joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405fe0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
push 0x40c234
mov esi, ecx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ecx, dword [esi + 0x38b48]
mov edx, dword [esi + 0x38b4c]
mov ebx, dword [sym.imp.MSVCRT.dll_fwrite]
mov edi, eax
push edi
push 1
lea eax, [esp + 0x1c]
push 0x10
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], 5
call ebx
push edi
push 1
add esi, 0x38b20
push 0x20
push esi
call ebx
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x2c
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x406060
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
push 0x40c234
mov esi, ecx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ecx, dword [esi + 0x2ee58]
mov edx, dword [esi + 0x2ee60]
mov ebx, dword [sym.imp.MSVCRT.dll_fwrite]
mov edi, eax
mov eax, dword [esi + 0x2ee64]
mov dword [esp + 0x14], ecx
push edi
push 1
lea ecx, [esp + 0x1c]
push 0x10
push ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], 6
call ebx
mov edx, dword [esi + 0x2ee58]
push edi
push edx
add esi, 0xbbd8
push 0x48
push esi
call ebx
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x2c
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x406120
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push ebx
push esi
push edi
push 0x40c230
mov esi, ecx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov edi, eax
push edi
push 1
lea ecx, [esp + 0x1c]
push 0x10
push ecx
call ebx
mov eax, dword [esp + 0x28]
add esp, 0x18
test eax, eax
push edi
je 0x40616d
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
mov edx, dword [esi + 0x38adc]
lea eax, [esi + 0x58]
push edx
push 8
push eax
call ebx
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov dword [esi + 0x38aa8], edx
push edi
mov dword [esi + 0x38adc], ecx
mov dword [esi + 0x38aac], eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x4061b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push ebx
push esi
push edi
push 0x40c230
mov esi, ecx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov edi, eax
push edi
push 1
lea ecx, [esp + 0x1c]
push 0x10
push ecx
call ebx
mov eax, dword [esp + 0x28]
add esp, 0x18
cmp eax, 1
push edi
je 0x4061fe
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
mov edx, dword [esi + 0x38ad0]
lea eax, [esi + 0x3ed8]
push edx
push 8
push eax
call ebx
fld qword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push edi
fst qword [esi + 0x38ab0]
fstp qword [esi + 0x38aa8]
mov dword [esi + 0x38ad0], ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x406240
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push ebx
push esi
push edi
push 0x40c230
mov esi, ecx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov edi, eax
push edi
push 1
lea ecx, [esp + 0x1c]
push 0x10
push ecx
call ebx
mov eax, dword [esp + 0x28]
add esp, 0x18
cmp eax, 2
push edi
je 0x40628e
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
mov edx, dword [esi + 0x38ad4]
lea eax, [esi + 0x7d58]
push edx
push 8
push eax
call ebx
fld qword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push edi
fst qword [esi + 0x38ab8]
fstp qword [esi + 0x38aa8]
mov dword [esi + 0x38ad4], ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x4062d0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push ebx
push esi
push edi
push 0x40c230
mov esi, ecx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov edi, eax
push edi
push 1
lea ecx, [esp + 0x1c]
push 0x10
push ecx
call ebx
mov eax, dword [esp + 0x28]
add esp, 0x18
cmp eax, 3
push edi
je 0x40631e
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
mov edx, dword [esi + 0x38ad0]
lea eax, [esi + 0x3ed8]
push edx
push 8
push eax
call ebx
mov ecx, dword [esi + 0x38ad4]
push edi
push ecx
lea edx, [esi + 0x7d58]
push 8
push edx
call ebx
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x38]
mov dword [esi + 0x38ac0], ecx
push edi
mov dword [esi + 0x38ad8], eax
mov dword [esi + 0x38ac4], edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x24
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x406380
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push ebx
push esi
push edi
push 0x40c230
mov edi, ecx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov esi, eax
push esi
push 1
lea ecx, [esp + 0x1c]
push 0x10
push ecx
call ebx
mov eax, dword [esp + 0x28]
add esp, 0x18
cmp eax, 4
push esi
je 0x4063ce
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
push 1
lea edx, [edi + 0x38ae0]
push 0x40
push edx
call ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [edi + 0x38b40], eax
push esi
mov dword [edi + 0x38b44], ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x406410
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push ebx
push esi
push edi
push 0x40c230
mov edi, ecx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov esi, eax
push esi
push 1
lea ecx, [esp + 0x1c]
push 0x10
push ecx
call ebx
mov eax, dword [esp + 0x28]
add esp, 0x18
cmp eax, 5
push esi
je 0x40645e
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
push 1
lea edx, [edi + 0x38b20]
push 0x20
push edx
call ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [edi + 0x38b48], eax
push esi
mov dword [edi + 0x38b4c], ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x4064a0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push ebx
push esi
push edi
push 0x40c230
mov esi, ecx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov edi, eax
push edi
push 1
lea ecx, [esp + 0x1c]
push 0x10
push ecx
call ebx
mov eax, dword [esp + 0x28]
add esp, 0x18
cmp eax, 6
push edi
je 0x4064ee
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
mov edx, dword [esi + 0x2ee58]
lea eax, [esi + 0xbbd8]
push edx
push 0x48
push eax
call ebx
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov dword [esi + 0x2ee60], edx
push edi
mov dword [esi + 0x2ee58], ecx
mov dword [esi + 0x2ee64], eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x4065a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
mov ecx, esi
mov dl, byte [esi]
test dl, dl
je 0x4065bd
xor dl, bl
inc ebx
mov byte [ecx], dl
mov dl, byte [ecx + 1]
inc ecx
test dl, dl
jne 0x4065b0
mov eax, esi
pop esi
pop ebx
ret
Function at 0x43e897
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dl, byte [ebp + 0xc]
mov byte [ebp - 4], dl
test dl, dl
jle 0x43e8b2
mov eax, dword [ebp + 8]
call fcn.0060d29b
mov dword [ebp + 8], eax
mov eax, 0x67f1b0
call fcn.00600adb
mov word [ebp - 0x14], 8
mov cl, byte [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.0055b50b
add dword [ebp - 8], 2
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov dword [edx + 0x30], ecx
mov eax, dword [ebp + 8]
mov dx, word [ebp + 0x1c]
mov word [eax + 0x34], dx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x38], eax
mov edx, dword [ebp + 8]
mov byte [edx + 0xf], 1
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x43e90f
call fcn.0060d2a8
mov esp, ebp
pop ebp
ret

Function at 0x43eddb
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dl, byte [ebp + 0xc]
mov byte [ebp - 4], dl
test dl, dl
jle 0x43edf6
mov eax, dword [ebp + 8]
call fcn.0060d29b
mov dword [ebp + 8], eax
mov eax, 0x67f1d4
call fcn.00600adb
mov word [ebp - 0x14], 8
mov cl, byte [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.0055b50b
add dword [ebp - 8], 2
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov dword [edx + 0x30], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
mov dword [eax + 0x34], edx
mov ecx, dword [ebp + 8]
mov ax, word [ebp + 0x1c]
mov word [ecx + 0x38], ax
mov edx, dword [ebp + 8]
mov byte [edx + 0xf], 1
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x43ee53
call fcn.0060d2a8
mov esp, ebp
pop ebp
ret

Function at 0x43f2f3
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dl, byte [ebp + 0xc]
mov byte [ebp - 4], dl
test dl, dl
jle 0x43f30e
mov eax, dword [ebp + 8]
call fcn.0060d29b
mov dword [ebp + 8], eax
mov eax, 0x67f1f8
call fcn.00600adb
mov word [ebp - 0x14], 8
mov cl, byte [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.0055b50b
add dword [ebp - 8], 2
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov dword [edx + 0x30], ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0xf], 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x43f357
call fcn.0060d2a8
mov esp, ebp
pop ebp
ret
Function at 0x43f35b
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dl, byte [ebp + 0xc]
mov byte [ebp - 4], dl
test dl, dl
jle 0x43f376
mov eax, dword [ebp + 8]
call fcn.0060d29b
mov dword [ebp + 8], eax
mov eax, 0x67f21c
call fcn.00600adb
mov word [ebp - 0x14], 8
mov cl, byte [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.0055b50b
add dword [ebp - 8], 2
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov dword [edx + 0x30], ecx
mov eax, dword [ebp + 8]
mov dx, word [ebp + 0x1c]
mov word [eax + 0x38], dx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x20]
mov dword [ecx + 0x34], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x24]
mov dword [edx + 0x3c], ecx
mov eax, dword [ebp + 8]
mov dx, word [ebp + 0x28]
mov word [eax + 0x40], dx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x44], eax
mov edx, dword [ebp + 8]
mov byte [edx + 0xf], 1
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x43f3f0
call fcn.0060d2a8
mov esp, ebp
pop ebp
ret
Function at 0x450f9b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x24]
mov eax, dword [ebx + 0x34]
sub eax, dword [ebx + 0x6c]
sub eax, dword [ebx + 0x64]
mov dword [ebp - 8], eax
jmp 0x450fd6
mov edx, dword [ebx + 0x24]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x64]
ja 0x451057
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.00600677
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], edi
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x451024
mov cx, word [ebp - 4]
sub cx, si
jmp 0x451026
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x45100d
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x45104c
mov cx, word [ebp - 4]
sub cx, si
jmp 0x45104e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x451035
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x4510b9
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x30]
add edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
push edx
push edi
call fcn.00450c6f
add esp, 0xc
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x4510a4
mov ecx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x64]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x4510b9
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x450faa
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x45964f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, 0x6890ac
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
call fcn.00600adb
mov word [ebp - 0x18], 8
mov word [ebp - 0x18], 8
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov ebx, edx
lea eax, [eax + eax*4]
cmp edi, ecx
lea esi, [eax*8 + 0x68848c]
jle 0x4596a0
mov eax, ecx
push ecx
mov ecx, 0x28
cdq
idiv ecx
pop ecx
mov al, byte [esi + edx]
xor byte [ebx], al
inc ecx
inc ebx
cmp edi, ecx
jg 0x459689
mov word [ebp - 0x18], 0
jmp 0x4596e6
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4596f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, 0x6890fc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
call fcn.00600adb
mov word [ebp - 0x18], 8
mov word [ebp - 0x18], 8
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov ebx, edx
lea eax, [eax + eax*4]
cmp edi, ecx
lea esi, [eax*8 + 0x68848c]
jle 0x459748
mov eax, ecx
push ecx
mov ecx, 0x28
cdq
idiv ecx
pop ecx
mov al, byte [esi + edx]
xor byte [ebx], al
inc ecx
inc ebx
cmp edi, ecx
jg 0x459731
mov word [ebp - 0x18], 0
jmp 0x45978e
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c623
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dl, byte [ebp + 0xc]
mov byte [ebp - 4], dl
test dl, dl
jle 0x46c63e
mov eax, dword [ebp + 8]
call fcn.0060d29b
mov dword [ebp + 8], eax
mov eax, 0x690080
call fcn.00600adb
mov dword [ebp - 8], 1
lea edx, [ebp + 0x14]
lea eax, [ebp + 0x14]
call fcn.0060c177
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
mov word [ebp - 0x14], 0x14
mov cl, byte [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.0055b50b
add dword [ebp - 8], 2
mov eax, dword [ebp + 8]
add eax, 0x38
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov byte [ecx + 0xf], 1
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
mov dword [eax + 0x30], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x24]
mov dword [ecx + 0x34], eax
lea edx, [ebp + 0x14]
mov eax, dword [ebp + 8]
add eax, 0x38
call fcn.0060c3c3
mov edx, dword [ebp + 8]
mov cx, word [ebp + 0x18]
mov word [edx + 0x3c], cx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x1c]
mov dword [eax + 0x40], edx
dec dword [ebp - 8]
lea eax, [ebp + 0x14]
mov edx, 2
call fcn.0060c393
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x46c6ea
call fcn.0060d2a8
mov esp, ebp
pop ebp
ret

Function at 0x474277
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
test dl, dl
push ebx
push esi
mov byte [ebp - 0xc], dl
jle 0x47428b
call fcn.0060d29b
mov ebx, ecx
mov byte [ebp - 0x2d], dl
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov eax, 0x693330
call fcn.00600adb
mov word [ebp - 0x1c], 8
mov ecx, ebx
xor edx, edx
mov eax, dword [esi]
call fcn.0055b50b
add dword [ebp - 0x10], 2
mov eax, dword [esi]
add eax, 0x20268
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 0x10]
mov eax, dword [esi]
add eax, 0x2026c
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 0x10]
mov eax, dword [esi]
add eax, 0x20270
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 0x10]
mov eax, dword [esi]
add eax, 0x202b4
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 0x10]
mov ecx, dword [esi]
mov byte [ecx + 0xf], 1
push 0
push 0
mov word [ebp - 0x1c], 0x14
mov eax, dword [esi]
mov edx, dword [eax + 8]
lea eax, [ebp - 8]
call fcn.0060c34f
inc dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [0x5473f8]
push edx
mov dl, 1
call fcn.00561a6b
mov ecx, dword [esi]
mov edx, 2
mov dword [ecx + 0x30], eax
lea eax, [ebp - 8]
dec dword [ebp - 0x10]
call fcn.0060c393
call fcn.006865f9
mov ecx, dword [esi]
mov dword [ecx + 0x20284], eax
mov eax, dword [esi]
add eax, 0x2029c
push eax
call fcn.00685ab7
mov edx, 0x69261b
mov eax, dword [esi]
add eax, 0x20270
call fcn.0060cd23
mov edx, dword [esi]
xor ecx, ecx
mov dword [edx + 0x202bc], ecx
mov eax, dword [ebp - 0x2c]
mov dword fs:[0], eax
mov eax, dword [esi]
cmp byte [ebp - 0x2d], 0
je 0x47437e
call fcn.0060d2a8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aa047
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x371], 0
jne 0x4aa10f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x238], 0
jne 0x4aa10f
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x371], 1
xor edx, edx
push ebp
push 0x48fb29
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x365], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004a9d8f
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 5]
mov byte [eax + 0x371], dl
cmp byte [ebp - 5], 0
je 0x4aa0ce
mov eax, dword [ebp - 4]
mov byte [eax + 0x372], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fb30
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 0
ret
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x4aa117
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x238], 0
je 0x4aa222
mov eax, dword [ebp - 4]
cmp byte [eax + 0x373], 0
jne 0x4aa222
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x373], 1
xor edx, edx
push ebp
push 0x48fc3c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x36d], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004a9863
mov edx, dword [ebp - 0xc]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.004a792b
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 5]
mov byte [eax + 0x373], dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004a9863
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x74]
mov edx, 2
call fcn.005ccfbf
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004a9863
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x74]
xor edx, edx
call fcn.005ccfbf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fcfc
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 0
ret
mov eax, dword [ebp - 4]
cmp byte [eax + 0x372], 0
jne 0x4aa2db
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x372], 1
xor edx, edx
push ebp
push 0x48fcf5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x365], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004a9863
mov edx, dword [ebp - 0xc]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.004a792b
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 5]
mov byte [eax + 0x372], dl
cmp byte [ebp - 5], 0
je 0x4aa29a
mov eax, dword [ebp - 4]
mov byte [eax + 0x371], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fcfc
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 0
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret