joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4444c0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [eax]
cmp esi, 0xffffffff
jne 0x44451a
mov eax, dword [0x53af88]
test al, 1
jne 0x4444f7
or eax, 1
mov dword [0x53af9c], 0x50b1f8
push 0x501e00
mov dword [0x53af88], eax
call fcn.004c95ad
add esp, 4
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov dword [edx], 0x2719
mov ecx, dword [edx]
mov dword [edx + 4], 0x53af9c
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
pop esi
pop ecx
pop ebp
ret 0x10
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 4
push dword [ebp + 0x10]
push 4
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [0x53af88]
mov esi, eax
test cl, 1
jne 0x444562
or ecx, 1
mov dword [0x53af9c], 0x50b1f8
push 0x501e00
mov dword [0x53af88], ecx
call fcn.004c95ad
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov dword [edx + 4], 0x53af9c
test esi, esi
jne 0x444581
mov dword [edx], esi
mov dword [edx + 4], 0x52c6cc
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
pop esi
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
pop ecx
pop ebp
ret 0x10

Function at 0x4445a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [eax]
cmp esi, 0xffffffff
jne 0x4445fa
mov eax, dword [0x53af88]
test al, 1
jne 0x4445d7
or eax, 1
mov dword [0x53af9c], 0x50b1f8
push 0x501e00
mov dword [0x53af88], eax
call fcn.004c95ad
add esp, 4
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov dword [edx], 0x2719
mov ecx, dword [edx]
mov dword [edx + 4], 0x53af9c
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
pop esi
pop ecx
pop ebp
ret 0x10
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 4
push dword [ebp + 0x10]
push 0x20
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [0x53af88]
mov esi, eax
test cl, 1
jne 0x444642
or ecx, 1
mov dword [0x53af9c], 0x50b1f8
push 0x501e00
mov dword [0x53af88], ecx
call fcn.004c95ad
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov dword [edx + 4], 0x53af9c
test esi, esi
jne 0x444661
mov dword [edx], esi
mov dword [edx + 4], 0x52c6cc
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
pop esi
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
pop ecx
pop ebp
ret 0x10
Function at 0x445b70
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [eax]
cmp esi, 0xffffffff
jne 0x445bca
mov eax, dword [0x53af88]
test al, 1
jne 0x445ba7
or eax, 1
mov dword [0x53af9c], 0x50b1f8
push 0x501e00
mov dword [0x53af88], eax
call fcn.004c95ad
add esp, 4
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov dword [edx], 0x2719
mov ecx, dword [edx]
mov dword [edx + 4], 0x53af9c
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
pop esi
pop ecx
pop ebp
ret 0x10
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 4
push dword [ebp + 0x10]
push 1
push 6
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [0x53af88]
mov esi, eax
test cl, 1
jne 0x445c0f
or ecx, 1
mov dword [0x53af9c], 0x50b1f8
push 0x501e00
mov dword [0x53af88], ecx
call fcn.004c95ad
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov dword [edx + 4], 0x53af9c
test esi, esi
jne 0x445c2e
mov dword [edx], esi
mov dword [edx + 4], 0x52c6cc
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
pop esi
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
pop ecx
pop ebp
ret 0x10

Function at 0x445c50
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [eax]
cmp esi, 0xffffffff
jne 0x445caa
mov eax, dword [0x53af88]
test al, 1
jne 0x445c87
or eax, 1
mov dword [0x53af9c], 0x50b1f8
push 0x501e00
mov dword [0x53af88], eax
call fcn.004c95ad
add esp, 4
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov dword [edx], 0x2719
mov ecx, dword [edx]
mov dword [edx + 4], 0x53af9c
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
pop esi
pop ecx
pop ebp
ret 0x10
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 4
push dword [ebp + 0x10]
push 8
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [0x53af88]
mov esi, eax
test cl, 1
jne 0x445cf2
or ecx, 1
mov dword [0x53af9c], 0x50b1f8
push 0x501e00
mov dword [0x53af88], ecx
call fcn.004c95ad
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov dword [edx + 4], 0x53af9c
test esi, esi
jne 0x445d11
mov dword [edx], esi
mov dword [edx + 4], 0x52c6cc
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
pop esi
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
pop ecx
pop ebp
ret 0x10
Function at 0x448c70
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500958
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x52a51c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x10]
test ecx, ecx
jne 0x448cb7
mov dword [esi + 0x10], ecx
jmp 0x448cc7
mov eax, dword [ecx]
cmp ecx, edi
jne 0x448cc0
push esi
jmp 0x448cc2
push 0
call dword [eax]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0x18]
mov dword [ecx], 0
push eax
mov dword [ecx + 4], 0
call fcn.004082d0
movzx eax, word [edi + 0x20]
lea ecx, [esi + 0x3c]
mov word [esi + 0x20], ax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
movzx eax, word [edi + 0x38]
mov word [esi + 0x38], ax
movzx eax, word [edi + 0x3a]
mov word [esi + 0x3a], ax
lea eax, [edi + 0x3c]
push eax
mov dword [ecx], 0
mov dword [ecx + 4], 0
call fcn.004082d0
lea ecx, [esi + 0x44]
lea eax, [edi + 0x44]
mov dword [ecx], 0
push eax
mov dword [ecx + 4], 0
call fcn.004082d0
lea ecx, [esi + 0x4c]
lea eax, [edi + 0x4c]
mov dword [ecx], 0
push eax
mov dword [ecx + 4], 0
call fcn.004082d0
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x449740
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.VirtualAllocExNuma
push str.kernel32.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.AllocateUserPhysicalPagesNuma
push str.kernel32.dll
mov dword [0x53afc0], eax
call edi
push eax
call esi
push str.GetNumaProcessorNode
push str.kernel32.dll
mov dword [0x53afc4], eax
call edi
push eax
call esi
push str.GetNumaAvailableMemoryNodeEx
push str.kernel32.dll
mov dword [0x53afc8], eax
call edi
push eax
call esi
push 0x5139f4
push str.kernel32.dll
mov dword [0x53afcc], eax
call edi
push eax
call esi
push str.GetNumaNodeProcessorMaskEx
push str.kernel32.dll
mov dword [0x53afd0], eax
call edi
push eax
call esi
push str.SetThreadGroupAffinity
push str.kernel32.dll
mov dword [0x53afd4], eax
call edi
push eax
call esi
pop edi
mov dword [0x53afd8], eax
pop esi
ret
Function at 0x44ecc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [edi], 0
cmp dword [0x52c580], 0
je 0x44ed17
mov eax, dword [0x53afe8]
test eax, eax
je 0x44ecf0
push eax
call dword [0x52c5d4]
add esp, 4
lea edx, [ebp - 4]
mov ecx, 0x14
call fcn.0044c420
mov eax, dword [0x53afe8]
test eax, eax
je 0x44ed12
push eax
call dword [0x52c5dc]
mov esi, dword [ebp - 4]
jmp 0x44ed21
mov esi, dword [ebp - 4]
jmp 0x44ed24
push 0x14
call dword [0x52c5a4]
mov esi, eax
add esp, 4
test esi, esi
jne 0x44ed32
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x52c584], 0
mov ebx, dword [ebp + 8]
je 0x44ed65
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x44ec90
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.004cb7bb
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x44ed73
xorps xmm0, xmm0
movdqu xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x44ed8c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp - 8]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x450d90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
xor eax, eax
mov cl, byte [esi]
test cl, cl
je 0x450dbe
jmp 0x450da0
movzx ecx, cl
lea esi, [esi + 1]
movzx edx, byte [ecx + 0x50bd50]
lea ecx, [eax*8]
xor edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x450da0
pop esi
ret
Function at 0x450e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov ecx, 0x80
mov dword [ebp - 4], esi
lea eax, [edi*8]
cmp eax, 0x400
cmova edi, ecx
cmp edi, dword [esi]
jne 0x450e61
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x53b010]
test eax, eax
je 0x450e6c
call eax
lea eax, [edi*8]
push 0
push eax
call fcn.0044c510
mov ecx, dword [0x53b014]
add esp, 8
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ecx, ecx
je 0x450e8f
call ecx
test ebx, ebx
je 0x450e58
push dword [esi + 0xc]
call fcn.0044c830
add esp, 4
mov dword [esi + 0xc], ebx
push ebx
call dword [0x52c5b0]
shr eax, 3
add esp, 4
mov dword [ebp - 8], eax
mov dword [esi], eax
lea ecx, [eax*8]
push ecx
push 0
push ebx
call fcn.004ce8d0
mov ecx, dword [esi + 8]
add esp, 0xc
mov dword [esi + 8], 0
test ecx, ecx
je 0x450f72
mov edi, dword [ecx + 0xc]
xor ebx, ebx
mov al, byte [edi]
test al, al
je 0x450f01
movzx eax, al
lea edx, [ebx*8]
lea edi, [edi + 1]
movzx esi, byte [eax + 0x50bd50]
mov al, byte [edi]
xor esi, edx
xor ebx, esi
test al, al
jne 0x450ee3
xor edx, edx
mov edi, dword [ecx]
mov eax, ebx
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea esi, [eax + edx*8]
test esi, esi
je 0x450f4c
mov eax, dword [esi]
test eax, eax
je 0x450f1f
mov edx, dword [esi + 4]
jmp 0x450f21
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x450f4c
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x450f41
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x450f68
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x450f68
mov esi, dword [ebp - 4]
mov eax, dword [esi + 8]
mov dword [ecx], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x450f5e
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [esi + 8], ecx
mov ecx, edi
test edi, edi
jne 0x450ed8
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x450f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push ebx
push esi
push edi
mov ecx, dword [eax + 0xc]
mov ebx, edx
mov dword [ebp - 4], eax
test ecx, ecx
je 0x450fd3
mov al, byte [ebx]
xor esi, esi
mov edi, ebx
test al, al
je 0x450fbe
nop
movzx eax, al
lea ecx, [esi*8]
lea edi, [edi + 1]
movzx edx, byte [eax + 0x50bd50]
mov al, byte [edi]
xor edx, ecx
xor esi, edx
test al, al
jne 0x450fa0
mov ecx, dword [ebp - 4]
mov eax, esi
xor edx, edx
div dword [ecx]
mov edi, dword [ecx + 0xc]
mov esi, dword [edi + edx*8 + 4]
mov edi, dword [edi + edx*8]
jmp 0x450fdb
mov esi, dword [eax + 8]
xor edx, edx
mov edi, dword [eax + 4]
mov eax, dword [ebp + 8]
mov dword [eax], edx
test edi, edi
je 0x450ffb
push ebx
push dword [esi + 0xc]
dec edi
call fcn.0044f860
add esp, 8
test eax, eax
je 0x451004
mov esi, dword [esi]
test edi, edi
jne 0x450fe4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a4d6
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x45a511
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x45a4f8
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x45a509
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x45a513
inc edi
add eax, 0x28
cmp edi, esi
jb 0x45a4ee
xor eax, eax
pop edi
pop esi
ret

Function at 0x45c200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
loop 0x45c201
invalid
call [ecx + 0x50]
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.0045a407
add esp, 0xc
jmp 0x45c40e
Function at 0x464db0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov dword [esp + 0x18], edx
mov edi, ecx
cmp dword [ebx], 0
mov dword [esp + 0x10], 0
jne 0x464f57
cmp byte [edi + 1], 0
jne 0x464f03
mov esi, dword [ebp + 0xc]
movzx eax, word [edi + 0x10]
lea ecx, [esi + 2]
cmp ecx, eax
jg 0x464f03
mov ecx, dword [edi + 0x44]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x464e0d
call fcn.0045ada0
jmp 0x464e12
call fcn.0045abf0
test eax, eax
je 0x464e1f
mov dword [ebx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x38]
mov edx, esi
movzx ecx, word [edi + 0xe]
mov dword [esp + 0x14], eax
movzx eax, word [edi + 0x12]
lea eax, [ecx + eax*2]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
lea eax, [ecx + eax*2]
mov ecx, edi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
call fcn.0045f8f0
add esp, 4
test eax, eax
jne 0x464e16
mov ecx, dword [esp + 0x10]
mov eax, 0xfffe
mov edx, dword [esp + 0x14]
sub eax, esi
inc word [edi + 0x12]
add word [edi + 0x10], ax
push esi
push dword [ebp + 8]
lea esi, [edx + ecx]
push esi
call fcn.004cd4f0
mov ecx, dword [ebp + 0x14]
add esp, 0xc
test ecx, ecx
je 0x464e9d
mov eax, ecx
mov byte [esi + 3], cl
shr eax, 0x18
mov byte [esi], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 1], al
mov eax, ecx
shr eax, 8
mov byte [esi + 2], al
mov esi, dword [esp + 0x14]
add esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x18]
push eax
lea eax, [esi + 2]
push esi
push eax
call fcn.004c8c20
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov edx, dword [esp + 0x14]
mov eax, ecx
mov byte [esi + 1], cl
sar eax, 8
mov byte [esi], al
movzx ecx, byte [edi + 6]
movzx eax, byte [edi + 0x13]
mov byte [ecx + edx + 3], al
movzx ecx, byte [edi + 6]
movzx eax, byte [edi + 0x12]
mov byte [ecx + edx + 4], al
mov eax, dword [edi + 0x34]
cmp byte [eax + 0x11], 0
je 0x464f57
mov edx, dword [ebp + 8]
mov ecx, edi
push ebx
call fcn.0045f570
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x464f1f
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.004cd4f0
mov edx, dword [esp + 0x24]
add esp, 0xc
jmp 0x464f22
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x464f43
mov eax, ecx
mov byte [esi + 3], cl
shr eax, 0x18
mov byte [esi], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 1], al
mov eax, ecx
shr eax, 8
mov byte [esi + 2], al
mov al, byte [edi + 1]
movzx ecx, al
inc al
mov byte [edi + 1], al
mov dword [edi + ecx*4 + 0x20], esi
mov word [edi + ecx*2 + 0x16], dx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x467600
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x18], ebx
cmp edx, dword [ebx + 0x2c]
jbe 0x46763c
push 0x51877c
push 0xee71
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.0044eab0
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004600d0
add esp, 8
test eax, eax
jne 0x467801
mov esi, dword [esp + 0x14]
cmp byte [esi + 9], al
je 0x46767f
push 0x51877c
push 0xee76
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.0044eab0
add esp, 0x10
mov ebx, 0xb
jmp 0x4677ce
mov byte [esi + 9], 1
xor ecx, ecx
movzx edi, byte [esi + 6]
xor eax, eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], ecx
cmp ax, word [esi + 0x12]
jae 0x46772f
lea ecx, [ecx]
mov eax, dword [esi + 0x40]
movzx edi, byte [eax + ecx*2]
movzx eax, byte [eax + ecx*2 + 1]
shl edi, 8
or edi, eax
movzx eax, word [esi + 0x14]
and edi, eax
add edi, dword [esi + 0x38]
cmp byte [esi + 5], 0
jne 0x4676f7
movzx edx, byte [edi]
mov ecx, ebx
movzx eax, byte [edi + 1]
push dword [ebp + 0xc]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 3]
shl edx, 8
or edx, eax
push 1
call fcn.00467600
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4677ce
lea eax, [esp + 0x10]
mov edx, edi
push eax
mov ecx, esi
call fcn.00464680
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4677ce
mov ecx, dword [esp + 0x14]
movzx eax, word [esi + 0x12]
inc ecx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
cmp ecx, eax
jl 0x4676a0
mov edi, dword [esp + 0x1c]
cmp byte [esi + 5], 0
jne 0x467770
mov ecx, dword [esi + 0x38]
push dword [ebp + 0xc]
add ecx, edi
push 1
movzx edx, byte [ecx + 8]
movzx eax, byte [ecx + 9]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xa]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xb]
shl edx, 8
mov ecx, ebx
or edx, eax
call fcn.00467600
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4677ce
jmp 0x46777d
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x46777d
movzx eax, word [esi + 0x12]
add dword [ecx], eax
cmp dword [ebp + 8], 0
je 0x467797
push dword [esi + 0x48]
mov ecx, dword [esi + 0x34]
mov edx, esi
call fcn.004642b0
add esp, 4
mov ebx, eax
jmp 0x4677ce
mov ecx, dword [esi + 0x44]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x4677b2
call fcn.0045ada0
jmp 0x4677b7
call fcn.0045abf0
mov ebx, eax
test ebx, ebx
jne 0x4677ce
mov eax, dword [esi + 0x38]
mov ecx, esi
movzx edx, byte [eax + edi]
or edx, 8
call fcn.0045ffb0
mov byte [esi + 9], 0
mov ecx, dword [esi + 0x44]
test byte [ecx + 0x18], 0x40
mov esi, dword [ecx + 0x10]
je 0x4677f3
call fcn.004594d0
mov ecx, esi
call fcn.0045a590
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00455240
mov ecx, esi
call fcn.0045a590
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46af70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
mov esi, edx
push edi
movsx eax, word [ebx + 0x4c]
mov ecx, dword [ebx + 0x20]
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov eax, dword [ebx + eax*4 + 0x78]
mov dword [ebp - 8], esi
mov edx, dword [eax + 0x3c]
movzx eax, word [ebx + 0x28]
sub edx, ecx
cmp eax, edx
lea ecx, [esi + edi]
cmovb edx, eax
cmp ecx, edx
ja 0x46afc6
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
add ecx, esi
xor eax, eax
mov dword [edx + 0x10], ecx
mov ecx, 0x1010
mov word [edx + 8], cx
mov dword [edx + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x10]
lea edx, [edi + 2]
mov ecx, 1
mov word [esi + 8], cx
cmp dword [esi + 0x18], edx
jge 0x46aff1
push 0
mov ecx, esi
call fcn.0046a180
add esp, 4
test eax, eax
je 0x46affb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], eax
mov word [esi + 8], cx
cmp dword [ebp + 0xc], 0
je 0x46b016
mov edx, dword [ebp - 8]
mov ecx, ebx
push 0
push dword [esi + 0x10]
push edi
call fcn.00462a90
add esp, 0xc
jmp 0x46b026
push dword [esi + 0x10]
push edi
push dword [ebp - 8]
push ebx
call fcn.00462e70
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x46b04e
mov eax, dword [esi + 0x10]
mov byte [edi + eax], bl
mov eax, dword [esi + 0x10]
mov byte [eax + edi + 1], bl
mov eax, 0x210
mov word [esi + 8], ax
mov eax, ebx
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x2460
test word [esi + 8], ax
jne 0x46b05f
cmp dword [esi + 0x18], 0
je 0x46b066
mov ecx, esi
call fcn.0046a5f0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c3820
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500cf3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x52a51c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x53b180
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x53b180
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x50af83
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.004c2500
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4d1080
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret