joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b7ca7
Capabilities:
Delete file
Encode data using xor
Initialize winsock library

Disassembly:
cmp byte [esp + eax + 0x60670], 0x5c
je 0x41108c
dec eax
jns 0x411072
jmp 0x411093
mov byte [esp + eax + 0x60671], bl
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x60670]
mov byte [eax + 0x6934e8], cl
jmp 0x44fe4e
inc eax
mov word [esp + eax*2 + 0x1e], cx
cmp eax, 0xa
jl 0x5b7ccc
lea edx, [esp + 0x20]
push edx
call fcn.00421a4d
add esp, 4
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x4cd1
xor cx, word [eax*2 + 0x5cfb54]
inc eax
mov word [esp + eax*2 + 0x1e], cx
cmp eax, 2
jl 0x411fda
lea edx, [esp + 0x1f]
push edx
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.msvcrt.dll_scanf]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 8
push 0x100
jmp 0x49e73a
inc eax
cmp cl, bl
jne 0x411099
call fcn.0048ef89
push ebx
call esi
mov edx, dword [eax + 0x3c]
add edx, eax
push 0x100
mov dword [0x6d8528], eax
mov dword [0x6d852c], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor eax, eax
mov edi, edi
lea ecx, [eax + 1]
imul ecx, ecx, 0x639d
xor cx, word [eax*2 + 0x5cfb5c]
inc eax
mov word [esp + eax*2 + 0x1e], cx
cmp eax, 6
jl 0x44fe85
jmp 0x4e130c
lea ecx, [esp + 0x60674]
push ecx
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x60670]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x49e756
sub eax, edx
dec eax
cmp eax, ebx
jl 0x411093
jmp 0x411072
push edx
call fcn.00421a4d
add esp, 4
lea eax, [esp + 0x220]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jns 0x54ffc6
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x54c0
xor cx, word [eax*2 + 0x5cfb7c]
inc eax
mov word [esp + eax*2 + 0x1e], cx
cmp eax, 6
jl 0x4a1d4a
jmp 0x4ca016
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea edx, [esp + 0x24]
push edx
push 0x6933c8
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
push ebx
push ebx
push 0x6933c8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60968]
xor ecx, esp
call fcn.00555928
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.msvcrt.dll_remove]
add esp, 4
xor eax, eax
lea esp, [esp]
lea ecx, [eax + 1]
imul ecx, ecx, 0x45fd
xor cx, word [eax*2 + 0x5cfb6c]
inc eax
mov word [esp + eax*2 + 0x1e], cx
cmp eax, 6
jl 0x4e1320
lea edx, [esp + 0x20]
jmp 0x4a1d24
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xff
mov esi, eax
lea eax, [esp + 0x60775]
push ebx
push eax
mov byte [esp + 0x6077c], bl
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x267c1fb0
jmp 0x54fff5
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x4842
xor cx, word [eax*2 + 0x5cfb8c]
inc eax
mov word [esp + eax*2 + 0x1e], cx
jmp dword [0x550014]
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x6096c
call fcn.005b4454
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x60968], eax
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x6f9f
xor cx, word [eax*2 + 0x5cfb3c]
jmp 0x411fbc
Function at 0x417180
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6b4166
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov byte [esi + 4], al
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], edi
call fcn.0061d780
lea ecx, [esi + 0x24]
mov byte [esp + 0x18], 1
call fcn.0061d780
lea ecx, [esi + 0x28]
mov byte [esp + 0x18], 2
call fcn.0061d780
lea ecx, [esi + 0x2c]
mov byte [esp + 0x18], 3
call fcn.0061d780
mov cl, byte [esp + 0xb]
mov dword [esi + 0x34], edi
mov byte [esi + 0x30], cl
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 5
call fcn.0061d780
lea ecx, [esi + 0x44]
mov byte [esp + 0x18], 6
call fcn.0061d780
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 7
call fcn.0061d780
mov dl, byte [esp + 0xb]
mov dword [esi + 0x50], edi
mov byte [esi + 0x4c], dl
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
lea ecx, [esi + 0x5c]
mov byte [esp + 0x18], 9
call fcn.0061d780
lea ecx, [esi + 0x60]
mov byte [esp + 0x18], 0xa
call fcn.0061d780
lea ecx, [esi + 0x64]
mov byte [esp + 0x18], 0xb
call fcn.0061d780
mov al, byte [esp + 0xb]
mov dword [esi + 0x6c], edi
mov byte [esi + 0x68], al
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea ecx, [esi + 0x78]
mov byte [esp + 0x18], 0xd
call fcn.0061d780
lea ecx, [esi + 0x7c]
mov byte [esp + 0x18], 0xe
call fcn.0061d780
lea ecx, [esi + 0x80]
mov byte [esp + 0x18], 0xf
call fcn.0061d780
push fcn.0061d8c0
push fcn.0061d780
push 5
lea ecx, [esi + 0x84]
push 4
push ecx
mov byte [esp + 0x2c], 0x10
call fcn.006a7199
push fcn.0061d8c0
push fcn.0061d780
push 5
lea edx, [esi + 0x98]
push 4
push edx
mov byte [esp + 0x2c], 0x11
call fcn.006a7199
push fcn.0061d8c0
push fcn.0061d780
push 5
lea eax, [esi + 0xac]
push 4
push eax
mov byte [esp + 0x2c], 0x12
call fcn.006a7199
lea ecx, [esi + 0xc8]
mov byte [esp + 0x18], 0x13
call fcn.0061d780
mov ecx, dword [esp + 0x10]
mov dword [esi], 0x6dd210
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x419139
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6b4618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.0061aaa0
xor ebx, ebx
push 8
push 0x7138e0
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], ebx
call fcn.0061d820
mov eax, dword [esp + 0x40]
lea ecx, [esp + 8]
push eax
push 3
mov byte [esp + 0x40], 1
call fcn.0061dbc0
cmp byte [0x72bd0c], bl
je 0x4191ac
lea ecx, [esp + 8]
mov byte [esp + 0x38], bl
call fcn.0061d8c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0061ab90
xor ax, ax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x34
ret 4
push 1
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
call fcn.0061d790
mov ecx, dword [esi + 4]
lea edx, [esp + 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
cmp ax, bx
je 0x419239
lea eax, [esp + 0x40]
lea ecx, [esp + 0xc]
push eax
call fcn.0061afb0
push ebx
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], 2
call fcn.0061daa0
xor ecx, ecx
cmp al, 0xee
setne cl
mov esi, ecx
lea ecx, [esp + 0x40]
mov byte [esp + 0x38], 1
call fcn.0061d8c0
lea ecx, [esp + 8]
mov byte [esp + 0x38], bl
call fcn.0061d8c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0061ab90
mov ax, si
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x34
ret 4
lea ecx, [esp + 8]
mov byte [esp + 0x38], bl
call fcn.0061d8c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0061ab90
mov ecx, dword [esp + 0x30]
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret 4
Function at 0x4f8280
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x6c3fb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8c
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x1c]
call fcn.0063bb20
xor ebx, ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0xa0], ebx
call fcn.0061d780
lea ecx, [esp + 0x50]
mov byte [esp + 0xa0], 1
call fcn.0061aaa0
push 0x7e2
lea ecx, [esp + 0x30]
mov byte [esp + 0xa4], 2
call fcn.0054f000
mov eax, dword [esi]
mov edi, dword [0x71c358]
mov ecx, esi
mov byte [esp + 0xa0], 3
call dword [eax + 0x18]
test ax, ax
jne 0x4f834a
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa0], 2
call fcn.0054f030
lea ecx, [esp + 0x50]
mov byte [esp + 0xa0], 1
call fcn.0061ab90
lea ecx, [esp + 0x14]
mov byte [esp + 0xa0], bl
call fcn.0061d8c0
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa0], 0xffffffff
call fcn.0062d500
xor ax, ax
jmp 0x4f83f4
cmp byte [esp + 0xa8], 6
jae 0x4f83aa
cmp di, bx
jle 0x4f83aa
xor esi, esi
movsx edi, di
mov cl, byte [esi + 0x71c35a]
lea eax, [esi + 0x71c35a]
mov byte [esp + 0x10], cl
push ebx
mov edx, dword [esp + 0x14]
and edx, 0xff
mov cl, byte [edx + esi + 0x71c35b]
mov byte [esp + 0x10], cl
lea ecx, [esp + 0x30]
mov edx, dword [esp + 0x10]
push edx
push eax
lea eax, [esp + 0x80]
push eax
call fcn.00551050
lea ecx, [esp + 0x74]
call fcn.0061ab90
add esi, 0xa
dec edi
jne 0x4f835e
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa0], 2
call fcn.0054f030
lea ecx, [esp + 0x50]
mov byte [esp + 0xa0], 1
call fcn.0061ab90
lea ecx, [esp + 0x14]
mov byte [esp + 0xa0], bl
call fcn.0061d8c0
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa0], 0xffffffff
call fcn.0062d500
mov ax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x98
ret 4
Function at 0x4fb010
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6c42cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb8
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x78]
call fcn.0061aaa0
push 0x6c
push 0xf1
push 0x40
lea ecx, [esp + 0x44]
mov dword [esp + 0xd4], 0
call fcn.00555f00
push 0x6c
push 0xf1
push 0xfe
lea ecx, [esp + 0x64]
mov byte [esp + 0xd4], 1
call fcn.00555f00
mov al, 0x2a
mov cl, 0x14
mov byte [esp + 0xd], al
mov byte [esp + 0x14], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x22], al
mov byte [esp + 0x29], al
mov byte [esp + 0x30], al
mov eax, dword [esi]
mov dl, 6
mov byte [esp + 0xe], cl
mov ebx, 0xff
mov byte [esp + 0x15], cl
mov byte [esp + 0x1c], cl
mov byte [esp + 0x23], cl
mov byte [esp + 0x2a], cl
mov ecx, esi
mov byte [esp + 0xc8], 2
mov byte [esp + 0xa], 1
mov byte [esp + 0xb], 0x3f
mov byte [esp + 0xc], dl
mov byte [esp + 0xf], 0x20
mov byte [esp + 0x10], bl
mov byte [esp + 0x11], bl
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], dl
mov byte [esp + 0x16], 0x12
mov byte [esp + 0x17], bl
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1d], 0x10
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], dl
mov byte [esp + 0x24], 0x13
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], dl
mov byte [esp + 0x2b], 0x15
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], 2
mov byte [esp + 0x31], 0xf1
mov dword [esp + 0x32], 0
call dword [eax + 0x18]
test ax, ax
je 0x4fb1cd
mov eax, dword [esp + 0xd0]
push 0
and eax, ebx
push 0
lea ecx, [eax*8]
sub ecx, eax
lea eax, [esp + 0xa4]
lea edx, [esp + ecx + 0x14]
lea ecx, [esp + 0x40]
push edx
push eax
call fcn.00556960
lea ecx, [esp + 0x9c]
call fcn.0061ab90
lea ecx, [esp + 0xa]
push ecx
push 0x12c
lea ecx, [esp + 0x60]
call fcn.00556ea0
lea ecx, [esp + 0x58]
mov byte [esp + 0xc8], 1
call fcn.00555f30
lea ecx, [esp + 0x38]
mov byte [esp + 0xc8], 0
call fcn.00555f30
lea ecx, [esp + 0x78]
mov dword [esp + 0xc8], 0xffffffff
call fcn.0061ab90
mov ax, 1
jmp 0x4fb206
lea ecx, [esp + 0x58]
mov byte [esp + 0xc8], 1
call fcn.00555f30
lea ecx, [esp + 0x38]
mov byte [esp + 0xc8], 0
call fcn.00555f30
lea ecx, [esp + 0x78]
mov dword [esp + 0xc8], 0xffffffff
call fcn.0061ab90
xor ax, ax
mov ecx, dword [esp + 0xc0]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xc4
ret 4
Function at 0x556c10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6c96e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
lea ecx, [esp + 0xc]
call fcn.0061aaa0
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0
call fcn.0061d780
mov bl, byte [esp + 0x40]
mov byte [esp + 0x38], 1
xor esi, esi
sub esp, 0x24
mov ecx, 0x72baa8
mov eax, esp
mov dword [esp + 0x64], esp
push 0
push eax
call fcn.00628c00
lea ecx, [esp + 0x30]
call fcn.0061ac40
lea ecx, [esp + 0xc]
call fcn.0061b070
test ax, ax
jle 0x556cb4
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push ecx
lea ecx, [esp + 0x14]
call fcn.0061afb0
lea ecx, [esp + 0xc]
call fcn.0061dab0
lea ecx, [esp + 8]
call fcn.0061dc40
cmp ax, 6
jle 0x556cb4
push 4
lea ecx, [esp + 0xc]
call fcn.0061daa0
cmp al, bl
je 0x556cf0
inc esi
cmp si, 8
jl 0x556c4f
lea ecx, [esp + 8]
mov byte [esp + 0x38], 0
call fcn.0061d8c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0061ab90
xor ax, ax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x34
ret 8
push ecx
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
call fcn.0061d790
mov ecx, dword [esp + 0x48]
call fcn.0061dab0
lea ecx, [esp + 8]
mov byte [esp + 0x38], 0
call fcn.0061d8c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0061ab90
mov ecx, dword [esp + 0x30]
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret 8
Function at 0x570460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6ca628
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push 0x246
lea ecx, [esp + 0x40]
call fcn.0054f000
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], 0
call fcn.0061aaa0
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0061d780
push 0
push 0
push ecx
mov bl, 2
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x713420
mov byte [esp + 0x7c], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 1
mov byte [esp + 0x1e], 0x3e
call fcn.0061d820
push ecx
mov byte [esp + 0x78], 3
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x713464
call fcn.0061d820
mov ecx, 0x72bae0
mov byte [esp + 0x78], bl
call fcn.0061ef70
xor esi, esi
sub esp, 0x24
lea ecx, [esp + 0x2c]
mov eax, esp
mov dword [esp + 0x38], esp
push 0
push 1
push ecx
push eax
lea ecx, [esp + 0x70]
call fcn.00551050
lea ecx, [esp + 0x3c]
call fcn.0061ac40
lea ecx, [esp + 0x18]
call fcn.0061b070
test ax, ax
jg 0x5705b5
inc esi
cmp esi, 3
jl 0x5704fa
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x7133ac
call fcn.0061d820
push ecx
mov byte [esp + 0x78], 4
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x71345c
call fcn.0061d820
mov ecx, 0x72bae0
mov byte [esp + 0x78], bl
call fcn.0061ef70
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0061d8c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 0
call fcn.0061ab90
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.0054f030
xor ax, ax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x64
ret
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0061d8c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 0
call fcn.0061ab90
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.0054f030
mov ecx, dword [esp + 0x60]
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x64
ret

Function at 0x570600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6ca658
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push 0x246
lea ecx, [esp + 0x34]
call fcn.0054f000
lea ecx, [esp + 0xc]
mov dword [esp + 0x5c], 0
call fcn.0061aaa0
lea ecx, [esp + 4]
mov byte [esp + 0x5c], 1
call fcn.0061d780
mov al, 2
push 0x14
mov byte [esp + 0x60], al
mov byte [esp + 4], al
mov byte [esp + 5], 1
mov byte [esp + 6], 0x20
call fcn.0041afd0
sub esp, 0x20
lea ecx, [esp + 0x24]
mov eax, esp
mov dword [esp + 0x2c], esp
push 0
push 1
push ecx
push eax
lea ecx, [esp + 0x64]
call fcn.00551050
lea ecx, [esp + 0x30]
call fcn.0061ac40
push 0
push 0
mov ecx, 0x72baa8
call fcn.00623e40
lea ecx, [esp + 4]
mov byte [esp + 0x5c], 1
call fcn.0061d8c0
lea ecx, [esp + 0xc]
mov byte [esp + 0x5c], 0
call fcn.0061ab90
lea ecx, [esp + 0x30]
mov dword [esp + 0x5c], 0xffffffff
call fcn.0054f030
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret
Function at 0x574790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6cacb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push 0x24c
lea ecx, [esp + 0x40]
call fcn.0054f000
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], 0
call fcn.0061aaa0
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0061d780
push 0
push 0
push ecx
mov bl, 2
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x713420
mov byte [esp + 0x7c], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 1
mov byte [esp + 0x1e], 0x3e
call fcn.0061d820
push ecx
mov byte [esp + 0x78], 3
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x713464
call fcn.0061d820
mov ecx, 0x72bae0
mov byte [esp + 0x78], bl
call fcn.0061ef70
xor esi, esi
sub esp, 0x24
lea ecx, [esp + 0x2c]
mov eax, esp
mov dword [esp + 0x38], esp
push 0
push 1
push ecx
push eax
lea ecx, [esp + 0x70]
call fcn.00551050
lea ecx, [esp + 0x3c]
call fcn.0061ac40
lea ecx, [esp + 0x18]
call fcn.0061b070
test ax, ax
jg 0x5748e5
inc esi
cmp esi, 3
jl 0x57482a
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x7133ac
call fcn.0061d820
push ecx
mov byte [esp + 0x78], 4
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x71345c
call fcn.0061d820
mov ecx, 0x72bae0
mov byte [esp + 0x78], bl
call fcn.0061ef70
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0061d8c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 0
call fcn.0061ab90
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.0054f030
xor ax, ax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x64
ret
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0061d8c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 0
call fcn.0061ab90
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.0054f030
mov ecx, dword [esp + 0x60]
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x64
ret

Function at 0x574930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6cace8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push 0x24c
lea ecx, [esp + 0x34]
call fcn.0054f000
lea ecx, [esp + 0xc]
mov dword [esp + 0x5c], 0
call fcn.0061aaa0
lea ecx, [esp + 4]
mov byte [esp + 0x5c], 1
call fcn.0061d780
mov al, 2
push 0x14
mov byte [esp + 0x60], al
mov byte [esp + 4], al
mov byte [esp + 5], 1
mov byte [esp + 6], 0x20
call fcn.0041afd0
sub esp, 0x20
lea ecx, [esp + 0x24]
mov eax, esp
mov dword [esp + 0x2c], esp
push 0
push 1
push ecx
push eax
lea ecx, [esp + 0x64]
call fcn.00551050
lea ecx, [esp + 0x30]
call fcn.0061ac40
push 0
push 0
mov ecx, 0x72baa8
call fcn.00623e40
lea ecx, [esp + 4]
mov byte [esp + 0x5c], 1
call fcn.0061d8c0
lea ecx, [esp + 0xc]
mov byte [esp + 0x5c], 0
call fcn.0061ab90
lea ecx, [esp + 0x30]
mov dword [esp + 0x5c], 0xffffffff
call fcn.0054f030
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret
Function at 0x57db60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6cbaa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push 0x7e0
lea ecx, [esp + 0x40]
call fcn.0054f000
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], 0
call fcn.0061aaa0
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0061d780
push 0
push 0
push ecx
mov bl, 2
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x713420
mov byte [esp + 0x7c], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 1
mov byte [esp + 0x1e], 0x3e
call fcn.0061d820
push ecx
mov byte [esp + 0x78], 3
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x713464
call fcn.0061d820
mov ecx, 0x72bae0
mov byte [esp + 0x78], bl
call fcn.0061ef70
xor esi, esi
sub esp, 0x24
lea ecx, [esp + 0x2c]
mov eax, esp
mov dword [esp + 0x38], esp
push 0
push 1
push ecx
push eax
lea ecx, [esp + 0x70]
call fcn.00551050
lea ecx, [esp + 0x3c]
call fcn.0061ac40
lea ecx, [esp + 0x18]
call fcn.0061b070
test ax, ax
jg 0x57dcb5
inc esi
cmp esi, 3
jl 0x57dbfa
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x7133ac
call fcn.0061d820
push ecx
mov byte [esp + 0x78], 4
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x71345c
call fcn.0061d820
mov ecx, 0x72bae0
mov byte [esp + 0x78], bl
call fcn.0061ef70
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0061d8c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 0
call fcn.0061ab90
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.0054f030
xor ax, ax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x64
ret
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 1
call fcn.0061d8c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 0
call fcn.0061ab90
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.0054f030
mov ecx, dword [esp + 0x60]
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x64
ret

Function at 0x57dd00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6cbad8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push 0x7e0
lea ecx, [esp + 0x34]
call fcn.0054f000
lea ecx, [esp + 0xc]
mov dword [esp + 0x5c], 0
call fcn.0061aaa0
lea ecx, [esp + 4]
mov byte [esp + 0x5c], 1
call fcn.0061d780
mov al, 2
push 0x14
mov byte [esp + 0x60], al
mov byte [esp + 4], al
mov byte [esp + 5], 1
mov byte [esp + 6], 0x20
call fcn.0041afd0
sub esp, 0x20
lea ecx, [esp + 0x24]
mov eax, esp
mov dword [esp + 0x2c], esp
push 0
push 1
push ecx
push eax
lea ecx, [esp + 0x64]
call fcn.00551050
lea ecx, [esp + 0x30]
call fcn.0061ac40
push 0
push 0
mov ecx, 0x72baa8
call fcn.00623e40
lea ecx, [esp + 4]
mov byte [esp + 0x5c], 1
call fcn.0061d8c0
lea ecx, [esp + 0xc]
mov byte [esp + 0x5c], 0
call fcn.0061ab90
lea ecx, [esp + 0x30]
mov dword [esp + 0x5c], 0xffffffff
call fcn.0054f030
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret
Function at 0x5891c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6cc6f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x6e20a0
lea ecx, [esi + 0x8c]
mov dword [esp + 0x20], 8
call fcn.0061d8c0
mov eax, dword [esi + 0x7c]
push eax
mov dword [esp + 0x18], eax
call fcn.006a64d0
xor ebx, ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov eax, dword [esi + 0x6c]
push eax
mov dword [esp + 0x1c], eax
call fcn.006a64d0
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov eax, dword [esi + 0x5c]
push eax
mov dword [esp + 0x20], eax
call fcn.006a64d0
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov ebp, dword [esi + 0x50]
mov edi, dword [esi + 0x4c]
add esp, 0xc
cmp edi, ebp
mov byte [esp + 0x20], 4
je 0x589266
push ebx
mov ecx, edi
call fcn.00415c90
add edi, 4
cmp edi, ebp
jne 0x589257
mov eax, dword [esi + 0x4c]
push eax
call fcn.006a64d0
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov ebp, dword [esi + 0x40]
mov edi, dword [esi + 0x3c]
add esp, 4
cmp edi, ebp
mov byte [esp + 0x20], 3
je 0x589299
push ebx
mov ecx, edi
call fcn.00415c90
add edi, 4
cmp edi, ebp
jne 0x58928a
mov eax, dword [esi + 0x3c]
push eax
call fcn.006a64d0
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov ebp, dword [esi + 0x30]
mov edi, dword [esi + 0x2c]
add esp, 4
cmp edi, ebp
mov byte [esp + 0x20], 2
je 0x5892cc
push ebx
mov ecx, edi
call fcn.00415c90
add edi, 4
cmp edi, ebp
jne 0x5892bd
mov eax, dword [esi + 0x2c]
push eax
call fcn.006a64d0
lea edi, [esi + 0x18]
add esp, 4
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, edi
mov byte [esp + 0x28], 1
call fcn.00413d20
mov eax, dword [edi + 4]
push eax
call fcn.006a64d0
add esp, 4
lea ecx, [esi + 8]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov byte [esp + 0x20], bl
call fcn.00413420
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.004a4600
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret