joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b28d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4dddee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004b31f0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4fd584
call fcn.004d02d3
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4b2963
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004d02d3
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4b295c
push 0
mov ecx, eax
call fcn.004a9ab0
mov dword [esi + 0xc], eax
jmp 0x4b2965
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b2965
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4d295f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4d2997
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004d09ed
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004d09c5
jmp 0x4d29a3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4d4051
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4d4093
call fcn.004d9ad4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4d4093
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4d408a
xor eax, eax
jmp 0x4d409b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004d40a1
pop edi
pop esi
pop ebx
ret 4
Function at 0x41298e
Capabilities:
Hash data with md5

Disassembly:
push esi
xor eax, eax
mov dword [ecx], 0x67452301
push 0x40
lea esi, [ecx + 0x58]
mov dword [ecx + 0x14], eax
push eax
push esi
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
call fcn.005e1780
add esp, 0xc
mov byte [esi], 0x80
pop esi
ret

Function at 0x413262
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x58], 0
jne 0x41329a
push 0x98
call fcn.00430c2b
mov esi, eax
mov dword [ebp - 4], esi
pop ecx
test esi, esi
je 0x41328d
mov ecx, esi
call fcn.0041298e
jmp 0x41328f
xor esi, esi
mov dword [edi + 0x58], esi
test esi, esi
jne 0x41329a
xor eax, eax
jmp 0x4132fd
push 0x695a84
push dword [ebp + 8]
call fcn.005e87ee
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x413296
cmp dword [edi + 0x5c], 0
jne 0x4132d1
push 0xff
call fcn.00499923
pop ecx
mov dword [edi + 0x5c], eax
jmp 0x4132d1
mov ecx, dword [edi + 0x58]
push eax
push dword [edi + 0x5c]
call fcn.004129c6
push esi
push 0xff
push 1
push dword [edi + 0x5c]
call fcn.005edda7
add esp, 0x10
test eax, eax
jne 0x4132c5
push esi
call fcn.005e4ecd
pop ecx
mov ecx, dword [edi + 0x58]
lea esi, [edi + 4]
push esi
call fcn.00412a63
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x413305
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x58
push esi
push edi
push 0x58
lea eax, [esp + 0xc]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.005e1780
push dword [ebp + 8]
and dword [esp + 0x2c], 0
lea ecx, [esp + 0x18]
and dword [esp + 0x28], 0
mov edx, esi
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.0041336e
add esp, 0x10
lea ecx, [esp + 8]
mov edx, edi
call fcn.0041340f
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415a37
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x60d4fc
call fcn.0060bd28
sub esp, 0xc
push esi
push edi
xor edi, edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edi
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x415a75
push dword [ebp + 8]
call fcn.005f0038
inc eax
pop ecx
cmp eax, 0x3fffffff
jle 0x415a79
mov eax, edi
jmp 0x415a8f
lea esi, [eax + eax]
mov eax, esi
call fcn.0060b200
mov edx, dword [ebp + 8]
mov ecx, esp
push ecx
push esi
call fcn.00404a71
push eax
lea ecx, [ebp - 0x14]
call fcn.00405d0b
mov esi, dword [ebp - 0x14]
movzx eax, word [esi - 0xc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x415aaf
xor byte [edi + esi], 0x88
inc edi
cmp edi, eax
jl 0x415aa6
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push 2
push eax
lea ecx, [edi + 4]
call fcn.0041587b
movzx eax, word [ebp - 0x10]
lea ecx, [edi + 4]
push eax
push esi
call fcn.0041587b
lea ecx, [esi - 0x10]
call fcn.00404ea9
lea esp, [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x415be7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x60d521
call fcn.0060bd28
sub esp, 0x90
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0x10], edi
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.00406173
mov byte [ebp - 4], 1
lea eax, [ebp - 0x98]
push 0xfde9
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], eax
call fcn.00408f48
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
push dword [ebp - 0x9c]
call fcn.00405d0b
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x9c], eax
je 0x415c70
push dword [ebp - 0x9c]
call fcn.005f0033
pop ecx
mov esi, dword [ebp - 0x14]
movzx eax, word [esi - 0xc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x415c87
xor byte [edi + esi], 0x88
inc edi
cmp edi, eax
jl 0x415c7e
push 2
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 4]
call fcn.0041587b
movzx eax, word [ebp - 0x10]
lea ecx, [ebx + 4]
push eax
push esi
call fcn.0041587b
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x417777
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x60d64a
call fcn.0060bd28
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x41787b
cmp byte [ebx + 0x3d], 0
je 0x41787b
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x4177b5
xor al, al
jmp 0x41787d
xor eax, eax
mov dword [ebp - 0x18], 0xf
push eax
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
call fcn.0040984f
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
lea eax, [ebp - 0x14]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x417813
sub eax, 1
je 0x417817
dec eax
sub eax, 1
je 0x417869
xor bl, bl
jmp 0x41786b
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
cmp ecx, 0x10
mov esi, dword [ebp - 0x14]
cmovae eax, edx
sub esi, eax
je 0x41784f
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.005f2409
add esp, 0x10
cmp esi, eax
jne 0x41780f
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp byte [ebx + 0x3d], 0
je 0x417869
test esi, esi
jne 0x4177d9
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040a72d
jmp 0x4177d3
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004097fa
mov al, bl
jmp 0x41787d
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418d8a
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
push edi
push 0x58
xor edi, edi
lea eax, [ebp - 0x64]
push edi
push eax
mov esi, ecx
call fcn.005e1780
add esp, 0xc
mov dword [ebp - 0x50], edi
lea eax, [ebp - 0x64]
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
push dword [ebp + 0x10]
mov dword [ebp - 0x5c], 0x98badcfe
push dword [ebp + 0xc]
mov dword [ebp - 0x58], 0x10325476
push eax
call fcn.00418e55
push 8
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004131cf
mov edx, dword [ebp - 0x54]
push 0x38
pop ecx
push 0x78
shr edx, 3
pop eax
and edx, 0x3f
sub eax, edx
sub ecx, edx
cmp edx, 0x38
cmovb eax, ecx
push eax
push esi
lea eax, [ebp - 0x64]
push eax
call fcn.00418e55
push 8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00418e55
push 0x10
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 8]
call fcn.004131cf
push 0x10
lea eax, [ebp - 0x64]
push edi
push eax
call fcn.005e1780
push 8
lea eax, [ebp - 0x54]
push edi
push eax
call fcn.005e1780
push 0x40
lea eax, [ebp - 0x4c]
push edi
push eax
call fcn.005e1780
add esp, 0x24
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4197fd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x696460
mov edi, edx
mov ebx, ecx
call fcn.005e4660
xor esi, esi
mov edx, eax
pop ecx
test edi, edi
je 0x419837
mov ecx, dword [ebp + 8]
sub ebx, ecx
mov al, byte [ebx + ecx]
xor al, byte [esi + 0x696460]
inc esi
cmp esi, edx
mov byte [ecx], al
sbb eax, eax
and esi, eax
inc ecx
sub edi, 1
jne 0x41981f
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
pop ebp
ret

Function at 0x41b522
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x60d9e4
call fcn.0060bd28
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi], 0x696744
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x10
mov dword [esi + 0x14], 0x696750
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], 1
mov byte [esi + 0x2c], al
call fcn.0041ce9a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x41b52d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x60d9e4
call fcn.0060bd28
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi], 0x696744
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x10
mov dword [esi + 0x14], 0x696750
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], 1
mov byte [esi + 0x2c], al
call fcn.0041ce9a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42d2b7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x60f125
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x30]
mov dword [esi], 0x697680
mov dword [esi + 4], 0x697668
mov dword [esi + 8], 0x697654
mov dword [esi + 0xc], 0x69763c
mov dword [esi + 0x10], 0x697628
mov dword [esi + 0x14], 0x697614
mov dword [esi + 0x18], 0x697600
mov dword [esi + 0x1c], 0x6975ec
mov dword [esi + 0x20], 0x6975d8
mov dword [esi + 0x24], 0x6975c4
mov dword [esi + 0x28], 0x6975b0
call fcn.00431119
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x74]
test ecx, ecx
je 0x42d337
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x42d34b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x42d35f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 3
mov ecx, dword [esi + 0x68]
test ecx, ecx
je 0x42d373
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 4
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x42d387
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 5
mov ecx, dword [esi + 0x60]
test ecx, ecx
je 0x42d39b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 6
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x42d3af
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 7
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x42d3c3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42ea0d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 4], ebx
jne 0x42ea28
lea ecx, [esi + 4]
call fcn.00437288
test eax, eax
jne 0x42ea90
push edi
lea edi, [esi + 8]
cmp dword [edi], ebx
jne 0x42ea3b
mov ecx, edi
call fcn.00437288
test eax, eax
jne 0x42ea8f
push dword [esi + 4]
call dword [0x614270]
test eax, eax
jne 0x42ea4d
call fcn.00437218
push dword [edi]
call dword [0x614270]
test eax, eax
jne 0x42ea5e
call fcn.00437218
mov byte [esi + 0x10], bl
cmp dword [esi + 0xc], ebx
je 0x42ea6a
xor eax, eax
jmp 0x42ea8f
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x42e9cd
push ebx
push ebx
call fcn.005f3920
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
jne 0x42ea8d
call fcn.00437218
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439fcc
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x60f4da
call fcn.0060bd28
push ecx
push ecx
and dword [ebp - 0x10], 0
mov eax, 0x20e2
push ebx
mov ebx, ecx
push esi
push edi
push 8
mov word [ebx + 0x30], ax
lea ecx, [ebx + 4]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041587b
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.00415be7
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.00415be7
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.00415a0d
call fcn.00404f47
push eax
lea ecx, [ebp + 0xc]
call fcn.004065d8
push dword [ebp + 0x18]
and dword [ebp - 4], 0
lea eax, [ebp + 0xc]
push 0x6950ec
push eax
call fcn.00406cc8
mov esi, dword [ebp + 0xc]
add esp, 0xc
mov ecx, ebx
push esi
call fcn.00415be7
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x64
push eax
lea ecx, [ebx + 4]
call fcn.0041587b
push dword [ebp + 0x1c]
mov ecx, ebx
call fcn.00415a0d
push dword [ebp + 0x20]
mov ecx, ebx
call fcn.00415a22
mov ecx, ebx
call fcn.00415bbd
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4479b5
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x60fe41
call fcn.0060bd28
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov eax, dword [0x6145c0]
mov dword [edi + 4], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], eax
mov dword [ebp - 4], ebx
lea ecx, [edi + 0x2c]
mov dword [edi + 0x28], ebx
mov dword [edi + 0x24], 0x6998ec
call fcn.0046ae61
lea ecx, [edi + 0x188]
mov byte [ebp - 4], 1
call fcn.0046ae61
lea ecx, [edi + 0x2e4]
mov byte [ebp - 4], 2
call fcn.0046ae61
mov dword [edi + 0x444], ebx
mov dword [edi + 0x440], 0x699a5c
mov dword [edi + 0x450], ebx
mov dword [edi + 0x448], ebx
mov dword [edi + 0x44c], ebx
mov byte [ebp - 4], 4
call fcn.00404f47
push eax
lea ecx, [edi + 0x474]
call fcn.004065d8
mov dword [edi + 0x4b4], ebx
mov dword [edi + 0x4b8], ebx
mov byte [ebp - 4], 6
call fcn.00404f47
push eax
lea ecx, [edi + 0x4bc]
call fcn.004065d8
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x4dc]
mov dword [edi + 0x4d8], eax
call fcn.004501ee
xor ecx, ecx
lea ebx, [edi + 0x518]
mov dword [ebx], 0x699384
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [edi + 0x524], ecx
mov dword [edi + 0x528], ecx
mov dword [edi + 0x52c], ecx
mov dword [edi + 0x530], ecx
mov dword [edi + 0x534], ecx
add edi, 0x538
mov dword [ebp + 8], edi
mov dword [edi], ecx
mov eax, 0x699604
mov dword [edi + 8], ecx
mov dword [edi + 4], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ecx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], ecx
mov byte [ebp - 4], 0xd
lea esi, [edi + 0x34]
mov dword [ebp - 0x14], esi
mov dword [esi], ecx
mov dword [esi + 4], ecx
call fcn.004069f1
mov dword [esi], eax
xor edx, edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [edi + 0x3c], edx
inc ecx
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], edx
mov dword [edi + 0x20], edx
mov dword [edi + 0x24], edx
or dword [eax + 0x4c8], 0xffffffff
mov dword [eax + 0x51c], edi
pop edi
mov dword [eax + 0x500], ecx
mov dword [eax + 0x4b0], ecx
mov dword [eax + 0x470], ecx
mov dword [eax + 0x4c0], ecx
mov dword [eax + 0x4cc], ecx
mov dword [eax + 0x504], ecx
mov dword [eax + 0x510], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x184], ebx
mov dword [eax + 0x2e0], ebx
mov dword [eax + 0x43c], ebx
pop esi
mov dword [eax + 0x454], edx
mov dword [eax + 0x458], edx
mov dword [eax + 0x464], edx
mov dword [eax + 0x468], edx
mov dword [eax + 0x488], edx
mov dword [eax + 0x48c], edx
mov dword [eax + 0x490], edx
mov dword [eax + 0x494], edx
mov dword [eax + 0x498], edx
mov dword [eax + 0x4a8], edx
mov dword [eax + 0x46c], edx
mov dword [eax + 0x4a0], edx
mov dword [eax + 0x4ac], edx
mov dword [eax + 0x4a4], edx
mov dword [eax + 0x4c4], edx
mov dword [eax + 0x4d0], edx
mov dword [eax + 0x4d4], edx
mov dword [eax + 0x45c], edx
mov dword [eax + 0x508], edx
mov dword [eax + 0x50c], edx
mov dword [eax + 0x49c], edx
mov dword [eax + 0x514], 0xff
mov dword [eax + 0x460], edx
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x464619
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x6106e3
call fcn.0060bd28
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
and dword [ebp - 4], 0
mov dword [edi], 0x69b330
call fcn.0046ac67
mov ebx, 0x6c8a98
push ebx
call dword [0x614388]
call fcn.0046ac67
inc dword [eax + 0x60]
mov esi, dword [eax + 0x60]
push esi
call fcn.0046ac67
mov ecx, eax
call fcn.004644f6
push ebx
mov dword [eax], edi
call dword [0x614384]
xor ebx, ebx
mov dword [edi + 4], esi
mov dword [edi + 8], ebx
lea esi, [edi + 0x10]
mov dword [edi + 0xc], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [edi + 0x20], ebx
call fcn.00404f47
push eax
lea ecx, [edi + 0x24]
call fcn.004065d8
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
call fcn.00404f47
push eax
lea ecx, [edi + 0x3c]
call fcn.004065d8
mov dword [edi + 0x40], ebx
call fcn.00404f47
push eax
lea ecx, [edi + 0x44]
call fcn.004065d8
call fcn.00404f47
push eax
lea ecx, [edi + 0x48]
call fcn.004065d8
or dword [edi + 0x4c], 0xffffffff
lea ecx, [edi + 0xbc]
or dword [edi + 0x50], 0xffffffff
xor eax, eax
or dword [edi + 0x60], 0xffffffff
mov dword [edi + 0x54], ebx
mov word [edi + 0x58], ax
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x9c], ebx
mov dword [edi + 0xa0], ebx
mov dword [edi + 0xa4], ebx
mov dword [edi + 0xa8], 1
mov dword [edi + 0xac], ebx
mov dword [edi + 0xb0], ebx
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xb8], ebx
call fcn.004669a4
call fcn.004669a4
mov byte [ecx + 0x28], 0xff
lea ecx, [edi + 0x100]
mov dword [edi + 0xec], ebx
mov dword [edi + 0xf0], ebx
mov dword [edi + 0xf4], ebx
mov dword [edi + 0xf8], 0x69acf0
mov dword [edi + 0xfc], edi
call fcn.004669a4
call fcn.004669a4
mov byte [ecx + 0x28], 0xff
mov byte [edi + 0x130], bl
push esi
mov dword [edi + 0x134], ebx
mov dword [edi + 0x138], ebx
call dword [0x614580]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x46abb4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x6109f0
call fcn.0060bd28
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
push 0x11
or dword [esi + 0x18], 0xffffffff
pop ebx
push 0xa
pop edi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0xc], 0x3f400000
mov dword [esi + 0x10], 0x3e800000
mov dword [esi + 0x14], 0x40100000
call fcn.0044ee5a
lea ecx, [esi + 0x30]
xor eax, eax
mov dword [ebp - 4], eax
or dword [ecx + 0x18], 0xffffffff
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebx
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edi
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0xc], 0x3f400000
mov dword [ecx + 0x10], 0x3e800000
mov dword [ecx + 0x14], 0x40100000
call fcn.0044ee5a
mov byte [ebp - 4], 1
and dword [esi + 0x60], 0
push 0x6c8a98
call dword [0x614368]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x47a203
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi], esi
je 0x47a278
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x47a278
cmp dword [edi + 8], esi
je 0x47a23c
push esi
push dword [edi + 8]
call dword [0x614364]
test eax, eax
jne 0x47a237
push dword [edi + 8]
call dword [0x61444c]
mov dword [edi + 8], esi
cmp dword [edi + 8], esi
jne 0x47a278
mov eax, dword [edi]
push 0xc
mov dword [ebp + 8], eax
call fcn.00430c2b
pop ecx
test eax, eax
je 0x47a26c
mov ecx, dword [ebp + 8]
push esi
push esi
push eax
push 0x47a40a
push esi
push esi
mov dword [eax], ecx
mov dword [eax + 8], esi
mov dword [eax + 4], ebx
call fcn.005f3920
add esp, 0x18
mov esi, eax
xor eax, eax
mov dword [edi + 8], esi
test esi, esi
setne al
jmp 0x47a27a
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x484afd
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x61213b
call fcn.0060bd28
push ecx
push ecx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], ecx
mov dword [ebp - 4], ecx
mov eax, 0x699a5c
movsd xmm0, qword [0x6a03a0]
mov dword [edi], 0x69ebb4
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
movsd qword [edi + 0x10], xmm0
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], ecx
mov dword [edi + 0x24], ecx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], ecx
mov dword [edi + 0x34], ecx
mov dword [edi + 0x38], ecx
mov dword [edi + 0x3c], ecx
mov dword [edi + 0x40], ecx
mov dword [edi + 0x48], ecx
mov dword [edi + 0x44], eax
mov dword [edi + 0x54], ecx
mov dword [edi + 0x4c], ecx
mov dword [edi + 0x50], ecx
mov dword [edi + 0x58], ecx
mov dword [edi + 0x60], ecx
mov dword [edi + 0x5c], eax
mov dword [edi + 0x6c], ecx
mov dword [edi + 0x64], ecx
mov dword [edi + 0x68], ecx
mov byte [ebp - 4], 2
lea esi, [edi + 0x74]
mov dword [edi + 0x70], ecx
mov dword [ebp - 0x14], esi
mov dword [esi], ecx
mov dword [esi + 4], ecx
call fcn.004069f1
mov ecx, dword [ebp - 0xc]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x48db58
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x18
mov esi, ecx
call fcn.00430c2b
mov edx, eax
pop ecx
test edx, edx
je 0x48db91
xor ecx, ecx
mov dword [edx], esi
push ecx
push ecx
push edx
mov dword [edx + 0x10], ecx
mov eax, dword [ebp + 8]
push 0x48db94
push ecx
mov dword [edx + 8], eax
mov eax, dword [ebp + 0xc]
push ecx
mov dword [edx + 0xc], eax
call fcn.005f3920
add esp, 0x18
pop esi
pop ebp
ret