joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f050
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x59e534
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
lea esi, [ecx + 8]
push edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x28], 0
lea edi, [esi + 0x294]
mov dword [esp + 0x10], edi
mov ecx, edi
mov byte [esp + 0x28], 6
call fcn.0049aff0
mov edi, dword [edi]
push 0x18
push edi
mov byte [esp + 0x30], 5
call fcn.00402e90
mov ecx, dword [esi + 0x250]
mov eax, dword [esi + 0x258]
add esp, 8
sub eax, ecx
test ecx, ecx
mov byte [esp + 0x28], 4
je 0x48f0c8
test eax, eax
je 0x48f0c8
push eax
push ecx
call fcn.00402e90
add esp, 8
mov ecx, dword [esi + 0x244]
mov eax, dword [esi + 0x24c]
sub eax, ecx
mov byte [esp + 0x28], 3
test ecx, ecx
je 0x48f0ed
test eax, eax
je 0x48f0ed
push eax
push ecx
call fcn.00402e90
add esp, 8
mov ecx, dword [esi + 0x220]
mov eax, dword [esi + 0x228]
sub eax, ecx
mov byte [esp + 0x28], 2
test ecx, ecx
je 0x48f112
test eax, eax
je 0x48f112
push eax
push ecx
call fcn.00402e90
add esp, 8
mov edi, dword [esi + 0x214]
mov eax, dword [esi + 0x21c]
sub eax, edi
test edi, edi
je 0x48f161
test eax, eax
je 0x48f161
cmp eax, 0x80
jbe 0x48f13a
push edi
call fcn.005089dd
add esp, 4
jmp 0x48f161
add eax, 7
mov ecx, 0x5d59e8
shr eax, 3
lea ebx, [eax*4 + 0x5d59a4]
call fcn.00402330
mov eax, dword [ebx]
mov ecx, 0x5d59e8
mov dword [edi], eax
mov dword [ebx], edi
call fcn.00443330
lea edi, [esi + 0x70]
mov dword [esp + 0x18], edi
mov dword [edi], 0x5a9490
lea ecx, [edi + 0x50]
mov byte [esp + 0x28], 9
call fcn.0049b380
lea ebx, [edi + 0x44]
mov dword [esp + 0x1c], ebx
mov eax, dword [ebx + 4]
mov ebp, dword [ebx]
cmp ebp, eax
mov byte [esp + 0x28], 0xa
mov dword [esp + 0x10], eax
je 0x48f1a8
push ebp
call fcn.0049eb00
mov eax, dword [esp + 0x14]
add ebp, 0x48
add esp, 4
cmp ebp, eax
jne 0x48f194
mov ecx, ebx
mov byte [esp + 0x28], 8
call fcn.0049b3d0
lea ecx, [edi + 0x40]
mov byte [esp + 0x28], 7
call fcn.0049b380
mov ecx, edi
mov byte [esp + 0x28], 0
call fcn.004920f0
add esi, 0x44
mov dword [esp + 0x1c], esi
mov ecx, dword [esi + 0x18]
sub esp, 0x10
mov eax, esp
mov dword [esp + 0x28], esp
sub esp, 0x10
mov dword [esp + 0x48], 0xb
mov dword [eax], ecx
mov edx, dword [esi + 0x1c]
mov dword [eax + 4], edx
mov ecx, dword [esi + 0x20]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0x24]
mov dword [eax + 0xc], edx
lea eax, [esi + 8]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004e6040
call fcn.0049e030
add esp, 0x20
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.004fe670
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret
Function at 0x49fef0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x49ff03
push eax
call fcn.0050b6a7
add esp, 4
mov eax, dword [esp + 8]
push 0x8000
push eax
call fcn.0050be71
add esp, 8
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x49ff5e
mov eax, dword [esi + 4]
test eax, eax
jne 0x49ff33
push 0x2800
call fcn.005095d5
add esp, 4
mov dword [esi + 4], eax
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push 0x2800
push ecx
push edx
call fcn.0050b977
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], eax
mov eax, dword [esi]
pop esi
ret 4

Function at 0x49ff70
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
mov edi, eax
sub edi, ecx
cmp edi, 0x400
jge 0x49ffe0
cmp eax, 0x2800
jge 0x49ff96
test eax, eax
jl 0x49ff96
mov eax, edi
pop edi
pop esi
ret
test edi, edi
je 0x49ffaa
mov eax, dword [esi + 4]
push edi
add ecx, eax
push ecx
push eax
call fcn.005092a0
add esp, 0xc
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, 0x2800
add eax, edi
sub edx, edi
push edx
push eax
push ecx
call fcn.0050b977
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
add ecx, edx
add esp, 0xc
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 4]
add eax, edi
mov dword [esi + 0x10], 0
mov dword [esi + 8], ecx
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
pop edi
pop esi
ret

Function at 0x4a2e29
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x59f9df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.004e8a10
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esi + 0x34]
mov dword [esi + 0x30], 0x5a9a98
mov dword [esp + 0x20], ebx
rep stosd dword es:[edi], eax
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x19c], ebx
mov dword [esi + 0x1a0], ebx
mov dword [esi + 0x1a4], ebx
push 0x18
mov byte [esp + 0x24], 4
mov dword [esi + 0x1a8], ebx
call fcn.00402bf0
mov cl, byte [esp + 0x13]
mov dword [esi + 0x1a8], eax
mov dword [esi + 0x1ac], ebx
mov byte [esi + 0x1b0], cl
mov byte [eax], bl
mov edx, dword [esi + 0x1a8]
mov dword [edx + 4], ebx
mov eax, dword [esi + 0x1a8]
mov dword [eax + 8], eax
mov eax, dword [esi + 0x1a8]
mov dword [eax + 0xc], eax
lea edi, [esi + 0x1b4]
push 0x18
mov byte [esp + 0x28], 5
mov dword [esp + 0x1c], edi
mov dword [edi], ebx
call fcn.00402bf0
add esp, 8
mov dword [edi], eax
mov al, byte [esp + 0xf]
mov ecx, edi
mov byte [esp + 0x20], 6
mov dword [edi + 4], ebx
mov byte [edi + 8], al
call fcn.004b4a30
mov dword [esi + 0x40c], ebx
mov dword [esi + 0x410], ebx
mov dword [esi + 0x414], ebx
mov ecx, esi
mov byte [esp + 0x20], 8
mov dword [esi], 0x5a9980
mov dword [esi + 0x30], 0x5a98f8
call fcn.004a4b30
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x4a2f60
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x59fa5f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004e8a10
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esi + 0x34]
mov dword [esi + 0x30], 0x5a9a98
mov dword [esp + 0x1c], ebx
rep stosd dword es:[edi], eax
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x19c], ebx
mov dword [esi + 0x1a0], ebx
mov dword [esi + 0x1a4], ebx
push 0x18
mov byte [esp + 0x20], 4
mov dword [esi + 0x1a8], ebx
call fcn.00402bf0
mov cl, byte [esp + 0x30]
mov dword [esi + 0x1a8], eax
mov dword [esi + 0x1ac], ebx
mov byte [esi + 0x1b0], cl
mov byte [eax], bl
mov edx, dword [esi + 0x1a8]
mov dword [edx + 4], ebx
mov eax, dword [esi + 0x1a8]
mov dword [eax + 8], eax
mov eax, dword [esi + 0x1a8]
mov dword [eax + 0xc], eax
lea edi, [esi + 0x1b4]
push 0x18
mov byte [esp + 0x24], 5
mov dword [esp + 0x18], edi
mov dword [edi], ebx
call fcn.00402bf0
add esp, 8
mov dword [edi], eax
mov al, byte [esp + 0x2c]
mov ecx, edi
mov byte [esp + 0x1c], 6
mov dword [edi + 4], ebx
mov byte [edi + 8], al
call fcn.004b4a30
mov dword [esi + 0x40c], ebx
mov dword [esi + 0x410], ebx
mov dword [esi + 0x414], ebx
mov ecx, esi
mov byte [esp + 0x1c], 8
mov dword [esi], 0x5a9980
mov dword [esi + 0x30], 0x5a98f8
call fcn.004a4b30
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
push ecx
push edx
push edi
mov ecx, esi
call fcn.004a30c0
push ebx
push edi
mov ecx, esi
call fcn.004a34a0
push ebx
push 0x10
push 1
push ebx
mov ecx, esi
call fcn.004a5650
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x4a34a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x574
test eax, eax
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x30]
je 0x4a34be
mov edx, dword [ecx]
push eax
call dword [edx + 0xc]
jmp 0x4a34c8
mov eax, dword [ecx]
push str.mface
call dword [eax + 0xc]
test eax, eax
je 0x4a34f8
push 0
push eax
call fcn.0040ed10
lea ecx, [esp + 0x48]
lea edx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x34]
push edx
push ecx
lea edx, [esp + 0x30]
lea ecx, [esp + 0x24]
push edx
push ecx
push eax
call fcn.0040f550
add esp, 0x20
jmp 0x4a3558
mov dword [esp + 0x10], 0x3f333333
mov dword [esp + 0x14], 0x3f333333
mov dword [esp + 0x18], 0x3f333333
mov dword [esp + 0x1c], 0x3f333333
mov dword [esp + 0x20], 0x3f333333
mov dword [esp + 0x24], 0x3f333333
mov dword [esp + 0x28], 0x3f333333
mov dword [esp + 0x2c], 0x3f333333
mov dword [esp + 0x30], 0x3f333333
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x38]
mov ecx, dword [esp + 0x584]
lea eax, [esp + 0x40]
push 0
push eax
push ecx
call fcn.004a8160
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
mov dx, word [0x5c6838]
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
repne scasb al, byte es:[edi]
add esi, 0x19c
mov word [edi - 1], dx
lea eax, [esp + 0x240]
push eax
call fcn.0042a910
mov ecx, dword [esi + 4]
mov edi, dword [esi]
sub ecx, edi
lea edx, [esp + 0x44]
sar ecx, 2
push ecx
push edx
lea eax, [esp + 0x14c]
push str._s_02d
push eax
call fcn.00508ac6
lea ecx, [esp + 0x154]
lea edx, [esp + 0x254]
push ecx
push edx
lea eax, [esp + 0x35c]
push str._s_s.
push eax
call fcn.00508ac6
mov ecx, 0x50
xor eax, eax
lea edi, [esp + 0x464]
add esp, 0x24
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x440]
lea edx, [esp + 0x340]
push ecx
push edx
call ebx
cmp eax, 0xffffffff
je 0x4a3675
push 0
push 0
push 0
push 0
lea eax, [esp + 0x150]
push 0
push eax
lea ecx, [esp + 0x4c]
push 0x42200000
lea edx, [esp + 0x44]
push ecx
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.0040ed80
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
add esp, 0x2c
cmp ecx, edx
mov dword [esp + 0xc], eax
je 0x4a3663
test ecx, ecx
je 0x4a365a
mov dword [ecx], eax
add dword [esi + 4], 4
jmp 0x4a3598
lea edx, [esp + 0xc]
push edx
push ecx
mov ecx, esi
call fcn.0049c640
jmp 0x4a3598
mov eax, dword [esi + 4]
mov edi, dword [esi]
sub eax, edi
xor ecx, ecx
sar eax, 2
cmp ecx, eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
add esp, 0x574
ret 8
Function at 0x4abaa0
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x59feec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
call fcn.004a9010
lea ebx, [esi + 0x10]
xor ebp, ebp
mov ecx, ebx
mov dword [esp + 0x28], ebp
call fcn.0054e150
lea ecx, [esi + 0x108]
mov byte [esp + 0x28], 1
call fcn.005498c0
lea ecx, [esi + 0x150]
call fcn.005498c0
lea ecx, [esi + 0x198]
call fcn.005498c0
lea edi, [esi + 0x1ec]
lea eax, [esp + 0x10]
push 8
push eax
mov ecx, edi
mov dword [esp + 0x24], edi
call fcn.00402b70
mov ecx, edi
mov byte [esp + 0x28], 2
call fcn.00402a70
lea edx, [esp + 0x11]
lea ecx, [edi + 0xc]
push 8
push edx
mov byte [esp + 0x30], 3
mov dword [esp + 0x1c], ecx
call fcn.00402b70
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x28], 4
call fcn.00402a70
lea eax, [esp + 0x12]
lea ecx, [edi + 0x18]
push 8
push eax
mov byte [esp + 0x30], 5
mov dword [esp + 0x1c], ecx
call fcn.00402b70
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x28], 6
call fcn.00402a70
lea ecx, [edi + 0x58]
mov byte [esp + 0x28], 7
call fcn.00499700
mov dword [edi + 0x38], ebp
mov dword [edi + 0x54], ebp
mov dword [edi + 0x4c], ebp
mov dword [edi + 0x48], ebp
mov dword [edi + 0x44], ebp
mov dword [edi + 0x40], ebp
mov dword [edi + 0x3c], ebp
mov dword [edi + 0x50], 0x64
mov dword [edi + 0x2c], 2
mov dword [edi + 0x30], 0x12c
mov dword [edi + 0x34], 3
lea ecx, [esi + 0x258]
mov byte [esp + 0x28], 8
call fcn.005498c0
lea ecx, [esi + 0x2a0]
call fcn.005498c0
lea ecx, [esi + 0x2e8]
call fcn.005498c0
lea ecx, [esi + 0x330]
call fcn.005498c0
lea edi, [esi + 0x388]
push 0x1c
mov dword [esp + 0x20], edi
mov dword [edi], ebp
call fcn.00402bf0
add esp, 4
mov dword [edi], eax
mov cl, byte [esp + 0x12]
mov byte [esp + 0x28], 9
mov byte [edi + 8], cl
mov ecx, edi
mov dword [edi + 4], ebp
call fcn.004b4a30
lea edi, [esi + 0x394]
push 0x14
mov byte [esp + 0x2c], 0xa
mov dword [esp + 0x20], edi
mov dword [edi], ebp
call fcn.00402bf0
add esp, 4
mov dword [edi], eax
mov dl, byte [esp + 0x12]
mov ecx, edi
mov byte [esp + 0x28], 0xb
mov dword [edi + 4], ebp
mov byte [edi + 8], dl
call fcn.004b4a30
lea edi, [esi + 0x3a4]
lea eax, [esp + 0x12]
lea edx, [esp + 0x11]
push eax
lea ecx, [edi + 4]
push edx
mov byte [esp + 0x30], 0xc
mov dword [esp + 0x24], edi
call fcn.004b4790
lea eax, [esp + 0x10]
lea edx, [esp + 0x13]
push eax
lea ecx, [edi + 0x10]
push edx
mov byte [esp + 0x30], 0xd
call fcn.004b47f0
mov dword [edi], 0x5a9444
mov dword [edi + 0x24], ebp
mov dword [edi + 0x20], ebp
mov dword [edi + 0x1c], ebp
mov ecx, esi
mov byte [esp + 0x28], 0xe
mov dword [esi], 0x5a9bf8
mov dword [ebx], 0x5a9bd8
call fcn.004abe80
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4b40b8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a0748
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push 0
push 0
lea ecx, [esp + 0x10]
call fcn.00549d20
mov eax, dword [esp + 0x2c]
push 0xc
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
call fcn.00549da0
lea ecx, [esp + 4]
push 7
push ecx
lea ecx, [esp + 0x10]
call fcn.00549de0
fild dword [esp + 4]
lea edx, [esp + 4]
push 7
push edx
lea ecx, [esp + 0x10]
fsub dword [0x5a9bc8]
fmul dword [0x5a83e8]
fadd dword [esi + 0x24]
fst dword [esi + 0x24]
fstp dword [esi]
call fcn.00549de0
fild dword [esp + 4]
lea eax, [esp + 4]
push 7
push eax
lea ecx, [esp + 0x10]
fsub dword [0x5a9bc8]
fmul dword [0x5a83e8]
fadd dword [esi + 0x28]
fst dword [esi + 0x28]
fstp dword [esi + 4]
call fcn.00549de0
fild dword [esp + 4]
lea ecx, [esp + 4]
push 7
push ecx
lea ecx, [esp + 0x10]
fsub dword [0x5a9bc8]
fmul dword [0x5a83e8]
fadd dword [esi + 0x2c]
fst dword [esi + 0x2c]
fstp dword [esi + 8]
call fcn.00549de0
fild dword [esp + 4]
lea edx, [esp + 4]
push 0xc
push edx
lea ecx, [esp + 0x10]
fmul dword [0x5a9bc4]
mov dword [esi + 0x14], 0
fld st(0)
fcos
fstp dword [esi + 0xc]
fsin
fstp dword [esi + 0x10]
call fcn.00549de0
fild dword [esp + 4]
lea eax, [esp + 4]
push 0xc
push eax
lea ecx, [esp + 0x10]
fsub dword [0x5a9bc0]
fmul dword [0x5a8fac]
fstp dword [esi + 0x30]
call fcn.00549de0
fild dword [esp + 4]
fsub dword [0x5a9bc0]
fmul dword [0x5a8fac]
lea ecx, [esp + 4]
push 0xc
push ecx
lea ecx, [esp + 0x10]
fstp dword [esi + 0x34]
call fcn.00549de0
fild dword [esp + 4]
lea edx, [esp + 4]
push 0x10
push edx
lea ecx, [esp + 0x10]
fsub dword [0x5a9bc0]
fmul dword [0x5a8fac]
fstp dword [esi + 0x38]
call fcn.00549de0
mov eax, dword [esp + 4]
lea ecx, [esp + 4]
push 0x10
push ecx
lea ecx, [esp + 0x10]
mov dword [esi + 0x3c], eax
call fcn.00549de0
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
mov dword [esi + 0x40], edx
mov dword [esp + 0x24], 0xffffffff
call fcn.00549d80
mov ecx, dword [esp + 0x1c]
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x4b4268
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a0768
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push 0
push 0
lea ecx, [esp + 0x10]
call fcn.00549d20
mov eax, dword [esp + 0x2c]
push 0xe
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
call fcn.00549da0
lea ecx, [esp + 4]
push 0xe
push ecx
lea ecx, [esp + 0x10]
call fcn.00549de0
fild dword [esp + 4]
lea edx, [esp + 4]
push 0xe
push edx
lea ecx, [esp + 0x10]
fsub dword [0x5a9bbc]
fmul dword [0x5a83e8]
fst dword [esi]
fstp dword [esi + 0x24]
call fcn.00549de0
fild dword [esp + 4]
lea eax, [esp + 4]
push 0xc
push eax
lea ecx, [esp + 0x10]
fsub dword [0x5a9bbc]
fmul dword [0x5a83e8]
fst dword [esi + 4]
fstp dword [esi + 0x28]
call fcn.00549de0
fild dword [esp + 4]
lea ecx, [esp + 4]
push 6
push ecx
lea ecx, [esp + 0x10]
fsub dword [0x5a9bb8]
fmul dword [0x5a83e8]
fst dword [esi + 8]
fstp dword [esi + 0x2c]
call fcn.00549de0
fild dword [esp + 4]
lea edx, [esp + 4]
push 0xb
push edx
lea ecx, [esp + 0x10]
fmul dword [0x5a83ec]
mov dword [esi + 0x14], 0
fld st(0)
fcos
fstp dword [esi + 0xc]
fsin
fstp dword [esi + 0x10]
call fcn.00549de0
fild dword [esp + 4]
lea eax, [esp + 4]
push 0xb
push eax
lea ecx, [esp + 0x10]
fsub dword [0x5a9bb4]
fmul dword [0x5a9bb0]
fstp dword [esi + 0x30]
call fcn.00549de0
fild dword [esp + 4]
push 0xb
fsub dword [0x5a9bb4]
fmul dword [0x5a9bb0]
fstp dword [esi + 0x34]
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x10]
call fcn.00549de0
fild dword [esp + 4]
lea edx, [esp + 4]
push 0x10
push edx
lea ecx, [esp + 0x10]
fsub dword [0x5a9bb4]
fmul dword [0x5a9bb0]
fstp dword [esi + 0x38]
call fcn.00549de0
mov eax, dword [esp + 4]
lea ecx, [esp + 4]
push 0x10
push ecx
lea ecx, [esp + 0x10]
mov dword [esi + 0x3c], eax
call fcn.00549de0
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
mov dword [esi + 0x40], edx
mov dword [esp + 0x24], 0xffffffff
call fcn.00549d80
mov ecx, dword [esp + 0x1c]
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x4beeb0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5a1229
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004a9010
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
push 0x4c3b40
push 0x4bf040
push 0x64
lea eax, [esi + 0x24]
push 0xc
push eax
mov byte [esp + 0x30], 1
call fcn.0050ac41
mov dword [esi + 0x4fc], edi
mov dword [esi + 0x500], edi
mov dword [esi + 0x504], edi
lea ebx, [esi + 0x50c]
push 8
mov byte [esp + 0x20], 3
mov dword [esp + 0x14], ebx
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
call fcn.00402bf0
mov dword [ebx], eax
mov dword [ebx + 4], eax
add eax, 8
add esp, 4
mov dword [ebx + 8], eax
mov ecx, ebx
mov byte [esp + 0x1c], 6
call fcn.00402a70
mov dword [esi + 0x518], edi
mov dword [esi + 0x51c], edi
mov dword [esi + 0x520], edi
lea ecx, [esi + 0x524]
mov byte [esp + 0x1c], 8
call fcn.004f88c0
mov dword [esi], 0x5aa5f4
mov byte [esp + 0x1c], 9
mov dword [0x66629c], esi
call fcn.004e84f0
mov eax, 5
push str.Level
mov dword [esi + 0x570], edi
mov dword [esi + 0x574], edi
mov dword [esi + 0x578], eax
mov dword [esi + 0x57c], 0xf
mov dword [esi + 0x580], eax
mov dword [esi + 0x584], edi
mov dword [esi + 0x58c], edi
mov dword [esi + 0x598], edi
mov dword [esi + 0x590], edi
mov dword [esi + 0x4e4], edi
mov dword [esi + 0x4e0], edi
mov dword [esi + 0x4dc], edi
mov dword [esi + 0x4f0], edi
mov dword [esi + 0x4ec], edi
mov dword [esi + 0x4e8], edi
mov dword [esi + 0x4d8], edi
mov dword [esi + 0x4d4], edi
call fcn.004faf80
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4c8730
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5a17bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x14], esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esp + 0x28], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
lea ecx, [esi + 0x58]
mov byte [esp + 0x28], 4
call fcn.005498c0
lea edi, [esi + 0xa0]
push 8
mov ecx, edi
mov dword [esp + 0x1c], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.004608a0
mov ecx, edi
mov byte [esp + 0x28], 5
call fcn.00402a70
lea ebp, [edi + 0xc]
lea eax, [esp + 0x10]
push 8
push eax
mov ecx, ebp
mov byte [esp + 0x30], 6
mov dword [esp + 0x24], ebp
call fcn.00402b70
mov ecx, ebp
mov byte [esp + 0x28], 7
call fcn.00402a70
lea ecx, [esp + 0x11]
lea ebp, [edi + 0x18]
push 8
push ecx
mov ecx, ebp
mov byte [esp + 0x30], 8
mov dword [esp + 0x24], ebp
call fcn.00402b70
mov ecx, ebp
mov byte [esp + 0x28], 9
call fcn.00402a70
lea edx, [esp + 0x12]
lea eax, [esp + 0x13]
push edx
lea ecx, [edi + 0x58]
push eax
mov byte [esp + 0x30], 0xa
call fcn.004c9aa0
mov dword [edi + 0x38], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x50], 0x64
mov dword [edi + 0x2c], 2
mov dword [edi + 0x30], 0x12c
mov dword [edi + 0x34], 3
mov ecx, esi
mov byte [esp + 0x28], 0xb
mov dword [esi], 0x5aa660
call fcn.004c8a40
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4cabc0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5a195b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call fcn.00502d60
xor ebx, ebx
lea ecx, [esi + 0xf0]
mov dword [esp + 0x28], ebx
call fcn.005498c0
lea ecx, [esi + 0x138]
call fcn.005498c0
lea ecx, [esi + 0x180]
call fcn.005498c0
lea ecx, [esi + 0x1c8]
call fcn.005498c0
lea ecx, [esi + 0x210]
call fcn.005498c0
lea ecx, [esi + 0x258]
call fcn.005498c0
lea ecx, [esi + 0x2a0]
call fcn.005498c0
lea edi, [esi + 0x2e8]
push 8
mov ecx, edi
mov dword [esp + 0x1c], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.004608a0
mov ecx, edi
mov byte [esp + 0x28], 1
call fcn.00402a70
lea edi, [esi + 0x2f4]
push 8
mov ecx, edi
mov byte [esp + 0x2c], 2
mov dword [esp + 0x1c], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.004608a0
mov ecx, edi
mov byte [esp + 0x28], 3
call fcn.00402a70
lea ecx, [esi + 0x300]
mov byte [esp + 0x28], 4
call fcn.005498c0
lea edi, [esi + 0x3d4]
push 0x18
mov dword [esp + 0x1c], edi
mov dword [edi + 4], ebx
call fcn.00402bf0
mov cl, byte [esp + 0x17]
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov byte [edi + 0xc], cl
mov byte [eax], bl
mov edx, dword [edi + 4]
mov dword [edx + 4], ebx
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov eax, dword [edi + 4]
mov dword [eax + 0xc], eax
lea ebp, [edi + 0x10]
push 0x18
mov byte [esp + 0x30], 5
mov dword [esp + 0x24], ebp
mov dword [ebp], ebx
call fcn.00402bf0
add esp, 8
mov dword [ebp], eax
mov byte [esp + 0x28], 6
mov al, byte [esp + 0x13]
mov ecx, ebp
mov dword [ebp + 4], ebx
mov byte [ebp + 8], al
call fcn.004b4a30
lea ebp, [edi + 0x1c]
mov byte [esp + 0x28], 7
lea ecx, [ebp + 8]
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
call fcn.00502310
lea ecx, [ebp + 0x18]
call fcn.00502310
push ebx
mov ecx, ebp
call fcn.004d21d0
mov ecx, edi
mov byte [esp + 0x28], 8
mov dword [edi], 0x5aa88c
call fcn.004d0e00
mov ecx, esi
mov byte [esp + 0x28], 9
mov dword [esi], 0x5aa6a8
call fcn.004cafa0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret