joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48cc00
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x582456
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xcc
push ebx
mov ebx, dword [esp + 0xe8]
push ebp
push esi
mov esi, dword [esp + 0xec]
push edi
mov edi, dword [esp + 0xec]
push 0
push ebx
push esi
lea eax, [esp + 0x34]
push edi
mov ebp, ecx
push eax
call fcn.0048c7a0
mov eax, dword [eax]
push 0
push 0
push 0xff0000
push 0xe9e9e9
push eax
push 0
push 0
lea ecx, [ebp + 0x77c]
mov dword [esp + 0x100], 0
call fcn.004f2260
lea ecx, [esp + 0x28]
mov dword [esp + 0xe4], 0xffffffff
call 0x5af70c
push 0x5fe7d8
lea ecx, [esp + 0x38]
call 0x5af77a
push ebx
push esi
lea ecx, [esp + 0x30]
push edi
push ecx
mov ecx, ebp
mov dword [esp + 0xf4], 1
call fcn.0048dd60
mov eax, dword [eax]
lea edx, [esp + 0x34]
push edx
push eax
lea ecx, [ebp + 0xc50]
mov byte [esp + 0xec], 2
call 0x5ae2cc
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], eax
mov byte [esp + 0xe4], 1
call 0x5af70c
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, eax
mov dword [ebp + 0x960], eax
je 0x48cd0d
mov ecx, dword [esp + 0x34]
push eax
push eax
push 0xff0000
push 0xffffff
push ecx
push eax
push 1
lea ecx, [ebp + 0x918]
call fcn.004f2260
jmp 0x48cd57
push 1
push ebx
push esi
lea edx, [esp + 0x34]
push edi
push edx
mov ecx, ebp
call fcn.0048c7a0
mov eax, dword [eax]
push 0
push 0
push 0xff0000
push 0xffffff
push eax
push 0
push 1
lea ecx, [ebp + 0x918]
mov byte [esp + 0x100], 3
call fcn.004f2260
lea ecx, [esp + 0x28]
mov byte [esp + 0xe4], 1
call 0x5af70c
mov eax, dword [0x5f9f88]
mov dword [esp + 0x4c], eax
push ebx
push esi
push edi
lea ecx, [esp + 0x58]
push 0x5eb2ec
push ecx
mov byte [esp + 0xf8], 4
call 0x5aaeb4
mov edx, dword [esp + 0x60]
add esp, 0x14
lea esi, [ebp + 0xab4]
push edx
push 0
mov ecx, esi
call fcn.004f1f30
push 0xa
push 4
mov ecx, esi
call fcn.004f1d90
xor edi, edi
push 0
push 0
push 0xff0000
push 0xffffff
push 0x5ea618
push edi
push 0
mov ecx, esi
call fcn.004f2260
push 0
push 0
push 0xff0000
push 0xffffff
push 0x5ea618
push edi
push 1
mov ecx, esi
call fcn.004f2260
push 0
push 0
push 0xff0000
push 0xffffff
push 0x5ea618
push edi
push 2
mov ecx, esi
call fcn.004f2260
push 0
push 0
push 0xff0000
push 0xffffff
push 0x5ea618
push edi
push 3
mov ecx, esi
call fcn.004f2260
inc edi
cmp edi, 0xa
jl 0x48cd9e
mov eax, dword [0x5f9f88]
xor edi, edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x68]
mov byte [esp + 0xe4], 6
call 0x5ad653
lea ecx, [esp + 0x80]
mov byte [esp + 0xe4], 7
call 0x5ad653
lea ecx, [esp + 0x54]
mov byte [esp + 0xe4], 8
call 0x5ad653
lea ecx, [esp + 0x94]
mov byte [esp + 0xe4], 9
call 0x5ad653
lea ecx, [esp + 0xbc]
mov byte [esp + 0xe4], 0xa
call 0x5ad653
lea ecx, [esp + 0xa8]
mov byte [esp + 0xe4], 0xb
call 0x5ad653
mov eax, dword [ebp + 0xc78]
mov byte [esp + 0xe4], 0xc
neg eax
sbb eax, eax
mov dword [esp + 0x3c], edi
test eax, eax
mov dword [esp + 0x7c], eax
je 0x48d144
jmp 0x48cec4
Function at 0x48dd60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58247f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x5f9f88]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
lea ecx, [esp + 0x10]
push 0x5eb620
push ecx
mov dword [esp + 0x28], 1
call 0x5aaeb4
mov esi, dword [esp + 0x30]
add esp, 0x14
lea edx, [esp + 4]
mov ecx, esi
push edx
call 0x5af481
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call 0x5af70c
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10

Function at 0x48ddf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5824c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0x14], esi
push 0x5ea618
push 0x5e6484
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 1
call 0x5aa7fc
push 0x5ea618
push 0x5e8fcc
lea ecx, [esp + 0x34]
call 0x5aa7fc
lea eax, [esp + 0x2c]
lea ecx, [esp + 0xc]
push eax
call 0x5af481
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov ebx, 2
mov eax, dword [ecx - 8]
mov byte [esp + 0x20], bl
cmp eax, edi
jle 0x48defc
push 0x5fe7d8
lea ecx, [esp + 0x10]
call 0x5af895
add edi, 0xfffffffe
cmp edi, esi
jle 0x48deee
mov edx, dword [esp + 0x2c]
mov al, byte [esi + edx]
cmp al, 0xa1
jae 0x48debc
cmp al, 0xd
je 0x48debc
push 1
lea eax, [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0x38]
call 0x5aa982
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 4
call 0x5afb24
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], bl
call 0x5af70c
jmp 0x48dee9
push ebx
lea ecx, [esp + 0x14]
push esi
push ecx
lea ecx, [esp + 0x38]
call 0x5aa982
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call 0x5afb24
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], bl
call 0x5af70c
inc esi
inc esi
cmp esi, edi
jl 0x48de7e
push 0x5eb630
lea ecx, [esp + 0x10]
call 0x5afae8
mov esi, dword [esp + 0x28]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call 0x5af481
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call 0x5af70c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call 0x5af70c
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x48e900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5825a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov dword [esp + 8], 0
mov dword [esp + 0x14], 1
mov eax, dword [0x5f9f88]
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
lea ecx, [esp + 0x1c]
push 0x5eb634
push ecx
mov byte [esp + 0x34], 4
call 0x5aaeb4
mov esi, dword [esp + 0x3c]
add esp, 0x20
lea edx, [esp + 4]
mov ecx, esi
push edx
call 0x5af481
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 3
call 0x5af70c
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call 0x5af70c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x14], 1
call 0x5af70c
lea ecx, [esp + 0x30]
mov byte [esp + 0x14], 0
call 0x5af70c
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x1c

Function at 0x48ebe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5825ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x5f9f88]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
lea ecx, [esp + 0x1c]
push 0x5eb658
push ecx
mov dword [esp + 0x34], 1
call 0x5aaeb4
mov esi, dword [esp + 0x3c]
add esp, 0x20
lea edx, [esp + 4]
mov ecx, esi
push edx
call 0x5af481
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call 0x5af70c
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x1c

Function at 0x4900d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.0058f05e
lea ecx, [esp + 0x8c]
mov dword [esp + 0x78], eax
call fcn.0058f088
lea ecx, [esp + 0x8c]
mov dword [esp + 0x48], eax
call fcn.0058f0b2
mov dword [esp + 0x58], eax
mov dword [esp + 0x98], 0x59a3bc
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa0], ebx
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xa0]
mov byte [esp + 0xc0], 2
call fcn.00492880
mov eax, dword [esi + 0xc78]
neg eax
sbb eax, eax
cmp eax, ebx
mov dword [esp + 0x38], eax
je 0x4905f6
lea edi, [esi + 0xc6c]
mov bl, 0xd
Function at 0x494900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5825a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov dword [esp + 8], 0
mov dword [esp + 0x14], 1
mov eax, dword [0x5f9f88]
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
lea ecx, [esp + 0x1c]
push 0x5eb634
push ecx
mov byte [esp + 0x34], 4
call 0x5b0eb4
mov esi, dword [esp + 0x3c]
add esp, 0x20
lea edx, [esp + 4]
mov ecx, esi
push edx
call 0x5b5481
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 3
call 0x5b570c
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call 0x5b570c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x14], 1
call 0x5b570c
lea ecx, [esp + 0x30]
mov byte [esp + 0x14], 0
call 0x5b570c
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x1c

Function at 0x494be0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5825ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x5f9f88]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
lea ecx, [esp + 0x1c]
push 0x5eb658
push ecx
mov dword [esp + 0x34], 1
call 0x5b0eb4
mov esi, dword [esp + 0x3c]
add esp, 0x20
lea edx, [esp + 4]
mov ecx, esi
push edx
call 0x5b5481
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call 0x5b570c
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x1c
Function at 0x495710
Capabilities:
Get process heap force flags

Disassembly:
mov ecx, dword [esp + 0x20]
mov eax, dword [eax]
push ecx
push eax
mov ecx, ebp
mov byte [esp + 0x198], 0x10
call 0x5b42f2
mov ecx, eax
call 0x5b5895
lea ecx, [esp + 0x14]
mov byte [esp + 0x190], bl
call 0x5b570c
xor edx, edx
xor eax, eax
mov dx, word [esi + 0xcb4]
mov ax, word [esi + 0xcb2]
xor ecx, ecx
push edx
mov cx, word [esi + 0xcb0]
push eax
push ecx
mov ecx, esi
call fcn.00492c00
xor edx, edx
xor eax, eax
mov dx, word [esi + 0xcb2]
mov ax, word [esi + 0xcb0]
push edx
push eax
mov ecx, esi
call fcn.00492690
push 0
push ecx
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call 0x5b5481
push ecx
mov byte [esp + 0x19c], 0x11
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x5e6488
call 0x5b577a
mov ecx, esi
mov byte [esp + 0x19c], bl
call fcn.00494380
push 1
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call 0x5b5481
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
mov byte [esp + 0x1a0], 0x12
call 0x5b5481
push ecx
mov byte [esp + 0x1a0], 0x13
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x5e6488
call 0x5b577a
mov ecx, esi
mov byte [esp + 0x1a0], bl
call fcn.00494230
lea ecx, [esp + 0x20]
mov byte [esp + 0x190], 0xa
call 0x5b570c
lea ecx, [esp + 0x24]
mov byte [esp + 0x190], 7
call 0x5b570c
lea ecx, [esp + 0x184]
mov byte [esp + 0x190], 0x1a
call 0x5b570c
lea ecx, [esp + 0x180]
mov byte [esp + 0x190], 0x19
call 0x5b570c
lea ecx, [esp + 0x17c]
mov byte [esp + 0x190], 0x18
call 0x5b570c
lea ecx, [esp + 0x138]
mov byte [esp + 0x190], 0x17
call 0x5c25c5
lea ecx, [esp + 0xfc]
mov byte [esp + 0x190], 0x16
call 0x5c25c5
lea ecx, [esp + 0xc0]
mov byte [esp + 0x190], 0x15
call 0x5c25c5
lea ecx, [esp + 0xbc]
mov byte [esp + 0x190], 0x14
call 0x5b570c
lea ecx, [esp + 0x54]
mov byte [esp + 0x190], 6
call 0x5b4cd3
lea ecx, [esp + 0x2c]
mov byte [esp + 0x190], 5
call 0x5b570c
lea ecx, [esp + 0x28]
mov byte [esp + 0x190], 4
call 0x5b570c
lea ecx, [esp + 0x10]
mov byte [esp + 0x190], 3
call 0x5b570c
lea ecx, [esp + 0x30]
mov byte [esp + 0x190], 1
call 0x5b570c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x190], 0
call 0x5b570c
lea ecx, [esp + 0x18]
mov dword [esp + 0x190], 0xffffffff
call 0x5b570c
mov ecx, dword [esp + 0x188]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x184
ret
Function at 0x496d90
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x582b20
push eax
mov dword fs:[0], esp
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x7c]
mov dword [esp + 0x14], 3
test eax, eax
je 0x496f41
mov eax, dword [esp + 0x24]
test eax, eax
je 0x496e38
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x134]
call fcn.00498880
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x148]
call fcn.00539340
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x120]
call 0x5b36e6
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0xbc]
call 0x5b36e6
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0xd0]
call 0x5b36e6
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0xe4]
call 0x5b36e6
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0xf8]
call fcn.00539340
mov dword [esi + 0x10c], 0
mov ebp, dword [esi + 0x13c]
lea edi, [esi + 0x134]
push 0xffffffffffffffff
mov ecx, edi
lea eax, [ebp + 1]
push eax
call fcn.00498880
mov ecx, dword [edi + 4]
lea edi, [esi + 0x148]
fld qword [esp + 0x38]
push 0xffffffffffffffff
fstp qword [ecx + ebp*8]
mov ebp, dword [edi + 8]
mov ecx, edi
lea edx, [ebp + 1]
push edx
call fcn.00539340
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x1c]
mov dword [eax + ebp*4], ecx
mov eax, dword [esi + 0x128]
lea ecx, [esi + 0x120]
push edx
push eax
call 0x5b38bb
mov eax, dword [esi + 0xc4]
lea ecx, [esi + 0xbc]
lea edx, [esp + 0x20]
push edx
push eax
call 0x5b38bb
mov eax, dword [esi + 0xd8]
lea ecx, [esi + 0xd0]
lea edx, [esp + 0x2c]
push edx
push eax
call 0x5b38bb
mov eax, dword [esi + 0xec]
lea ecx, [esi + 0xe4]
lea edx, [esp + 0x30]
push edx
push eax
call 0x5b38bb
mov ebp, dword [esi + 0x100]
lea edi, [esi + 0xf8]
push 0xffffffffffffffff
mov ecx, edi
lea eax, [ebp + 1]
push eax
call fcn.00539340
mov ecx, dword [edi + 4]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x34]
test eax, eax
mov dword [ecx + ebp*4], edx
je 0x496f41
lea edi, [esi + 0x60]
mov ecx, edi
call fcn.0054e160
test eax, eax
je 0x496f1b
push 1
mov ecx, edi
call fcn.0054e120
jmp 0x496f22
mov ecx, edi
call fcn.0054e160
push 4
mov ecx, edi
call str.Pj_aR
mov eax, dword [esi + 0x7c]
push 1
push 0
push eax
call dword [0x5977b0]
push 0x40
call dword [0x597680]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 2
call 0x5b570c
lea ecx, [esp + 0x20]
mov byte [esp + 0x14], 1
call 0x5b570c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x14], 0
call 0x5b570c
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], 0xffffffff
call 0x5b570c
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0xc
ret 0x28
Function at 0x4a80d0
Capabilities:
Get number of processors

Disassembly:
mov edx, dword [esi + 0x10]
push edx
call 0x5c1f76
mov esi, eax
lea eax, [esp + 0x14]
push 0xffffcb
push eax
mov ecx, esi
call 0x5c8c0d
test ebp, ebp
jle 0x4a8146
cmp ebp, 0x64
jg 0x4a8146
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
sub eax, ecx
imul eax, ebp
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x18]
fild dword [esp + 0x44]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x30], edx
fmul qword [0x59ac60]
fiadd dword [esp + 0x14]
call 0x5a39ac
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x24]
push 0xffe27a
push eax
mov ecx, esi
call 0x5c8c0d
mov edx, dword [esi]
push 0xff
mov ecx, esi
call dword [edx + 0x30]
push 3
lea eax, [esp + 0x14]
push edi
push eax
mov ecx, ebx
call 0x5b801c
mov eax, dword [eax]
mov edx, dword [esi]
lea edi, [esp + 0x14]
push 0x25
mov ecx, dword [eax - 8]
push edi
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x4c], 0
call dword [edx + 0x68]
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0xffffffff
call 0x5bb70c
mov eax, dword [esp + 0x48]
pop ebp
pop edi
pop esi
mov dword [eax], 4
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 8
Function at 0x4ad570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x583c83
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c8
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x84]
mov esi, dword [0x597058]
push edi
push eax
mov dword [esp + 0x3c], ebx
call esi
cmp eax, 4
jle 0x4ad5d0
mov ecx, dword [ebx + 0x84]
push ecx
call esi
lea esi, [eax - 1]
cmp esi, 3
jle 0x4ad5d0
mov edi, dword [0x597060]
mov edx, dword [ebx + 0x84]
push esi
push edx
call edi
dec esi
cmp esi, 3
jg 0x4ad5c0
lea eax, [ebx + 0x80]
test eax, eax
je 0x4ad5dd
mov eax, dword [eax + 4]
mov esi, dword [0x5977c4]
push eax
mov eax, dword [ebx + 0xb8]
push 1
push 0x1003
push eax
call esi
push eax
call 0x5be7c3
mov ecx, dword [ebx + 0xb8]
push 0
push 0
push 0x1009
push ecx
call esi
lea ecx, [ebx + 0x64]
call 0x5c01ad
push 0xffffffffffffffff
lea ecx, [ebx + 0x88]
push 0
call fcn.00545340
mov eax, dword [ebx + 0x5c]
or edx, 0xffffffff
mov eax, dword [eax + 8]
mov ebp, dword [eax + 4]
cmp ebp, eax
je 0x4adb78
test ebp, ebp
je 0x4adb78

Function at 0x4ad790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb byte [ebx + 0x48b0cc4], al
mov dl, 0x8b
push ebp
or al, 0x8b
dec eax
xor byte [ebx - 0x74ebdbbc], cl
add al, 0x82
Function at 0x4ae0d0
Capabilities:
Get number of processors

Disassembly:
mov edx, dword [esi + 0x10]
push edx
call 0x5c7f76
mov esi, eax
lea eax, [esp + 0x14]
push 0xffffcb
push eax
mov ecx, esi
call 0x5cec0d
test ebp, ebp
jle 0x4ae146
cmp ebp, 0x64
jg 0x4ae146
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
sub eax, ecx
imul eax, ebp
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x18]
fild dword [esp + 0x44]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x30], edx
fmul qword [0x59ac60]
fiadd dword [esp + 0x14]
call 0x5a99ac
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x24]
push 0xffe27a
push eax
mov ecx, esi
call 0x5cec0d
mov edx, dword [esi]
push 0xff
mov ecx, esi
call dword [edx + 0x30]
push 3
lea eax, [esp + 0x14]
push edi
push eax
mov ecx, ebx
call 0x5be01c
mov eax, dword [eax]
mov edx, dword [esi]
lea edi, [esp + 0x14]
push 0x25
mov ecx, dword [eax - 8]
push edi
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x4c], 0
call dword [edx + 0x68]
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0xffffffff
call 0x5c170c
invalid
Function at 0x4ae8b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x583f10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov esi, ecx
call 0x5c131a
mov eax, dword [esi + 0x84]
mov ecx, esi
push eax
call 0x5c4f5f
mov eax, dword [esi + 0x3c4]
mov edi, dword [0x5977c4]
xor ebp, ebp
push 0x865
push ebp
push 0x1036
push eax
call edi
mov edx, dword [esi + 0x3c4]
lea ecx, [esp + 0x1c]
push ecx
push ebp
push 0x101b
push edx
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x38], 0x5ebf30
mov dword [esp + 0x40], ebp
mov dword [esp + 0x34], 0xc8
mov dword [esp + 0x30], ebp
call edi
mov ecx, dword [esi + 0x3c4]
lea eax, [esp + 0x1c]
push eax
push 1
push 0x101b
push ecx
mov dword [esp + 0x38], 0x5e8aa0
mov dword [esp + 0x40], 1
mov dword [esp + 0x34], 0x3c
call edi
mov eax, dword [esi + 0x3c4]
lea edx, [esp + 0x1c]
push edx
push 2
push 0x101b
push eax
mov dword [esp + 0x38], 0x5e8a98
mov dword [esp + 0x40], 2
mov dword [esp + 0x34], 0x50
call edi
mov edx, dword [esi + 0x3c4]
lea ecx, [esp + 0x1c]
push ecx
push 3
push 0x101b
push edx
mov dword [esp + 0x38], 0x5ebf24
mov dword [esp + 0x40], 3
mov dword [esp + 0x34], 0x82
call edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], 0x597d4c
mov dword [esp + 0x44], ebp
call 0x5d1d59
mov eax, dword [eax + 0xc]
push 0x92
push eax
call dword [0x5977a0]
push eax
lea ecx, [esp + 0x18]
call 0x5c8b13
cmp eax, ebp
je 0x4aea3e
push 1
push 3
lea ebx, [esi + 0x64]
push 0x11
push 0x10
push 0x10
mov ecx, ebx
call 0x5be7f6
mov edx, dword [esp + 0x18]
and al, 0x18
lea eax, [esp + 0x14]
neg eax
sbb eax, eax
push 0xff00ff
and eax, edx
push eax
mov eax, dword [esi + 0x68]
push eax
call dword [0x597050]
cmp ebx, ebp
jne 0x4aea24
xor ebx, ebx
jmp 0x4aea27
mov ebx, dword [ebx + 4]
mov ecx, dword [esi + 0x3c4]
push ebx
push 1
push 0x1003
push ecx
call edi
push eax
call 0x5be7c3
lea ecx, [esp + 0x14]
call 0x5c8b6a
push 1
push ecx
lea edx, [esi + 0x80]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call 0x5c1481
mov ecx, esi
call fcn.004aee80
mov dword [esp + 0x14], 0x5c0144
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 1
call 0x5c8b6a
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x38
ret
Function at 0x4b9210
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x584480
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x5c0124
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x20], eax
push ecx
push 1
push eax
call dword [0x597168]
push eax
lea ecx, [esp + 0xc]
call 0x5ceb13
mov esi, dword [esp + 0x28]
lea edx, [esp + 8]
push edx
mov ecx, esi
call 0x5ce11f
mov ecx, dword [esp + 0x2c]
mov edi, eax
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x10]
push eax
push ecx
push edx
mov ecx, esi
call 0x5ce624
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push eax
push ecx
mov ecx, esi
call 0x5ce670
push edi
mov ecx, esi
call 0x5ce11f
lea ecx, [esp + 8]
call 0x5ceb6a
mov dword [esp + 8], 0x5c0144
lea ecx, [esp + 8]
mov dword [esp + 0x20], 1
call 0x5ceb6a
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x18

Function at 0x4bae50
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], edi
mov dword [ebp + 4], ecx
mov ecx, esi
mov dword [ebp + 8], edx
lea edx, [esp + 0x74]
push edx
mov dword [ebp + 0xc], edi
call dword [ebx + 0xcc]
lea ecx, [esp + 0x30]
push 1
push ecx
mov ecx, dword [esp + 0x18]
sub esp, 0x10
mov eax, dword [esi]
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [esp + 0x2c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x30]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x34]
mov dword [edx + 0xc], ecx
lea edx, [esp + 0x78]
push edx
mov ecx, esi
call dword [eax + 0xc8]
lea ecx, [esp + 0x20]
call 0x5d4dfb
lea ecx, [esp + 0x10]
call 0x5d4dfb
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
sub ecx, edx
mov edx, dword [esp + 0x24]
sub eax, edi
mov edi, dword [esp + 0x20]
sub edx, ebp
push eax
sub edi, ebx
push ecx
push edx
lea eax, [esp + 0x4c]
push edi
push eax
call dword [0x597730]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push edx
lea eax, [esp + 0x58]
push eax
call dword [0x5977e8]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x30]
inc eax
sub edx, ebx
mov dword [esp + 0x38], eax
add edx, eax
mov eax, dword [esp + 0x40]
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x44]
add edx, eax
mov eax, dword [esp + 0x84]
inc ecx
mov dword [esp + 0x3c], ecx
mov dword [eax], edx
mov edx, dword [esp + 0x4c]
invalid