joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472638
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x10]
mov ebp, ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
shr ebx, 0xf
push 0x12
and bl, 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x4726c3
movzx eax, word [edi + 0xc]
mov ecx, eax
test bl, bl
je 0x4726b2
cmp eax, 0x41
je 0x4726b7
movzx ecx, cx
push 0x20
mov eax, ecx
pop edx
sub eax, edx
je 0x47269c
sub eax, 0x4b
je 0x47269c
sub eax, 1
je 0x47269c
sub eax, 1
je 0x47269c
dec eax
sub eax, 1
je 0x47269c
sub eax, 0x4c
je 0x47269c
dec eax
sub eax, 1
jne 0x4726c3
test bl, bl
jne 0x4726c3
xor eax, eax
cmp cx, dx
mov ecx, ebp
setne al
push eax
call fcn.00471e6e
jmp 0x4726bf
cmp eax, 0x6a
jne 0x472670
lea ecx, [ebp + 0x28]
call fcn.0044c5fb
mov al, 1
jmp 0x4726c5
xor al, al
pop edi
pop ebp
pop ebx
ret 4

Function at 0x474263
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x571094
call fcn.00566548
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.00402516
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.00402516
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ecx
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [edi + 0x28], eax
lea eax, [esi + 0x30]
mov dword [edi + 0x2c], ecx
lea ecx, [edi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00402516
lea eax, [esi + 0x3c]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x3c]
call fcn.00402516
mov eax, dword [esi + 0x48]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x48], eax
mov al, byte [esi + 0x4c]
mov byte [edi + 0x4c], al
mov al, byte [esi + 0x4d]
mov byte [edi + 0x4d], al
mov al, byte [esi + 0x4e]
mov byte [edi + 0x4e], al
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4742fc
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x571094
call fcn.00566548
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0040260e
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.0040260e
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.0040260e
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 2
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov word [esi + 0x4c], bx
mov byte [esi + 0x4e], bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x478591
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x5714bb
call fcn.00566548
push ecx
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ecx
mov eax, dword [ebp + 8]
mov dword [esi], 0x57f164
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [esi + 0x3c], ecx
lea ecx, [esi + 0x48]
call fcn.0040260e
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.0040260e
or dword [esi + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x47dccd
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x57170f
call fcn.00566548
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x57f318
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x26], ebx
mov dword [esi + 0x2a], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 1
call fcn.0040260e
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
call fcn.0040260e
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov word [esi + 0x60], bx
mov dword [esi + 0x6c], ebx
mov byte [esi + 0x6e], 1
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x483b39
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x571c03
call fcn.00566548
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [ebx + 0x60]
mov eax, dword [ebx]
push 0xa
mov dword [edi], eax
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov dword [edi + 0x14], ecx
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
mov dword [edi + 0x24], ecx
mov dword [edi + 0x20], eax
mov eax, dword [ebx + 0x28]
mov ecx, dword [ebx + 0x2c]
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x34]
mov dword [edi + 0x34], ecx
mov dword [edi + 0x30], eax
mov eax, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x3c]
mov dword [edi + 0x3c], ecx
mov dword [edi + 0x38], eax
mov eax, dword [ebx + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [ebx + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [ebx + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [ebx + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [ebx + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [ebx + 0x50]
mov dword [edi + 0x50], eax
mov ax, word [ebx + 0x54]
mov word [edi + 0x54], ax
mov ax, word [ebx + 0x56]
mov word [edi + 0x56], ax
mov eax, dword [ebx + 0x58]
mov ecx, dword [ebx + 0x5c]
mov dword [edi + 0x5c], ecx
mov dword [edi + 0x58], eax
add edi, 0x60
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x10]
lea eax, [ebx + 0x88]
push eax
lea ecx, [edi + 0x88]
call fcn.0040231e
mov al, byte [ebx + 0x94]
lea ecx, [edi + 0x9c]
and dword [ebp - 4], 0
mov byte [edi + 0x94], al
mov al, byte [ebx + 0x95]
mov byte [edi + 0x95], al
mov eax, dword [ebx + 0x98]
mov dword [edi + 0x98], eax
lea eax, [ebx + 0x9c]
push eax
call fcn.0048397f
lea eax, [ebx + 0xa8]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0xa8]
call fcn.00483928
mov eax, dword [ebx + 0xb4]
lea esi, [ebx + 0xc0]
mov dword [edi + 0xb4], eax
mov eax, dword [ebx + 0xb8]
mov dword [edi + 0xb8], eax
mov eax, dword [ebx + 0xbc]
mov dword [edi + 0xbc], eax
add edi, 0xc0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x483d47
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x571c7f
call fcn.00566548
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
or dword [esi + 0x7c], 0xffffffff
lea eax, [esi + 0x3e8]
push 0x4c
push ebx
push eax
mov byte [ebp - 4], 9
mov dword [esi + 0x78], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi + 0x434], ebx
lea ecx, [esi + 0x444]
mov byte [esi + 0x438], bl
mov dword [esi + 0x43c], ebx
mov dword [esi + 0x440], ebx
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x487a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
mov edi, ecx
call fcn.00487dbe
cmp dword [esi + 0x20], 0x42535041
jne 0x487bd9
movzx eax, word [edi + 0x10]
cmp eax, 0xd
jne 0x487bd9
mov edx, dword [esp + 0x10]
mov ecx, esi
call fcn.004848bb
test al, al
je 0x487bd9
mov eax, dword [esi + 0x24]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ecx
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x84]
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], ecx
mov eax, dword [esi + 0x88]
mov ecx, dword [esi + 0x8c]
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], ecx
mov eax, dword [esi + 0xb8]
mov ecx, dword [esi + 0xbc]
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], ecx
mov eax, dword [esi + 0xc0]
mov ecx, dword [esi + 0xc4]
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], ecx
mov eax, dword [esi + 0xc8]
mov ecx, dword [esi + 0xcc]
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], ecx
mov eax, dword [esi + 0xd0]
mov ecx, dword [esi + 0xd4]
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], ecx
mov eax, dword [esi + 0xd8]
mov ecx, dword [esi + 0xdc]
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], ecx
mov eax, dword [esi + 0xe0]
mov ecx, dword [esi + 0xe4]
push ebx
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], ecx
mov eax, dword [esi + 0xe8]
mov ecx, dword [esi + 0xec]
push ebp
mov dword [edi + 0x78], eax
lea eax, [esi + 0xf0]
push 0x10
push eax
lea eax, [edi + 0x80]
mov dword [edi + 0x7c], ecx
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x100]
add esp, 0xc
mov ecx, dword [esi + 0x104]
mov dword [edi + 0x94], ecx
mov dword [edi + 0x90], eax
mov ecx, dword [esi + 0x10c]
mov eax, dword [esi + 0x108]
add esi, 0x110
mov dword [edi + 0x9c], ecx
lea ecx, [edi + 0xa0]
push esi
mov dword [edi + 0x98], eax
call fcn.00488002
push 8
add esi, 0x30
lea ebx, [edi + 0xd0]
pop ebp
push esi
mov ecx, ebx
call fcn.00488002
add esi, 0x30
add ebx, 0x30
sub ebp, 1
jne 0x487b6f
pop ebp
pop ebx
push 0x100
lea eax, [edi + 0x250]
push esi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x140]
add esp, 0xc
mov ecx, dword [esi + 0x144]
mov dword [edi + 0x350], eax
mov dword [edi + 0x354], ecx
mov eax, dword [esi + 0x148]
mov ecx, dword [esi + 0x14c]
mov dword [edi + 0x358], eax
mov dword [edi + 0x35c], ecx
mov eax, dword [esi + 0x150]
mov dword [edi + 0x360], eax
mov al, 1
jmp 0x487bdb
xor al, al
pop edi
pop esi
ret 8
Function at 0x48ac9d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x56a066
call fcn.00566548
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push esi
mov dword [ebp - 0x10], ebx
call fcn.0040231e
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.0040231e
mov eax, dword [esi + 0x18]
lea edi, [ebx + 0x40]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov al, byte [esi + 0x2c]
mov byte [ebx + 0x2c], al
mov al, byte [esi + 0x2d]
mov byte [ebx + 0x2d], al
mov al, byte [esi + 0x2e]
mov byte [ebx + 0x2e], al
mov al, byte [esi + 0x2f]
mov byte [ebx + 0x2f], al
mov al, byte [esi + 0x30]
mov byte [ebx + 0x30], al
mov al, byte [esi + 0x31]
mov byte [ebx + 0x31], al
mov ax, word [esi + 0x32]
mov word [ebx + 0x32], ax
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
add esi, 0x40
mov dword [ebx + 0x38], eax
mov eax, ebx
mov dword [ebx + 0x3c], ecx
mov ecx, dword [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x48f654
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x57090f
call fcn.00566548
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0x18], eax
lea eax, [esi + 0x20]
mov dword [edi + 0x1c], ecx
lea ecx, [edi + 0x20]
push eax
call fcn.0040231e
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
and dword [ebp - 4], 0
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
mov dword [edi + 0x50], eax
lea eax, [esi + 0x58]
mov dword [edi + 0x54], ecx
lea ecx, [edi + 0x58]
push eax
call fcn.00428239
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4923e3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56e5ce
call fcn.00566548
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea ecx, [esi + 0x48]
mov dword [ebp - 4], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov word [esi + 0x44], bx
call fcn.0040238d
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4971c6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x5727ce
call fcn.00566548
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], eax
mov dword [esi], 0x58256c
mov dword [esi + 4], 0x5825a0
mov dword [esi + 8], 0x5825bc
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x60], eax
push 0x402652
push 0x40c137
push 6
push 8
lea eax, [esi + 0x160]
mov byte [ebp - 4], 6
push eax
call fcn.00566567
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x499b41
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [esp + 0x10]
push 0x3c
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x44], ebx
mov ax, word [edi]
mov word [esi + 0x10], ax
movzx eax, word [edi + 2]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 4]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x28], eax
movzx eax, word [edi + 0x18]
mov dword [esi + 0x18], eax
movzx eax, word [edi + 0x1a]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], ebx
mov eax, dword [edi + 0x20]
mov dword [esi + 0x54], eax
lea eax, [edi + 0x28]
push eax
lea eax, [esi + 0x5c]
push eax
call sub.msvcrt.dll_memcpy
mov ax, word [esi + 0x10]
mov ecx, 0xf000
and ax, cx
add esp, 0xc
mov ecx, 0x8000
cmp ax, cx
jne 0x499bd2
mov eax, dword [edi + 0x6c]
or dword [esi + 0x20], ebx
or dword [esi + 0x24], eax
movzx eax, word [edi + 0x74]
or dword [esi + 0x48], ebx
mov ebx, 0x80
cdq
or dword [esi + 0x4c], eax
movzx eax, word [edi + 0x78]
shl eax, 0x10
or dword [esi + 0x14], eax
movzx eax, word [edi + 0x7a]
shl eax, 0x10
or dword [esi + 0x18], eax
mov eax, dword [esp + 0x14]
movzx eax, word [eax + 0x48]
cmp ax, bx
jbe 0x499c47
movzx edx, word [edi + 0x80]
lea ecx, [ebx + edx]
cmp ecx, eax
jbe 0x499c15
xor al, al
jmp 0x499c49
cmp edx, 0x1c
jb 0x499c47
mov eax, dword [edi + 0x84]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x88]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x8c]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x90]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x94]
mov dword [esi + 0x3c], eax
mov al, 1
pop edi
pop esi
pop ebx
ret 8
Function at 0x4a9c9a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5733c1
call fcn.00566548
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi], 0x5840d8
mov dword [esi + 4], 0x58410c
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4aaf7b
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x573528
call fcn.00566548
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebx]
mov dword [edi], eax
mov ax, word [ebx + 4]
mov word [edi + 4], ax
mov ax, word [ebx + 6]
mov word [edi + 6], ax
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
lea ecx, [edi + 0x18]
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [edi + 0x14], eax
lea eax, [ebx + 0x18]
push eax
call fcn.004aacc4
and dword [ebp - 4], 0
lea eax, [ebx + 0x24]
push eax
lea ecx, [edi + 0x24]
call fcn.004aad1b
lea eax, [ebx + 0x30]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x30]
call fcn.004aad72
push 0xa
pop ecx
add edi, 0x40
mov byte [ebp - 4], 2
lea esi, [ebx + 0x40]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x10]
lea eax, [ebx + 0x68]
push eax
lea ecx, [esi + 0x68]
call fcn.00428239
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4ba468
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, ecx
push 0x14
pop ecx
cmp edi, ecx
jb case.0x4ba55d.8
mov ebx, dword [esp + 0x14]
xor ebp, ebp
movzx edx, word [ebx]
mov word [esi], dx
mov eax, edx
mov dword [esp + 0x18], eax
mov ax, word [ebx + 2]
mov word [esi + 2], ax
mov ax, word [ebx + 4]
mov word [esi + 4], ax
mov ax, word [ebx + 6]
mov word [esi + 6], ax
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
cmp edx, 2
je 0x4ba5d9
cmp dx, 9
je 0x4ba5a8
cmp dx, 1
jne 0x4ba4f9
push 0x20
pop ecx
cmp edi, ecx
jb case.0x4ba55d.8
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebp
movzx eax, word [ebx + 0x18]
cdq
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
movzx eax, word [ebx + 0x1a]
mov dword [esi + 0xc], eax
mov eax, ecx
jmp 0x4ba582
push 8
pop eax
cmp dx, ax
jne 0x4ba54b
push 0x28
pop ecx
cmp edi, ecx
jb case.0x4ba55d.8
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebp
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebp
movzx edx, word [ebx + 0x20]
movzx eax, word [ebx + 0x22]
mov dword [esi + 0xc], eax
test edx, edx
je 0x4ba4f2
lea eax, [ecx + 0xc]
cmp eax, edi
ja case.0x4ba55d.8
mov eax, dword [ecx + ebx + 8]
add ecx, 0xd
add ecx, eax
cmp ecx, edi
ja case.0x4ba55d.8
cmp eax, 0x400
ja case.0x4ba55d.8
inc ebp
cmp ebp, edx
jb 0x4ba529
jmp 0x4ba4f2
movzx eax, dx
add eax, 0xfffffffd
cmp eax, 0xb
ja case.0x4ba55d.8
movzx eax, byte [eax + 0x4ba648]
jmp dword [eax*4 + 0x4ba638]
cmp edi, 0x18
jb case.0x4ba55d.8
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebp
lea ecx, [eax + 0x18]
cmp edi, ecx
jb case.0x4ba55d.8
cmp eax, 0x40000000
jbe case.0x4ba55d.6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
push 0x18
pop ecx
cmp edi, ecx
jb case.0x4ba55d.8
push 8
pop eax
cmp dx, ax
jb 0x4ba4f2
add ecx, 4
cmp edi, ecx
jb case.0x4ba55d.8
jmp 0x4ba4f2
push 0x38
pop eax
mov dword [esp + 0x18], eax
cmp edi, eax
jb case.0x4ba55d.8
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov eax, dword [ebx + 0x2c]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0x30]
mov dword [esi + 0xc], eax
jmp 0x4ba602
push 0x20
pop eax
mov dword [esp + 0x18], eax
cmp edi, eax
jb case.0x4ba55d.8
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebp
mov eax, dword [ebx + 0x14]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebp
push dword [esp + 0x1c]
mov ecx, esi
mov ebx, ebp
call fcn.004b8593
shld edx, eax, 2
shl eax, 2
add eax, dword [esp + 0x18]
adc edx, ebx
cmp edx, ebp
ja 0x4ba62e
jb 0x4ba582
cmp eax, edi
jbe 0x4ba582
mov eax, ebp
jmp 0x4ba582
Function at 0x4bbede
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x573edf
call fcn.00566548
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi], 0x586798
mov dword [esi + 4], 0x5867cc
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0040260e
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x40], al
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4bbfc0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x56a066
call fcn.00566548
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.0040231e
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.0040231e
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov al, byte [esi + 0x28]
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0x28], al
mov al, byte [esi + 0x29]
mov byte [edi + 0x29], al
mov al, byte [esi + 0x2a]
mov byte [edi + 0x2a], al
mov al, byte [esi + 0x2b]
mov byte [edi + 0x2b], al
mov al, byte [esi + 0x2c]
mov byte [edi + 0x2c], al
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4