joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e270
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5ff3c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push 0
mov ecx, 0x6b4960
mov dword [esp + 4], 0x6b4960
call fcn.004b6efd
mov dword [esp + 0x30], 0
mov ecx, 0x6b4a30
mov dword [0x6b4960], 0x65b6c8
call fcn.00404ef0
mov ecx, 0x6b4a34
call fcn.00404ef0
mov ecx, 0x6b4a38
call fcn.00404ef0
mov ecx, 0x6b4a40
mov byte [esp + 0x30], 3
call fcn.00420dc0
mov ecx, 0x6b4a68
mov byte [esp + 0x30], 4
call fcn.0043cbe0
mov ecx, 0x6b4e6c
mov byte [esp + 0x30], 5
call fcn.0043c1f0
mov ecx, 0x6b4f34
mov byte [esp + 0x30], 6
call fcn.00439340
mov ecx, 0x6b4fb8
call fcn.00404ef0
mov ecx, 0x6b4fc4
call fcn.00404ef0
mov byte [esp + 0x30], 9
mov ecx, 0x6b4fc4
push 0x651e48
mov dword [0x6b4a0c], 1
mov dword [0x6b4fa0], 0
mov dword [0x6b4f8c], 0
mov dword [0x6b4f90], 0
mov dword [0x6b4f94], 0
mov dword [0x6b4f9c], 0
mov dword [0x6b4fa4], 0
mov dword [0x6b4fa8], 0
mov dword [0x6b4fb0], 0
mov dword [0x6b4fb4], 0
mov dword [0x6b4fac], 0
mov dword [0x6b4fbc], 0
mov dword [0x6b4fc0], 0
call fcn.00404df0
mov ecx, 0x74
mov dword [0x6b4f98], 0
mov word [esp + 0x10], cx
lea ecx, [esp + 4]
mov dword [esp + 0x1a], 0x430043
mov dword [esp + 0x1e], 0x520050
mov dword [esp + 0xc], 0x610076
mov dword [esp + 0x12], 0x500065
mov dword [esp + 0x16], 0x410043
mov dword [esp + 4], 0x630041
mov dword [esp + 8], 0x690074
mov dword [esp + 0x22], 0x4f
call fcn.0048de60
mov dword [0x6b4f80], eax
mov ecx, 0x6b4a30
mov byte [0x6b4a2c], 0
push 0x651e48
mov byte [0x6b4a2d], 0
mov byte [0x6b4f30], 0
call fcn.00404df0
push 0x651e48
mov ecx, 0x6b4a34
call fcn.00404df0
push 0x651e48
mov ecx, 0x6b4a38
call fcn.00404df0
mov ecx, dword [esp + 0x28]
mov eax, 0x6b4960
mov byte [0x6b4a3c], 1
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x43e7d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5ff45b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x43c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x40], 0
lea esi, [edi + 0xd0]
mov ecx, esi
call fcn.00404a70
test eax, eax
jg 0x43e918
mov ecx, esi
call fcn.00404a70
test eax, eax
jne 0x43e85d
lea ecx, [edi + 0x3d0]
call fcn.0043c990
push eax
lea ecx, [esp + 0x40]
call fcn.00404720
mov dword [esp + 0x454], 0
push dword [eax]
push 0x657524
push esi
call fcn.00404860
add esp, 0xc
mov dword [esp + 0x454], 0xffffffff
lea ecx, [esp + 0x3c]
call fcn.00404e10
mov ecx, esi
call fcn.00404a70
test eax, eax
jne 0x43e918
push 0x3fe
push eax
mov word [esp + 0x4c], ax
lea eax, [esp + 0x4e]
push eax
call fcn.005d9ee0
xor eax, eax
mov dword [esp + 0x28], 0x72006f
mov word [esp + 0x44], ax
lea ecx, [edi + 0x5d4]
mov eax, 0x4e
mov dword [esp + 0x34], 0x65006e
mov word [esp + 0x38], ax
add esp, 0xc
mov eax, 0x62
mov dword [esp + 0x18], 0x700070
mov word [esp + 0x32], ax
mov ebp, 0x6f
mov eax, 0x74
mov dword [esp + 0x2e], 0x6d0075
mov word [esp + 0x20], ax
lea eax, [esp + 0x44]
push 0x200
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x2a], 0x680050
push eax
mov dword [esp + 0x20], 0x750053
mov word [esp + 0x32], bp
mov dword [esp + 0x40], 0x720065
call fcn.00439d00
lea eax, [esp + 0x44]
push eax
push 0x657524
push esi
call fcn.00404860
add esp, 0xc
mov ecx, dword [esp + 0x45c]
push esi
call fcn.00407790
mov ecx, dword [esp + 0x44c]
mov eax, dword [esp + 0x45c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x448
ret 4
Function at 0x441410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5ff87b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x90], 0
call fcn.00404ef0
mov dword [esp + 0x9c], 0
lea edx, [esp + 0x20]
mov eax, 0x6c
mov dword [esp + 0x8c], 0x104
mov word [esp + 0x6a], ax
mov ebp, 0x65
mov eax, 0x53
mov dword [esp + 0x14], 0x104
mov word [esp + 0x4e], ax
mov esi, 0x5c
mov eax, 0x50
mov dword [esp + 0x76], 0x730073
mov word [esp + 0x40], ax
lea ecx, [ebp - 0x21]
lea eax, [esp + 0x88]
mov dword [esp + 0x82], 0x30
push eax
push 0x20019
push ecx
lea edi, [ebp - 0x13]
mov dword [esp + 0x6e], 0x74006e
lea ebx, [ebp - 0x20]
mov dword [esp + 0x2c], 0x410048
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x78], 0x720050
mov dword [esp + 0x64], 0x5c006d
mov dword [esp + 0x48], 0x490052
mov dword [esp + 0x56], 0x5c005c
mov dword [esp + 0x6a], 0x650043
mov dword [esp + 0x36], 0x520041
mov dword [esp + 0x8a], 0x5c005c
mov dword [esp + 0x7c], 0x63006f
mov dword [esp + 0x40], 0x450044
mov dword [esp + 0x60], 0x650074
mov dword [esp + 0x52], 0x4e004f
mov dword [esp + 0x32], 0x570044
mov dword [esp + 0x72], 0x610072
mov dword [esp + 0x5c], 0x730079
mov dword [esp + 0x4e], 0x490054
mov dword [esp + 0x86], 0x72006f
mov word [esp + 0x68], si
mov dword [esp + 0x44], 0x430053
mov dword [esp + 0x3c], 0x5c005c
mov word [esp + 0x80], bp
mov word [esp + 0x30], di
mov word [esp + 0x3a], bx
call fcn.0048a380
add esp, 0xc
test eax, eax
je 0x441598
mov ecx, dword [esp + 0xa4]
push 0x651e48
call fcn.00404720
jmp 0x4415ef
lea eax, [esp + 0x8c]
mov edx, str.MHz
push eax
lea eax, [esp + 0x18]
push eax
push 0
push ecx
mov ecx, dword [esp + 0x98]
call fcn.0048af90
push dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x2c], 0x690025
mov word [esp + 0x30], ax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00404860
mov ecx, dword [esp + 0xc0]
lea eax, [esp + 0x2c]
add esp, 0x1c
push eax
call fcn.00407790
lea ecx, [esp + 0x10]
call fcn.00404e10
mov ecx, dword [esp + 0x94]
mov eax, dword [esp + 0xa4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x90
ret 4
Function at 0x441620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2a4
push ebx
push ebp
push esi
mov ebx, 0x5c
mov dword [esp + 0xa4], 0
mov eax, 0x6c
mov dword [esp + 0xa0], 0x104
mov ecx, 0x53
mov word [esp + 0x7e], ax
mov word [esp + 0x62], cx
lea eax, [esp + 0x9c]
push edi
mov ecx, 0x65
mov dword [esp + 0x8e], 0x730073
push eax
mov word [esp + 0x90], cx
lea esi, [ebx - 0x17]
lea edx, [ebx - 0xa]
mov word [esp + 0x4a], si
lea ecx, [ebx - 9]
mov word [esp + 0x40], dx
push 0x20019
push ecx
mov esi, 0x50
mov dword [esp + 0xa6], 0x30
lea edx, [esp + 0x44]
mov dword [esp + 0x86], 0x74006e
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x44], 0x410048
mov dword [esp + 0x90], 0x720050
mov dword [esp + 0x7c], 0x5c006d
mov dword [esp + 0x60], 0x490052
mov dword [esp + 0x6e], 0x5c005c
mov dword [esp + 0x82], 0x650043
mov dword [esp + 0x4e], 0x520041
mov dword [esp + 0xa2], 0x5c005c
mov dword [esp + 0x94], 0x63006f
mov dword [esp + 0x58], 0x450044
mov dword [esp + 0x78], 0x650074
mov dword [esp + 0x6a], 0x4e004f
mov dword [esp + 0x4a], 0x570044
mov dword [esp + 0x8a], 0x610072
mov dword [esp + 0x74], 0x730079
mov dword [esp + 0x66], 0x490054
mov dword [esp + 0x9e], 0x72006f
mov word [esp + 0x80], bx
mov dword [esp + 0x5c], 0x430053
mov dword [esp + 0x54], 0x5c005c
mov word [esp + 0x64], si
call fcn.0048a380
add esp, 0xc
test eax, eax
je 0x441783
push 0x651e48
jmp 0x44180b
lea eax, [esp + 0xa4]
mov dword [esp + 0x34], 0x67
push eax
mov ecx, 0x65
mov dword [esp + 0x24], 0x4e0072
lea eax, [esp + 0xb0]
mov dword [esp + 0x34], 0x6e0069
push eax
push 0
lea edx, [ecx + 0xa]
mov dword [esp + 0x22], 0x650063
mov word [esp + 0x2a], dx
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x22], 0x6f0072
mov dword [esp + 0x2a], 0x730073
mov dword [esp + 0x38], 0x530065
mov word [esp + 0x20], si
mov dword [esp + 0x34], 0x6d0061
mov dword [esp + 0x3c], 0x720074
call fcn.0048af90
add esp, 0x10
lea eax, [esp + 0xac]
push eax
mov ecx, dword [esp + 0x2bc]
call fcn.00404720
mov eax, dword [esp + 0x2b8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a4
ret 4
Function at 0x441cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5ff989
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc4
push ebx
push ebp
push esi
mov dword [esp + 0xc8], 0
mov ecx, dword [esp + 0xe0]
push edi
call fcn.00404ef0
mov dword [esp + 0xdc], 0
lea eax, [esp + 0x10]
push 0
push eax
mov ecx, 0x6b4960
mov dword [esp + 0xd4], 1
mov dword [esp + 0x18], 0x700070
mov dword [esp + 0x1c], 0x6f
call fcn.00441390
xor eax, eax
mov dword [esp + 0xa6], 0x730025
mov word [esp + 0xb2], ax
mov ecx, 0x63
mov word [esp + 0x2c], cx
mov eax, 0x26
mov ecx, eax
mov word [esp + 0x90], ax
mov word [esp + 0x86], cx
mov word [esp + 0x9c], cx
mov dword [esp + 0x58], 0x6f0063
lea eax, [ecx + 0x3f]
mov dword [esp + 0x82], 0x730025
lea ecx, [eax + 0xf]
mov word [esp + 0x42], ax
mov eax, 0x3d
mov word [esp + 0x4c], cx
mov word [esp + 0x80], ax
mov ecx, 0x72
mov word [esp + 0x96], ax
lea eax, [esp + 0xc0]
mov word [esp + 0x52], cx
mov ecx, 0x6b4960
push eax
mov dword [esp + 0x2c], 0x650073
mov dword [esp + 0x42], 0x630063
mov dword [esp + 0xa6], 0x3d0066
mov dword [esp + 0x80], 0x68003f
mov dword [esp + 0x64], 0x690073
mov dword [esp + 0x70], 0x720075
mov dword [esp + 0x36], 0x320065
mov dword [esp + 0x48], 0x65006c
mov dword [esp + 0x20], 0x700074
mov dword [esp + 0xae], 0x730025
mov dword [esp + 0x78], 0x730061
mov dword [esp + 0x6c], 0x70002f
mov dword [esp + 0x68], 0x650074
mov dword [esp + 0x9c], 0x730025
mov dword [esp + 0x74], 0x680063
mov dword [esp + 0x4c], 0x610072
mov dword [esp + 0x3e], 0x610063
mov dword [esp + 0x24], 0x3a0073
mov dword [esp + 0x52], 0x700065
mov dword [esp + 0x96], 0x640069
mov dword [esp + 0x60], 0x2f006d
mov dword [esp + 0x32], 0x720075
mov dword [esp + 0x8c], 0x3d0073
mov dword [esp + 0x3a], 0x70002e
mov dword [esp + 0x58], 0x2e006f
mov dword [esp + 0x7c], 0x2f0065
mov dword [esp + 0xa2], 0x660061
mov dword [esp + 0x28], 0x2f002f
mov dword [esp + 0xb2], 0x730025
mov dword [esp + 0x90], 0x730025
mov dword [esp + 0x1c], 0x740068
call fcn.00441830
mov dword [esp + 0xc8], eax
lea eax, [esp + 0xb8]
mov dword [esp + 0xdc], 1
push eax
mov ecx, 0x6b4960
call fcn.00441ca0
mov ebp, eax
lea ecx, [esp + 0xc4]
mov byte [esp + 0xdc], 2
call fcn.0043d320
mov ebx, eax
lea ecx, [esp + 0xb4]
mov byte [esp + 0xdc], 3
call fcn.004215a0
mov edi, eax
lea ecx, [esp + 0xbc]
mov byte [esp + 0xdc], 4
call fcn.004142a0
mov esi, eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xdc], 5
call fcn.00414250
mov ecx, dword [esp + 0xc8]
mov byte [esp + 0xdc], 6
push dword [ecx]
push dword [ebp]
push dword [ebx]
push dword [edi]
push dword [esi]
mov esi, dword [esp + 0xf8]
push dword [eax]
lea eax, [esp + 0x30]
push eax
push esi
call fcn.00404860
add esp, 0x20
lea ecx, [esp + 0xd0]
call fcn.00404e10
lea ecx, [esp + 0xbc]
call fcn.00404e10
lea ecx, [esp + 0xb4]
call fcn.00404e10
lea ecx, [esp + 0xc4]
call fcn.00404e10
lea ecx, [esp + 0xb8]
call fcn.00404e10
lea ecx, [esp + 0xc0]
call fcn.00404e10
mov ecx, dword [esp + 0xd4]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xd0
ret 4
Function at 0x4427f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5ff9e2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x248
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x25c], 0
push 0x651e48
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], 0
call fcn.00404720
xor eax, eax
mov dword [esp + 0x25c], 0
push 0x206
push eax
mov word [esp + 0x54], ax
lea eax, [esp + 0x56]
push eax
mov dword [esp + 0x50], 1
call fcn.005d9ee0
add esp, 8
lea edx, [esp + 0x50]
call fcn.00442960
xor eax, eax
mov dword [esp + 0x3a], 0x690070
mov word [esp + 0x46], ax
add esp, 4
mov eax, 0x61
mov dword [esp + 0x3e], 0x6c006c
mov word [esp + 0x34], ax
lea eax, [esp + 0x2c]
mov dword [esp + 0x3a], 0x64002e
push eax
mov dword [esp + 0x34], 0x77006c
mov dword [esp + 0x30], 0x680053
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x442939
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x68746150
push eax
push edi
mov word [esp + 0x23], 0x5765
mov byte [esp + 0x25], 0
mov dword [esp + 0x18], 0x646e6946
mov dword [esp + 0x1e], 0x614e656c
mov byte [esp + 0x22], 0x6d
mov word [esp + 0x1c], 0x6946
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x442932
lea ecx, [esp + 0x4c]
push ecx
call eax
push eax
mov ecx, esi
call fcn.00404df0
mov eax, 0x78
mov dword [esp + 0x20], 0x65002e
mov word [esp + 0x24], ax
mov ecx, esi
push 0x651e48
lea eax, [esp + 0x24]
mov dword [esp + 0x2a], 0x65
push eax
call fcn.004095d0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x254]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x254
ret

Function at 0x442960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
xor eax, eax
mov dword [esp + 0x24], 0x64002e
push esi
mov word [esp + 0x30], ax
mov esi, edx
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x65004b
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0x6c0065
push eax
mov dword [esp + 0x34], 0x6c006c
mov dword [esp + 0x2c], 0x320033
mov dword [esp + 0x24], 0x6e0072
mov word [esp + 0x1a], 0x6d61
mov dword [esp + 0xf], 0x75646f4d
mov word [esp + 0x14], 0x4665
mov word [esp + 0xd], 0x7465
mov word [esp + 0x1d], 0x57
mov word [esp + 0x17], 0x656c
mov byte [esp + 0x19], 0x4e
mov byte [esp + 0xc], 0x47
mov byte [esp + 0x13], 0x6c
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x1c], 0x65
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x442a0b
push 0x104
push esi
push 0
call eax
pop esi
add esp, 0x30
ret
xor eax, eax
pop esi
add esp, 0x30
ret
Function at 0x442a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5ffa12
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x250
push esi
push edi
mov esi, ecx
mov dword [esp + 0x260], 0
push 0x651e48
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], 0
call fcn.00404720
xor eax, eax
mov dword [esp + 0x260], 0
push 0x206
push eax
mov word [esp + 0x58], ax
lea eax, [esp + 0x5a]
push eax
mov dword [esp + 0x54], 1
call fcn.005d9ee0
add esp, 8
lea edx, [esp + 0x54]
call fcn.00442960
mov eax, 0x69
mov dword [esp + 0x38], 0x77006c
mov word [esp + 0x40], ax
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 0x680053
mov word [esp + 0x46], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x42], 0x6c006c
push eax
mov dword [esp + 0x3c], 0x700061
mov dword [esp + 0x42], 0x64002e
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x442b8e
lea eax, [esp + 0x1c]
mov word [esp + 0x22], 0x6f6d
push eax
push edi
mov dword [esp + 0x2f], 0x53656c69
mov dword [esp + 0x25], 0x52687461
mov dword [esp + 0x33], 0x57636570
mov byte [esp + 0x37], 0
mov word [esp + 0x2d], 0x4665
mov byte [esp + 0x2c], 0x76
mov byte [esp + 0x24], 0x50
mov byte [esp + 0x29], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x442b38
lea ecx, [esp + 0x50]
push ecx
call eax
lea eax, [esp + 8]
mov word [esp + 0x13], 0x4e65
push eax
push edi
mov dword [esp + 0x16], 0x6946646e
mov dword [esp + 0x12], 0x69466874
mov dword [esp + 0x1e], 0x57656d
mov word [esp + 0x10], 0x6150
mov byte [esp + 0x1d], 0x61
mov byte [esp + 0x1a], 0x6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x442b87
lea ecx, [esp + 0x50]
push ecx
call eax
push eax
mov ecx, esi
call fcn.00404df0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x258]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x25c
ret

Function at 0x4430f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ffa88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
mov dword [esp + 4], 0
push ecx
lea ecx, [esp + 0xc]
call fcn.00443030
push 0
mov edx, eax
mov dword [esp + 0x30], 0
mov ecx, esi
call fcn.00442f70
add esp, 8
lea ecx, [esp + 8]
call fcn.00406f10
mov ecx, dword [esp + 0x20]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x28
ret
Function at 0x444e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push esi
push edi
mov edi, ecx
mov edx, 0x80
mov ecx, dword [esp + 0x2c]
mov byte [edi + 0x1c7ec], 1
mov dword [edi + 0x1c430], 0x3bc
call fcn.0048c670
mov ecx, edi
mov dword [edi + 0x1c444], eax
mov dword [edi + 0x1c440], 0x401
call fcn.00404780
mov dword [edi + 0x1c434], eax
mov edx, 0x65
mov eax, 0x41
mov dword [edi + 0x1c438], 0x402
mov word [esp + 0xc], ax
lea eax, [esp + 8]
push eax
lea eax, [edi + 0x1c448]
mov dword [esp + 0x16], 0x6c0065
push 0x10
push eax
mov dword [esp + 0x1a], 0x630063
mov dword [esp + 0x28], 0x650074
mov dword [esp + 0x14], 0x430050
mov dword [esp + 0x24], 0x610072
mov dword [esp + 0x2c], 0x720050
mov dword [esp + 0x30], 0x6f
mov word [esp + 0x22], dx
call fcn.005d55ea
add esp, 0xc
mov dword [edi + 0x1c43c], 7
lea edx, [edi + 0x1c430]
xor ecx, ecx
call fcn.0048c6d0
pop edi
pop esi
add esp, 0x20
ret 4
Function at 0x450500
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x600a4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
push esi
mov dword [esp + 0xc], edi
call fcn.00406ec0
lea eax, [esi + 0x18]
mov dword [esp + 0x14], 0
push eax
lea ecx, [edi + 0x18]
call fcn.00406ec0
lea eax, [esi + 0x30]
mov byte [esp + 0x14], 1
push eax
lea ecx, [edi + 0x30]
call fcn.00406ec0
lea eax, [esi + 0x48]
mov byte [esp + 0x14], 2
push eax
lea ecx, [edi + 0x48]
call fcn.00406ec0
mov eax, dword [esi + 0x60]
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
mov eax, dword [esi + 0x6c]
mov dword [edi + 0x6c], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4505c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x600a7e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
push esi
mov dword [esp + 0xc], edi
call fcn.00406ec0
lea eax, [esi + 0x18]
mov dword [esp + 0x14], 0
push eax
lea ecx, [edi + 0x18]
call fcn.00406ec0
lea eax, [esi + 0x30]
mov byte [esp + 0x14], 1
push eax
lea ecx, [edi + 0x30]
call fcn.00406ec0
lea eax, [esi + 0x48]
mov byte [esp + 0x14], 2
push eax
lea ecx, [edi + 0x48]
call fcn.00406ec0
mov eax, dword [esi + 0x60]
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
mov eax, dword [esi + 0x6c]
mov dword [edi + 0x6c], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x451e20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x600c7f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
push esi
mov dword [esp + 0xc], edi
call fcn.00406ec0
lea eax, [esi + 0x18]
mov dword [esp + 0x14], 0
push eax
lea ecx, [edi + 0x18]
call fcn.00406ec0
lea eax, [esi + 0x30]
mov byte [esp + 0x14], 1
push eax
lea ecx, [edi + 0x30]
call fcn.00406ec0
lea eax, [esi + 0x48]
mov byte [esp + 0x14], 2
push eax
lea ecx, [edi + 0x48]
call fcn.00406ec0
lea eax, [esi + 0x60]
mov byte [esp + 0x14], 3
push eax
lea ecx, [edi + 0x60]
call fcn.00406ec0
lea eax, [esi + 0x78]
mov byte [esp + 0x14], 4
push eax
lea ecx, [edi + 0x78]
call fcn.00406ec0
mov byte [esp + 0x14], 5
lea ecx, [edi + 0x98]
mov eax, dword [esi + 0x90]
mov dword [edi + 0x90], eax
mov eax, dword [esi + 0x94]
mov dword [edi + 0x94], eax
lea eax, [esi + 0x98]
push eax
call fcn.00406ec0
mov eax, dword [esi + 0xb0]
mov ecx, dword [esp + 0xc]
mov dword [edi + 0xb0], eax
mov eax, dword [esi + 0xb4]
mov dword [edi + 0xb4], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x451f40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x600cb9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
push esi
mov dword [esp + 0xc], edi
call fcn.00406ec0
lea eax, [esi + 0x18]
mov dword [esp + 0x14], 0
push eax
lea ecx, [edi + 0x18]
call fcn.00406ec0
lea eax, [esi + 0x30]
mov byte [esp + 0x14], 1
push eax
lea ecx, [edi + 0x30]
call fcn.00406ec0
lea eax, [esi + 0x48]
mov byte [esp + 0x14], 2
push eax
lea ecx, [edi + 0x48]
call fcn.00406ec0
lea eax, [esi + 0x60]
mov byte [esp + 0x14], 3
push eax
lea ecx, [edi + 0x60]
call fcn.00406ec0
mov eax, dword [esi + 0x78]
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x78], eax
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x7c], eax
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x452010
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x600d12
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
push esi
mov dword [esp + 0xc], edi
call fcn.00406ec0
lea eax, [esi + 0x18]
mov dword [esp + 0x14], 0
push eax
lea ecx, [edi + 0x18]
call fcn.00406ec0
lea eax, [esi + 0x30]
mov byte [esp + 0x14], 1
push eax
lea ecx, [edi + 0x30]
call fcn.00406ec0
lea eax, [esi + 0x48]
mov byte [esp + 0x14], 2
push eax
lea ecx, [edi + 0x48]
call fcn.00406ec0
mov byte [esp + 0x14], 3
lea ecx, [edi + 0x64]
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
lea eax, [esi + 0x64]
push eax
call fcn.00406ec0
mov byte [esp + 0x14], 4
lea ecx, [edi + 0x80]
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x7c], eax
lea eax, [esi + 0x80]
push eax
call fcn.00406ec0
lea eax, [esi + 0x98]
mov byte [esp + 0x14], 5
push eax
lea ecx, [edi + 0x98]
call fcn.00406ec0
mov eax, dword [esi + 0xb0]
mov ecx, dword [esp + 0xc]
mov dword [edi + 0xb0], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4