joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50c040
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb7000]
push edi
jmp 0x50c05a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50c061
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50c050
mov eax, 1
add ebx, ebx
jne 0x50c073
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50c084
jne 0x50c0a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50c0a3
dec eax
add ebx, ebx
jne 0x50c090
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x50c068
add ebx, ebx
jne 0x50c09f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x50c0f5
xor ecx, ecx
sub eax, 3
jb 0x50c0bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50c12a
sar eax, 1
mov ebp, eax
jmp 0x50c0c6
add ebx, ebx
jne 0x50c0c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50c094
inc ecx
add ebx, ebx
jne 0x50c0d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50c094
add ebx, ebx
jne 0x50c0e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50c0d6
jne 0x50c0f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50c0d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50c114
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50c106
jmp 0x50c056
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50c114
add edi, ecx
jmp 0x50c056
pop esi
mov edi, esi
mov ecx, 0x3eef
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x50c132
cmp byte [edi], 0x11
jne 0x50c132
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x50c137
lea edi, [esi + 0x105000]
mov eax, dword [edi]
or eax, eax
je 0x50c1af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x140344]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1404c0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50c164
mov ecx, edi
jns 0x50c193
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1404c4]
or eax, eax
je 0x50c1a9
mov dword [ebx], eax
add ebx, 4
jmp 0x50c181
call dword [esi + 0x1404d4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x50c1e0
cmp al, 0xef
ja 0x50c1d3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x50c1b5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x50c1c2
mov ebp, dword [esi + 0x1404c8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50c214
sub esp, 0xffffff80
jmp 0x426bf7
Function at 0x401336
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4034c0
call fcn.00401978
push 1
call fcn.004014d6
pop ecx
test al, al
jne 0x4011df
push 7
call fcn.00401743
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004014a1
mov byte [ebp - 0x24], al
mov eax, dword [0x40433c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4011d8
test eax, eax
jne 0x401249
mov dword [0x40433c], ecx
push 0x403110
push 0x4030fc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40122c
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x401330
push 0x4030f8
push 0x4030f0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x40433c], 2
jmp 0x40124e
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00401633
pop ecx
call fcn.00401737
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x40127e
push esi
call fcn.004015a6
pop ecx
test al, al
je 0x40127e
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00401972
call esi
call fcn.0040173d
mov esi, eax
cmp dword [esi], edi
je 0x40129c
push esi
call fcn.004015a6
pop ecx
test al, al
je 0x40129c
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00401858
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.0040188b
test al, al
jne 0x4012d5
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4012de
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00401650
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x401330
call fcn.004019be
ret
call fcn.00401050
jmp 0x4011c0

Function at 0x45d8ff
Capabilities:
Packed with generic packer

Disassembly:
push 0
call 0x45d90b
mov dword [0], eax
add esp, 8
jmp loc.01fd1dc0

Function at 0x45d90b
Capabilities:
Packed with generic packer

Disassembly:
push 0
call 0x45d90b
mov dword [0], eax
add esp, 8
jmp loc.01fd1dc0

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x41cde0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
or ebp, 0xffffffff
jmp 0x41ce02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ce09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41cdf8
mov eax, 1
add ebx, ebx
jne 0x41ce1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41ce10
jne 0x41ce2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ce10
xor ecx, ecx
sub eax, 3
jb 0x41ce40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ceb2
mov ebp, eax
add ebx, ebx
jne 0x41ce4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41ce58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41ce7c
inc ecx
add ebx, ebx
jne 0x41ce68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41ce5d
jne 0x41ce79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ce5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ce9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41ce8d
jmp 0x41cdfe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ce9c
add edi, ecx
jmp 0x41cdfe
pop esi
mov edi, esi
mov ecx, 0xa2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ceba
cmp byte [edi], 2
jne 0x41ceba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41cebf
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41cf37
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1c8e0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1c91c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ceec
mov ecx, edi
jns 0x41cf1b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1c920]
or eax, eax
je 0x41cf31
mov dword [ebx], eax
add ebx, 4
jmp 0x41cf09
call dword [esi + 0x1c928]
mov ebp, dword [esi + 0x1c924]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41cf6b
sub esp, 0xffffff80
jmp 0x4019d0
Function at 0x4e0037
Capabilities:
Packed with generic packer

Disassembly:
pushal
call 0x4e003d
pop eax
sub eax, 0x3d
push eax
lea edi, [eax - 0xdf000]
push edi
add word [edi + 0xde800], 0
lea esi, [eax + 0x1ec]
or ebp, 0xffffffff
xor ebx, ebx
jmp 0x4e0066
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e0071
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e0060
mov eax, 1
add ebx, ebx
jne 0x4e0083
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
ja 0x4e0078
jne 0x4e0094
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e0078
xor ecx, ecx
sub eax, 3
jb 0x4e0102
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e011e
mov ebp, eax
add ebx, ebx
jne 0x4e00b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4e00c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4e00e4
inc ecx
add ebx, ebx
jne 0x4e00d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
ja 0x4e00c5
jne 0x4e00e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e00c5
add ecx, 2
cmp eax, 0xfffff300
adc ecx, 1
lea edx, [edi + eax]
cmp eax, 0xfffffffc
jle 0x4e0108
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e00f4
jmp 0x4e0066
mov eax, ebp
jmp 0x4e00a8
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e0108
add edi, ecx
jmp 0x4e0066
pop esi
pop ebp
sub edi, dword [edi - 4]
push edi
lea edi, [esi]
mov ecx, 0x4178
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e012f
cmp byte [edi], 0x13
jne 0x4e012f
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4e0134
pop edi
mov eax, dword [edi]
or eax, eax
je 0x4e0199
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xde000]
add ebx, esi
push eax
add edi, 8
call dword [ebp]
xchg edx, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e015c
push edx
mov ecx, edi
jns 0x4e0189
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push edx
call dword [ebp + 4]
pop edx
mov dword [ebx], eax
add ebx, 4
jmp 0x4e0176
lea ebx, [esi - 4]
add edi, 4
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4e01ca
cmp al, 0xef
ja 0x4e01bd
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4e019f
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4e01ac
popal
jmp 0x472a25
Function at 0x1000f950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000f95f
pop dword [ebp - 0x28]
mov eax, 0x1000f95f
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x3cef9c90
sub dword [ebp - 0x38], 0xee9d5745
mov dword [ebp - 0x34], 0x9ae4bb15
sub dword [ebp - 0x34], 0x68b16ed0
mov dword [ebp - 0x30], 0x8dc56acb
add dword [ebp - 0x30], 0xbe86d963
mov dword [ebp - 0x2c], 0x162ccaa8
add dword [ebp - 0x2c], 0xe9d33558
lea eax, [ebp - 0x38]
push eax
mov eax, 0x490906dc
sub eax, 0x39074684
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x410b1e79
add dword [ebp - 0x38], 0x33674add
mov dword [ebp - 0x34], 0x48d5a3e0
add dword [ebp - 0x34], 0xf896bd95
mov dword [ebp - 0x30], 0xbfeca62b
sub dword [ebp - 0x30], 0x5c7d39bf
mov dword [ebp - 0x2c], 0x4052aa32
add dword [ebp - 0x2c], 0xbfad55ce
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xc0e3f11f
add eax, 0x4f1dcf41
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3b923
push 0
call eax
mov ecx, 0x4d74dae8
add ecx, 0xb28b6d0b
xor edx, edx
add edx, eax
mov esi, 0x10028800
add esi, dword [ebp - 0x28]
mov ebx, 0x3bf167f2
sub ebx, 0x7e6d4a0b
sub dword [ebp - 8], 0x33d7d520
mov edi, dword [esi]
xor dword [ebp - 8], 0x4945f237
add edi, ebx
mov dword [edx], edi
add dword [ebp - 0x20], ebx
add edx, 0xb5405142
add edx, 0x4abfaec2
add esi, 0x6c72acd0
sub esi, 0x6c72accc
loop 0x1000fa78
add eax, 0x1129f
xor ebx, ebx
add ebx, eax
add eax, 0x4c70dad
sub eax, 0x4c70da8
mov ecx, 0xa73d3776
add ecx, 0x68c2c88a
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x9c7680
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x456000]
push edi
or ebp, 0xffffffff
jmp 0x9c76a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9c76a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c7698
mov eax, 1
add ebx, ebx
jne 0x9c76bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9c76cc
jne 0x9c76eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c76eb
dec eax
add ebx, ebx
jne 0x9c76d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x9c76b0
add ebx, ebx
jne 0x9c76e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x9c773d
xor ecx, ecx
sub eax, 3
jb 0x9c7703
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9c7772
sar eax, 1
mov ebp, eax
jmp 0x9c770e
add ebx, ebx
jne 0x9c770e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c76dc
inc ecx
add ebx, ebx
jne 0x9c771c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c76dc
add ebx, ebx
jne 0x9c7729
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9c771e
jne 0x9c773a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9c771e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9c775c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9c774e
jmp 0x9c769e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9c775c
add edi, ecx
jmp 0x9c769e
pop esi
mov edi, esi
mov ecx, 0x16ab5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9c777a
cmp byte [edi], 0xb3
jne 0x9c777a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9c777f
lea edi, [esi + 0x5c3000]
mov eax, dword [edi]
or eax, eax
je 0x9c77ee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5db470]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5db5d0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9c77ac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5db5d8]
or eax, eax
je 0x9c77e8
mov dword [ebx], eax
add ebx, 4
jmp 0x9c77c9
call dword [esi + 0x5db5d4]
mov ebp, dword [esi + 0x5db5dc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9c7822
sub esp, 0xffffff80
jmp 0x84b25c
Function at 0x4040bc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00404d74
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0040421c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x404206
test ebx, ebx
jl 0x4041aa
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcba520
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4041cb
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4041bd
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00405b8c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00405b8c
add esp, 8
mov ebx, 0x80070057
jmp 0x4041aa
Function at 0x41ae8c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0041bb44
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0041afec
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41afd6
test ebx, ebx
jl 0x41af7a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcd12f0
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41af9b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x41af8d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0041c95c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0041c95c
add esp, 8
mov ebx, 0x80070057
jmp 0x41af7a
Function at 0x431d1c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004329d4
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00431e7c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x431e66
test ebx, ebx
jl 0x431e0a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce8180
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x431e2b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x431e1d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004337ec
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004337ec
add esp, 8
mov ebx, 0x80070057
jmp 0x431e0a
Function at 0x44875c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00449414
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004488bc
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4488a6
test ebx, ebx
jl 0x44884a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcfebc0
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x44886b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x44885d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0044a22c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0044a22c
add esp, 8
mov ebx, 0x80070057
jmp 0x44884a