joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e9aa3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x667050]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea esi, [esp + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.004063a0
mov esi, 1
mov dword [esp + 0x38], esi
cmp dword [esp + 0x24], 0
je 0x40667e
push 0x5c
lea ecx, [esp + 0x14]
call dword [0x6105a8]
push str.register.ini
lea ecx, [esp + 0x14]
call dword [0x610590]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call dword [0x610494]
jmp 0x40668b
push 0x6111d4
mov ecx, edi
call dword [0x610498]
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
mov byte [esp + 0x38], 0
call dword [0x6105a0]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005e693f
add esp, 0x34
ret

Function at 0x4066c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e9aa3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x667050]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea esi, [esp + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.004063a0
mov esi, 1
mov dword [esp + 0x38], esi
cmp dword [esp + 0x24], 0
je 0x40673e
push 0x5c
lea ecx, [esp + 0x14]
call dword [0x6105a8]
push str.installed.ini
lea ecx, [esp + 0x14]
call dword [0x610590]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call dword [0x610494]
jmp 0x40674b
push 0x6111d4
mov ecx, edi
call dword [0x610498]
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
mov byte [esp + 0x38], 0
call dword [0x6105a0]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005e693f
add esp, 0x34
ret

Function at 0x406780
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e9aa3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x667050]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea esi, [esp + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.004063a0
mov esi, 1
mov dword [esp + 0x38], esi
cmp dword [esp + 0x24], 0
je 0x4067fe
push 0x5c
lea ecx, [esp + 0x14]
call dword [0x6105a8]
push str.update.ini
lea ecx, [esp + 0x14]
call dword [0x610590]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call dword [0x610494]
jmp 0x40680b
push 0x6111d4
mov ecx, edi
call dword [0x610498]
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
mov byte [esp + 0x38], 0
call dword [0x6105a0]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005e693f
add esp, 0x34
ret
Function at 0x406970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e9aa3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x667050]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea esi, [esp + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.004063a0
mov esi, 1
mov dword [esp + 0x38], esi
cmp dword [esp + 0x24], 0
je 0x4069ee
push 0x5c
lea ecx, [esp + 0x14]
call dword [0x6105a8]
push str.flashad.gmx
lea ecx, [esp + 0x14]
call dword [0x610590]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call dword [0x610494]
jmp 0x4069fb
push 0x6111d4
mov ecx, edi
call dword [0x610498]
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
mov byte [esp + 0x38], 0
call dword [0x6105a0]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005e693f
add esp, 0x34
ret

Function at 0x406a30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e9aa3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x667050]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea esi, [esp + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.004063a0
mov esi, 1
mov dword [esp + 0x38], esi
cmp dword [esp + 0x24], 0
je 0x406aae
push 0x5c
lea ecx, [esp + 0x14]
call dword [0x6105a8]
push str.flashadr
lea ecx, [esp + 0x14]
call dword [0x610590]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call dword [0x610494]
jmp 0x406abb
push 0x6111d4
mov ecx, edi
call dword [0x610498]
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
mov byte [esp + 0x38], 0
call dword [0x6105a0]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005e693f
add esp, 0x34
ret

Function at 0x406d10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e9aa3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x667050]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea esi, [esp + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.004063a0
mov esi, 1
mov dword [esp + 0x38], esi
cmp dword [esp + 0x24], 0
je 0x406d8e
push 0x5c
lea ecx, [esp + 0x14]
call dword [0x6105a8]
push str.Icons
lea ecx, [esp + 0x14]
call dword [0x610590]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call dword [0x610494]
jmp 0x406d9b
push 0x6111d4
mov ecx, edi
call dword [0x610498]
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
mov byte [esp + 0x38], 0
call dword [0x6105a0]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005e693f
add esp, 0x34
ret
Function at 0x407070
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e9aa3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x667050]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea esi, [esp + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.004dcd50
mov esi, 1
mov dword [esp + 0x38], esi
cmp dword [esp + 0x24], 0
je 0x4070fd
push str.tool
lea ecx, [esp + 0x14]
call dword [0x610590]
push 0x5c
lea ecx, [esp + 0x14]
call dword [0x6105a8]
push str.K8NTFSConverter.exe
lea ecx, [esp + 0x14]
call dword [0x610590]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call dword [0x610494]
jmp 0x40710a
push 0x6111d4
mov ecx, edi
call dword [0x610498]
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
mov byte [esp + 0x38], 0
call dword [0x6105a0]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005e693f
add esp, 0x34
ret

Function at 0x407350
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5efa6e
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x54], ebx
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
call fcn.004dcd50
mov dword [esp + 0x54], ebx
push str.tool
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 1
call dword [0x610498]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
push esi
push ecx
mov dword [esp + 0x60], 1
call fcn.004c9450
add esp, 0xc
push eax
mov ecx, esi
mov byte [esp + 0x58], 2
call dword [0x61059c]
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 1
call dword [0x6105a0]
lea ecx, [esp + 0x14]
mov byte [esp + 0x54], bl
call dword [0x6105a0]
push str.K8UrlEncrypt.dll
lea ecx, [esp + 0x18]
call dword [0x610498]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x34]
push esi
push eax
mov dword [esp + 0x60], 3
call fcn.004c9450
add esp, 0xc
push eax
mov ecx, esi
mov byte [esp + 0x58], 4
call dword [0x61059c]
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 3
call dword [0x6105a0]
lea ecx, [esp + 0x14]
mov byte [esp + 0x54], bl
call dword [0x6105a0]
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x4c
ret
Function at 0x407710
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5f3a3b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, 1
push 0x6111d4
mov ecx, 0x66e558
mov dword [esp + 0xc], 0x66e548
mov dword [0x66e548], 0
mov dword [0x66e54c], 0x64
mov dword [0x66e550], ebx
mov byte [0x66e554], 0
call dword [0x610498]
mov dword [esp + 0x30], 0
mov eax, 0x400
push 0x6111d4
mov ecx, 0x66e580
mov dword [0x66e574], eax
mov dword [0x66e578], eax
mov dword [0x66e57c], ebx
call dword [0x610498]
mov byte [esp + 0x30], bl
mov ecx, 0x66e5a4
mov byte [0x66e59c], bl
mov byte [0x66e59d], bl
mov byte [0x66e59e], 0
mov byte [0x66e59f], bl
mov dword [0x66e5a0], 3
call dword [0x61049c]
mov ecx, 0x66e5c0
mov byte [esp + 0x30], 2
call dword [0x61049c]
mov ecx, 0x66e5dc
mov byte [esp + 0x30], 3
call dword [0x61049c]
mov ecx, 0x66e5f8
mov byte [esp + 0x30], 4
call dword [0x61049c]
mov ecx, 0x66e614
mov byte [esp + 0x30], 5
call dword [0x61049c]
mov ecx, 0x66e630
mov byte [esp + 0x30], 6
call dword [0x61049c]
mov ecx, 0x66e64c
mov byte [esp + 0x30], 7
call dword [0x61049c]
mov ecx, 0x66e668
mov byte [esp + 0x30], 8
call dword [0x61049c]
mov byte [esp + 0x30], 9
mov ecx, 0x66e688
mov byte [0x66e684], bl
mov byte [0x66e685], bl
mov byte [0x66e686], bl
call dword [0x61049c]
mov byte [esp + 0x30], 0xa
mov ecx, 0x66e6b8
mov byte [0x66e6a4], bl
mov byte [0x66e6a5], 0
mov byte [0x66e6a6], 0
mov byte [0x66e6aa], 0
mov byte [0x66e6ae], 0
mov byte [0x66e6b2], 0
mov dword [0x66e6b4], 7
call dword [0x61049c]
mov byte [esp + 0x30], 0xb
mov ecx, 0x66e6d8
mov byte [0x66e6d4], 0
call dword [0x61049c]
mov byte [esp + 0x30], 0xc
mov ecx, 0x66e6f4
call dword [0x61049c]
mov ecx, 0x66e710
mov byte [esp + 0x30], 0xd
call dword [0x61049c]
mov byte [esp + 0x30], 0xe
mov ecx, 0x66e740
mov byte [0x66e72c], bl
mov byte [0x66e72d], bl
mov byte [0x66e72e], bl
mov dword [0x66e730], 0
mov byte [0x66e734], bl
mov dword [0x66e738], ebx
mov byte [0x66e73c], bl
call dword [0x61049c]
mov ecx, 0x66e75c
mov byte [esp + 0x30], 0xf
call dword [0x61049c]
mov byte [esp + 0x30], 0x10
mov ecx, 0x66e784
mov byte [0x66e780], 0
mov byte [0x66e781], 0
call dword [0x61049c]
mov bl, 0x11
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], bl
call fcn.00405f30
push eax
mov ecx, 0x66e784
mov byte [esp + 0x34], 0x12
call dword [0x61059c]
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], bl
call dword [0x6105a0]
mov eax, 0x66e548
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x2c
ret
Function at 0x40a710
Capabilities:
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x5ebea3
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x667050]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push esi
push edi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x10]
push eax
push 3
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
mov dword [esp + 0x8c], ebx
call dword [0x610044]
cmp eax, ebx
je 0x40a796
cmp eax, 2
mov dword [esp + 0x14], eax
jne 0x40a88e
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
lea esi, [esp + 0x18]
call fcn.004d8a80
cmp al, bl
je 0x40a87f
lea ecx, [esp + 0x50]
call fcn.004d9290
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x80], 1
call fcn.004c9670
add esp, 8
push 0x61228c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7c], 2
call dword [0x610590]
push str._background
lea ecx, [esp + 0x1c]
call dword [0x610590]
lea ecx, [esp + 0x34]
call dword [0x61049c]
lea eax, [esp + 0x34]
push eax
push str.K8GM.exe
lea edi, [esp + 0x18]
mov byte [esp + 0x80], 3
call fcn.004d8bf0
test al, al
je 0x40a853
lea eax, [esp + 0x18]
lea esi, [esp + 0x34]
call fcn.004ce200
test eax, eax
jne 0x40a853
mov ecx, esi
mov byte [esp + 0x78], 2
call dword [0x6105a0]
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], 1
call dword [0x6105a0]
lea ecx, [esp + 0x50]
mov byte [esp + 0x78], bl
call dword [0x6105a0]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a84f
push eax
call dword [0x610040]
mov al, 1
jmp 0x40a890
lea ecx, [esp + 0x34]
mov byte [esp + 0x78], 2
call dword [0x6105a0]
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], 1
call dword [0x6105a0]
lea ecx, [esp + 0x50]
mov byte [esp + 0x78], bl
call dword [0x6105a0]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a88e
push eax
call dword [0x610040]
xor al, al
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.005e693f
add esp, 0x6c
ret
Function at 0x40a8b0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ebe53
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x667050]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor ebx, ebx
cmp byte [ebp + 8], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
je 0x40aa77
lea eax, [esp + 0x14]
push eax
push 3
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
mov dword [esp + 0x94], ebx
call dword [0x610044]
cmp eax, ebx
je 0x40a953
cmp eax, 2
mov dword [esp + 0x18], eax
jne 0x40a94c
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
lea esi, [esp + 0x1c]
call fcn.004d8a80
cmp al, bl
jne 0x40a953
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40a94c
push eax
call dword [0x610040]
xor al, al
jmp 0x40aad3
lea ecx, [esp + 0x54]
call fcn.004d9290
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x88], 1
call fcn.004c9670
add esp, 8
push 0x61228c
lea ecx, [esp + 0x20]
mov byte [esp + 0x84], 2
call dword [0x610590]
push str._background
lea ecx, [esp + 0x20]
call dword [0x610590]
lea ecx, [esp + 0x38]
call dword [0x61049c]
lea eax, [esp + 0x38]
push eax
push str.K8GM.exe
lea edi, [esp + 0x1c]
mov byte [esp + 0x88], 3
call fcn.004d8bf0
test al, al
je 0x40aa1f
lea eax, [esp + 0x1c]
lea esi, [esp + 0x38]
call fcn.004ce200
test eax, eax
jne 0x40aa1f
mov ecx, esi
mov byte [esp + 0x80], 2
call dword [0x6105a0]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x80], 1
call dword [0x6105a0]
lea ecx, [esp + 0x54]
mov byte [esp + 0x80], bl
call dword [0x6105a0]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40aa18
push eax
call dword [0x610040]
mov al, 1
jmp 0x40aad3
cmp dword [esp + 0x34], 8
mov edx, dword [esp + 0x20]
jae 0x40aa2e
lea edx, [esp + 0x20]
push str.K8GM.exe
lea edi, [esp + 0x18]
call fcn.004d8ad0
lea ecx, [esp + 0x38]
mov byte [esp + 0x13], al
mov byte [esp + 0x80], 2
call dword [0x6105a0]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x80], 1
call dword [0x6105a0]
lea ecx, [esp + 0x54]
mov byte [esp + 0x80], bl
call dword [0x6105a0]
jmp 0x40aac0
lea ecx, [esp + 0x14]
push ecx
push 2
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [0x610044]
cmp eax, ebx
je 0x40aaa4
cmp eax, 2
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
je 0x40aa18
mov edx, dword [esp + 0x14]
push str.K8GM.exe
push edx
call dword [0x610060]
cmp eax, ebx
je 0x40aaf3
mov dword [esp + 0x18], eax
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40aacf
push eax
call dword [0x610040]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.005e693f
mov esp, ebp
pop ebp
ret 4
mov byte [esp + 0x13], 1
jmp 0x40aac0
Function at 0x40c3a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60101f
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x667050]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push esi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0xa4]
mov dword fs:[0], eax
mov esi, dword [esp + 0xb4]
xor ebx, ebx
mov dword [esp + 0xac], ebx
push str.CacheDir
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
call dword [0x610498]
lea eax, [esp + 0x30]
mov ecx, esi
mov dword [esp + 0xac], 1
call fcn.004256c0
lea ecx, [esp + 0x30]
mov dword [esp + 0xc], 1
mov byte [esp + 0xac], bl
call dword [0x6105a0]
mov ecx, esi
call fcn.004dcbb0
test al, al
jne 0x40c4cc
push str.Kuai8GamesDownload
lea ecx, [esp + 0x50]
call dword [0x610498]
push 0x612228
lea ecx, [esp + 0x6c]
mov dword [esp + 0xb0], 2
call dword [0x610498]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0xb8], 3
call fcn.004c9450
add esp, 0xc
push eax
mov ecx, esi
mov byte [esp + 0xb0], 4
call dword [0x61059c]
lea ecx, [esp + 0x14]
mov byte [esp + 0xac], 3
call dword [0x6105a0]
lea ecx, [esp + 0x68]
mov byte [esp + 0xac], 2
call dword [0x6105a0]
lea ecx, [esp + 0x4c]
mov byte [esp + 0xac], bl
call dword [0x6105a0]
lea ecx, [esp + 0x84]
call dword [0x61049c]
mov eax, dword [esp + 0xb8]
push eax
lea ecx, [esp + 0x88]
push str._05d
push ecx
mov dword [esp + 0xb8], 5
call fcn.004ce830
lea edx, [esp + 0x90]
push edx
lea eax, [esp + 0x24]
push esi
push eax
call fcn.004c9450
add esp, 0x18
push eax
mov ecx, esi
mov byte [esp + 0xb0], 6
call dword [0x61059c]
lea ecx, [esp + 0x14]
mov byte [esp + 0xac], 5
call dword [0x6105a0]
lea ecx, [esp + 0x84]
mov byte [esp + 0xac], bl
call dword [0x6105a0]
mov eax, esi
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005e693f
add esp, 0xa4
ret
Function at 0x414530
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5fdf93
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
push esi
call fcn.005b05d0
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
push edi
push eax
mov dword [esi], 0x612b2c
mov dword [esi + 0x1c], 0x612bc4
call fcn.004e8840
add esp, 8
mov byte [esp + 0x30], 1
cmp dword [eax + 0x18], 8
jb 0x414591
mov eax, dword [eax + 4]
jmp 0x414594
add eax, 4
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 1
push 0x86c00000
push eax
push edi
mov eax, esi
call fcn.005aff30
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call dword [0x6105a0]
cmp byte [esp + 0x3c], 0
jne 0x4145ea
push 0x66
lea eax, [esi + 0x20]
call fcn.005aa990
test eax, eax
je 0x4145ea
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x11c]
push 0
call eax
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 8
Function at 0x41c4c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6065bd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x5c]
push 0xc8
add eax, 0x20
call fcn.005aa990
mov edi, eax
mov eax, dword [edi]
mov edx, dword [eax + 0x20c]
mov ecx, edi
call edx
push 0x404
call fcn.005e694e
add esp, 4
mov dword [esp + 0x5c], eax
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x54], ebx
je 0x41c52b
push eax
call fcn.005b8ae0
mov esi, eax
jmp 0x41c52d
xor esi, esi
mov dword [esp + 0x54], 0xffffffff
mov ebp, dword [esi]
xor ecx, ecx
lea edx, [ecx + 0x1e]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], edx
mov edx, dword [ebp + 0x94]
mov ecx, ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ecx
mov ecx, esi
mov dword [esp + 0x30], ebx
call edx
push 0x613630
lea ecx, [esp + 0x18]
call dword [0x610498]
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 0x24]
mov dword [esp + 0x58], 1
call dword [0x61059c]
or ebx, 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], ebx
call dword [0x6105a0]
mov ecx, dword [esp + 0x60]
push ecx
lea ecx, [esp + 0x34]
mov dword [esi + 0x294], 7
mov dword [esi + 0x284], 0x10
call dword [0x610498]
mov dword [esp + 0x54], 2
mov edx, dword [esi]
mov edx, dword [edx + 0x150]
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0x30]
mov dword [esp + 0x54], ebx
call dword [0x6105a0]
mov eax, dword [edi]
mov edx, dword [eax + 0x1fc]
push esi
mov ecx, edi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x114]
mov ecx, edi
call edx
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 8

Function at 0x41f8d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f8c86
mov eax, dword fs:[0]
push eax
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
fldz
xor ecx, ecx
fstp qword [eax + 0x20]
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov byte [eax + 0x38], cl
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x74], ecx
mov dword [eax + 0x7c], ecx
mov dword [eax + 0x80], ecx
mov dword [eax + 0x84], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov byte [eax + 0x1c], cl
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4
Function at 0x422350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5f1199
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x667050]
xor eax, esp
mov dword [esp + 0x20], eax
push edi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call dword [0x61049c]
lea eax, [esp + 0xc]
push eax
push edi
mov dword [esp + 0x40], 0
call fcn.005c8820
cmp dword [esp + 0x20], 0
lea ecx, [esp + 0xc]
je 0x4223ee
push esi
call fcn.00422840
mov edi, eax
test edi, edi
je 0x4223ea
mov eax, dword [esi + 0x1e4]
push 0x77
add eax, 0x20
call fcn.005aa990
test eax, eax
je 0x4223ea
push edi
call fcn.0043c4b0
add esp, 4
test eax, eax
je 0x4223ea
mov ecx, dword [esi + 0x1e4]
push 0
push eax
call fcn.0047e0c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call dword [0x6105a0]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005e693f
mov esp, ebp
pop ebp
ret