joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x5efc1068
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x6db2e36
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412cf0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412e9a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x27
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x56
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x5f
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa8
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x15
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1a
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x7c
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x52
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x37
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa8
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2b
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 2
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xef
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 2
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1f
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d10
pop ebx
pop edi
pop esi
ret

Function at 0x4035d5
Capabilities:
Terminate process

Disassembly:
jmp 0x451b59
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451b6a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004058fd
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403706
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b002
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b013
pop esi
ret
push ebx
push edi
push esi
call fcn.0049aee9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fd0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b03b
push ebx
push esi
push edi
call fcn.004056f0
add esp, 0xc
push 0
call fcn.0040623a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4995a1
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4ce034]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4995ec
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00499a63
test al, al
jne 0x4995e6
sub edx, 2
cmp edx, edi
jne 0x4995cc
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x49960e
lea eax, [edi + 2]
cmp edx, eax
je 0x49960e
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0049919a
add esp, 0x10
jmp 0x499708
push esi
lea ecx, [ebp - 0x255]
call fcn.00499a63
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x499651
push dword [ebp - 0x25c]
jmp 0x4995fe
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x49968e
cmp word [ebp - 0x226], 0
je 0x4996af
cmp word [ebp - 0x226], ax
jne 0x49968e
cmp word [ebp - 0x224], 0
je 0x4996af
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0049919a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4996fb
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x499668
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4996e3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x499708
push 0x498b82
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00405538
add esp, 0x10
jmp 0x4996d8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040303f
leave
ret

Function at 0x438c88
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x438a14
mov ecx, ebx
sub ecx, 0xd8f11986
call fcn.00438cc2
inc ecx
mov ebx, ecx
xor dword [edi], eax
add ebx, ecx
sub ebx, ecx
sub ecx, ebx
inc edi
or ebx, ecx
add ecx, ecx
sub ebx, 0x4b1525bb
cmp edi, edx
jne fcn.00438c88
add ecx, 0x64c7b6f1
and ebx, ecx
dec ebx
ret
Function at 0x409d41
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409d99
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x40c4ac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409d8c
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x409d9b
xor eax, eax
pop esi
leave
ret 4
Function at 0x41ad9c
Capabilities:
Encode data using xor

Disassembly:
stc
out 0x95, al
inc ebp
inc eax
stosd dword es:[edi], eax
xor bh, byte [ebp - 0x7a]
lcall 0x5540, 0xe7f407df
add al, 0xf3
cwde
lodsb al, byte [esi]
in eax, 0x87
xor bh, 0x14
cmc
inc esi
add ebx, dword [edx + 0x2f]
pop ds
jge 0x41ad66
clc
imul esi, dword [ecx + 0x5d], 0xffffffa3
push 0x1ab72c26
xor byte [ebx - 0x3895b8d4], ch
push es
aad 0x85
xchg bl, ah
push ebp
ljmp 0x2223
cwde
mov esp, 0x3d32ecec
ja 0x41addb
jl 0x41ad52
push ebp
invalid
ret

Function at 0x41c86f
Capabilities:
Encode data using xor

Disassembly:
pop es
push ss
jl 0x41c8b8
in al, 0xbe
dec edx
mov esi, 0x468f47e9
add al, 0xb4
stc
pop edx
adc ch, byte gs:[ecx]
fisttp word [esi - 0x5036b39]
retf
jbe 0x41c90c
cmp al, 0xd0
jno 0x41c93d
wait
mov dword [0x3b5120f8], eax
pop esp
mov dh, 0x39
stc
int1
jae 0x41c8f6
cmp byte [ebp + 0xefe513a], ah
inc ebx
and dword [esi], eax
dec ecx
dec edx
push esi
invalid
xor ebx, 0x2d
invalid
jmp [edi + 0xc386a5f]
sbb dword [ecx + 0x71], eax
sbb dword [bx + 0x15fc], 0x2ff47c46
sbb al, 0x68
clc
jg 0x41c987
mov dword [ebp + 0x3ec8abaf], edi
into
into
jno 0x41c953
sub al, 0xc7
stosd dword es:[edi], eax
outsb dx, byte [esi]
bound ebp, qword gs:[edi + ebx*2 + 0x31]
mov edx, 0x65ca5bb8
mov ah, 0xd8
pop esp
adc eax, 0x74646c2a
pushal
push ebp
lodsd eax, dword [esi]
push es
rcr dh, 0x9f
xchg ecx, eax
rol byte [edi + 0x75d14039], cl
xor al, 0x15
in eax, dx
sbb esp, dword [edi + 0x60]
mov esp, 0xc6c4c276
add al, 0x6c
insb byte es:[edi], dx
out 0xa2, al
or al, byte [edx + 0xa8f835b]
xor ebx, 0xf81b2651
dec esp
mov edi, es
or edi, dword [edx - 0x8691ff6]
cmp ah, byte [eax]
cmp byte [esi - 0x57], dh
mov byte [0xc14a29a3], al
sub dword [edx - 0x3f], ecx
pop ss
test dword [edi + 0x16146206], esi
jae 0x41ca24
or dword [ebx + 0x3d963564], esp
push ebp
enter 0x6f93, 0xffffffffffffff92
mov cl, 0x36
test eax, 0x791b6d97
mov ebx, 0xc402994d
inc ebx
fcomp qword [ebp - 0x20f22df9]
out dx, al
mov esi, 0xe7ab8665
sbb byte [eax - 0x489c07a5], cl
or byte [edx - 0x89ea223], cl
xor ebx, esi
inc ebp
dec dword [edi]
sbb eax, 0x6cc3e061
push esp
jae 0x41c9a6
popal
ret 0x156e
and al, 0x9f
fcomp st(0)
sar bl, cl
int3
Function at 0x403fcd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x403fee
jl 0x403fe5
test edi, edi
jne 0x403fee
xor eax, eax
xor edx, edx
jmp 0x4040af
cmp dword [ebx + 0x38], 0
je 0x404003
push eax
push edi
push dword [ebp + 8]
call fcn.004040b5
jmp 0x4040af
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40404a
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x40404a
cmp eax, edi
jb 0x404024
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00406210
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x404050
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x4040a4
mov ecx, ebx
call fcn.00403826
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40408f
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040a126
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x4040a4
jmp 0x404062
test edx, edx
je 0x4040a4
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040a126
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x4041a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4041c6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00404289
jmp 0x404284
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x4041ec
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x4041f1
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov eax, ecx
cdq
mov dword [ebp - 4], eax
mov ecx, edx
mov dword [ebp - 8], ecx
test edi, edi
jl 0x404251
jg 0x404206
test esi, esi
je 0x404251
test ecx, ecx
jl 0x40424c
jg 0x404210
test eax, eax
je 0x40424c
cmp edi, ecx
jg 0x404222
jl 0x40421a
cmp esi, eax
jae 0x404222
mov eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.00406210
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [ebp - 8]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x404254
mov ecx, dword [ebp + 8]
jmp 0x40425e
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x404278
jg 0x40425e
test esi, esi
je 0x404278
cmp dword [ebx + 0x4c], 0
je 0x404278
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040a79f
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4059e5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405a24
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405a24
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405a24
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405a24
cmp dword [ecx + 0x74], 0xe
jbe 0x405a24
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4101b5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00410034

Function at 0x4145c7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00414287

Function at 0x419430
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41945d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41945d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401cba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42608c]
jne 0x401cc4
repz ret
jmp fcn.004022e3

Function at 0x40d443
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004045b5
xor ebx, ebx
cmp dword [0x428174], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40d518
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40d483
xor eax, eax
jmp 0x40d5dc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40d47c
push eax
call fcn.00404552
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428174], eax
call esi
push eax
call fcn.00404552
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x428178], eax
call esi
push eax
call fcn.00404552
mov dword [0x42817c], eax
lea eax, [ebp - 8]
push eax
call fcn.0040367f
test eax, eax
pop ecx
pop ecx
je 0x40d4e6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040275f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40d518
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404552
cmp eax, ebx
pop ecx
mov dword [0x428184], eax
je 0x40d518
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404552
pop ecx
mov dword [0x428180], eax
mov eax, dword [0x428180]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40d591
cmp dword [0x428184], esi
je 0x40d591
push eax
call fcn.004045be
pop ecx
call eax
cmp eax, ebx
je 0x40d55e
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x428184]
call fcn.004045be
pop ecx
call eax
test eax, eax
je 0x40d55e
test byte [ebp - 0x18], 1
jne 0x40d591
lea eax, [ebp - 0xc]
push eax
call fcn.0040372e
test eax, eax
pop ecx
je 0x40d579
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040275f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40d588
or dword [ebp + 0x10], 0x200000
jmp 0x40d5c2
or dword [ebp + 0x10], 0x40000
jmp 0x40d5c2
mov eax, dword [0x428178]
cmp eax, esi
je 0x40d5c2
push eax
call fcn.004045be
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40d5c2
mov eax, dword [0x42817c]
cmp eax, esi
je 0x40d5c2
push dword [ebp - 4]
push eax
call fcn.004045be
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x428174]
call fcn.004045be
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401718
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x401757
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401757
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401757
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401757
cmp dword [ecx + 0x74], 0xe
jbe 0x401757
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x421900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x42196c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x4219b3
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00476b28
add esp, 8
test eax, eax
jne 0x4219b1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x4219b5
jmp 0x421963
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x451870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8147
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4d5f3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00450760
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00450760
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00450760
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00451170
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00451170
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00451170
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x451b50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8237
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4d5f3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00450680
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00450680
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00450680
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00451190
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00451190
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00451190
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4663a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bae80
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4d5f3c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x4d9d14
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], 0x4d9df8
call fcn.0041b850
mov byte [esp + 0x38], 1
call fcn.00465574
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.0041b920
mov dword [esi], 0x4d9e1c
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret