joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493eca
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov dword [ebp - 8], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x4a8384]
mov ecx, edi
call esi
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
js 0x493fe6
push 0x41de80
push ebx
call dword [sym.imp.msvcrt.dll__wfopen]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x493fb0
push ebx
call dword [sym.imp.msvcrt.dll__fileno]
push eax
call dword [sym.imp.msvcrt.dll__filelengthi64]
mov esi, eax
pop ecx
pop ecx
test edx, edx
jg 0x493f57
jl 0x493f2e
test esi, esi
jae 0x493f57
push dword [ebp - 8]
push 0xdef00076
mov eax, dword [edi]
mov esi, dword [eax + 0x40]
mov ecx, esi
call dword [0x4a8384]
mov ecx, edi
call esi
mov esi, dword [ebp - 4]
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
jmp 0x493fe8
or eax, edx
je 0x493fa9
test edx, edx
jg 0x493fa9
jl 0x493f69
cmp esi, 0x1000000
ja 0x493fa9
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
mov edx, esi
lea ecx, [ecx + 4]
call fcn.00469f13
cmp dword [ebp - 0xc], 0
je 0x493f9f
push ebx
push esi
push 1
push dword [ebp - 0xc]
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, esi
je 0x493f47
push dword [ebp - 8]
push 0xdef00078
jmp 0x493f36
push dword [ebp - 8]
push 0xdef00005
jmp 0x493f36
mov esi, 0xdef00525
jmp 0x493f4a
call dword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [eax]
call fcn.0045101f
mov ecx, eax
cmp ecx, 0x80004005
jne 0x493fcc
mov ecx, 0x80070780
mov eax, dword [edi]
push dword [ebp - 8]
push ecx
mov esi, dword [eax + 0x40]
mov ecx, esi
call dword [0x4a8384]
mov ecx, edi
call esi
mov esi, dword [ebp - 4]
jmp 0x493fe8
mov esi, eax
mov edx, edi
mov ecx, esi
call fcn.00427be7
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x497fc3
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x4a4ed8
call fcn.00498848
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x4a7a60
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x498008
cmp eax, esi
jne 0x497ffb
xor esi, esi
inc esi
mov edi, esi
jmp 0x49800b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x497fdf
xor esi, esi
inc esi
cmp dword [0x4a7a64], esi
jne 0x49801d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x498057
cmp dword [0x4a7a64], ebx
jne 0x498051
mov dword [0x4a7a64], esi
push 0x4030d8
push 0x4030cc
call fcn.0049813c
pop ecx
pop ecx
test eax, eax
je 0x498057
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x49812c
mov dword [0x4a72c4], esi
cmp dword [0x4a7a64], esi
jne 0x49807a
push 0x4030c8
push 0x403094
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x4a7a64], 2
test edi, edi
jne 0x498087
xor eax, eax
mov ecx, 0x4a7a60
xchg dword [ecx], eax
cmp dword [0x4a7a70], 0
je 0x4980b3
push 0x4a7a70
call fcn.004986a0
pop ecx
test eax, eax
je 0x4980b3
push ebx
push 2
push ebx
mov esi, dword [0x4a7a70]
mov ecx, esi
call dword [0x4a8384]
call esi
push dword [0x4a72d0]
push dword [0x4a72cc]
push dword [0x4a72c8]
call fcn.00420d13
add esp, 0xc
mov dword [0x4a72c0], eax
cmp dword [0x4a72d8], 0
jne 0x498111
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x4a72c4], 0
jne 0x498125
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x4a72c0]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00547000
jmp 0x497fc3

Function at 0x498594
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4a4f18
call fcn.00498848
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x4985f4
cmp eax, 0xffffffff
je 0x4985f4
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x4985ed
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x4985ed
cmp edx, 0x10000000
jae 0x4985ed
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x4985ea
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x498650
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x49868e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x498686
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x498690
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x498676
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x498760
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x498791
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x498791
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x498791
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x33f2004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x114], edx
push 0
push eax
mov dword [ebp - 0x110], ecx
call fcn.0040a410
mov edx, 0x33f2844
add esp, 0xc
mov esi, edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x401780
lea edi, [ebp - 0x108]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401790
mov ecx, edx
lea eax, [ebp - 0x108]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0x80
push 3
push 0
push 1
mov ecx, edx
and ecx, 3
push 0x80000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [0x33ea03c]
mov edi, eax
mov dword [ebp - 0x11c], edi
cmp edi, 0xffffffff
je 0x4018cd
push ebx
push 0
push edi
call dword [0x33ea04c]
mov esi, eax
xor edx, edx
mov ecx, esi
add ecx, 1
setb dl
neg edx
or edx, ecx
push edx
call fcn.0040b4a2
mov ebx, eax
add esp, 4
mov dword [ebp - 0x118], ebx
test ebx, ebx
je 0x4018cc
inc esi
push esi
push 0
push ebx
call fcn.0040a410
add esp, 0xc
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x10c]
push 0
push eax
push esi
push ebx
push edi
call dword [0x33ea0d8]
cmp dword [ebx], 0
mov esi, ebx
mov edi, ebx
je 0x4018b7
nop dword [eax + eax]
add edi, 0x208
cmp dword [edi], 0
jne 0x401840
nop dword [eax + eax]
xor eax, eax
xor byte [eax + esi + 8], al
lea ecx, [eax + esi]
inc eax
cmp eax, 0x200
jb 0x401852
lea ebx, [esi + 8]
push ebx
push 0x33efac0
call fcn.0040dcbf
add esp, 8
test eax, eax
jne 0x4018a6
push dword [esi]
call fcn.004081ee
mov ecx, dword [ebp - 0x110]
mov dword [ecx], eax
mov ecx, dword [ebx - 4]
push dword [esi]
add ecx, 0x208
add ecx, edi
push ecx
push eax
call fcn.00418680
mov ecx, dword [ebp - 0x114]
add esp, 0x10
mov eax, dword [esi]
mov dword [ecx], eax
add esi, 0x208
cmp dword [esi], 0
jne 0x401850
mov ebx, dword [ebp - 0x118]
push dword [ebp - 0x11c]
call dword [0x33ea048]
push ebx
call fcn.0040b49d
add esp, 4
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004080b5
mov esp, ebp
pop ebp
ret
Function at 0x404a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cc01d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0xde8598]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
call dword [0x4eba0c]
add esp, 8
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 0
call dword [0x4eb9c4]
lea edx, [esp + 0xc]
push edx
mov ecx, eax
mov byte [esp + 0x3c], 1
call dword [0x4eb9a8]
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 3
call dword [0x4eb9cc]
mov eax, dword [esp + 0x40]
mov byte [esp + 0x38], 4
or ecx, 0xffffffff
lock xadd dword [eax], ecx
mov esi, dword [0x4eba10]
jne 0x404b04
mov edx, dword [esp + 0x40]
push edx
call esi
add esp, 4
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
call dword [0x4eb9ac]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 5
call dword [0x4eb9b0]
push eax
mov byte [esp + 0x3c], 6
call fcn.00479f00
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 5
call dword [0x4eb23c]
mov edx, dword [esp + 8]
mov byte [esp + 0x38], 4
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x404b60
mov ecx, dword [esp + 8]
push ecx
call esi
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call dword [0x4eb9d8]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x409000
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4cc473
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0xde8598]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0xde8628
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], 0x4eeda4
mov dword [esp + 0x18], ebx
mov dword [ecx], 0xde8628
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x4ed290
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.0040a040
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x40e0d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d6b12
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0xde8598]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [0x4eb980]
mov dword [esp + 0x10], eax
mov ecx, 1
lock xadd dword [eax], ecx
mov eax, dword [0x4eb980]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
mov edx, 1
lock xadd dword [eax], edx
mov edx, dword [esp + 0x30]
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
mov byte [esp + 0x3c], 1
call dword [0x4ecb18]
mov esi, eax
mov eax, dword [esp + 0x2c]
add esp, 0x20
mov byte [esp + 0x1c], 0
or ecx, 0xffffffff
lock xadd dword [eax], ecx
mov edi, dword [0x4eba10]
jne 0x40e175
mov edx, dword [esp + 0xc]
push edx
call edi
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x40e194
mov edx, dword [esp + 0x10]
push edx
call edi
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x40e1b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ce0d9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xde8598]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4eb980]
mov dword [esp + 8], eax
mov ecx, 1
lock xadd dword [eax], ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
mov dword [esp + 0x34], 0
call dword [0x4ecb14]
mov edx, dword [esp + 0x28]
mov esi, eax
add esp, 0x20
mov dword [esp + 0x14], 0xffffffff
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x40e23c
mov ecx, dword [esp + 8]
push ecx
call dword [0x4eba10]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x40ee60
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4cce7e
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0xde8598]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0xde8598]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov eax, dword [esp + 0x74]
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
push ecx
xor edx, edx
mov ecx, esp
mov dword [esp + 0x28], esp
mov dword [esp + 0x2c], edx
push edx
mov dword [ecx], edx
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x74], edx
mov dword [esp + 0x38], esi
call dword [0x4ecb2c]
mov ebx, 1
push esi
mov ecx, eax
mov dword [esp + 0x6c], ebx
call dword [0x4ecabc]
lea ecx, [esp + 0x40]
mov dword [esp + 0x28], ebx
mov byte [esp + 0x68], 0
call dword [0x4ecb4c]
push esi
lea ecx, [esp + 0x18]
call dword [0x4ecac0]
push 5
lea ecx, [esp + 0x18]
mov dword [esp + 0x6c], 2
call dword [0x4ecac4]
lea ecx, [esp + 0x14]
call dword [0x4ecac8]
push eax
lea ecx, [esp + 0x1c]
call dword [0x4ecacc]
lea ecx, [esp + 0x4c]
mov byte [esp + 0x68], 3
call dword [0x4ecad0]
push 0xff
push 0x21
push 0x91
push 0xed
lea ecx, [esp + 0x5c]
call dword [0x4ecad4]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x1c]
call dword [0x4ecad8]
lea ecx, [esp + 0x14]
call dword [0x4ecadc]
push eax
lea ecx, [esp + 0x20]
call dword [0x4ecae0]
mov ebx, dword [0x4ecae4]
push 0x4b
lea ecx, [esp + 0x20]
mov byte [esp + 0x6c], 4
call ebx
push 0x23
lea ecx, [esp + 0x20]
call dword [0x4ecae8]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x18]
call dword [0x4ecaec]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x18]
call dword [0x4ecaf0]
push 0
push edi
push 0x84
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call dword [0x4ecaf4]
push eax
lea ecx, [esp + 0x24]
call dword [0x4ecaf8]
push 0x32
lea ecx, [esp + 0x20]
call ebx
push 0x14
lea ecx, [esp + 0x20]
call dword [0x4ecae8]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
call dword [0x4ecaf0]
mov ecx, esi
call dword [0x4ecafc]
fld qword [0x4efb78]
sub eax, 0x64
fstp qword [esp + 0x30]
mov dword [esp + 0x24], eax
fild dword [esp + 0x24]
push ebp
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x1c]
fstp qword [esp + 0x40]
call dword [0x4ecb00]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x68], 3
call dword [0x4ecb04]
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 2
call dword [0x4ecb08]
lea ecx, [esp + 0x14]
mov byte [esp + 0x68], 0
call dword [0x4ecb0c]
mov eax, esi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.004cab76
add esp, 0x58
ret
Function at 0x413ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cd72b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0xde8598]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
call dword [0x4eb8b8]
push 0x14
mov esi, eax
call fcn.004cab98
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], 0
test eax, eax
je 0x413b22
mov ecx, eax
call fcn.00413f30
jmp 0x413b24
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x14], esi
call fcn.00413800
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x417d90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cddd2
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0xde8598]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0x7c]
call dword [0x4eca68]
mov edx, dword [esi + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edx + 0x7c]
call dword [0x4eca6c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 0
call dword [0x4eb8dc]
mov edx, dword [esp + 0x10]
or edi, 0xffffffff
mov byte [esp + 0x2c], 2
mov eax, edi
lock xadd dword [edx], eax
mov esi, dword [0x4eba10]
jne 0x417e0e
mov ecx, dword [esp + 0x10]
push ecx
call esi
add esp, 4
push 0x4f46f0
lea ecx, [esp + 0x10]
call dword [0x4eb8a4]
test al, al
jne 0x417ea9
push 0x4f46e4
lea ecx, [esp + 0x10]
call dword [0x4eb8a4]
test al, al
jne 0x417ea9
push 0x4f46dc
lea ecx, [esp + 0x10]
call dword [0x4eb8a4]
test al, al
jne 0x417ea9
lea edx, [esp + 0x14]
push 0x4f46ac
push edx
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], 0x4f4680
mov dword [esp + 0x24], 0x4f4658
mov dword [esp + 0x28], 0x314
call fcn.0040c600
mov eax, dword [esp + 0x14]
add esp, 8
mov dword [esp + 0x2c], edi
lock xadd dword [eax], edi
jne 0x417e95
mov ecx, dword [esp + 0xc]
push ecx
call esi
add esp, 4
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret
mov edx, dword [esp + 0xc]
mov dword [esp + 0x2c], edi
lock xadd dword [edx], edi
jne 0x417ec1
mov eax, dword [esp + 0xc]
push eax
call esi
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret
Function at 0x41fa00
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x4cf27c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0xde8598]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
push 0x70
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], ebx
call fcn.004cab98
add esp, 4
mov dword [esp + 0x18], eax
mov edi, 1
mov dword [esp + 0x28], edi
cmp eax, ebx
je 0x41fa57
mov ecx, eax
call fcn.0046ba80
jmp 0x41fa59
xor eax, eax
mov esi, dword [esp + 0x30]
push eax
mov ecx, esi
mov byte [esp + 0x2c], bl
call fcn.0041e6e0
mov eax, dword [esi]
mov dword [eax + 0x68], 0x45b130
mov eax, dword [esi]
mov dword [eax + 0x6c], 0x45b170
mov ecx, dword [ebp + 0x18]
lea eax, [esp + 0x18]
mov dword [esp + 0x14], edi
mov edi, dword [esi]
push eax
call fcn.0041efd0
mov eax, dword [eax]
mov eax, dword [eax + 0xb0]
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x10]
mov ecx, edi
mov dword [esp + 0x2c], 2
call eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ecx
push edx
mov byte [esp + 0x30], bl
call fcn.0041e5b0
mov ebx, dword [esi]
mov edi, dword [ebx]
add esp, 8
mov ecx, ebp
add edi, 0x1c
call fcn.00418680
mov edx, dword [edi]
movzx eax, al
push eax
mov ecx, ebx
call edx
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x426dc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cfb6c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0xde8598]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xcc]
lea eax, [esp + 0xc]
push eax
call dword [0x4ec5b0]
lea edx, [esp + 8]
push edx
mov ecx, eax
mov dword [esp + 0x20], 1
call dword [0x4eb7f8]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov esi, dword [esp + 0x24]
push eax
mov ecx, esi
mov byte [esp + 0x20], 2
call dword [0x4eb244]
mov ecx, dword [esp + 8]
mov dword [esp + 0x10], 1
mov byte [esp + 0x1c], 1
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x426e54
mov eax, dword [esp + 8]
push eax
call dword [0x4eba04]
add esp, 4
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x1c], 0
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x426e74
mov eax, dword [esp + 0xc]
push eax
call dword [0x4eba10]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret 4
Function at 0x440e30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e18e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0xde8598]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x4f87bc
mov dword [esi + 8], 0x4f87a0
mov dword [esi + 0x24], 0x4f8798
mov ecx, dword [esi + 0x30]
xor edi, edi
mov dword [esp + 0x18], edi
cmp ecx, edi
je 0x440e86
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 1
call edx
mov dword [esi + 0x30], edi
mov ecx, dword [esi + 0x34]
cmp ecx, edi
je 0x440e99
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 1
call edx
mov dword [esi + 0x34], edi
mov eax, dword [esi + 0x28]
cmp eax, edi
je 0x440eac
push eax
call fcn.004cab6a
add esp, 4
mov dword [esi + 0x28], edi
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.00425ca0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x44c570
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4d4635
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0xde8598]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x4eb940]
mov dword [esp + 0xc], eax
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [0x4eba0c]
push 0xffffffffffffffff
push 0x4f9b58
mov dword [esp + 0x34], 0
call esi
mov dword [esp + 0x28], eax
push 0xffffffffffffffff
push 0x4f9b50
mov byte [esp + 0x3c], 1
call esi
mov dword [esp + 0x2c], eax
push 0xffffffffffffffff
push 0x4f9b44
mov byte [esp + 0x44], 2
call esi
mov dword [esp + 0x30], eax
push 0xffffffffffffffff
push 0x4f9b34
mov byte [esp + 0x4c], 3
call esi
mov dword [esp + 0x34], eax
push 0xffffffffffffffff
push 0x4f9b28
mov byte [esp + 0x54], 4
call esi
add esp, 0x28
mov dword [esp + 0x10], eax
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 5
call fcn.0040fb50
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.0040fb50
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10]
call fcn.0040fb50
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x10]
call fcn.0040fb50
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x10]
call fcn.0040fb50
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x2c], 4
or edx, 0xffffffff
lock xadd dword [ecx], edx
mov esi, dword [0x4eba10]
jne 0x44c67c
mov eax, dword [esp + 0x10]
push eax
call esi
add esp, 4
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x2c], 3
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x44c698
mov eax, dword [esp + 0x14]
push eax
call esi
add esp, 4
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x2c], 2
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x44c6b4
mov eax, dword [esp + 0x18]
push eax
call esi
add esp, 4
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x2c], 1
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x44c6d0
mov eax, dword [esp + 0x1c]
push eax
call esi
add esp, 4
mov ecx, dword [esp + 0x20]
mov byte [esp + 0x2c], 0
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x44c6ec
mov eax, dword [esp + 0x20]
push eax
call esi
add esp, 4
mov ecx, dword [edi + 0x1c]
mov esi, dword [ecx + 0x3c]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call dword [0x4ec594]
push eax
mov ecx, esi
call dword [0x4ebc38]
mov eax, dword [edi + 0x1c]
mov ecx, dword [eax + 0x3c]
push 0
call dword [0x4ec5ac]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
test eax, eax
je 0x44c75e
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x44c75e
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 0xc]
lea ecx, [eax + edx*4 + 0x14]
mov edx, dword [eax + 8]
mov esi, eax
push ecx
lea eax, [eax + edx*4 + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.00402a60
mov ecx, dword [esi]
test ecx, ecx
jne 0x44c75e
push esi
call dword [0x4eba04]
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret