lea ecx, [esp + 0x58]
mov byte [esp + 0xc8], 1
call fcn.00548470
lea ecx, [esp + 0x38]
mov byte [esp + 0xc8], 0
call fcn.00548470
lea ecx, [esp + 0x78]
mov dword [esp + 0xc8], 0xffffffff
call fcn.0060d280
mov ax, 1
jmp 0x4ed916
lea ecx, [esp + 0x58]
mov byte [esp + 0xc8], 1
call fcn.00548470
lea ecx, [esp + 0x38]
mov byte [esp + 0xc8], 0
call fcn.00548470
lea ecx, [esp + 0x78]
mov dword [esp + 0xc8], 0xffffffff
call fcn.0060d280
xor ax, ax
mov ecx, dword [esp + 0xc0]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xc4
ret 4
Function at 0x549150
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6b9e50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
lea ecx, [esp + 0xc]
call fcn.0060d180
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0
call fcn.0060fe70
mov bl, byte [esp + 0x40]
mov byte [esp + 0x38], 1
xor esi, esi
sub esp, 0x24
mov ecx, 0x71b8f8
mov eax, esp
mov dword [esp + 0x64], esp
push 0
push eax
call fcn.0061b460
lea ecx, [esp + 0x30]
call fcn.0060d330
lea ecx, [esp + 0xc]
call fcn.0060d760
test ax, ax
jle 0x5491f4
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push ecx
lea ecx, [esp + 0x14]
call fcn.0060d6b0
lea ecx, [esp + 0xc]
call fcn.006101a0
lea ecx, [esp + 8]
call fcn.00610330
cmp ax, 6
jle 0x5491f4
push 4
lea ecx, [esp + 0xc]
call fcn.00610190
cmp al, bl
je 0x549230
inc esi
cmp si, 8
jl 0x54918f
lea ecx, [esp + 8]
mov byte [esp + 0x38], 0
call fcn.0060ffb0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0060d280
xor ax, ax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x34
ret 8
push ecx
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
call fcn.0060fe80
mov ecx, dword [esp + 0x48]
call fcn.006101a0
lea ecx, [esp + 8]
mov byte [esp + 0x38], 0
call fcn.0060ffb0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0060d280
mov ecx, dword [esp + 0x30]
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret 8
Function at 0x5629a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6bad98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push 0x246
lea ecx, [esp + 0x40]
call fcn.00541680
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], 0
call fcn.0060d180
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0060fe70
push 0
push 0
push ecx
mov bl, 2
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x703420
mov byte [esp + 0x7c], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 1
mov byte [esp + 0x1e], 0x3e
call fcn.0060ff10
push ecx
mov byte [esp + 0x78], 3
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x703464
call fcn.0060ff10
mov ecx, 0x71b930
mov byte [esp + 0x78], bl
call fcn.006115e0
xor esi, esi
sub esp, 0x24
lea ecx, [esp + 0x2c]
mov eax, esp
mov dword [esp + 0x38], esp
push 0
push 1
push ecx
push eax
lea ecx, [esp + 0x70]
call fcn.005436d0
lea ecx, [esp + 0x3c]
call fcn.0060d330
lea ecx, [esp + 0x18]
call fcn.0060d760
test ax, ax
jg 0x562af5
inc esi
cmp esi, 3
jl 0x562a3a
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x7033ac
call fcn.0060ff10
push ecx
mov byte [esp + 0x78], 4
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x70345c
call fcn.0060ff10
mov ecx, 0x71b930
mov byte [esp + 0x78], bl
call fcn.006115e0
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0060ffb0
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 0
call fcn.0060d280
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.005416b0
xor ax, ax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x64
ret
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0060ffb0
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 0
call fcn.0060d280
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.005416b0
mov ecx, dword [esp + 0x60]
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x64
ret

Function at 0x562b40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6badc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push 0x246
lea ecx, [esp + 0x34]
call fcn.00541680
lea ecx, [esp + 0xc]
mov dword [esp + 0x5c], 0
call fcn.0060d180
lea ecx, [esp + 4]
mov byte [esp + 0x5c], 1
call fcn.0060fe70
mov al, 2
push 0x14
mov byte [esp + 0x60], al
mov byte [esp + 4], al
mov byte [esp + 5], 1
mov byte [esp + 6], 0x20
call fcn.0041ad00
sub esp, 0x20
lea ecx, [esp + 0x24]
mov eax, esp
mov dword [esp + 0x2c], esp
push 0
push 1
push ecx
push eax
lea ecx, [esp + 0x64]
call fcn.005436d0
lea ecx, [esp + 0x30]
call fcn.0060d330
push 0
push 0
mov ecx, 0x71b8f8
call fcn.006166b0
lea ecx, [esp + 4]
mov byte [esp + 0x5c], 1
call fcn.0060ffb0
lea ecx, [esp + 0xc]
mov byte [esp + 0x5c], 0
call fcn.0060d280
lea ecx, [esp + 0x30]
mov dword [esp + 0x5c], 0xffffffff
call fcn.005416b0
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret
Function at 0x566cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6bb428
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push 0x24c
lea ecx, [esp + 0x40]
call fcn.00541680
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], 0
call fcn.0060d180
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0060fe70
push 0
push 0
push ecx
mov bl, 2
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x703420
mov byte [esp + 0x7c], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 1
mov byte [esp + 0x1e], 0x3e
call fcn.0060ff10
push ecx
mov byte [esp + 0x78], 3
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x703464
call fcn.0060ff10
mov ecx, 0x71b930
mov byte [esp + 0x78], bl
call fcn.006115e0
xor esi, esi
sub esp, 0x24
lea ecx, [esp + 0x2c]
mov eax, esp
mov dword [esp + 0x38], esp
push 0
push 1
push ecx
push eax
lea ecx, [esp + 0x70]
call fcn.005436d0
lea ecx, [esp + 0x3c]
call fcn.0060d330
lea ecx, [esp + 0x18]
call fcn.0060d760
test ax, ax
jg 0x566e25
inc esi
cmp esi, 3
jl 0x566d6a
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x7033ac
call fcn.0060ff10
push ecx
mov byte [esp + 0x78], 4
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x70345c
call fcn.0060ff10
mov ecx, 0x71b930
mov byte [esp + 0x78], bl
call fcn.006115e0
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0060ffb0
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 0
call fcn.0060d280
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.005416b0
xor ax, ax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x64
ret
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0060ffb0
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 0
call fcn.0060d280
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.005416b0
mov ecx, dword [esp + 0x60]
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x64
ret

Function at 0x566e70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6bb458
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push 0x24c
lea ecx, [esp + 0x34]
call fcn.00541680
lea ecx, [esp + 0xc]
mov dword [esp + 0x5c], 0
call fcn.0060d180
lea ecx, [esp + 4]
mov byte [esp + 0x5c], 1
call fcn.0060fe70
mov al, 2
push 0x14
mov byte [esp + 0x60], al
mov byte [esp + 4], al
mov byte [esp + 5], 1
mov byte [esp + 6], 0x20
call fcn.0041ad00
sub esp, 0x20
lea ecx, [esp + 0x24]
mov eax, esp
mov dword [esp + 0x2c], esp
push 0
push 1
push ecx
push eax
lea ecx, [esp + 0x64]
call fcn.005436d0
lea ecx, [esp + 0x30]
call fcn.0060d330
push 0
push 0
mov ecx, 0x71b8f8
call fcn.006166b0
lea ecx, [esp + 4]
mov byte [esp + 0x5c], 1
call fcn.0060ffb0
lea ecx, [esp + 0xc]
mov byte [esp + 0x5c], 0
call fcn.0060d280
lea ecx, [esp + 0x30]
mov dword [esp + 0x5c], 0xffffffff
call fcn.005416b0
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret
Function at 0x5700a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6bc218
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push 0x7e0
lea ecx, [esp + 0x40]
call fcn.00541680
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], 0
call fcn.0060d180
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0060fe70
push 0
push 0
push ecx
mov bl, 2
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x703420
mov byte [esp + 0x7c], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 1
mov byte [esp + 0x1e], 0x3e
call fcn.0060ff10
push ecx
mov byte [esp + 0x78], 3
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x703464
call fcn.0060ff10
mov ecx, 0x71b930
mov byte [esp + 0x78], bl
call fcn.006115e0
xor esi, esi
sub esp, 0x24
lea ecx, [esp + 0x2c]
mov eax, esp
mov dword [esp + 0x38], esp
push 0
push 1
push ecx
push eax
lea ecx, [esp + 0x70]
call fcn.005436d0
lea ecx, [esp + 0x3c]
call fcn.0060d330
lea ecx, [esp + 0x18]
call fcn.0060d760
test ax, ax
jg 0x5701f5
inc esi
cmp esi, 3
jl 0x57013a
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x7033ac
call fcn.0060ff10
push ecx
mov byte [esp + 0x78], 4
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x70345c
call fcn.0060ff10
mov ecx, 0x71b930
mov byte [esp + 0x78], bl
call fcn.006115e0
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0060ffb0
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 0
call fcn.0060d280
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.005416b0
xor ax, ax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x64
ret
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0060ffb0
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 0
call fcn.0060d280
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.005416b0
mov ecx, dword [esp + 0x60]
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x64
ret

Function at 0x570240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6bc248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push 0x7e0
lea ecx, [esp + 0x34]
call fcn.00541680
lea ecx, [esp + 0xc]
mov dword [esp + 0x5c], 0
call fcn.0060d180
lea ecx, [esp + 4]
mov byte [esp + 0x5c], 1
call fcn.0060fe70
mov al, 2
push 0x14
mov byte [esp + 0x60], al
mov byte [esp + 4], al
mov byte [esp + 5], 1
mov byte [esp + 6], 0x20
call fcn.0041ad00
sub esp, 0x20
lea ecx, [esp + 0x24]
mov eax, esp
mov dword [esp + 0x2c], esp
push 0
push 1
push ecx
push eax
lea ecx, [esp + 0x64]
call fcn.005436d0
lea ecx, [esp + 0x30]
call fcn.0060d330
push 0
push 0
mov ecx, 0x71b8f8
call fcn.006166b0
lea ecx, [esp + 4]
mov byte [esp + 0x5c], 1
call fcn.0060ffb0
lea ecx, [esp + 0xc]
mov byte [esp + 0x5c], 0
call fcn.0060d280
lea ecx, [esp + 0x30]
mov dword [esp + 0x5c], 0xffffffff
call fcn.005416b0
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret
Function at 0x57be20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6bce60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x6d3068
lea ecx, [esi + 0x8c]
mov dword [esp + 0x20], 8
call fcn.0060ffb0
mov eax, dword [esi + 0x7c]
push eax
mov dword [esp + 0x18], eax
call fcn.00697880
xor ebx, ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov eax, dword [esi + 0x6c]
push eax
mov dword [esp + 0x1c], eax
call fcn.00697880
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov eax, dword [esi + 0x5c]
push eax
mov dword [esp + 0x20], eax
call fcn.00697880
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov ebp, dword [esi + 0x50]
mov edi, dword [esi + 0x4c]
add esp, 0xc
cmp edi, ebp
mov byte [esp + 0x20], 4
je 0x57bec6
push ebx
mov ecx, edi
call fcn.00415aa0
add edi, 4
cmp edi, ebp
jne 0x57beb7
mov eax, dword [esi + 0x4c]
push eax
call fcn.00697880
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov ebp, dword [esi + 0x40]
mov edi, dword [esi + 0x3c]
add esp, 4
cmp edi, ebp
mov byte [esp + 0x20], 3
je 0x57bef9
push ebx
mov ecx, edi
call fcn.00415aa0
add edi, 4
cmp edi, ebp
jne 0x57beea
mov eax, dword [esi + 0x3c]
push eax
call fcn.00697880
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov ebp, dword [esi + 0x30]
mov edi, dword [esi + 0x2c]
add esp, 4
cmp edi, ebp
mov byte [esp + 0x20], 2
je 0x57bf2c
push ebx
mov ecx, edi
call fcn.00415aa0
add edi, 4
cmp edi, ebp
jne 0x57bf1d
mov eax, dword [esi + 0x2c]
push eax
call fcn.00697880
lea edi, [esi + 0x18]
add esp, 4
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, edi
mov byte [esp + 0x28], 1
call fcn.00413d00
mov eax, dword [edi + 4]
push eax
call fcn.00697880
add esp, 4
lea ecx, [esi + 8]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov byte [esp + 0x20], bl
call fcn.004133f0
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.00497260
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret