joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df35f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103a0ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x105623f8]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.00695caf
add esi, 0x50
mov ecx, esi
mov dword [esp + 0x44], 0
call fcn.004d815f
mov ecx, eax
call fcn.004df0af
mov ecx, esi
call fcn.004d815f
lea ecx, [eax + 0x10]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 0xc]
call fcn.004d7f2f
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.0069ef8f
mov ecx, esi
call fcn.004d815f
lea ecx, [eax + 0x10]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 0x14]
call fcn.004d7f2f
lea edx, [esp + 0xc]
push edx
mov ecx, eax
call fcn.0069ef8f
mov ecx, esi
call fcn.004d815f
lea ecx, [eax + 0x10]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 0x2c]
call fcn.004d7f2f
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.0069ef8f
mov ecx, esi
call fcn.004d815f
lea ecx, [eax + 0x10]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 0x34]
call fcn.004d7f2f
lea edx, [esp + 0xc]
push edx
mov ecx, eax
call fcn.0069ef8f
mov ecx, esi
call fcn.004d815f
lea ecx, [eax + 0x10]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 0x3c]
call fcn.004d7f2f
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.0069ef8f
mov ecx, esi
call fcn.004d815f
mov edx, dword [eax + 0x20]
sub edx, dword [eax + 0x1c]
lea eax, [esp + 8]
sar edx, 2
push eax
mov ecx, esi
mov dword [esp + 0xc], edx
call fcn.004d815f
mov ecx, eax
call fcn.00605adf
lea ecx, [esp + 0xc]
mov dword [esp + 0x44], 0xffffffff
call fcn.006949bf
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00777267
add esp, 0x40
ret
Function at 0x51e6af
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x103a67e0
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x105623f8]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, dword [esp + 0x80]
mov eax, 7
xor ebp, ebp
xor ecx, ecx
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], ebp
mov word [esp + 0x54], cx
xor edx, edx
mov dword [esp + 0x78], ebp
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ebp
mov word [esp + 0x38], dx
push edi
mov byte [esp + 0x7c], 1
call fcn.00463d5f
lea esi, [ebp + 8]
add esp, 4
lea eax, [esp + 0x18]
push edi
push eax
call fcn.0051db6f
add esp, 8
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x84], 2
call fcn.0040826f
cmp dword [eax + 0x14], ebp
mov byte [esp + 0x78], 1
setne bl
cmp dword [esp + 0x30], esi
jb 0x51e763
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00776c58
add esp, 4
test bl, bl
je 0x51e7e5
mov edx, dword [esp + 0x8c]
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
push edx
push eax
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0x64]
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebp
push eax
mov word [ecx + 4], dx
call fcn.0040826f
lea ecx, [esp + 0x40]
push ecx
call fcn.0051de6f
add esp, 0x2c
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x84], 3
call fcn.004088df
mov byte [esp + 0x78], 1
cmp dword [esp + 0x30], esi
jb 0x51e722
mov edx, dword [esp + 0x1c]
push edx
call fcn.00776c58
jmp 0x51e71f
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0x58]
push eax
mov ecx, edi
call fcn.0040826f
cmp dword [esp + 0x4c], esi
jb 0x51e807
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00776c58
add esp, 4
xor edx, edx
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], ebp
mov word [esp + 0x38], dx
cmp dword [esp + 0x68], esi
jb 0x51e82d
mov eax, dword [esp + 0x54]
push eax
call fcn.00776c58
add esp, 4
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00777267
add esp, 0x68
ret
Function at 0x51eb5f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x103a67e0
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x105623f8]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, dword [esp + 0x80]
mov eax, 7
xor ebp, ebp
xor ecx, ecx
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], ebp
mov word [esp + 0x54], cx
xor edx, edx
mov dword [esp + 0x78], ebp
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ebp
mov word [esp + 0x38], dx
push edi
mov byte [esp + 0x7c], 1
call fcn.00463d5f
lea esi, [ebp + 8]
add esp, 4
lea eax, [esp + 0x18]
push edi
push eax
call fcn.0051db6f
add esp, 8
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x84], 2
call fcn.0040826f
cmp dword [eax + 0x14], ebp
mov byte [esp + 0x78], 1
setne bl
cmp dword [esp + 0x30], esi
jb 0x51ec13
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00776c58
add esp, 4
test bl, bl
je 0x51ec8d
mov edx, dword [esp + 0x88]
mov eax, dword [esp + 0x84]
push edx
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0x60]
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebp
push eax
mov word [ecx + 4], dx
call fcn.0040826f
lea ecx, [esp + 0x3c]
push ecx
call fcn.0051e84f
add esp, 0x28
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x84], 3
call fcn.004088df
mov byte [esp + 0x78], 1
cmp dword [esp + 0x30], esi
jb 0x51ebd2
mov edx, dword [esp + 0x1c]
push edx
call fcn.00776c58
jmp 0x51ebcf
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0x58]
push eax
mov ecx, edi
call fcn.0040826f
cmp dword [esp + 0x4c], esi
jb 0x51ecaf
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00776c58
add esp, 4
xor edx, edx
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], ebp
mov word [esp + 0x38], dx
cmp dword [esp + 0x68], esi
jb 0x51ecd5
mov eax, dword [esp + 0x54]
push eax
call fcn.00776c58
add esp, 4
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00777267
add esp, 0x68
ret

Function at 0x52227f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103a69c8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x20]
add esi, 0x24
xor edi, edi
push eax
mov ecx, esi
mov dword [esp + 0x18], edi
call fcn.0076446f
mov eax, dword [esp + 0x2c]
mov byte [esi + 0x18], 1
cmp eax, edi
je 0x5222cf
push eax
call fcn.00776c58
add esp, 4
mov ecx, dword [esp + 0x20]
push ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
call fcn.00776c58
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret
Function at 0x58033f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b1878
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x105623f8]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [esp + 0x40]
xor eax, eax
push 0xffffffffffffffff
push eax
mov esi, ecx
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
call fcn.0040826f
mov cl, byte [edi + 0x1c]
mov byte [esp + 0x28], cl
lea edx, [esp + 0xc]
push edx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.00583adf
lea eax, [esi + 0x1c]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x5803cb
mov cl, byte [eax]
mov dl, byte [esp + 0x28]
mov byte [eax], dl
mov byte [esp + 0x28], cl
cmp dword [esp + 0x24], 8
jb 0x5803df
mov eax, dword [esp + 0x10]
push eax
call fcn.00776c58
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00777267
add esp, 0x30
ret 4

Function at 0x580a7f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103ae05e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov ecx, 0xf
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov byte [esi + 4], al
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x20], al
mov dword [esi + 0x50], ecx
mov dword [esi + 0x4c], eax
mov byte [esi + 0x3c], al
lea ecx, [esi + 0x54]
mov byte [esp + 0x14], 2
call fcn.00580a1f
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x583c0f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103ae2f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x105623f8]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [esp + 0x40]
push 0xffffffffffffffff
push 0
mov esi, ecx
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.0040509f
mov al, byte [edi + 0x1c]
mov byte [esp + 0x28], al
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.00583adf
lea eax, [esi + 0x1c]
lea edx, [esp + 0x28]
cmp eax, edx
je 0x583c9a
mov cl, byte [eax]
mov dl, byte [esp + 0x28]
mov byte [eax], dl
mov byte [esp + 0x28], cl
cmp dword [esp + 0x24], 0x10
jb 0x583cae
mov eax, dword [esp + 0x10]
push eax
call fcn.00776c58
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00777267
add esp, 0x30
ret 4
Function at 0x585e4f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103af7a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x10]
call fcn.00585b0f
lea ecx, [esp + 0xc]
push ecx
xor edi, edi
mov ecx, esi
mov dword [esp + 0x30], edi
call fcn.005d1dff
lea ecx, [esp + 0xc]
call fcn.0058590f
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x585eb0
push eax
call fcn.00776c58
add esp, 4
mov edx, dword [esp + 0xc]
push edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call fcn.00776c58
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 4

Function at 0x591b8f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103ae421
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], 0x10484444
xor edx, edx
lea eax, [esi + 4]
mov dword [eax], edx
mov byte [eax + 4], dl
lea ecx, [esi + 0xc]
mov byte [ecx], dl
mov byte [ecx + 1], dl
mov dword [esi + 0x10], 0x10259a00
mov dword [esi + 0x14], edx
mov dword [esp + 0x28], edx
mov dword [esi + 0x18], 0x10259a00
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], 0x10259a00
mov dword [esi + 0x24], edx
mov edi, dword [esp + 0x30]
mov ebp, dword [edi + 4]
mov edx, dword [edi + 8]
lea ebx, [esp + 0x18]
mov byte [esp + 0x28], 2
cmp eax, ebx
je 0x591c0f
mov dword [eax], ebp
add eax, 4
lea ebx, [esp + 0x1c]
cmp eax, ebx
je 0x591c1c
mov byte [eax], dl
mov dx, word [edi + 0xc]
lea eax, [esp + 0x30]
cmp ecx, eax
je 0x591c2a
mov byte [ecx], dl
lea eax, [ecx + 1]
lea ecx, [esp + 0x31]
cmp eax, ecx
je 0x591c37
mov byte [eax], dh
cmp dword [edi + 0x14], 0
je 0x591c48
mov ecx, dword [edi + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
jmp 0x591c4a
xor eax, eax
lea ecx, [esi + 0x14]
lea edx, [esp + 0x1c]
cmp ecx, edx
je 0x591c5b
mov edx, dword [ecx]
mov dword [ecx], eax
mov eax, edx
push eax
call fcn.0065d66f
add esp, 4
cmp dword [edi + 0x1c], 0
je 0x591c75
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
jmp 0x591c77
xor eax, eax
lea ecx, [esi + 0x1c]
lea edx, [esp + 0x1c]
cmp ecx, edx
je 0x591c88
mov edx, dword [ecx]
mov dword [ecx], eax
mov eax, edx
push eax
call fcn.0065d66f
add esp, 4
cmp dword [edi + 0x24], 0
je 0x591ca2
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
jmp 0x591ca4
xor eax, eax
lea ecx, [esi + 0x24]
lea edx, [esp + 0x1c]
cmp ecx, edx
je 0x591cb5
mov edx, dword [ecx]
mov dword [ecx], eax
mov eax, edx
push eax
call fcn.0065d66f
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x59325f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103b8538
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esi], 0x10259a00
mov dword [esi + 4], ebx
push 0x38
mov dword [esp + 0x1c], ebx
call fcn.00776c63
add esp, 4
cmp eax, ebx
je 0x5932e0
mov dword [eax], 0x104842e8
mov dword [eax + 8], ebx
mov byte [eax + 0xc], bl
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov byte [eax + 0x18], bl
mov dword [eax + 0x20], ebx
mov byte [eax + 0x24], bl
mov dword [eax + 0x28], ebx
mov dword [eax + 0x2c], ebx
mov byte [eax + 0x30], bl
mov dword [esi + 4], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
mov dword [esi + 4], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x5941cf
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b79c6
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], 0x10484408
xor ebx, ebx
lea eax, [esi + 4]
lea ecx, [esi + 0xc]
lea edi, [esi + 0xe]
mov dword [esi + 0x10], 0x10259a00
mov dword [esi + 0x14], ebx
mov dword [esp + 0x28], ebx
mov dword [esi + 0x18], 0x10259a00
mov dword [esi + 0x1c], ebx
mov ebp, dword [esp + 0x30]
mov dword [eax], ebx
mov byte [eax + 4], bl
mov byte [ecx], bl
mov byte [ecx + 1], bl
mov byte [edi], bl
mov byte [edi + 1], bl
mov edx, dword [ebp + 8]
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x18]
mov byte [esp + 0x28], 1
cmp eax, edx
je 0x594251
mov edx, dword [ebp + 4]
mov dword [eax], edx
add eax, 4
lea edx, [esp + 0x1c]
cmp eax, edx
je 0x594262
mov dl, byte [esp + 0x1c]
mov byte [eax], dl
mov dx, word [ebp + 0xc]
lea eax, [esp + 0x30]
cmp ecx, eax
je 0x594270
mov byte [ecx], dl
lea eax, [ecx + 1]
lea ecx, [esp + 0x31]
cmp eax, ecx
je 0x59427d
mov byte [eax], dh
mov cx, word [ebp + 0xe]
lea edx, [esp + 0x30]
cmp edi, edx
je 0x59428b
mov byte [edi], cl
lea eax, [edi + 1]
lea edx, [esp + 0x31]
cmp eax, edx
je 0x594298
mov byte [eax], ch
cmp dword [ebp + 0x14], ebx
je 0x5942a8
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
jmp 0x5942aa
xor eax, eax
lea ecx, [esi + 0x14]
lea edx, [esp + 0x1c]
cmp ecx, edx
je 0x5942bb
mov edx, dword [ecx]
mov dword [ecx], eax
mov eax, edx
push eax
call fcn.0065d66f
add esp, 4
cmp dword [ebp + 0x1c], ebx
je 0x5942d4
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
jmp 0x5942d6
xor eax, eax
lea ecx, [esi + 0x1c]
lea edx, [esp + 0x1c]
cmp ecx, edx
je 0x5942e7
mov edx, dword [ecx]
mov dword [ecx], eax
mov eax, edx
push eax
call fcn.0065d66f
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x59a1cf
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103ae5dc
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x10484508
mov eax, dword [esi + 0x40]
push eax
mov eax, dword [esi + 0x3c]
mov dword [esp + 0x18], 3
call eax
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x34]
push eax
mov byte [esp + 0x1c], 2
call ecx
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x2c]
push eax
mov byte [esp + 0x20], 1
call edx
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x24]
push eax
mov byte [esp + 0x24], 0
call ecx
add esp, 0x10
cmp dword [esi + 0x1c], 8
jb 0x59a24d
mov edx, dword [esi + 8]
push edx
call fcn.00776c58
add esp, 4
xor eax, eax
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], 0
mov word [esi + 8], ax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x59d89f
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x10482e50
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10572828
lea eax, [edi + 8]
push eax
push 0x10476148
mov ecx, esi
call fcn.0057f5df
push 0x10572828
add edi, 0x18
push edi
push 0x10476144
mov ecx, esi
call fcn.0057f5df
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x59da2f
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x10482e50
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10572fc4
lea eax, [edi + 8]
push eax
push 0x104762e8
mov ecx, esi
call fcn.0057f29f
push 0x10572fc4
add edi, 0x18
push edi
push 0x104762e4
mov ecx, esi
call fcn.0057f29f
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
Function at 0x59e67f
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x10482e50
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10572828
lea eax, [edi + 8]
push eax
push 0x10476148
mov ecx, esi
call fcn.0057f5df
push 0x10572828
lea ecx, [edi + 0x18]
push ecx
push 0x10476144
mov ecx, esi
call fcn.0057f5df
push 0x10572828
add edi, 0x28
push edi
push 0x1047611c
mov ecx, esi
call fcn.0057f5df
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x59e81f
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x10482e50
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10572828
lea eax, [edi + 8]
push eax
push 0x10476118
mov ecx, esi
call fcn.0057f5df
push 0x10572828
lea ecx, [edi + 0x18]
push ecx
push 0x10476114
mov ecx, esi
call fcn.0057f5df
push 0x10572828
add edi, 0x28
push edi
push 0x10476110
mov ecx, esi
call fcn.0057f5df
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x59e9bf
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x10482e50
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10572f08
lea eax, [edi + 4]
push eax
push 0x1047610c
mov ecx, esi
call fcn.0057eccf
push 0x10572f08
lea ecx, [edi + 0xc]
push ecx
push 0x10476108
mov ecx, esi
call fcn.0057eccf
push 0x10572f08
add edi, 0x14
push edi
push 0x10476104
mov ecx, esi
call fcn.0057eccf
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
Function at 0x59eccf
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x10482e50
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x1057472c
lea eax, [edi + 4]
push eax
push 0x10476548
mov ecx, esi
call fcn.0057eccf
push 0x1057472c
add edi, 0xc
push edi
push 0x10476154
mov ecx, esi
call fcn.0057eccf
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x59efff
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x10482e50
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10574054
lea eax, [edi + 8]
push eax
push 0x1046aee0
mov ecx, esi
call fcn.0057f6af
push 0x10574054
lea ecx, [edi + 0x18]
push ecx
push 0x10476098
mov ecx, esi
call fcn.0057f6af
push 0x105755f8
add edi, 0x28
push edi
push 0x104760c4
mov ecx, esi
call fcn.0057ed9f
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8