joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
movzx eax, word [edi + 4]
mov word [esi + 4], ax
movzx ecx, word [edi + 6]
mov word [esi + 6], cx
movzx edx, word [edi + 8]
mov word [esi + 8], dx
movzx eax, word [edi + 0xa]
mov word [esi + 0xa], ax
movzx ecx, word [edi + 0xc]
mov word [esi + 0xc], cx
movzx edx, word [edi + 0xe]
mov word [esi + 0xe], dx
movzx eax, word [edi + 0x10]
mov word [esi + 0x10], ax
movzx ecx, word [edi + 0x12]
mov word [esi + 0x12], cx
mov dl, byte [edi + 0x14]
mov byte [esi + 0x14], dl
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
movzx ecx, word [edi + 0x1c]
mov word [esi + 0x1c], cx
movzx edx, word [edi + 0x1e]
mov word [esi + 0x1e], dx
movzx eax, word [edi + 0x20]
mov word [esi + 0x20], ax
movzx ecx, word [edi + 0x22]
mov word [esi + 0x22], cx
movzx edx, word [edi + 0x24]
mov word [esi + 0x24], dx
movzx eax, word [edi + 0x26]
mov word [esi + 0x26], ax
movzx ecx, word [edi + 0x28]
mov word [esi + 0x28], cx
movzx edx, word [edi + 0x2a]
mov word [esi + 0x2a], dx
movzx eax, word [edi + 0x2c]
mov word [esi + 0x2c], ax
movzx ecx, word [edi + 0x2e]
mov word [esi + 0x2e], cx
movzx edx, word [edi + 0x30]
mov word [esi + 0x30], dx
movzx eax, word [edi + 0x32]
mov word [esi + 0x32], ax
movzx ecx, word [edi + 0x34]
mov word [esi + 0x34], cx
movzx edx, word [edi + 0x36]
mov word [esi + 0x36], dx
movzx eax, word [edi + 0x38]
mov word [esi + 0x38], ax
fld dword [edi + 0x3c]
fstp dword [esi + 0x3c]
fld dword [edi + 0x40]
fstp dword [esi + 0x40]
movzx ecx, word [edi + 0x44]
mov word [esi + 0x44], cx
movzx edx, word [edi + 0x46]
mov word [esi + 0x46], dx
mov al, byte [edi + 0x48]
mov byte [esi + 0x48], al
mov cl, byte [edi + 0x49]
mov byte [esi + 0x49], cl
mov edx, dword [edi + 0x4c]
mov dword [esi + 0x4c], edx
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov ecx, dword [edi + 0x54]
lea edx, [edi + 0x58]
mov dword [esi + 0x54], ecx
push edx
lea ecx, [esi + 0x58]
call fcn.00466890
lea eax, [edi + 0x68]
push eax
lea ecx, [esi + 0x68]
call fcn.00466890
lea ecx, [edi + 0x78]
push ecx
lea ecx, [esi + 0x78]
call fcn.00465ce0
mov edx, dword [edi + 0x88]
mov dword [esi + 0x88], edx
mov eax, dword [edi + 0x8c]
mov dword [esi + 0x8c], eax
mov ecx, dword [edi + 0x90]
mov dword [esi + 0x90], ecx
mov edx, dword [edi + 0x94]
mov dword [esi + 0x94], edx
mov eax, dword [edi + 0x98]
mov dword [esi + 0x98], eax
mov ecx, dword [edi + 0x9c]
mov dword [esi + 0x9c], ecx
movzx edx, word [edi + 0xa0]
mov word [esi + 0xa0], dx
movzx eax, word [edi + 0xa2]
mov word [esi + 0xa2], ax
movzx ecx, word [edi + 0xa4]
pop edi
mov word [esi + 0xa4], cx
mov eax, esi
pop esi
ret 4
Function at 0x46e830
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x8517d4
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.004704e0
xor ebx, ebx
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
lea ecx, [esi + 0x10]
mov dword [esp + 0x20], ebx
call fcn.00414cd0
lea edi, [esi + 0x18]
mov ecx, edi
mov byte [esp + 0x20], 1
call fcn.00414cd0
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
lea ebp, [esi + 0x4c]
mov ecx, ebp
mov byte [esp + 0x20], 3
call fcn.00609410
mov dword [ebp + 4], eax
mov dword [ebp + 8], ebx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push ebx
mov dword [0x8985dc], esi
push ebx
mov byte [esp + 0x30], 4
mov byte [esi + 0xc], 1
call ebp
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x20], eax
call ebp
push esi
push 0x46e6d0
lea ecx, [esi + 0x10]
mov dword [esi + 0x24], eax
call fcn.00414cf0
push esi
push 0x46e6f0
mov ecx, edi
call fcn.00414cf0
push 0xfffffffffffffff1
mov ecx, edi
call fcn.00414d80
xor eax, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x46f9c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x851861
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable.BackgroundBase.0
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
fldz
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
fst dword [eax + 0x58]
fst dword [eax + 0x54]
fst dword [eax + 0x50]
fst dword [eax + 0x4c]
fst dword [eax + 0x48]
fstp dword [eax + 0x44]
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x47e0d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_InfoEffectObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4adec0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_ReimuObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4d2130
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_MarisaObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4feeb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_SakuyaObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x524210
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_AliceObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x555d80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_PatchouliObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x57a830
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_YoumuObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x59b8e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_RemiliaObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x5b9120
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_YuyukoObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x5de6f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_YukariObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x609700
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_SuikaObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x6336c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_UdongeObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x657a80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_KomachiObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x67d1a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_AyaObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x69beb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x8526d1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8943b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], vtable.CHandleManagerEx_class_IkuObject_.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ebx, [esi + 0x24]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00412c80
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.0040aec0
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x6c4a5d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
call fcn.006c4a5d
add byte [ebx + 0x3d], al
inc esp
xor dh, byte ss:[edi]
dec edi
add esp, 4
and edi, 0x4f7
add edi, 0x1dbb
call 0x6c4a79
add byte [ebx], bh
dec ecx
dec ecx
inc esp
inc ebp
xor eax, 0x4c4833b
pop edi
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push eax
add eax, 0x310c
pop eax
push edx
or edx, 0x2e1e
sub edx, 0x171c1
xor edx, 0xc505
pop edx
push esi
sub esi, 0xd938
or esi, 0xe79f
pop esi
push ebx
add ebx, 0x89df
pop ebx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push esi
push edx
add esp, 4
sub esi, 0xb62f
jmp 0x6c4b47
sub esi, 0x16132
or esi, 0x5a0
pop esi
push esi
add esi, 0x12891
or esi, 0x13ec4
sub esi, 0x68a4
pop esi
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x6c4b8b
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x6c4bee
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x6c4aaa
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x6c4aaa
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x6c4bd8
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x6c4be2
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
xchg ebp, eax
push 0x83ffffeb
mov ebp, 0xffffeb68
add byte [ebp + 0x40], dh
cmp dword [ebp - 0x1498], 0
jne 0x6c4c37
push eax
push esi
add esp, 4
and eax, 0x2205
or eax, 0x9259
pop eax
push edx
call 0x6c4c19
add byte [edx], bh
cmp dword ds:[edx + 0x41], eax
dec eax
aaa
aaa
cmp al, byte [ebx - 0x357efb3c]
cmp al, 0x7d
add byte [eax], al
sub edx, 0x10788
pop edx
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x6c4c9f
push ecx
or ecx, 0x161b3
pop ecx
push edx
or edx, 0x1849f
pop edx
push ebx
push ecx
add esp, 4
call 0x6c4c59
add byte [ebp + 0x40], cl
aas
dec ecx
inc eax
cmp byte [eax - 0x7d], dl
les eax, [ecx + eax*4]
jecxz 0x6c4be9
pop edi
add byte [eax], al
xor ebx, 0x11502
pop ebx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x6c4c95
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x6c4a4b
mov dword [ebp - 0x2e0], 0