joyce8/EMBER2024-capa huggingface dataset:
Function at 0x654840
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x843618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0061a3b0
mov ecx, dword [esp + 0x2c]
mov dword [esi], 0x86f334
mov edx, dword [ecx]
lea eax, [esi + 0x20]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov ecx, dword [ecx + 8]
mov edx, dword [esp + 0x30]
mov dword [eax + 8], ecx
mov edi, dword [edx]
lea ecx, [esi + 0x2c]
mov eax, ecx
mov dword [eax], edi
mov edi, dword [edx + 4]
mov dword [eax + 4], edi
mov edx, dword [edx + 8]
mov dword [eax + 8], edx
mov eax, dword [esp + 0x24]
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0x28]
mov ebp, dword [eax]
lea edi, [esi + 0x38]
lea edx, [esi + 0x3c]
mov dword [edx], ebp
mov ebp, dword [eax + 4]
mov dword [edx + 4], ebp
mov eax, dword [eax + 8]
mov dword [edx + 8], eax
mov dl, byte [esp + 0x20]
mov al, byte [esi + 0x49]
mov byte [esi + 0x48], dl
mov dl, byte [esp + 0x34]
and al, 0xc4
and dl, 1
or al, dl
or al, 4
mov dword [esp + 0x18], 0
mov byte [esi + 0x49], al
mov byte [esi + 0x4a], 0
mov dword [esi + 0x34], 0
call fcn.0059c910
push 0x64
call fcn.0041b7c0
add esp, 4
test eax, eax
je 0x654903
mov dword [eax], 0
jmp 0x654905
xor eax, eax
push 0x64
mov dword [esi + 0xc], eax
call fcn.0041b7c0
add esp, 4
test eax, eax
je 0x65491e
mov dword [eax], 0
jmp 0x654920
xor eax, eax
mov ecx, dword [edi]
push edi
mov dword [esi + 0x10], eax
call fcn.00571b70
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x65b930
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x843f58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0061a3b0
mov ecx, dword [esp + 0x18]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x20]
lea eax, [esi + 0xc]
xor edx, edx
mov dword [esi], 0x86f708
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], edx
mov byte [esi + 0x28], dl
mov byte [esi + 0x29], dl
mov dword [esi + 0x2c], ecx
mov cl, byte [esp + 0x1c]
mov byte [esi + 0x30], cl
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x34], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x38], ecx
mov ecx, dword [eax]
cmp ecx, edx
mov dword [esp + 0x10], edx
je 0x65b9a3
push eax
call fcn.00571b70
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18

Function at 0x65c430
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x844028
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0061a3b0
mov ecx, dword [esp + 0x18]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x20]
lea eax, [esi + 0xc]
mov dword [esi + 0x20], ecx
mov cl, byte [esp + 0x1c]
mov byte [esi + 0x24], cl
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x28], ecx
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov dword [esi + 0x2c], ecx
mov dword [esi], 0x86f784
mov dword [esi + 0x30], 7
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], edx
mov byte [esi + 0x3c], dl
mov byte [esi + 0x3d], dl
mov ecx, dword [eax]
cmp ecx, edx
mov dword [esp + 0x10], edx
je 0x65c4aa
push eax
call fcn.00571b70
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18

Function at 0x65c900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x8440a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
push esi
push eax
mov eax, dword [esp + 0x24]
mov esi, ecx
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x1c], esi
call fcn.0065c430
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ecx
mov dword [esi], 0x86f7c4
lea eax, [esi + 0xc]
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], edx
mov byte [esi + 0x50], dl
mov byte [esi + 0x51], dl
mov ecx, dword [eax]
cmp ecx, edx
mov dword [esp + 0x10], edx
je 0x65c977
push eax
call fcn.00571b70
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20
Function at 0x65cc60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x844108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x20]
push esi
push eax
mov eax, dword [esp + 0x24]
mov esi, ecx
mov ecx, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push 0
push ecx
mov ecx, esi
mov dword [esp + 0x1c], esi
call fcn.0065c430
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dl, byte [esp + 0x1c]
mov dword [esi + 0x44], eax
lea eax, [esi + 0xc]
mov dword [esi + 0x48], ecx
mov ecx, dword [eax]
test ecx, ecx
mov byte [esi + 0x40], dl
mov edx, dword [esp + 0x30]
mov dword [esp + 0x10], 0
mov dword [esi], 0x86f7f0
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], 0
je 0x65ccdf
push eax
call fcn.00571b70
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x24

Function at 0x65f3b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x844448
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0061a3b0
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esi], 0x86f998
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov byte [esi + 0x38], al
mov byte [esi + 0x39], al
lea edx, [esi + 0x10]
mov dword [edx], edi
mov edi, dword [esp + 0x24]
mov dword [edx + 4], edi
mov edi, dword [esp + 0x28]
mov dword [edx + 8], edi
mov dl, byte [esp + 0x2c]
mov byte [esi + 0x1c], dl
mov edx, dword [esp + 0x30]
mov dword [esi + 0x20], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x38]
mov dword [esp + 0x14], eax
lea eax, [esi + 0xc]
mov dword [esi + 0x28], edx
mov dl, byte [esp + 0x3c]
push eax
mov dword [eax], ecx
mov byte [esi + 0x2c], dl
call fcn.00571b70
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x3c], 0xbf800000
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x24

Function at 0x65f3c6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x844448
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0061a3b0
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esi], 0x86f998
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov byte [esi + 0x38], al
mov byte [esi + 0x39], al
lea edx, [esi + 0x10]
mov dword [edx], edi
mov edi, dword [esp + 0x24]
mov dword [edx + 4], edi
mov edi, dword [esp + 0x28]
mov dword [edx + 8], edi
mov dl, byte [esp + 0x2c]
mov byte [esi + 0x1c], dl
mov edx, dword [esp + 0x30]
mov dword [esi + 0x20], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x38]
mov dword [esp + 0x14], eax
lea eax, [esi + 0xc]
mov dword [esi + 0x28], edx
mov dl, byte [esp + 0x3c]
push eax
mov dword [eax], ecx
mov byte [esi + 0x2c], dl
call fcn.00571b70
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x3c], 0xbf800000
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x24
Function at 0x661dc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x844953
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0061a3b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x10], edx
mov edx, dword [esp + 0x28]
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x30]
xor eax, eax
mov dword [esi], 0x86fbb4
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
lea edi, [esi + 0xc]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov byte [esi + 0x3c], al
mov byte [esi + 0x3d], al
mov dword [esi + 0x40], 0x86f8f8
mov dword [esp + 0x14], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov cl, byte [esp + 0x38]
mov dl, byte [esi + 0x54]
and cl, 1
shl cl, 1
and dl, 0xf0
or cl, dl
mov dl, byte [esp + 0x34]
and dl, 1
or cl, dl
mov byte [esi + 0x54], cl
mov ecx, dword [edi]
cmp ecx, eax
mov byte [esp + 0x14], 1
mov dword [esi + 0x50], 6
je 0x661e7c
push edi
call fcn.00571b70
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20

Function at 0x668790
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
pushfd
mov ebx, dword [0x53ec1f]
xor ebx, dword [0x15607c8]
popfd
xchg dword [esp], ebx
jmp 0x668797
push 0xffffffffffffffff
jmp 0x405855
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0061a3b0
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
test ecx, ecx
lea edx, [esi + 0x14]
mov dword [edx], edi
mov edi, dword [esp + 0x30]
mov dword [edx + 4], edi
mov edi, dword [esp + 0x34]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x10]
mov dword [esp + 0x18], 0
mov dword [esi], 0x86fe00
mov dword [eax], ecx
mov dword [edx + 8], edi
je 0x6687f3
push eax
call fcn.00571b70
mov ebx, dword [esp + 0x24]
lea edi, [esi + 0x20]
push ebx
push edi
call fcn.00509760
add esp, 8
test al, al
jne 0x668824
fld dword [esi + 0x2c]
fcomp dword [esp + 0x38]
fnstsw ax
test ah, 0x44
jp 0x668824
fld dword [esi + 0x30]
fcomp dword [esp + 0x3c]
fnstsw ax
test ah, 0x44
jnp 0x66884a
mov eax, dword [ebx]
mov dword [edi], eax
mov ecx, dword [ebx + 4]
mov eax, dword [esp + 0x38]
mov dword [edi + 4], ecx
mov edx, dword [ebx + 8]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x2c], eax
mov al, byte [esi + 0x34]
or al, 1
mov dword [edi + 8], edx
mov dword [esi + 0x30], ecx
mov byte [esi + 0x34], al
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20
Function at 0x6688ee
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x844f31
push eax
mov eax, dword [esp + 0x10]
sub eax, 0x387
mov dword fs:[0], esp
push esi
mov esi, ecx
je 0x66898c
sub eax, 0x75
je 0x668915
sub eax, 0x11a
xor eax, eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
cmp eax, 0x385
push 0x3c
jne 0x668948
call fcn.0061a5a0
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0xc], 1
je 0x668901
push 0x927c0
push 1
push 3
jmp 0x668969
call fcn.0061a5a0
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0xc], 2
je 0x668901
push 0x927c0
push 1
push 0
mov edx, dword [esi + 0x10]
push 0
lea ecx, [esi + 0x14]
push ecx
push edx
mov ecx, eax
call fcn.0061f3f0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
push 0x28
call fcn.0061a5a0
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x668901
mov ecx, dword [esi + 0x30]
mov edx, dword [esi + 0x2c]
push 0
push 0
push ecx
push edx
mov edx, dword [esi + 0xc]
lea ecx, [esi + 0x20]
push ecx
push edx
mov ecx, eax
call fcn.00668120
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x6696a6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x845017
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, 0x387
push edi
jg 0x66984a
je 0x6697f7
cmp ecx, 0xcb
je 0x669784
cmp ecx, 0x2c0
je 0x669738
cmp ecx, 0x384
jne 0x66985c
push 0x30
call fcn.0061a5a0
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x14], 0
je 0x66985a
mov ecx, dword [0x86fc78]
mov edx, dword [esi + 0x38]
push 0
push 0
push ecx
mov ecx, dword [esi + 0x30]
lea edx, [edx + edx*2]
lea edx, [ecx + edx*4 + 4]
mov ecx, dword [esi + 0x18]
push edx
push ecx
mov ecx, eax
call fcn.00667cd0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
push 0x34
call fcn.0061a5a0
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov dword [esp + 0x14], 3
je 0x66985a
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 0x58c]
push 0
push 1
push 0
push 0
push ecx
mov ecx, eax
call fcn.0063b8c0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
push 0x20
call fcn.0061a5a0
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov dword [esp + 0x14], 4
je 0x6697b4
push 0x41000000
push 0
push 0
push 0
mov ecx, eax
call fcn.0062f310
mov edi, eax
jmp 0x6697b6
xor edi, edi
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
push 0
add esi, 0xc
mov ebx, dword [esi]
sub esp, 0xc
mov eax, esp
mov dword [eax], ebx
mov ebx, dword [esi + 4]
mov esi, dword [esi + 8]
mov dword [eax + 4], ebx
mov dword [esp + 0x24], 0xffffffff
mov dword [eax + 8], esi
call dword [edx + 0x38]
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
push 0x28
call fcn.0061a5a0
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x14], 2
je 0x66985a
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push 0
push 0
push ecx
push edx
mov edx, dword [esi + 0x38]
lea ecx, [edx + edx*2]
mov edx, dword [esi + 0x30]
lea ecx, [edx + ecx*4 + 4]
mov edx, dword [esi + 0x18]
push ecx
push edx
mov ecx, eax
call fcn.00668120
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
cmp ecx, 0x39e
je 0x669870
cmp ecx, 0x516
jne 0x66985c
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
push 0x24
call fcn.0061a5a0
mov edi, eax
add esp, 4
mov dword [esp + 0x20], edi
test edi, edi
mov dword [esp + 0x14], 1
je 0x66985a
mov eax, dword [0x86fc78]
mov edx, dword [esi + 0x30]
push 0
push eax
mov eax, dword [esi + 0x38]
lea ecx, [eax + eax*2]
lea eax, [edx + ecx*4 + 4]
mov edx, dword [eax]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ecx + 4], edx
mov dword [ecx + 8], eax
mov ecx, dword [esi + 0x18]
push ecx
call fcn.0065ef30
fstp dword [esp]
mov ecx, edi
call fcn.0065eeb0
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x66bb20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x845198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0061a3b0
mov ecx, dword [esp + 0x18]
mov dword [esi + 0xc], ecx
xor edx, edx
mov dword [esi], 0x86ffc0
lea eax, [esi + 0xc]
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], edx
mov byte [esi + 0x30], dl
mov byte [esi + 0x31], dl
mov cl, byte [esi + 0x34]
and cl, 0xf1
or cl, 1
mov byte [esi + 0x34], cl
mov ecx, dword [eax]
cmp ecx, edx
mov dword [esp + 0x10], edx
je 0x66bb7c
push eax
call fcn.00571b70
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x66ca40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x8452f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0061a3b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x10], edx
mov edx, dword [esp + 0x28]
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x30]
xor eax, eax
mov dword [esi], 0x87004c
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
lea edi, [esi + 0xc]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov byte [esi + 0x3c], al
mov byte [esi + 0x3d], al
mov dword [esi + 0x40], 0x86fd18
mov dword [esp + 0x14], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov cl, byte [esp + 0x38]
mov dl, byte [esi + 0x54]
and cl, 1
shl cl, 1
and dl, 0xf0
or cl, dl
mov dl, byte [esp + 0x34]
and dl, 1
or cl, dl
mov byte [esi + 0x54], cl
mov ecx, dword [edi]
cmp ecx, eax
mov byte [esp + 0x14], 1
mov dword [esi + 0x50], 6
je 0x66cafc
push edi
call fcn.00571b70
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20
Function at 0x66ea30
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ecx
pushfd
mov ecx, dword [0x1560864]
not ecx
xor ecx, dword [0x535e93]
popfd
xchg dword [esp], ecx
jmp 0x66ea37
push 0xffffffffffffffff
jmp 0x407441
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0061a3b0
mov ecx, dword [esp + 0x20]
mov dword [esi], 0x8700a8
mov edx, dword [ecx]
lea eax, [esi + 0xc]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov ecx, dword [ecx + 8]
mov edx, dword [esp + 0x1c]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
mov word [esi + 0x28], 0xffff
mov word [esi + 0x34], 0xffff
mov dword [esi + 0x3c], eax
xor eax, eax
mov al, byte [esp + 0x38]
xor ecx, ecx
mov cl, byte [esp + 0x30]
xor ebx, ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
and eax, 1
mov byte [esi + 0x48], bl
mov byte [esi + 0x49], bl
mov edx, dword [esi + 0x4c]
shl eax, 3
and ecx, 1
or eax, ecx
and edx, 0xfffffff6
or eax, edx
test al, 8
mov dword [esp + 0x14], ebx
mov dword [esi + 0x4c], eax
je 0x66eaec
and eax, 0xffffff9f
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
push 0x64
call fcn.0041b7c0
add esp, 4
cmp eax, ebx
je 0x66eafe
mov dword [eax], ebx
jmp 0x66eb00
xor eax, eax
push 0x24
mov dword [esi + 0x30], eax
call fcn.0041b860
add esp, 4
cmp eax, ebx
je 0x66eb2d
mov dword [eax], ebx
lea ecx, [eax + 4]
mov edx, 8
jmp 0x66eb20
mov word [ecx], 0xffff
add ecx, 4
dec edx
jne 0x66eb20
jmp 0x66eb2f
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2c], eax
mov word [esi + 0x34], 0xffff
mov eax, dword [0x8a5f44]
mov dword [esi + 0x28], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20
Function at 0x671510
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ecx
pushfd
stc
mov ecx, dword [0x15606e4]
sbb ecx, dword [0x49d63d]
popfd
xchg dword [esp], ecx
jmp 0x671517
push 0xffffffffffffffff
jmp 0x401d9d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0061a3b0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0xc], eax
xor eax, eax
mov al, byte [esp + 0x34]
xor edx, edx
mov dl, byte [esp + 0x38]
mov dword [esi + 0x14], ecx
xor ecx, ecx
mov cl, byte [esp + 0x30]
xor edi, edi
and eax, 1
shl eax, 1
and edx, 1
or eax, edx
mov edx, dword [esi + 0x28]
shl eax, 2
and ecx, 1
or eax, ecx
and edx, 0xfffffff2
or eax, edx
test al, 8
mov dword [esp + 0x14], edi
mov dword [esi], 0x870078
mov dword [esi + 0x28], eax
je 0x671592
and eax, 0xffffff9f
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
push 0x64
call fcn.0041b7c0
add esp, 4
cmp eax, edi
je 0x6715a6
mov dword [eax], edi
mov ecx, eax
jmp 0x6715a8
xor ecx, ecx
mov eax, dword [esp + 0x20]
push eax
mov dword [esi + 0x20], ecx
call fcn.0063a040
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x1c], edx
mov edx, dword [esi + 0x28]
or edx, 2
mov eax, edx
test al, 8
mov dword [esi + 0x18], ecx
mov dword [esi + 0x24], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x28], edx
je 0x6715ed
and eax, 0xffffffdf
or eax, 0x40
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], eax
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20

Function at 0x67a110
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebx
pushfd
clc
mov ebx, dword [0x1560780]
sbb ebx, dword [0x50a281]
popfd
xchg dword [esp], ebx
jmp 0x67a117
push 0xffffffffffffffff
jmp 0x4039b2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0061a390
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
cmp ecx, ebx
lea eax, [esi + 0x24]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x87059c
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xa], bl
mov byte [esi + 0xc], bl
mov dword [eax], ecx
mov dword [esi + 0x2c], ebx
je 0x67a161
push eax
call fcn.00571b70
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
lea eax, [esi + 0x18]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov ecx, dword [ecx + 8]
mov edx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov al, byte [esp + 0x28]
mov cl, byte [esp + 0x2c]
mov dword [esi + 0x14], edx
mov dl, byte [esp + 0x30]
mov byte [esi + 0xf], al
mov byte [esi + 0xd], cl
mov ecx, dword [esp + 0xc]
mov byte [esi + 0xe], bl
mov word [esi + 0x28], bx
mov byte [esi + 0xb], dl
mov byte [esi + 0x10], 0xff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18