joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ee58
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41eed2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004046fc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004045cc
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x41eeb0
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040462c
jmp 0x41eebc
mov eax, ebx
mov edx, 0x41eee8
call fcn.00404158
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41eed9
lea eax, [ebp - 4]
call fcn.00404104
ret

Function at 0x41f5b0
Capabilities:
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x41f6fb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, dword [0x1366658]
mov edx, dword [0x423950]
call fcn.00404a60
mov eax, dword [ebp - 8]
call fcn.0041c790
test al, al
je 0x41f6d0
lea eax, [ebp - 4]
push eax
push 0x41f708
push 0x80000001
call sub.advapi32.dll_RegOpenKeyA
lea eax, [ebp - 0xc]
mov edx, dword [0x423950]
call fcn.004043b8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [0x1366658]
call fcn.004043b8
mov edx, dword [ebp - 0x10]
pop eax
call fcn.004043d4
mov eax, dword [ebp - 0xc]
call fcn.004043cc
test eax, eax
jns 0x41f63c
call fcn.0040353c
push eax
lea eax, [ebp - 0x14]
mov edx, dword [0x423950]
call fcn.004043b8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [0x1366658]
call fcn.004043b8
mov edx, dword [ebp - 0x18]
pop eax
call fcn.004043d4
mov eax, dword [ebp - 0x14]
call fcn.004045cc
push eax
push 1
push 0
lea eax, [ebp - 0x1c]
mov ecx, 0x41f740
mov edx, dword [0x423958]
call fcn.00404418
mov eax, dword [ebp - 0x1c]
call fcn.004045cc
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
push 5
push 0
push 0
lea eax, [ebp - 0x20]
mov ecx, dword [0x1366658]
mov edx, dword [0x423950]
call fcn.00404a60
mov eax, dword [ebp - 0x20]
call fcn.004049e4
push eax
push 0x41f744
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f702
lea eax, [ebp - 0x20]
call fcn.0040482c
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00404128
lea eax, [ebp - 8]
call fcn.0040482c
ret
Function at 0x41f878
Capabilities:
Create process on windows
Enumerate services

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
xor eax, eax
push ebp
push 0x41fa22
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0x41fa30
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41fa07
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, 0x24024
call fcn.004026bc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x24024
mov eax, dword [ebp - 0x18]
push eax
push 1
push 0x130
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EnumServicesStatusA
mov eax, dword [ebp - 0x10]
dec eax
test eax, eax
jns 0x41f905
call fcn.0040353c
test eax, eax
jl 0x41f9f1
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov eax, dword [0x13677f8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x41f9e5
inc eax
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov edx, ebx
mov eax, dword [0x13677f8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
cmp eax, 0x1000
jbe 0x41f950
call fcn.0040353c
lea esi, [eax + eax*8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + esi*4 + 4]
lea edx, [ebp - 0x28]
call fcn.004080c0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00407774
mov edx, dword [ebp - 0x24]
pop eax
call fcn.0041b49c
test al, al
je 0x41f9e5
push 0
push 0
push 0x41fa3c
mov eax, dword [ebp - 4]
cmp eax, 0x1000
jbe 0x41f992
call fcn.0040353c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + esi*4 + 4]
lea edx, [ebp - 0x34]
call fcn.004080c0
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00407774
push dword [ebp - 0x30]
push 0x41fa4c
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.0040448c
mov eax, dword [ebp - 0x2c]
call fcn.004045cc
push eax
push 0x41fa50
push 0x41fa54
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x41f9e5
inc dword [ebp - 4]
dec dword [ebp - 0x1c]
jne 0x41f918
mov edx, 0x24024
mov eax, dword [ebp - 0x18]
call fcn.004026dc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41fa29
lea eax, [ebp - 0x34]
mov edx, 6
call fcn.00404128
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x7bfb19b6
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x93b1062
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x401a80
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406480
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4064a1
mov eax, 0xff
call fcn.00401a80
xor byte [esi], al
inc esi
dec ebx
jne 0x406491
pop esi
pop ebx
ret
Function at 0x40ca74
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41731c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [section..data]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a151
mov dword [ebp - 0x14], eax
cmp dword [0x41ac6c], esi
jne 0x40cb67
push 0x800
push esi
push 0x41287c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40caf4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40cc47
push esi
push esi
push 0x41287c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40cc47
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cc47
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x41ac6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x41ac70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x41ac74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41ac7c], eax
test eax, eax
je 0x40cb64
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41ac78], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40cb8c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40cb7f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40cba1
push 4
pop eax
jmp 0x40cc49
cmp dword [ebp - 0x14], esi
je 0x40cba1
push dword [0x41ac6c]
call dword [0x417004]
push 3
jmp 0x40cb86
mov eax, dword [0x41ac78]
mov ebx, dword [0x417004]
cmp eax, edi
je 0x40cbff
cmp dword [0x41ac7c], edi
je 0x40cbff
push eax
call ebx
push dword [0x41ac7c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40cbff
test eax, eax
je 0x40cbff
call ecx
test eax, eax
je 0x40cbf4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40cbf4
test byte [ebp - 8], 1
jne 0x40cbff
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40cc2f
mov eax, dword [0x41ac70]
cmp eax, edi
je 0x40cc2c
push eax
call ebx
test eax, eax
je 0x40cc2c
call eax
mov esi, eax
test esi, esi
je 0x40cc2c
mov eax, dword [0x41ac74]
cmp eax, edi
je 0x40cc2c
push eax
call ebx
test eax, eax
je 0x40cc2c
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x41ac6c]
call ebx
test eax, eax
je 0x40cc47
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40cc49
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404981
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x4285f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x564f9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov dword [edi], 0x596cf0
mov dword [esp + 0x18], 0
mov esi, dword [edi + 0x30]
test esi, esi
mov dword [esp + 0xc], esi
je 0x428640
mov byte [esp + 0x18], 0
mov eax, dword [esi + 0x20]
push eax
call fcn.00551318
push esi
call fcn.00551318
add esp, 8
mov esi, dword [edi + 0x34]
test esi, esi
mov dword [esp + 0xc], esi
je 0x428662
mov byte [esp + 0x18], 0
mov eax, dword [esi + 0x20]
push eax
call fcn.00551318
push esi
call fcn.00551318
add esp, 8
mov dword [esp + 0x18], 0xffffffff
mov ecx, edi
call fcn.004b5260
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4378f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56816a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x190
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi]
call dword [eax + 0xb0]
push eax
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x40]
push eax
call fcn.00419070
add esp, 8
mov edi, eax
mov dword [ebp - 0x24], edi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xb0]
push eax
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x40]
push eax
call fcn.00401180
mov dword [ebp - 0x18], eax
push eax
push edi
lea eax, [ebp + 0xc]
push eax
call fcn.00428170
add esp, 0x14
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, esi
call fcn.004aea00
mov eax, dword [esi]
sub esp, 0x10
mov ecx, esp
mov edx, dword [0x61568c]
mov dword [ecx], edx
mov edx, dword [0x615690]
mov dword [ecx + 4], edx
mov edx, dword [0x615694]
mov dword [ecx + 8], edx
mov edx, dword [0x615698]
mov dword [ecx + 0xc], edx
mov ecx, dword [esi + 0x30]
push ecx
mov ecx, esi
call dword [eax + 0x8c]
mov edx, dword [esi]
sub esp, 0x10
mov eax, esp
mov ecx, dword [0x61562c]
mov dword [eax], ecx
mov ecx, dword [0x615630]
mov dword [eax + 4], ecx
mov ecx, dword [0x615634]
mov dword [eax + 8], ecx
mov ecx, dword [0x615638]
mov dword [eax + 0xc], ecx
mov eax, dword [esi + 0x34]
push eax
mov ecx, esi
call dword [edx + 0x8c]
mov edx, dword [esi]
sub esp, 0x10
mov eax, esp
mov ecx, dword [0x6155d8]
mov dword [eax], ecx
mov ecx, dword [0x6155dc]
mov dword [eax + 4], ecx
mov ecx, dword [0x6155e0]
mov dword [eax + 8], ecx
mov ecx, dword [0x6155e4]
mov dword [eax + 0xc], ecx
mov eax, dword [esi + 0x38]
push eax
mov ecx, esi
call dword [edx + 0x8c]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x48]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43f890
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5698ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a4
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x3c], esi
call fcn.004a5dc0
mov dword [ebp - 4], 0
mov dword [esi], 0x596930
mov byte [esi + 0x2c], 0
mov dword [ebp - 4], 1
mov dword [esi], 0x597868
mov bl, 2
mov byte [ebp - 4], bl
push 0x4c
call fcn.005512e8
add esp, 4
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x43f8ff
mov ecx, eax
call fcn.004366b0
jmp 0x43f901
xor eax, eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], bl
mov dword [esi + 0x30], eax
push 0x34
call fcn.005512e8
add esp, 4
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x43f928
mov ecx, eax
call fcn.00434440
jmp 0x43f92a
xor eax, eax
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], bl
mov dword [esi + 0x34], eax
push 0x38
call fcn.005512e8
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x43f951
mov ecx, eax
call fcn.00435b70
jmp 0x43f953
xor eax, eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], bl
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x30]
push eax
mov ecx, esi
call fcn.004aec80
mov ecx, dword [esi + 0x34]
push ecx
mov ecx, esi
call fcn.004aec80
mov edx, dword [esi + 0x38]
push edx
mov ecx, esi
call fcn.004aec80
push 0x64
push 0xaa
mov ecx, esi
call fcn.004378f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e110
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5712e1
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0xc8
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x45e23b
push esi
mov esi, 0xf
push esi
push str.ColorData_NULL
lea ecx, [esp + 0x80]
mov dword [esp + 0x98], esi
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
call fcn.00403140
mov dword [esp + 0xd8], ebx
push ebx
push 0x5955cf
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
call fcn.00403140
mov byte [esp + 0xd8], 1
push ebx
push 0x5955cf
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
call fcn.00403140
mov byte [esp + 0xd8], 2
push 0x10
push str.assertion_failed
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
call fcn.00403140
mov byte [esp + 0xd8], 3
push 0x14
push str..DialogElements.cpp
lea ecx, [esp + 0x64]
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
call fcn.00403140
mov byte [esp + 0xd8], 4
lea eax, [esp + 0x78]
push eax
push ebx
lea ecx, [esp + 0x48]
push ecx
push ebx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x38]
push eax
push 0x3e8
lea ecx, [esp + 0x78]
push ecx
lea ecx, [esp + 0xb4]
call fcn.00535de0
push 0x5b7828
lea edx, [esp + 0x98]
push edx
call fcn.0053fb12
pop esi
mov edx, dword [eax]
mov dword [ecx + 0x28], edx
mov edx, dword [eax + 4]
mov dword [ecx + 0x2c], edx
mov edx, dword [eax + 8]
mov dword [ecx + 0x30], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0x34], eax
mov ecx, dword [esp + 0xcc]
pop ebx
mov dword fs:[0], ecx
add esp, 0xd4
ret 4

Function at 0x46ecd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572082
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
call fcn.004a5e80
mov dword [ebp - 4], 0
mov dword [esi], 0x59a308
lea edi, [esi + 0x30]
push 0
push 0
mov ecx, edi
call fcn.004a5f30
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, esi
call fcn.004a5da0
mov ebx, dword [ebp + 0x10]
mov edx, ebx
shl edx, 4
mov eax, dword [0x766cc4]
add eax, edx
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [eax + 8]
push edx
mov ecx, esi
call fcn.004aea00
mov eax, dword [ebp + 0x14]
push eax
push ebx
mov ecx, esi
call fcn.0045fb20
mov byte [esi + 0x2c], 0
mov byte [esi + 0x2d], 0
mov dword [esi + 0x38], 0
mov ecx, dword [ebp + 0x18]
mov dword [edi], ecx
mov edx, dword [ebp + 0x1c]
mov dword [edi + 4], edx
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x3c], eax
mov cl, byte [ebp + 0x24]
mov byte [esi + 0x2e], cl
mov byte [esi + 0x40], 1
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x46eef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x572138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
push esi
push edi
mov esi, ecx
mov ecx, dword [esp + 0x3c]
xor edi, edi
push edi
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
push edx
push eax
mov ecx, esi
mov dword [esp + 0x28], esi
call fcn.0046ecd0
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esi], 0x59a390
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], eax
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x46f8f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5721b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x34]
mov edx, dword [eax + 0xc]
mov ecx, dword [esp + 0x2c]
lea ebp, [eax + 8]
xor edi, edi
push edi
push ecx
mov ecx, dword [ebp]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x54], ebp
call fcn.0046ecd0
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x30]
mov dword [esi + 0x48], eax
shl eax, 2
push eax
mov dword [esi], 0x599570
mov dword [esi + 0x44], edi
call fcn.00551313
mov ecx, dword [esi + 0x48]
shl ecx, 2
push ecx
mov dword [esi + 0x4c], eax
call fcn.00551313
mov edi, dword [esi + 0x48]
lea edx, [edi*8]
push edx
mov dword [esi + 0x50], eax
call fcn.00551313
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], 1
test ebx, ebx
je 0x46f9b7
dec edi
mov ebp, ebx
js 0x46f9b1
inc edi
lea ebx, [ebx]
push 0
push 0
mov ecx, ebp
call fcn.004a5f30
add ebp, 8
dec edi
jne 0x46f9a0
mov ebp, dword [esp + 0x34]
jmp 0x46f9b9
xor ebx, ebx
mov byte [esp + 0x1c], 0
mov ecx, dword [esi + 0x48]
xor eax, eax
test ecx, ecx
mov dword [esi + 0x54], ebx
jle 0x46f9fc
mov ecx, ebp
lea esp, [esp]
mov edi, dword [ecx - 8]
mov edx, dword [esi + 0x4c]
mov dword [edx + eax*4], edi
mov edi, dword [ecx - 4]
mov edx, dword [esi + 0x50]
mov dword [edx + eax*4], edi
mov edi, dword [ecx]
mov edx, dword [esi + 0x54]
mov dword [edx + eax*8], edi
mov edi, dword [ecx + 4]
mov dword [edx + eax*8 + 4], edi
mov edx, dword [esi + 0x48]
inc eax
add ecx, 0x10
cmp eax, edx
jl 0x46f9d0
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x4743f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x572e78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1c]
push edi
push eax
mov eax, dword [ecx]
sub esp, 0x14
mov edx, esp
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 0x10]
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], ecx
mov ecx, esi
mov dword [esp + 0x24], esi
call fcn.0046de70
mov dword [esp + 0x18], 0
push 0
lea edi, [esi + 0x4c]
push 0
mov ecx, edi
mov dword [esi], 0x59aa30
call fcn.004a5f30
push 0
lea ebx, [esi + 0x54]
push 0
mov ecx, ebx
call fcn.004a5f30
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [edi], edx
mov edx, dword [esp + 0x34]
mov dword [edi + 4], eax
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x18

Function at 0x4744b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x572e78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1c]
push edi
push eax
mov eax, dword [ecx]
sub esp, 0x14
mov edx, esp
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 0x10]
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], ecx
mov ecx, esi
mov dword [esp + 0x24], esi
call fcn.0046de70
mov dword [esp + 0x18], 0
push 0
lea edi, [esi + 0x4c]
push 0
mov ecx, edi
mov dword [esi], 0x59aab8
call fcn.004a5f30
push 0
lea ebx, [esi + 0x54]
push 0
mov ecx, ebx
call fcn.004a5f30
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [edi], edx
mov edx, dword [esp + 0x34]
mov dword [edi + 4], eax
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x18

Function at 0x474a70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x572ec3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov dword [edi], 0x59afb8
xor eax, eax
mov dword [esp + 0x18], eax
mov esi, dword [edi + 0x30]
cmp esi, eax
mov dword [esp + 0xc], esi
je 0x474abd
mov byte [esp + 0x18], al
mov eax, dword [esi + 0x20]
push eax
call fcn.00551318
push esi
call fcn.00551318
add esp, 8
mov dword [esp + 0x18], 0xffffffff
mov ecx, edi
call fcn.004b5260
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret