joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc67fd4
Capabilities:
Parse pe header

Disassembly:
call int.00c64a24
push eax
jmp 0xc64a1f
call 0xc67fd4
lea esp, [esp + 0xf]
call 0xc67fb0
jns fcn.00c67f9c
sub ecx, dword [ecx + 0x34ff242c]
and al, 0xe9
xchg byte [ebx], al
add byte [eax], al
neg byte [esi - 0x26]
dec eax
das
fidiv dword [ebx + edi*4]
xchg edx, eax
or eax, 0x249c899c
test byte [eax], al
add byte [eax], al
call fcn.00c67f9c
mov byte [esp + 0xb], dh
call 0xc67fa6
pop word [esp + 1]
mov byte [esp + 5], ch
lea esp, [esp + 3]
mov dword [esp + 0x84], esp
call 0xc67fb2
mov dword [esp], ebp
lea esp, [esp + 3]
mov dword [esp + 0x88], esi
push esp
jmp 0xc6802f
push word [esp + 1]
mov word [esp + 2], dx
push word [esp + 1]
mov dword [esp + 3], eax
mov word [esp + 2], bx
push dword [esp + 6]
jmp 0xc68081
call 0xc68052
jmp 0xc6809a
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xc680b9
movzx ebx, word [eax + 0x3c]
jmp 0xc6814c
mov byte [esp + 5], bh
mov dword [esp + 7], esi
pushal
mov dword [esp + 0xb0], edi
lea esp, [esp + 0xb0]
jmp 0xc68062
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0xc68070
jne 0xc68103
mov ecx, dword [ebx]
wait
dec byte [0x22ac23e5]
inc ebp
mov ah, 0x56
cmp dword [eax], ebx
jnp 0xc68109
int 0x5c
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xc6804d
sub eax, 0x10000
jmp 0xc6809e
xchg esp, eax
out 0x83, eax
adc esi, dword [esi - 0x7b]
cmp eax, 0xbdda44df
dec esp
in eax, 0x6b
int1
popal
add bl, dh
inc esi
imul esi, edx, 0x60
pop es
bnd jne 0xc68192
mul dword [edi + 2]
int1
js 0xc68193
call 0x3dae9aac
test byte [0xeb0ffc95], al
mov dh, 0x24
inc ebx
mov esi, 0x3bab245f
pop esi
lodsd eax, dword [esi]
dec ecx
dec edx
int3
add ebx, eax
cmp word [ebx], 0x4550
je 0xc64aa8
jne 0xc68103
dec edx
rol dword [ebx + 0x26], cl
aad 0x33
rcl byte [edx + ecx*8 - 0x53]
pop esp
mov dl, 0x41
ret
fdiv qword [edx + 0x15]
jb 0xc681aa
in al, 0x43
mov dword [0x2bd8b929], eax
std
ret
add byte [esi + 0x33e200f1], dl
mov ebp, 0x2ec7342d
add ecx, dword [esi + 0x75967b1c]
invalid

Function at 0xc6800d
Capabilities:
Parse pe header

Disassembly:
pop word [esp]
mov word [esp], di
mov byte [esp + 1], ah
push esp
mov dword [esp], ecx
jmp 0xc67ff6

Function at 0xc68058
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
lea esp, [esp + 7]
call fcn.00c6800d
mov byte [esp + 2], ah
push dword [esp + 2]
jmp 0xc68026
Function at 0x4183a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cba83
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [fcn.005ea350]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [fcn.005ea328]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [fcn.005ea350]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [fcn.005ea35c]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x418420
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cba83
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [fcn.005ea350]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [fcn.005ea32c]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [fcn.005ea350]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [fcn.005ea35c]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x420750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cc383
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [fcn.005ea354]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [fcn.005ea328]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [fcn.005ea350]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [fcn.005ea35c]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x429510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ccd76
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
lea ebx, [esi + 0x38]
mov ecx, ebx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
call fcn.00427100
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x42956a
push eax
call fcn.005c88b6
add esp, 4
mov ecx, ebx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.00427100
mov dword [esi + 4], edi
mov eax, dword [esi + 0x2c]
cmp eax, edi
je 0x42958d
push eax
call fcn.005c88b6
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x42ea70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x42eac4
cmp byte [esi], 0
je 0x42eac4
mov ecx, esi
push edi
mov eax, 0xffffffff
lea edi, [ecx + 1]
jmp 0x42ea90
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x42ea90
sub ecx, edi
xor edx, edx
test ecx, ecx
jle 0x42eac0
push ebx
movzx edi, byte [edx + esi]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
mov ebx, dword [edi*4 + 0x63e4b0]
shr eax, 8
xor eax, ebx
inc edx
cmp edx, ecx
jl 0x42eaa0
pop ebx
pop edi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x494f80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d257c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x10]
mov ecx, edi
mov dword [esp + 0xc], esi
call dword [fcn.005ea34c]
xor ebx, ebx
push 0x5eb0c0
mov ecx, edi
mov dword [esp + 0x1c], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call dword [fcn.005ea348]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x499460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d3149
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call dword [fcn.005ea34c]
xor ebx, ebx
push 0x5eb0c0
mov ecx, esi
mov dword [esp + 0x18], ebx
call dword [fcn.005ea348]
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x20], bl
mov byte [esi + 0x21], bl
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x1c], 0xffffffff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x499477
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d3149
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call dword [fcn.005ea34c]
xor ebx, ebx
push 0x5eb0c0
mov ecx, esi
mov dword [esp + 0x18], ebx
call dword [fcn.005ea348]
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x20], bl
mov byte [esi + 0x21], bl
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x1c], 0xffffffff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a7880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d2ed6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
lea ecx, [esi + 4]
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
lea edi, [esi + 0x14]
mov dword [esp + 0x2c], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
sub esp, 0x10
xor eax, eax
mov ebp, esp
mov dword [ebp], eax
xor edx, edx
mov dword [ebp + 4], edx
mov dword [ebp + 8], eax
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x30]
push 0x14
mov byte [esp + 0x40], 1
mov dword [esi], ebx
mov dword [ebp + 0xc], eax
call fcn.004a6ab0
sub esp, 0x10
xor eax, eax
mov edx, esp
mov dword [edx], eax
xor ecx, ecx
mov dword [edx + 4], ecx
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x30]
mov dword [edx + 8], ebx
push 0x14
mov ecx, edi
mov dword [edx + 0xc], eax
call fcn.004a6ab0
mov ecx, dword [esp + 0x24]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret

Function at 0x4a789a
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d2ed6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
lea ecx, [esi + 4]
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
lea edi, [esi + 0x14]
mov dword [esp + 0x2c], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
sub esp, 0x10
xor eax, eax
mov ebp, esp
mov dword [ebp], eax
xor edx, edx
mov dword [ebp + 4], edx
mov dword [ebp + 8], eax
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x30]
push 0x14
mov byte [esp + 0x40], 1
mov dword [esi], ebx
mov dword [ebp + 0xc], eax
call fcn.004a6ab0
sub esp, 0x10
xor eax, eax
mov edx, esp
mov dword [edx], eax
xor ecx, ecx
mov dword [edx + 4], ecx
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x30]
mov dword [edx + 8], ebx
push 0x14
mov ecx, edi
mov dword [edx + 0xc], eax
call fcn.004a6ab0
mov ecx, dword [esp + 0x24]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret

Function at 0x4aa850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d3131
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x644904]
push esi
mov esi, ecx
mov dword [esp + 0x24], eax
lea ecx, [esp + 8]
mov dword [esi], 0
call dword [fcn.005ea34c]
push 0x5eb0c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0
call dword [fcn.005ea348]
sub esp, 0x1c
lea eax, [esp + 0x24]
mov dword [esp + 0x20], esp
mov ecx, esp
push eax
mov dword [esp + 0x50], 1
call dword [fcn.005ea350]
push 0xa
lea ecx, [esi + 4]
call fcn.004a9bd0
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call dword [fcn.005ea35c]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x24]
call fcn.005c8895
pop esi
add esp, 0x30
ret
Function at 0x4aa86d
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d3131
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x644904]
push esi
mov esi, ecx
mov dword [esp + 0x24], eax
lea ecx, [esp + 8]
mov dword [esi], 0
call dword [fcn.005ea34c]
push 0x5eb0c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0
call dword [fcn.005ea348]
sub esp, 0x1c
lea eax, [esp + 0x24]
mov dword [esp + 0x20], esp
mov ecx, esp
push eax
mov dword [esp + 0x50], 1
call dword [fcn.005ea350]
push 0xa
lea ecx, [esi + 4]
call fcn.004a9bd0
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call dword [fcn.005ea35c]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x24]
call fcn.005c8895
pop esi
add esp, 0x30
ret

Function at 0x4ab9d0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x5d3289
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x14]
mov dword [esp + 8], esi
call dword [fcn.005ea34c]
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], edi
call dword [fcn.005ea34c]
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 3
call fcn.004ab980
mov ecx, esi
mov byte [esp + 0x14], 4
call fcn.004aafa0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4ab9e6
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x5d3289
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x14]
mov dword [esp + 8], esi
call dword [fcn.005ea34c]
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], edi
call dword [fcn.005ea34c]
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 3
call fcn.004ab980
mov ecx, esi
mov byte [esp + 0x14], 4
call fcn.004aafa0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4ade30
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5d349a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
mov eax, dword [0x644904]
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x58], eax
push edi
mov dword [esp + 0x14], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea eax, [esi + 0x18]
xor ecx, ecx
mov edx, eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
or ecx, 0xffffffff
mov dword [eax + 8], ecx
mov word [eax + 2], cx
mov word [eax], cx
mov word [eax + 4], cx
lea ebp, [esi + 0x24]
mov ecx, ebp
mov dword [esp + 0x68], ebx
call dword [fcn.005ea34c]
lea ecx, [esi + 0x40]
mov byte [esp + 0x68], 1
call dword [fcn.005ea34c]
lea ecx, [esi + 0x5c]
mov byte [esp + 0x68], 2
call dword [fcn.005ea34c]
lea edi, [esi + 0x90]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
push 0x5eb0c0
mov ecx, ebp
mov byte [esp + 0x6c], 4
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call dword [fcn.005ea348]
push 0x5eb0c0
lea ecx, [esi + 0x5c]
call dword [fcn.005ea348]
push 0x5eb0c0
lea ecx, [esi + 0x40]
call dword [fcn.005ea348]
lea ecx, [esp + 0x18]
mov dword [esi + 0x78], ebx
mov byte [esi + 0x7c], bl
mov dword [esi + 0x80], ebx
mov byte [esi + 0x84], bl
mov byte [esi + 0x8c], bl
mov byte [esi + 0x8d], bl
mov byte [esi + 0x8e], bl
call fcn.004a7880
sub esp, 0x24
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
mov byte [esp + 0x90], 5
call fcn.004a7a80
push 0xa
mov ecx, esi
call fcn.004add50
lea ecx, [esp + 0x40]
call dword [fcn.005ea34c]
sub esp, 0x20
mov byte [esp + 0x88], 6
mov dword [esp + 0x30], esp
mov eax, esp
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0x60]
mov dword [eax], ecx
push edx
lea ecx, [eax + 4]
call dword [fcn.005ea350]
push 6
mov ecx, edi
call fcn.004a9d90
lea ecx, [esp + 0x40]
mov dword [esi + 0x88], ebx
mov byte [esi + 0x8f], bl
mov byte [esp + 0x68], 5
call dword [fcn.005ea35c]
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x4adfa9
push eax
call fcn.005c88b6
add esp, 4
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
je 0x4adfc6
push eax
call fcn.005c88b6
add esp, 4
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x5c]
mov eax, esi
call fcn.005c8895
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
Function at 0x4ba530
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5180
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x10]
mov dword [ebp - 4], eax
call dword [fcn.005ea34c]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call dword [fcn.005ea34c]
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
call dword [fcn.005ea34c]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4c8dc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d65f1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call fcn.005302b0
mov dword [esi], fcn.0051e930
push 0x601004
lea ecx, [esi + 0x24]
mov dword [esp + 0x30], 0
mov dword [0x645cdc], esi
call dword [fcn.005ea348]
mov eax, dword [0x645858]
mov ecx, dword [eax]
push 0x600ff0
lea edx, [esp + 0xc]
push edx
push eax
call dword [ecx + 0x90]
add esp, 0xc
push eax
lea ecx, [esi + 8]
mov byte [esp + 0x30], 1
call dword [fcn.005ea358]
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0
call dword [fcn.005ea35c]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x5c], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4

Function at 0x4c8ddc
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d65f1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call fcn.005302b0
mov dword [esi], fcn.0051e930
push 0x601004
lea ecx, [esi + 0x24]
mov dword [esp + 0x30], 0
mov dword [0x645cdc], esi
call dword [fcn.005ea348]
mov eax, dword [0x645858]
mov ecx, dword [eax]
push 0x600ff0
lea edx, [esp + 0xc]
push edx
push eax
call dword [ecx + 0x90]
add esp, 0xc
push eax
lea ecx, [esi + 8]
mov byte [esp + 0x30], 1
call dword [fcn.005ea358]
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0
call dword [fcn.005ea35c]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x5c], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4

Function at 0x4c9260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d65f1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call fcn.005302b0
mov dword [esi], fcn.0051e930
push 0x601148
lea ecx, [esi + 0x24]
mov dword [esp + 0x30], 0
mov dword [0x645ce0], esi
call dword [fcn.005ea348]
mov eax, dword [0x645858]
mov ecx, dword [eax]
push 0x601134
lea edx, [esp + 0xc]
push edx
push eax
call dword [ecx + 0x90]
add esp, 0xc
push eax
lea ecx, [esi + 8]
mov byte [esp + 0x30], 1
call dword [fcn.005ea358]
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0
call dword [fcn.005ea35c]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x5c], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x4c927c
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d65f1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call fcn.005302b0
mov dword [esi], fcn.0051e930
push 0x601148
lea ecx, [esi + 0x24]
mov dword [esp + 0x30], 0
mov dword [0x645ce0], esi
call dword [fcn.005ea348]
mov eax, dword [0x645858]
mov ecx, dword [eax]
push 0x601134
lea edx, [esp + 0xc]
push edx
push eax
call dword [ecx + 0x90]
add esp, 0xc
push eax
lea ecx, [esi + 8]
mov byte [esp + 0x30], 1
call dword [fcn.005ea358]
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0
call dword [fcn.005ea35c]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x5c], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4

Function at 0x4d8f40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5d6ed3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov ecx, 0x607370
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x20], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x34], ecx
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x70], 0x607394
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x88], 0x6073b8
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0x9c], 0x6073dc
lea ecx, [esi + 0xb0]
mov dword [ecx + 0x128], eax
mov dword [ecx + 0x12c], eax
mov dword [ecx + 0x130], eax
call fcn.004d6140
xor eax, eax
mov ecx, esi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret