joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x30]
push edi
xor ebx, ebx
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esi + 0x78]
mov dword [esp + 0x10], ebx
push eax
push ebp
call fcn.00435a60
add esp, 8
cmp eax, ebx
mov dword [esp + 0x34], eax
je 0x43a113
push 0x80000
call fcn.004df770
add esp, 4
cmp eax, ebx
mov dword [esp + 0x10], eax
je 0x43a113
mov edi, dword [esi + 0x20]
mov esi, dword [esi + 0x24]
cmp esi, ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
jl 0x43a10b
jg 0x43a007
cmp edi, ebx
jbe 0x43a10b
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00425fa0
add esp, 4
test eax, eax
je 0x43a113
mov eax, dword [0x7f2fa4]
test eax, eax
jne 0x43a113
test esi, esi
jl 0x43a03e
jg 0x43a037
cmp edi, 0x80000
jbe 0x43a03e
mov ebx, 0x80000
jmp 0x43a040
mov ebx, edi
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
push ebx
push edx
mov edx, dword [esp + 0x3c]
push eax
push ecx
push edx
push ebp
call fcn.004358b0
add esp, 0x18
test eax, eax
je 0x43a113
mov eax, dword [ebp + 0x3ca8]
test eax, eax
je 0x43a0a4
mov edi, dword [ebp + 0x3cac]
mov esi, dword [esp + 0x10]
mov ecx, ebx
add edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0x3cac]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
add eax, ebx
mov dword [ebp + 0x3cac], eax
jmp 0x43a0c3
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x3c]
push ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
push edx
call fcn.004dfb90
add esp, 0x14
test eax, eax
je 0x43a14e
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x43a0d6
mov eax, ebx
cdq
push edx
push eax
call dword [ecx + 4]
add esp, 8
mov eax, ebx
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
cdq
sub edi, eax
sbb esi, edx
add ebx, eax
adc ecx, edx
mov dword [esp + 0x20], edi
test esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ecx
jg 0x43a007
jl 0x43a10b
test edi, edi
ja 0x43a007
mov dword [esp + 0x14], 1
cmp dword [0x7f2fa4], 1
jne 0x43a124
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
push eax
call fcn.004df7a0
mov eax, dword [esp + 0x38]
add esp, 4
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
je 0x43a146
push eax
call fcn.00437060
add esp, 4
mov eax, dword [esp + 4]
add esp, 0x18
ret
mov eax, dword [0x7f2fa4]
test eax, eax
je 0x43a124
mov dword [0x7f2fa4], 3
jmp 0x43a124
Function at 0x4411b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x820
push ebx
push ebp
push esi
mov esi, dword [esp + 0x838]
push edi
mov edi, dword [esp + 0x838]
xor ebp, ebp
lea ecx, [esp + 0x30]
mov eax, dword [edi + 0x3918]
mov dword [0x71db34], ebp
mov edx, dword [esi + 0x78]
push ecx
push edx
push eax
push edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x20], ebp
call fcn.004410f0
mov eax, dword [0x71db34]
add esp, 0x10
cmp eax, ebp
jne 0x441398
push 0x80000
call fcn.004df770
add esp, 4
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x441398
mov ebx, dword [esi + 0x20]
mov esi, dword [esi + 0x24]
cmp esi, ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
jl 0x441390
jg 0x441251
cmp ebx, ebp
jbe 0x441390
jmp 0x441251
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x834]
push eax
call fcn.00425fa0
add esp, 4
test eax, eax
je 0x441398
mov eax, dword [0x7f2fa4]
test eax, eax
jne 0x441398
test esi, esi
jl 0x44128f
jg 0x441284
cmp ebx, 0x80000
jbe 0x44128f
mov esi, 0x80000
mov dword [esp + 0x20], esi
jmp 0x441295
mov dword [esp + 0x20], ebx
mov esi, ebx
mov ecx, dword [esp + 0x10]
mov eax, esi
cdq
mov ebp, edx
mov edx, dword [esp + 0x28]
mov ebx, eax
mov eax, dword [esp + 0x24]
push ecx
push ebp
push ebx
push edx
mov edx, dword [esp + 0x3c]
push eax
push 0
lea ecx, [esp + 0x48]
push 0
push ecx
push edx
push edi
call fcn.00440c20
add esp, 0x28
test edx, edx
jl 0x441398
jg 0x4412d6
test eax, eax
jb 0x441398
test edi, edi
je 0x44131d
mov eax, dword [edi + 0x3ca8]
test eax, eax
je 0x44131d
mov edi, dword [edi + 0x3cac]
mov ecx, esi
mov esi, dword [esp + 0x10]
add edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x838]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov edx, dword [eax + 0x3cac]
add edx, ecx
mov edi, eax
mov dword [eax + 0x3cac], edx
jmp 0x44133f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x844]
push esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push edx
push eax
call fcn.004dfb90
add esp, 0x14
test eax, eax
je 0x4413c5
mov eax, dword [esp + 0x834]
test eax, eax
je 0x441352
push ebp
push ebx
call dword [eax + 4]
add esp, 8
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
sub edx, ebx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x28]
sbb eax, ebp
add esi, ebx
adc edx, ebp
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edx
jg 0x441249
jl 0x441390
mov eax, dword [esp + 0x14]
test eax, eax
ja 0x441249
mov dword [esp + 0x1c], 1
cmp dword [0x7f2fa4], 1
jne 0x4413a9
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004df7a0
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x820
ret
mov eax, dword [0x7f2fa4]
test eax, eax
je 0x4413a9
mov dword [0x7f2fa4], 3
jmp 0x4413a9
Function at 0x442910
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
mov edx, 0x71db38
test cl, 1
mov eax, ecx
je 0x442927
shr eax, 1
xor eax, 0x82f63b78
jmp 0x442929
shr eax, 1
test al, 1
je 0x442936
shr eax, 1
xor eax, 0x82f63b78
jmp 0x442938
shr eax, 1
test al, 1
je 0x442945
shr eax, 1
xor eax, 0x82f63b78
jmp 0x442947
shr eax, 1
test al, 1
je 0x442954
shr eax, 1
xor eax, 0x82f63b78
jmp 0x442956
shr eax, 1
test al, 1
je 0x442963
shr eax, 1
xor eax, 0x82f63b78
jmp 0x442965
shr eax, 1
test al, 1
je 0x442972
shr eax, 1
xor eax, 0x82f63b78
jmp 0x442974
shr eax, 1
test al, 1
je 0x442981
shr eax, 1
xor eax, 0x82f63b78
jmp 0x442983
shr eax, 1
test al, 1
je 0x442990
shr eax, 1
xor eax, 0x82f63b78
jmp 0x442992
shr eax, 1
mov dword [edx], eax
add edx, 4
inc ecx
cmp edx, 0x71df38
jl 0x442917
push esi
push edi
mov esi, 0x71df38
mov eax, dword [esi - 0x400]
mov ecx, esi
mov edx, 7
mov edi, eax
add ecx, 0x400
and edi, 0xff
shr eax, 8
mov edi, dword [edi*4 + 0x71db38]
xor eax, edi
dec edx
mov dword [ecx - 0x400], eax
jne 0x4429b8
add esi, 4
cmp esi, 0x71e338
jl 0x4429ab
pop edi
pop esi
ret
Function at 0x4429f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test ebp, ebp
not edi
je 0x442a51
test bl, 7
je 0x442a4d
mov eax, edi
xor ecx, ecx
mov cl, byte [ebx]
and eax, 0xff
xor eax, ecx
mov ecx, 8
mov edx, dword [eax*4 + 0x71db38]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov eax, edi
mov edx, esi
call fcn.00526f40
mov ecx, dword [esp + 0x1c]
xor ecx, eax
mov eax, dword [esp + 0x18]
xor eax, edx
inc ebx
dec ebp
mov edi, ecx
mov esi, eax
jne 0x442a08
mov dword [esp + 0x1c], ebp
cmp ebp, 8
jb 0x442b30
shr ebp, 3
mov dword [esp + 0x18], ebp
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
xor esi, edx
xor edi, ecx
mov eax, esi
mov ecx, esi
shr eax, 0x10
shr ecx, 8
and eax, 0xff
and ecx, 0xff
mov ebp, dword [eax*4 + 0x71df38]
mov edx, dword [ecx*4 + 0x71e338]
xor ebp, edx
mov edx, esi
and edx, 0xff
mov ecx, 0x18
mov eax, dword [edx*4 + 0x71e738]
mov edx, esi
xor ebp, eax
mov eax, edi
call fcn.00526f40
and eax, 0xff
mov edx, esi
mov ecx, dword [eax*4 + 0x71eb38]
mov eax, edi
xor ebp, ecx
mov ecx, 0x10
call fcn.00526f40
and eax, 0xff
mov edx, esi
mov ecx, dword [eax*4 + 0x71ef38]
mov eax, edi
xor ebp, ecx
mov ecx, 8
call fcn.00526f40
and eax, 0xff
and edi, 0xff
shr esi, 0x18
mov ecx, dword [eax*4 + 0x71f338]
mov eax, dword [esp + 0x18]
xor ebp, ecx
mov ecx, dword [esi*4 + 0x71db38]
mov esi, dword [edi*4 + 0x71f738]
xor ebp, ecx
xor ebp, esi
xor esi, esi
mov edi, ebp
mov ebp, dword [esp + 0x1c]
add ebx, 8
sub ebp, 8
dec eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], eax
jne 0x442a61
test ebp, ebp
je 0x442b74
mov eax, edi
xor ecx, ecx
mov cl, byte [ebx]
and eax, 0xff
xor eax, ecx
mov ecx, 8
mov edx, dword [eax*4 + 0x71db38]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov eax, edi
mov edx, esi
call fcn.00526f40
mov ecx, dword [esp + 0x1c]
xor ecx, eax
mov eax, dword [esp + 0x18]
xor eax, edx
inc ebx
dec ebp
mov edi, ecx
mov esi, eax
jne 0x442b34
mov eax, edi
pop edi
pop esi
pop ebp
not eax
pop ebx
ret
Function at 0x443dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0x40]
xor edx, edx
mov ecx, esi
push edi
mov edi, dword [eax + 0x3930]
add ecx, ebp
adc edx, ebx
push 0
push 0x200
push edx
push ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], 0
call fcn.00526dd0
cmp edx, dword [edi + 0x14]
ja 0x443fa9
jb 0x443e23
cmp eax, dword [edi + 0x10]
ja 0x443fa9
test esi, esi
jbe 0x443fa9
jmp 0x443e35
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x34]
push eax
mov eax, dword [esp + 0x3c]
push ecx
push edx
push eax
push edi
call fcn.00443fd0
add esp, 0x14
cmp eax, 0xffffffff
je 0x443fa9
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x443fa9
mov edi, dword [ebx + 0x50]
mov ecx, dword [ebx + 0x48]
mov eax, dword [ebx + 0x4c]
mov edx, dword [esp + 0x1c]
xor ebp, ebp
add edi, ecx
mov ecx, dword [ebx + 0x54]
adc ecx, eax
mov eax, dword [esp + 0x18]
sub edi, eax
sbb ecx, edx
cmp ebp, ecx
jb 0x443e96
ja 0x443e92
cmp esi, edi
jbe 0x443e96
mov esi, edi
mov ebp, ecx
mov ecx, dword [ebx + 0x74]
dec ecx
cmp ecx, 3
ja case.default.0x443ea3
jmp dword [ecx*4 + 0x443fb8]
lea ecx, [esp + 0x20]
push ecx
push edx
mov edx, dword [esp + 0x1c]
push eax
push ebx
mov eax, dword [edx + 0x18]
push eax
call fcn.00444050
add esp, 0x14
cmp eax, 0xffffffff
je 0x443fa9
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [eax + 0x1c]
mov edi, dword [eax + 0x18]
push ebx
push edi
push ecx
push edx
call fcn.005271b0
sub edi, eax
sbb ebx, edx
cmp ebp, ebx
jb 0x443efa
ja 0x443ef4
cmp esi, edi
jbe 0x443efa
mov esi, edi
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, eax
or ecx, edx
mov ecx, esi
je 0x443f52
shl ecx, 9
push ecx
mov ecx, 9
call fcn.00526fd0
push edx
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x40]
push edx
mov ecx, dword [eax]
push ecx
call fcn.004dfa70
add esp, 0x14
test eax, eax
je 0x443fa9
jmp case.default.0x443ea3
mov ecx, esi
shl ecx, 9
push ecx
mov ecx, 9
call fcn.00526fd0
push edx
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [ebx]
push edx
push eax
jmp 0x443f26
mov ecx, esi
mov edi, dword [esp + 0x40]
xor eax, eax
shl ecx, 9
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov edx, dword [esp + 0x10]
sub eax, esi
add ecx, esi
mov dword [esp + 0x44], eax
mov dword [esp + 0x38], ecx
mov ecx, esi
adc ebp, 0
add edx, esi
shl ecx, 9
add edi, ecx
mov dword [esp + 0x3c], ebp
test eax, eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x10], edx
ja 0x443e2d
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x44a550
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
ret
Function at 0x44d5a0
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [esp + 4]
push ebx
push esi
push edi
mov eax, dword [edx + 0x7a]
mov edi, dword [esp + 0x14]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
mov esi, eax
mov ecx, eax
and esi, 0xff0000
shr ecx, 0x10
or esi, ecx
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
shr esi, 8
shl ecx, 8
or esi, ecx
mov ecx, dword [edi]
mov eax, ecx
mov ebx, ecx
and eax, 0xff0000
shr ebx, 0x10
or eax, ebx
mov ebx, ecx
shl ebx, 0x10
and ecx, 0xff00
or ebx, ecx
mov ecx, dword [edx + 0x76]
shr eax, 8
shl ebx, 8
or eax, ebx
mov ebx, dword [ecx*4 + str.BTBACTBAPAMBTBAI]
cmp eax, ebx
je 0x44d615
cmp eax, 0x49414233
jne 0x44d6b8
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 4]
mov ch, al
shr eax, 8
or ecx, eax
mov eax, dword [esp + 0x18]
cmp ecx, eax
jne 0x44d6b8
mov ecx, dword [edx + 8]
xor ebx, ebx
mov bx, word [edi + 6]
push eax
push edx
call dword [ecx + 0x10]
xor edx, edx
add esp, 8
mov dh, bl
shr ebx, 8
or edx, ebx
cmp edx, eax
jg 0x44d6b8
mov ecx, dword [edi + 8]
mov eax, ecx
mov edx, ecx
and eax, 0xff0000
mov ebx, ecx
shr edx, 0x10
or eax, edx
mov edx, ecx
shl edx, 0x10
and ebx, 0xff00
or edx, ebx
shr eax, 8
shl edx, 8
or eax, edx
cmp eax, 0xffffffff
je 0x44d67f
cmp eax, esi
jae 0x44d6b8
test ecx, ecx
je 0x44d6b8
mov ecx, dword [edi + 0xc]
mov eax, ecx
mov edx, ecx
and eax, 0xff0000
mov edi, ecx
shr edx, 0x10
or eax, edx
mov edx, ecx
shl edx, 0x10
and edi, 0xff00
or edx, edi
shr eax, 8
shl edx, 8
or eax, edx
cmp eax, 0xffffffff
je 0x44d6b4
cmp eax, esi
jae 0x44d6b8
test ecx, ecx
jne 0x44d6c1
pop edi
pop esi
mov eax, 0xffffffee
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x453730
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
mov ecx, dword [esp + 0x28]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
xor eax, eax
xor ebx, ebx
xor ebp, ebp
xor edi, edi
cmp ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
jbe 0x45382a
mov dword [esp + 0x34], eax
jmp 0x453777
xor eax, eax
push eax
push edi
push eax
push esi
call fcn.0044b330
add esp, 0x10
test eax, eax
jne 0x453878
push edi
push eax
push esi
call fcn.0044fa50
add esp, 0xc
test eax, eax
jne 0x453878
mov eax, dword [esi + 0x144]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x10]
add eax, ecx
mov ecx, dword [eax + 0x16]
add edx, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x14]
adc edx, 0
mov dword [esp + 0x14], edx
mov edx, dword [eax + 0x1a]
add ecx, edx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x1c]
adc ecx, 0
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 0xa]
add edx, ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x2c]
adc edx, 0
mov dword [esp + 0x2c], edx
mov edx, dword [eax + 6]
mov eax, dword [eax + 0x12]
add ecx, edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x34]
adc edx, 0
add ebx, eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x24], edx
adc ebp, 0
inc edi
add ecx, 0x26
cmp edi, eax
mov dword [esp + 0x34], ecx
jb 0x453775
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x20]
mov dword [esi + 0x8c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x90], edx
mov edx, dword [esp + 0x24]
mov dword [esi + 0x84], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x88], ecx
mov ecx, dword [esp + 0x28]
add ebx, edi
adc ebp, edx
add ebx, ecx
adc ebp, eax
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebp
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x4563c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55eb90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x2c]
push ecx
lea eax, [esp + 0x34]
push edx
lea ecx, [esp + 0x3c]
push eax
lea edx, [esp + 0x44]
push ecx
push edx
push 0
mov dword [esp + 0x60], 1
or edi, 0xffffffff
call fcn.0047b650
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
add esp, 0x28
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x40]
push eax
mov eax, dword [0x720bd4]
push ecx
push edx
push 0x1a
push ecx
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.005442c4
call fcn.004ded90
mov esi, eax
add esp, 0x2c
test esi, esi
je 0x4564d0
mov eax, dword [0x720bc8]
mov dword [0x70485c], esi
test eax, eax
je 0x456488
mov ecx, dword [esp + 0x50]
push ecx
push esi
call fcn.0049a3a0
add esp, 8
mov eax, dword [0x75e25c]
test eax, eax
je 0x4564aa
call fcn.004e34f0
mov eax, dword [0x75e25c]
test eax, eax
je 0x4564aa
mov edx, dword [0x720bd0]
push 0
push edx
jmp 0x4564b2
mov eax, dword [0x720bd0]
push 1
push eax
push esi
call fcn.00460cf0
add esp, 0xc
mov edi, eax
mov dword [0x70485c], 0
push esi
call fcn.0041c310
add esp, 4
lea ecx, [esp + 0x40]
mov byte [esp + 0x38], 0
call fcn.00544250
lea ecx, [esp + 0x44]
mov dword [esp + 0x38], 0xffffffff
call fcn.00544250
mov ecx, dword [esp + 0x30]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x34
ret
Function at 0x45d210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55f1bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebp
push esi
push edi
xor ebp, ebp
mov esi, 1
mov edi, ecx
mov word [esp + 0x20], 0xf
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x30], esi
mov dword [esp + 0xc], ebp
call fcn.0041ce10
test eax, eax
jne 0x45d3d8
push 0x99
call fcn.0043a730
add esp, 4
test eax, eax
je 0x45d3d8
push ebx
push 0x10
call fcn.00548c73
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebp
mov dword [esp + 0x40], ebp
je 0x45d297
mov ecx, eax
call fcn.0055cdbd
mov ebx, eax
jmp 0x45d299
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x40], 0xffffffff
call fcn.0054539e
call fcn.004dd790
mov ecx, edi
call fcn.0047e420
cmp eax, esi
jne 0x45d2da
mov eax, dword [0x75e0b4]
mov eax, dword [eax + 0x30f4]
mov ecx, dword [eax + 0xd0]
cmp ecx, ebp
je 0x45d2da
push ecx
lea ecx, [eax + 0x7c]
call fcn.0054241f
mov esi, eax
jmp 0x45d2f0
mov ecx, edi
call fcn.0047e420
cmp eax, 2
jne 0x45d2f4
mov esi, dword [0x720c64]
cmp esi, ebp
je 0x45d2f4
cmp esi, ebp
jne 0x45d2fa
mov esi, dword [0x75e0b0]
mov ecx, ebx
call fcn.0055ce8f
test eax, eax
je 0x45d389
push ebp
push 0xf
mov ecx, ebx
call fcn.0055ce51
test eax, eax
je 0x45d389
lea ecx, [esp + 0x24]
lea edx, [esp + 0x18]
push ecx
push edx
push 0xf
mov ecx, ebx
mov dword [0x75e12c], 1
call fcn.0055ce11
test eax, eax
je 0x45d367
mov eax, dword [esp + 0x1c]
mov ecx, edi
push eax
mov dword [0x720c18], esi
call fcn.0045ccf0
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x45d35a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45d383
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x45d383
cmp dword [0x75e12c], 0xa
jne 0x45d383
push 0xffffffffffffffff
push esi
push ebp
mov ecx, edi
mov dword [esp + 0x1c], 1
call fcn.0045d850
mov dword [0x75e12c], ebp
cmp ebx, ebp
je 0x45d39d
mov ecx, ebx
call fcn.0055cdea
push ebx
call fcn.00548c9c
add esp, 4
mov eax, dword [esp + 0x10]
pop ebx
cmp eax, ebp
je 0x45d3c0
mov eax, dword [0x75e124]
cmp eax, ebp
je 0x45d3c0
lea ecx, [eax + 0x50]
call fcn.004dffe0
test eax, eax
jne 0x45d3c0
call fcn.00489e40
mov eax, dword [0x75e0b4]
mov ecx, dword [eax + 0x30f4]
mov dword [ecx + 0xd0], ebp
mov ecx, edi
call fcn.005453b3
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x461e60
Capabilities:
Terminate process

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x44]
push eax
lea edx, [esp + 0x4c]
push ecx
push edx
push 0
mov dword [esp + 0x5c], 0xffffffff
call fcn.0047b650
call fcn.004dd790
mov edi, dword [esp + 0x64]
mov esi, dword [0x70480c]
push 0x200
push edi
push 0x7f2900
call fcn.00527768
mov eax, dword [esi + 0x14]
mov dword [esi + 0x18], 0
push eax
call fcn.004df7b0
push edi
call fcn.004dde60
add esp, 0x3c
mov dword [esi + 0x14], eax
test eax, eax
push edi
jne 0x461f03
call fcn.004dcf00
push edi
call fcn.004dde50
add esp, 8
mov dword [esi + 0x14], eax
test eax, eax
jne 0x462021
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004dde20
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
jne 0x461f2a
push edi
mov dword [0x7f2fa4], 2
call fcn.004dcf00
add esp, 4
jmp 0x462021
mov al, byte [esi + 0x2bc]
mov ecx, dword [esi + 0x29c]
test al, al
mov dword [esi + 0x28c], ecx
je 0x461f4a
mov dword [esi + 0x28c], 1
mov edx, dword [esi + 0xc]
push edx
call fcn.004df7a0
push edi
call fcn.00526b7f
mov ebx, dword [esi + 0x12e0]
add esp, 8
cmp ebx, 0xffffffff
mov dword [esi + 0xc], eax
je 0x461fbc
lea ebp, [esi + 0x2d8]
push 1
push ebp
push esi
call fcn.00418910
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
mov eax, ebx
push edx
push 1
cdq
push ebp
push edx
push eax
push esi
call fcn.0041e720
add esp, 0x44
cmp eax, 1
jne 0x462021
mov ebx, dword [esi + 0x12e4]
cmp ebx, 0xffffffff
je 0x462019
lea ebp, [esi + 0xad8]
push 1
push ebp
push esi
call fcn.00418bd0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
mov eax, ebx
push edx
push 1
cdq
push ebp
push edx
push eax
push esi
call fcn.0041e720
add esp, 0x44
cmp eax, 1
jne 0x462021
mov dword [esp + 0x34], 0
mov eax, dword [esi + 0x14]
push eax
call fcn.004df7b0
mov ecx, dword [esi + 0x18]
push ecx
call fcn.004df7b0
push edi
mov dword [esi + 0x18], 0
call fcn.004dde50
add esp, 0xc
mov dword [esi + 0x14], eax
test eax, eax
jne 0x46205b
push edi
call fcn.004dcf00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x465770
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x720ec8]
push esi
mov esi, dword [0x703424]
push 0x64
mov ecx, dword [eax + 0x88]
push 0
push 0x406
push ecx
call esi
mov edx, dword [0x720ec8]
push 0
push 0
push 0x402
mov eax, dword [edx + 0x88]
push eax
call esi
mov ecx, dword [0x720ec8]
push 1
call fcn.0046a4b0
mov eax, dword [0x720ec8]
mov ecx, dword [eax + 0x11d8]
add eax, 0x1200
mov dword [0x720e34], ecx
mov edx, dword [eax - 0x20]
push eax
mov ecx, 0x720e30
mov dword [0x7045a4], edx
call fcn.00544397
mov eax, dword [0x720ec8]
mov ecx, 0x720e2c
add eax, 0x11d4
push eax
call fcn.00544397
mov eax, dword [0x720ec8]
mov ecx, dword [eax + 0x1c]
add eax, 0x11fc
mov dword [0x75e0b8], ecx
push eax
mov ecx, 0x720e28
call fcn.00544397
lea edx, [esp + 4]
push edx
push 0
push 0
push 0x464bb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
pop esi
jne 0x46583a
mov ecx, dword [0x720ec8]
push eax
call fcn.0046a4b0
pop ecx
ret