joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4237e7
Capabilities:
Encode data using xor

Disassembly:
jne 0x4237f8
fisttp word [ecx - 0x2c375d83]
test al, 0x66
adc ch, ch
bnd jg 0x42380b
cmpsb byte [esi], byte es:[edi]
fcompi st(5)
adc eax, 0x102b2421
push edi
cmc
insd dword es:[edi], dx
cli
jmp 0x8b61e50b
adc cl, bh
inc edx
jnp 0x423813
fadd qword [edi + ecx - 0x35cfbdbf]
or bh, ah
push ss
sbb bl, cl
retf
insb byte es:[edi], dx
insd dword es:[edi], dx
mov ebp, 0xca9dd1c1
leave
loop 0x423826
invalid
inc esi
or byte [0xe1935f68], bl
xor eax, 0xd70102e0
xchg ebx, eax
loope 0x423848
loopne 0x423817
add edi, edx
adc eax, 0x13e82a78
mov bh, 0x94
pop es
cmp al, 0x7d
loop 0x4237b8
pop edx
adc dl, byte [ebp + 0x30]
and al, byte [ebx + 0x75]
dec ecx
xor byte [edx], ah
inc ebx
jne 0x423874
push 0xbe43abea
push ds
inc ecx
xor esp, esi
push ds
test ebp, esp
jbe 0x423810
pop esp
jae 0x4237e9
rcr byte [edi - 0x32d704db], cl
pop edx
mov ah, 0x22
adc eax, 0x2c6239a2
cmp dword [edx + 0x2c], esp
jo 0x423894
cmpsb byte [esi], byte es:[edi]
sti
ror dword [eax - 0x5be89916], 1
push edx
retf 0x2b97
mov esp, 0x84421a22
jmp 0x1b6b1429
movsd dword es:[edi], dword [esi]
jle 0x4238a3
rol byte [ebp + 2], cl
lcall 0xa6bf, 0xad028c0
adc al, 0xdf
inc ecx
scasb al, byte es:[edi]
or cl, byte [edx + 0x1a791448]
nop
loop 0x42390e
out 0x4c, ax
push ss
push eax
pop ebp
lcall 0x2c0a, 0xa0d0a2d
invalid
adc eax, 0xb9cab2ca
imul bl
push ecx
movsd dword es:[edi], dword [esi]
push ebx
and dword [edx], esp
add bl, dh
xrelease xchg dword [ecx - 0x1f], edx
xchg dword [esp + edx*4 - 0x25a99be3], ebx
lcall 0xe821, 0x502e579a
mov gs, word [ecx + 0x5dfe052b]
invalid

Function at 0x42b768
Capabilities:
Execute syscall

Disassembly:
js 0x42b7cd
syscall
lodsb al, byte [esi]
scasd eax, dword es:[edi]
fdiv qword [eax*8 - 0x28eb9cb9]
lodsd eax, dword [esi]
sbb byte [ecx], al
cld
xchg dword [ebx + 0x27], ebp
adc ecx, dword [ecx + 0x5dc12430]
push ebx
cmp eax, 0x8e36f24b
adc al, 0x7f
ret
push esi
mov al, byte [0x346b5f86]
pop es
les ecx, [esi + ebx]
or bl, byte [esi]
push 0x1f
int1
outsd dx, dword [esi]
iretd
Function at 0x437747
Capabilities:
Authenticate hmac

Disassembly:
mov esi, edx
popal
fsub st(3), st(0)
insd dword es:[edi], dx
add ebp, edx
and byte [edx - 0x50], 0x5a
js 0x437795
in eax, 0x38
sbb dword [ebx - 0x7e], ebp
sal dword [ecx + 0x40], 1
jp 0x437757
pushal
pushal
cmc
lea esp, [eax - 0x4f]
jecxz 0x43774f
and al, 0x21
pushal
sbb ebp, ecx
jns 0x4377ee
cwde
imul ebp, dword [eax - 0x33], 0xa89a18c1
daa
jecxz 0x43781f
cld
invalid
std
popal
test al, 0x21
adc byte [eax], bl
cmpsd dword [esi], dword es:[edi]
in al, 0xf9
nop
pop ecx
aam 0x5c
imul ebp, dword [eax - 0x1d], 0x4d8f005f
adc eax, dword [ecx + 0x213046f8]
mov byte [ebp + 0x10], cl
cwde
sub dword [ebp + 0x106bf17b], ebx
cmc
xor ebx, dword [ebp - 0x24]
inc ecx
mov cl, 0x4c
dec esp
mov dword [esi - 0xcd87a8a], 0xcd908860
pop ebp
stc
movsd dword es:[edi], dword [esi]
pushal
mov byte [eax - 0x5a06a233], dl
mov bh, 0x44
rcr al, 0x36
push edx
or cl, ch
in eax, 0x7b
jno 0x437830
push ss
push es
pop ebp
and dword [ebx - 0x60afe794], ebx
push ecx
arpl word [edi + esi*2 - 0x28], sp
mov al, byte [0xac96907d]
mov eax, dword [0x60c98cfc]
cmp cl, dh
arpl word [eax], si
xchg cl, dh
or byte [ebx + 0x3f], dl
pushal
sbb ecx, ebx
mov dword [0x947bb653], eax
mov ebx, 0xfd31f80b
nop
outsd dx, dword [esi]
mov al, byte [0x94640b62]
xchg esp, eax
push eax
fsubr qword [ebx]
das
push edx
or al, byte [eax + 0x1d]
fist word [ecx - 0x5fb0bd11]
or dword [esi + 0x5c], esp
xor byte [ebx - 0x6287119d], bl
dec ecx
pushfd
pushfd
fsubr qword [edi + 0x18d345b3]
leave
sbb ch, byte [ecx - 0x37]
jne 0x437818
cdq
scasd eax, dword es:[edi]
pop ss
push ebp
aad 0x20
cld
xchg ebp, eax
inc esp
mov bl, 0x76
jmp 0xc31eacc4

Function at 0x437c97
Capabilities:
Encode data using xor

Disassembly:
xor byte [esi + 0x1ea009ec], bl
inc edx
pop ebp
popal
mov esi, 0x6b9c1a58
fucomp st(4)
rcr eax, 0x8f
invalid

Function at 0x44e957
Capabilities:
Encode data using xor

Disassembly:
int1
pushal
arpl word [esp + edi], ax
xchg esp, eax
mov bl, 0xa1
push ss
mov dh, 0xbe
idiv byte [edi - 0x18]
fst qword [ebx - 0x1f1d2d20]
pop ss
mov cl, byte [eax]
xor esi, edi
add edi, esi
mov ch, 0x4d
invalid
insd dword es:[edi], dx
pushal
ja 0x44e915
loop 0x44e8dc
daa
mov ss, word [ebx - 0x3957e0b]
iretd
outsd dx, dword [esi]
pop ebp
adc al, 0x48
ret
xor al, byte [0xda424784]
sal dword [edx - 0x6d5b3965], 0xe3
sub edx, esp
mov dl, 0x9a
in eax, 0x67
invalid
pop edx
add al, 0x66
push edi
push ebx
daa
pop ss
jnp 0x44e93b
sal dword [edi + 0x1644ca9f], 0xfb
xchg edi, eax
loop 0x44e9c5
loop 0x44e8fb
ret 0x3cb4
Function at 0x4bb041
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2390
cmp edx, dword [eax]
je 0x4bb063
add eax, 8
inc ecx
cmp eax, 0x4c2420
jl 0x4bb054
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2390]
jne 0x4bb191
mov eax, dword [0x4c6d1c]
cmp eax, 1
je 0x4bb16b
test eax, eax
jne 0x4bb094
cmp dword [0x4c22bc], 1
je 0x4bb16b
cmp edx, 0xfc
je 0x4bb191
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb0cb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bba20
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbeb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb10e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbeb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c072c
push edi
call fcn.004bdd80
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bba20
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bba30
lea eax, [ebp - 0xa0]
push 0x4c070c
push eax
call fcn.004bba30
push dword [esi + 0x4c2394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bba30
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bdcf4
add esp, 0x2c
pop edi
jmp 0x4bb191
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2394]
push 0
push eax
push dword [esi]
call fcn.004bbeb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x5a7a57
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x3c
xchg dword [ebx - 0x78744718], eax
shr dword [esi - 0x5e], 0x8d
pop ebp
in eax, dx
enter 0x4415, 0x64
dec eax
sub edx, dword [edx]
or eax, 0x93879cba
lodsb al, byte [esi]
mov ebx, 0xa041035
and dword [esi - 0x58], 2

Function at 0x5eeeb5
Capabilities:
Encode data using xor

Disassembly:
pop ecx
pushal
sbb eax, 0x934cee28
pushfd
mov ecx, 0x6ef94330
stosb byte es:[edi], al
mov ch, 0x3b
mov dh, byte [edi - 0x61]
mov edx, 0xe393c3c
invalid
Function at 0x43ebb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x43ebce
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x43ebc3
pop esi
ret

Function at 0x43ed10
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x43eda2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x43ed94
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x43ed8c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x43ed55
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406037
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x406046
pop dword [ebp - 0x30]
mov eax, 0x406046
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xc7c3b5bf
sub dword [ebp - 0x40], 0x79717074
mov dword [ebp - 0x3c], 0xb5263a66
add dword [ebp - 0x3c], 0x7d0d11df
mov dword [ebp - 0x38], 0xc9e593e9
sub dword [ebp - 0x38], 0x7d994fbb
mov dword [ebp - 0x34], 0xa48f5b3d
add dword [ebp - 0x34], 0x5b70a4c3
lea eax, [ebp - 0x40]
push eax
mov eax, 0xfb1a1de
sub eax, 0xf70d18a
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x526d77a6
sub dword [ebp - 0x40], 0xddfb0e50
mov dword [ebp - 0x3c], 0x15b63951
add dword [ebp - 0x3c], 0x2bb62824
mov dword [ebp - 0x38], 0xc2248782
add dword [ebp - 0x38], 0xa14ae4ea
mov dword [ebp - 0x34], 0x36392d6
add dword [ebp - 0x34], 0xfc9c6d2a
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x39c87
push 0
call eax
mov ecx, 0x48d2
xor esi, esi
add esi, eax
mov edi, 0xac5143e7
add edi, 0x53f06c19
add edi, dword [ebp - 0x30]
mov ebx, 0x4e186250
sub ebx, 0x1a4d6242
add dword [ebp - 0x10], 0xb71fa91c
mov edx, dword [edi]
xor edx, ebx
xor dword [ebp - 0x20], edx
mov dword [esi], edx
add dword [ebp - 0x1c], ecx
add esi, 0x9348320c
add esi, 0x6cb7cdf8
add edi, 0x1bdac9bb
sub edi, 0x1bdac9b7
loop 0x40615a
add eax, 0x9c86bec1
add eax, 0x637a575a
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4086ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x4086d9
pop dword [ebp - 0x3c]
mov eax, 0x4086d9
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xf4dbc299
sub dword [ebp - 0x4c], 0xa6897d4e
mov dword [ebp - 0x48], 0x134cad7
sub dword [ebp - 0x48], 0xcf017e92
mov dword [ebp - 0x44], 0x2a4ff76c
add dword [ebp - 0x44], 0x21fc4cc2
mov dword [ebp - 0x40], 0x8fcf0b44
sub dword [ebp - 0x40], 0x8fcf0b44
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x2064ca21
sub dword [ebp - 0x4c], 0xabf260cb
mov dword [ebp - 0x48], 0x7015a3c
sub dword [ebp - 0x48], 0xc594f8c7
mov dword [ebp - 0x44], 0x97d137e8
sub dword [ebp - 0x44], 0x3461cb7c
mov dword [ebp - 0x40], 0x3bd76a37
sub dword [ebp - 0x40], 0x3bd76a37
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xd7320335
add eax, 0x290ecd17
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x387c9
push 0
call eax
mov ecx, 0xadcef76c
add ecx, 0x52314c72
mov ebx, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x3c]
mov edi, 0x1ede2d25
add edi, 0x722411f0
sub dword [ebp - 0x24], edx
mov edx, dword [esi]
xor dword [ebp - 4], edi
xor edx, edi
xor dword [ebp - 0x1c], 0xb69b066a
mov dword [ebx], edx
add dword [ebp - 0x34], ebx
add ebx, 0x72b14599
sub ebx, 0x72b14595
add esi, 0xe4c46014
add esi, 0x1b3b9ff0
loop 0x4087eb
add eax, 0x1024b
xor ebx, ebx
add ebx, eax
add eax, 0x51a43f24
sub eax, 0x51a43f1f
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40cb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40cb5f
pop dword [ebp - 0x2c]
mov eax, 0x40cb5f
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x39e32
push 0
mov eax, 0xedf14250
add eax, 0x124f9e88
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x4a98
mov ebx, eax
mov esi, 0xaee392c2
add esi, 0x515da902
add esi, dword [ebp - 0x2c]
mov edi, 0x8c71a0f5
add edi, 0xf2841e17
mov dword [ebp - 0x10], 0xf6bfb57d
mov edx, dword [esi]
add dword [ebp - 0x10], esi
sub edx, edi
xor dword [ebp - 0x18], eax
mov dword [ebx], edx
xor dword [ebp - 0x24], 0xd83cc0f
add ebx, 0x626a7bd1
sub ebx, 0x626a7bcd
add esi, 0xce6dcb21
sub esi, 0xce6dcb1d
loop 0x40cbb3
add eax, 0x11d33
mov ebx, eax
add eax, 0xd4578755
sub eax, 0xd4578750
mov ecx, 0xc5fdca1a
sub ecx, 0xc5bdca1a
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x40d673
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40d6a4
call fcn.00403763
mov dword [eax], esi
call fcn.00403750
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040cb50
add esp, 0x14
push 0x16
pop eax
jmp 0x40d6f9
test dword [ebp + 0xc], 0xfffffff9
jne 0x40d680
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40d6d1
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.0040cb50
pop ecx
call fcn.00403750
mov eax, dword [eax]
jmp 0x40d6f9
test al, 0x10
jne 0x40d6f7
test al, 1
je 0x40d6f7
test byte [ebp + 0xc], 2
je 0x40d6f7
call fcn.00403763
mov dword [eax], 5
call fcn.00403750
mov dword [eax], 0xd
jmp 0x40d6c8
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4133f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5aca28
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
lea ecx, [esi + 8]
mov dword [esp + 0x18], edi
call fcn.004e5100
mov dword [esi + 0x20], vtable.Maid::JobCacheTemplate_class_Maid::KEEPOUT::ShaderInput__class_Maid::KEEPOUT::ShaderFunction__class_Maid::KEEPOUT::ShaderOutput_.0
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], vtable.Maid::JobCacheTemplate_class_Maid::KEEPOUT::ilInput__class_Maid::KEEPOUT::ilFunction__class_Maid::KEEPOUT::ilOutput_.0
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x413460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ab22e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 2
call fcn.00413340
lea ecx, [esi + 0x20]
mov byte [esp + 0x14], 1
call fcn.00412c40
lea ecx, [esi + 8]
call fcn.00411260
mov esi, dword [esi + 4]
mov dword [esp + 0x14], 0xffffffff
test esi, esi
je 0x4134e6
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4134e6
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4134e6
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x41dd70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ac108
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [edi + 0x30]
mov dword [esp + 0x18], 0
test esi, esi
je 0x41ddd2
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x41ddd2
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x41ddd2
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov ecx, edi
mov dword [esp + 0x18], 0xffffffff
call fcn.0041dcb0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x420eb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ac8f3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov ecx, 3
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov dword [esi + 4], eax
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x20], eax
lea ecx, [esi + 0x38]
mov byte [esp + 0x14], 1
call fcn.004e5100
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x426220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp ebx, dword [esp + 0xc]
je 0x4263c4
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea esi, [ebx + 0x78]
lea esp, [esp]
mov eax, dword [edi]
mov dword [ebx], eax
mov ebp, dword [edi + 4]
cmp ebp, dword [esi - 0x74]
je 0x426294
test ebp, ebp
je 0x42625c
lea ecx, [ebp + 4]
mov edx, 1
lock xadd dword [ecx], edx
mov ebx, dword [esi - 0x74]
test ebx, ebx
je 0x42628d
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x42628d
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x42628d
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov ebx, dword [esp + 0x14]
mov dword [esi - 0x74], ebp
push 0xffffffffffffffff
push 0
lea eax, [edi + 8]
push eax
lea ecx, [esi - 0x70]
call fcn.00406e60
mov eax, dword [edi + 0x24]
mov dword [esi - 0x54], eax
mov ecx, dword [edi + 0x28]
mov dword [esi - 0x50], ecx
mov dl, byte [edi + 0x2c]
mov byte [esi - 0x4c], dl
fld dword [edi + 0x3c]
fstp dword [esi - 0x3c]
fld dword [edi + 0x30]
fstp dword [esi - 0x48]
fld dword [edi + 0x34]
fstp dword [esi - 0x44]
fld dword [edi + 0x38]
fstp dword [esi - 0x40]
mov eax, dword [edi + 0x40]
mov dword [esi - 0x38], eax
mov ecx, dword [edi + 0x44]
mov dword [esi - 0x34], ecx
mov ebp, dword [edi + 0x48]
cmp ebp, dword [esi - 0x30]
je 0x42632a
test ebp, ebp
je 0x4262f2
lea edx, [ebp + 4]
mov eax, 1
lock xadd dword [edx], eax
mov ebx, dword [esi - 0x30]
test ebx, ebx
je 0x426323
lea ecx, [ebx + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x426323
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
lea eax, [ebx + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x426323
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
mov ebx, dword [esp + 0x14]
mov dword [esi - 0x30], ebp
push 0xffffffffffffffff
push 0
lea ecx, [edi + 0x4c]
push ecx
lea ecx, [esi - 0x2c]
call fcn.00406e60
mov edx, dword [edi + 0x68]
mov dword [esi - 0x10], edx
mov eax, dword [edi + 0x6c]
mov dword [esi - 0xc], eax
mov cl, byte [edi + 0x70]
mov byte [esi - 8], cl
fld dword [edi + 0x80]
fstp dword [esi + 8]
push 0xffffffffffffffff
fld dword [edi + 0x74]
push 0
fstp dword [esi - 4]
lea eax, [edi + 0x88]
fld dword [edi + 0x78]
push eax
fstp dword [esi]
lea ecx, [esi + 0x10]
fld dword [edi + 0x7c]
fstp dword [esi + 4]
mov edx, dword [edi + 0x84]
mov dword [esi + 0xc], edx
call fcn.00406e60
push 0xffffffffffffffff
push 0
lea eax, [edi + 0xa4]
push eax
lea ecx, [esi + 0x2c]
call fcn.00406e60
mov eax, dword [edi + 0xc0]
mov dword [esi + 0x48], eax
mov ecx, dword [edi + 0xc4]
add ebx, 0xc8
mov dword [esi + 0x4c], ecx
add esi, 0xc8
mov dword [esp + 0x14], ebx
cmp ebx, dword [esp + 0x18]
jne 0x426240
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4433b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5afed9
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], 0
mov esi, dword [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.004b4fe0
fld1
mov eax, dword [esp + 0x3c]
fst dword [esp + 0x18]
mov ecx, dword [esp + 0x40]
fst dword [esp + 0x1c]
push 0xffffffffffffffff
fst dword [esp + 0x24]
lea edx, [esp + 0x1c]
fstp dword [esp + 0x28]
push edx
mov dword [esp + 0x18], eax
push 1
lea eax, [esp + 0x1c]
push eax
add edi, 0x19c
mov dword [esp + 0x24], ecx
push edi
mov ecx, esi
mov dword [esp + 0x44], 0
mov dword [esp + 0x20], 1
call fcn.004b5200
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 0xc

Function at 0x4434e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5aff49
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], 0
mov esi, dword [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00417480
fld1
mov eax, dword [esp + 0x3c]
fst dword [esp + 0x18]
mov ecx, dword [esp + 0x40]
fst dword [esp + 0x1c]
push 0xffffffffffffffff
fst dword [esp + 0x24]
lea edx, [esp + 0x1c]
fstp dword [esp + 0x28]
push edx
mov dword [esp + 0x18], eax
push 1
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x24], ecx
add edi, 0x19c
push edi
mov ecx, esi
mov dword [esp + 0x44], 0
mov dword [esp + 0x20], 1
call fcn.004b5200
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
push ecx
push 1
lea edx, [esp + 0x1c]
push edx
push edi
lea ecx, [esi + 0x44]
mov dword [esp + 0x24], 6
mov dword [esp + 0x28], 0xc
call fcn.004b5200
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 0xc
Function at 0x448e00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5b07cb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004d4ca0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.Maid::SurfaceInstance.0
call fcn.004e5100
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.004e5100
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x474d90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b3a18
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004e5100
lea ecx, [esi + 0x18]
mov dword [esp + 0x14], 0
call fcn.004e5100
mov dword [esi + 0x30], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x482550
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5aba88
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0xc]
call fcn.00481e80
lea ecx, [esp + 8]
push ecx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x30], 0
call fcn.0041ded0
cmp dword [esp + 0x20], 4
jb 0x4825ad
mov edx, dword [esp + 0xc]
push edx
call fcn.0058984a
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 4