joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449bf0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00449c50

Function at 0x449c50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x48c0d0]
test eax, eax
jle 0x449d53
mov edx, dword [0x48c0d4]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x449c81
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x449cf6
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x449c70
mov dword [esp], esi
call fcn.0044a590
test eax, eax
mov edi, eax
je 0x449d7a
lea esi, [ebx + ebx*2]
mov ebx, dword [0x48c0d4]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.0044a680
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x48c0d4]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x449d5a
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x449d00
add dword [0x48c0d0], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x449cef
cmp eax, 0x80
je 0x449cef
cmp eax, 8
je 0x449cef
mov eax, dword [ebp - 0x28]
add esi, dword [0x48c0d4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x449cef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00449bf0
xor ebx, ebx
jmp 0x449c8b
mov eax, dword [0x48c0d4]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00449bf0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00449bf0
lea esi, [esi]

Function at 0x44a4b0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x44a4e8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x44a4de
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x44a4ea
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x44a4d0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x44a7b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
sub esp, 8
test eax, eax
mov dword [esp + 0x2c], eax
je 0x44a920
mov eax, dword [esp + 0x3c]
add eax, 1
lea edx, [eax*4]
cmp eax, 0x1fc00000
mov eax, 0xffffffff
cmovbe eax, edx
mov dword [esp], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov edi, eax
mov eax, dword [esp + 0x3c]
test eax, eax
jle 0x44a8bb
xor ebx, ebx
mov eax, dword [esp + 0x2c]
mov ebp, dword [eax + ebx*4]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [esp], eax
mov dword [esp + 0x28], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov ecx, dword [esp + 0x28]
mov esi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [edi + ebx*4], esi
add ebx, 1
mov eax, dword [esp + 0x3c]
cmp eax, ebx
jg 0x44a810
mov dword [edi + eax*4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00401690
mov esi, eax
mov eax, dword [esp + 0x3c]
test eax, eax
jle 0x44a90c
mov edx, dword [edi]
test edx, edx
je 0x44a90c
xor ebx, ebx
mov dword [esp], edx
add ebx, 1
call sub.libstdc_6.dll_operator_delete___void_
cmp dword [esp + 0x3c], ebx
jle 0x44a90c
mov edx, dword [edi + ebx*4]
test edx, edx
jne 0x44a8f4
mov dword [esp], edi
call sub.libstdc_6.dll_operator_delete___void_
mov eax, esi
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, 0xffffffff
jmp 0x44a916
Function at 0x456600
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
sub esp, 4
movzx ecx, byte [edx + edi*4]
mov byte [eax + edi*4], cl
movzx ecx, byte [edx + edi*4 + 1]
mov byte [eax + edi*4 + 1], cl
movzx ecx, byte [edx + edi*4 + 2]
mov byte [eax + edi*4 + 2], cl
movzx ecx, byte [edx + edi*4 + 3]
mov byte [eax + edi*4 + 3], cl
add edi, 1
cmp edi, 4
jne 0x456609
add eax, 0xc
lea esi, [esi]
lea edi, [edi]
movzx edx, byte [eax + 3]
test edi, 3
movzx esi, byte [eax]
movzx ebx, byte [eax + 1]
movzx ecx, byte [eax + 2]
mov byte [esp + 3], dl
jne 0x45668e
movzx ebp, byte [ebx + 0x483c40]
movzx ebx, byte [ecx + 0x483c40]
movzx ecx, byte [edx + 0x483c40]
mov edx, esi
movzx esi, dl
movzx edx, byte [esi + 0x483c40]
mov esi, edi
shr esi, 2
movzx esi, byte [esi + 0x483b00]
mov byte [esp + 3], dl
xor esi, ebp
movzx edx, byte [eax - 0xc]
xor bl, byte [eax - 0xb]
add edi, 1
xor cl, byte [eax - 0xa]
add eax, 4
xor esi, edx
mov byte [eax + 1], bl
mov edx, esi
mov byte [eax + 2], cl
mov byte [eax], dl
movzx edx, byte [esp + 3]
xor dl, byte [eax - 0xd]
mov byte [eax + 3], dl
cmp edi, 0x2c
jne 0x456640
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x456df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
lea eax, [esi + 0xb0]
test edi, edi
mov ebx, ebp
mov dword [esp], eax
je 0x456e3d
xor ecx, ecx
movzx edx, byte [eax + ecx]
xor byte [ebx + ecx], dl
add ecx, 1
cmp ecx, 0x10
jne 0x456e14
mov edx, esi
mov eax, ebx
call fcn.004566d0
lea edx, [ebx + 0x10]
mov eax, ebx
mov ecx, edx
sub ecx, ebp
cmp edi, ecx
jbe 0x456e3f
mov ebx, edx
jmp 0x456e12
mov ebx, eax
mov eax, dword [ebx]
mov edi, dword [esp]
mov dword [esi + 0xb0], eax
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x456e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
test edi, edi
lea esi, [ebp + 0xb0]
je 0x456ef8
lea esi, [esi]
mov eax, dword [ebx]
mov edx, ebp
mov dword [esp], eax
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0xc], eax
mov eax, ebx
call fcn.00456950
xor eax, eax
movzx edx, byte [esi + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, 0x10
jne 0x456eb5
mov eax, dword [esp]
add ebx, 0x10
mov dword [ebp + 0xb0], eax
mov eax, dword [esp + 4]
mov dword [ebp + 0xb4], eax
mov eax, dword [esp + 8]
mov dword [ebp + 0xb8], eax
mov eax, dword [esp + 0xc]
mov dword [ebp + 0xbc], eax
mov eax, ebx
sub eax, dword [esp + 0x28]
cmp edi, eax
ja 0x456e90
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x56080c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov esi, eax
mov ebx, esi
mov eax, ebx
test eax, eax
je 0x560821
sub eax, 4
mov eax, dword [eax]
mov edx, eax
dec edx
mov eax, ebp
call fcn.004053f4
mov eax, ebx
test eax, eax
je 0x560836
sub eax, 4
mov eax, dword [eax]
mov edi, eax
sub edi, 2
jl 0x56085d
inc edi
mov ebx, 2
mov eax, ebp
call fcn.004051c4
mov edx, ebx
add dl, byte [esi]
sub dl, 2
xor dl, byte [esi + ebx - 1]
mov byte [eax + ebx - 2], dl
inc ebx
dec edi
jne 0x560843
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x56f0b0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x56f11c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x56f134
lea edx, [ebp - 0x104]
mov eax, dword [ebx]
call fcn.00403cd4
lea edx, [ebp - 0x104]
lea eax, [ebp - 4]
call fcn.00404f38
push dword [ebp - 4]
push 0x56f160
mov eax, esi
mov edx, 3
call fcn.00405068
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56f123
lea eax, [ebp - 4]
call fcn.00404cd4
ret
Function at 0x424080
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x463df8
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov edi, dword [esp + 0x44]
mov esi, ecx
test edi, edi
jne 0x4240b9
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24
push 0x400
lea ecx, [esp + 0xc]
call fcn.0045f0b1
mov eax, dword [esp + 0x40]
push 0
push edi
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0
call fcn.0045f0fd
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.00424140
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.0045f13a
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24
Function at 0x42bff0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4647d8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
call fcn.004268f0
test eax, eax
je 0x42c0f8
lea ecx, [esp + 0xc]
call fcn.00403310
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.004268f0
mov ecx, eax
call fcn.00423fa0
test eax, eax
je 0x42c0df
mov eax, dword [esp + 0x1c]
test eax, eax
mov ebp, eax
je 0x42c0df
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x42c0df
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
neg esi
push edi
push ebx
sbb esi, esi
and esi, edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, ebp
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.00403510
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop edi
jne 0x42c0c1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x42c0df
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [0x62dc60]
push ebx
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x604b58
call fcn.00403510
mov ecx, dword [esp + 0x20]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10
Function at 0x42c140
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.004268f0
test eax, eax
je 0x42c22f
mov ecx, edi
call fcn.004268f0
mov ecx, eax
call fcn.00423e50
test eax, eax
jne 0x42c22f
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42c22f
mov eax, dword [0x62dc60]
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x42c1a2
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
lea ecx, [esp + 0x10]
mov ebp, dword [esp + 0x24]
push 1
push ecx
mov ecx, dword [edi + 0x44]
lea edx, [esp + 0x1c]
shr ecx, 4
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x2c]
and ecx, 1
push eax
push ecx
push ebp
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov ecx, edi
call fcn.004268f0
mov ecx, eax
call fcn.00424080
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esp + 0x28]
mov eax, 1
cmp ecx, eax
jne 0x42c22f
cmp ebx, eax
jne 0x42c22f
cmp dword [esp + 0x10], eax
jne 0x42c215
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xcc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [edi]
push eax
mov eax, dword [esp + 0x24]
push ecx
push ebp
push eax
mov ecx, edi
call dword [edx + 0xc0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x438bd0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x465123
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00458f74
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0045e60a
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0045fb26
test eax, eax
je 0x438cec
mov ecx, dword [esp + 0x3c]
call fcn.0045e637
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x438cb0
push edi
mov ecx, esi
call fcn.0045bca3
mov ecx, esi
call fcn.00438e50
cmp dword [esp + 0x38], 1
jne 0x438ce5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0045bdde
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x4038ee
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004045a6
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00403a4e
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x403a38
test ebx, ebx
jl 0x4039dc
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcb9d52
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4039fd
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4039ef
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004053be
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004053be
add esp, 8
mov ebx, 0x80070057
jmp 0x4039dc
Function at 0x41a95e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0041b616
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0041aabe
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41aaa8
test ebx, ebx
jl 0x41aa4c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcd0dc2
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41aa6d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x41aa5f
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0041c42e
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0041c42e
add esp, 8
mov ebx, 0x80070057
jmp 0x41aa4c
Function at 0x4319ee
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004326a6
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00431b4e
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x431b38
test ebx, ebx
jl 0x431adc
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce7e52
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x431afd
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x431aef
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004334be
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004334be
add esp, 8
mov ebx, 0x80070057
jmp 0x431adc