joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b6f90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7756d8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
push esi
push ecx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], esi
mov dword [esp + 0x34], eax
call fcn.004b3e00
mov eax, dword [edi + 0x2868]
xor ecx, ecx
cmp eax, esi
setle cl
lea edx, [esp + 0xc]
push edx
sub ecx, 1
and ecx, eax
call fcn.004b6ec0
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004b2640
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 8

Function at 0x4b9b40
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
mov edi, edx
mov edx, dword [eax + 0x20]
call edx
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
push 0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push edi
push 1
push ecx
push edx
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
pop edi
pop esi
add esp, 8
ret

Function at 0x4bf090
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
push 0
push 1
lea eax, [esp + 0x10]
mov esi, edx
push eax
lea edx, [esp + 0x10]
push edx
push ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call sub.Storm.dll_Ordinal_279
test eax, eax
je 0x4bf0da
mov edx, 0x799ba0
mov ecx, esi
call fcn.004bde00
mov esi, eax
test esi, esi
jne 0x4bf0e1
mov eax, dword [esp + 4]
push eax
call sub.Storm.dll_Ordinal_280
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
push 1
push ecx
push edx
call dword [sym.imp.MSVCR80.dll_fwrite]
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
mov eax, dword [esp + 0x18]
add esp, 0x14
push eax
call sub.Storm.dll_Ordinal_280
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x4dcc80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x776908
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x14]
mov dword [esp + 0x30], esi
call fcn.004dcbb0
test eax, eax
jne 0x4dccea
mov ecx, dword [edi]
cmp ecx, esi
je 0x4dcd02
call fcn.0040b030
jmp 0x4dcd02
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 8]
push edx
mov edx, dword [esp + 0x10]
push edi
push eax
lea ecx, [esp + 0x1c]
call fcn.004dc3b0
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x4dcd18
push esi
push 0xfffffffffffffffe
push str.._AVCImVector_NTempest__
push eax
call sub.Storm.dll_Ordinal_403
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 8

Function at 0x4dec40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x776b88
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CProgressDialog.0
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004156a0
mov ecx, dword [esi + 0x34]
push ecx
mov ecx, dword [esi + 4]
call fcn.004156a0
mov edx, dword [esi + 0x38]
mov ecx, dword [esi + 4]
push edx
call fcn.004156a0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4decaa
mov ecx, dword [esi + 4]
push eax
call fcn.004156a0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004df3b0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x5039b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
shr esi, 2
xor eax, eax
and edx, 3
test esi, esi
je 0x5039d4
push edi
mov edi, dword [ecx]
xor edi, eax
sub esi, 1
rol edi, 3
add ecx, 4
test esi, esi
mov eax, edi
jne 0x5039c0
pop edi
test edx, edx
je 0x5039ec
movzx esi, byte [ecx]
xor esi, eax
sub edx, 1
rol esi, 3
add ecx, 1
test edx, edx
mov eax, esi
jne 0x5039d8
pop esi
ret
Function at 0x5081d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x128
mov eax, dword [0x84dea4]
xor eax, esp
mov dword [esp + 0x124], eax
push ebp
mov ebp, ecx
push esi
mov esi, dword [esp + 0x134]
mov dword [esp + 8], ebp
call fcn.00507f10
test eax, eax
jne 0x508206
mov eax, 1
jmp 0x5083e1
push ebx
push Ordinal_2
push esi
lea eax, [esp + 0x34]
push eax
call sub.Storm.dll_Ordinal_501
mov edx, str..wts
lea ecx, [esp + 0x2c]
call fcn.004bc990
mov edx, 0x799ba0
lea ecx, [esp + 0x2c]
call fcn.004bde00
mov ebx, eax
xor esi, esi
cmp ebx, esi
jne 0x508242
xor eax, eax
jmp 0x5083e0
push edi
push ebx
push 3
push 1
push 0x7b7f18
call dword [sym.imp.MSVCR80.dll_fwrite]
mov eax, dword [ebp + 4]
xor edx, edx
xor edi, edi
add esp, 0x10
cmp eax, edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], edx
jle 0x50831b
xor ecx, ecx
mov dword [esp + 0x24], ecx
jmp 0x508294
mov ebp, dword [esp + 0x10]
mov ebp, dword [ebp + 8]
cmp dword [ecx + ebp + 4], 0
jle 0x508302
lea ebp, [edi + 1]
cmp ebp, dword [esp + 0x14]
jbe 0x5082e5
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x5082bb
push ebp
lea ecx, [esp + 0x18]
call fcn.00507b60
mov ecx, eax
xor edx, edx
mov eax, ebp
div ecx
test edx, edx
je 0x5082cb
sub ecx, edx
add ecx, ebp
mov ebp, ecx
push ebp
lea ecx, [esp + 0x18]
call fcn.00507bc0
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x10]
lea eax, [esi + edi*8]
mov dword [eax], edx
mov ebp, dword [ebp + 8]
mov ebp, dword [ecx + ebp]
add edi, 1
mov dword [eax + 4], ebp
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], edi
add edx, 1
add ecx, 0x144
cmp edx, eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], ecx
jl 0x508290
push 0x507a20
push 8
push edi
push esi
call dword [sym.imp.MSVCR80.dll_qsort]
add esp, 0x10
xor ebp, ebp
test edi, edi
jle 0x5083bd
mov edi, dword [sym.imp.MSVCR80.dll_fprintf]
lea ecx, [ecx]
mov esi, dword [esi + ebp*8]
mov ecx, dword [esp + 0x10]
imul esi, esi, 0x144
mov edx, dword [ecx + 8]
mov eax, dword [edx + esi]
push eax
push str.STRING
push str._s__d_r_n
push ebx
call edi
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx + 8]
lea eax, [edx + esi + 0x18]
add esp, 0x10
cmp byte [eax], 0
je 0x508385
push eax
push 0x7b7ec8
push str._s__s_r_n
push ebx
call edi
add esp, 0x10
push 0x7b
push str._c_r_n
push ebx
call edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + esi + 0x10]
push edx
push 0x799ef4
push ebx
call edi
push 0x7d
push str._r_n_c_r_n_r_n
push ebx
call edi
mov esi, dword [esp + 0x40]
add ebp, 1
add esp, 0x24
cmp ebp, dword [esp + 0x18]
jl 0x508340
push ebx
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
test esi, esi
pop edi
je 0x5083db
push 0
push 0xfffffffffffffffe
push str.._AUStringSortInfo__
push esi
call sub.Storm.dll_Ordinal_403
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x12c]
pop esi
pop ebp
xor ecx, esp
call fcn.00735f58
add esp, 0x128
ret 4
Function at 0x50c690
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x777ec2
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x834], ebx
mov dword [esi + 0x838], ebx
mov dword [esi + 0x83c], ebx
mov dword [esi + 0x840], ebx
push ebx
push 0x2a
push str..CTriggers.cpp
push 0x18
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x84c], ebx
mov dword [esi + 0x30], ebx
call sub.Storm.dll_Ordinal_401
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 3
je 0x50c729
push esi
mov ecx, eax
call fcn.005c1b60
jmp 0x50c72b
xor eax, eax
mov dword [esi + 0x20], eax
or eax, 0xffffffff
mov ecx, esi
mov byte [esp + 0x20], 2
mov dword [esi + 0x28], ebx
mov dword [esi + 0x844], eax
mov dword [esi + 0x848], eax
mov byte [esi + 0x34], bl
call fcn.0050c670
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x517fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x178
fldz
push esi
fst dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x184]
fst dword [esp + 0x24]
fst dword [esp + 0x28]
mov esi, ecx
fst dword [esp + 0x2c]
lea edx, [esp + 0x20]
fst dword [esp + 0x30]
mov ecx, edi
fst dword [esp + 0x34]
fst dword [esp + 0x38]
fst dword [esp + 0x3c]
fst dword [esp + 0x40]
fst dword [esp + 0x44]
fst dword [esp + 0x48]
fst dword [esp + 0x4c]
fst dword [esp + 0x50]
fst dword [esp + 0x54]
fst dword [esp + 0x58]
fst dword [esp + 0x5c]
fst dword [esp + 0x60]
fst dword [esp + 0x64]
fst dword [esp + 0x68]
fst dword [esp + 0x6c]
fst dword [esp + 0x70]
fst dword [esp + 0x74]
fst dword [esp + 0x78]
fstp dword [esp + 0x7c]
call fcn.005ed1d0
lea ecx, [esp + 0x80]
call fcn.00517020
lea eax, [esp + 0x80]
push eax
mov edx, 8
lea ecx, [esp + 0x24]
call fcn.005ed3c0
cmp dword [esi + 0x3ad0], 0
mov ecx, dword [edi + 0x54]
mov edx, dword [edi + 0x58]
mov eax, dword [edi + 0x5c]
mov dword [esp + 8], ecx
mov ecx, dword [edi + 0x28]
mov dword [esp + 0xc], edx
mov edx, dword [edi + 0x2c]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x30]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
je 0x5180c3
push ebx
call fcn.00710f30
lea edi, [esi + 0x3ac8]
mov ebx, 2
mov ecx, dword [edi]
test ecx, ecx
je 0x5180ba
fld dword [esp + 0x18c]
push ecx
fstp dword [esp]
call fcn.005e0740
add edi, 4
sub ebx, 1
jne 0x5180a4
pop ebx
mov ecx, dword [esi + 0x3ad8]
test ecx, ecx
je 0x5180e6
cmp dword [esi + 0x3adc], 0
je 0x5180e6
fld dword [esp + 0x188]
push ecx
fstp dword [esp]
call fcn.005e0910
fld dword [esp + 0x188]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xc]
push edx
push ecx
fstp dword [esp]
call fcn.006f5400
mov ecx, eax
call fcn.006f5130
mov ecx, dword [esi + 0x38e0]
lea eax, [esp + 0x80]
push eax
call fcn.005dac30
fld dword [esp + 0x188]
push ecx
fstp dword [esp]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x38e0]
lea edx, [esp + 0x10]
push edx
call fcn.005da260
mov ecx, dword [esi + 0x38e4]
lea eax, [esp + 0x80]
push eax
call fcn.005ecd70
fld dword [esp + 0x188]
mov ecx, dword [esi + 0x38e4]
mov edx, dword [ecx]
mov edx, dword [edx + 0x9c]
push ecx
fstp dword [esp]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push eax
call edx
mov ecx, dword [esi + 0x38e8]
lea eax, [esp + 0x80]
push eax
call fcn.005ecd70
fld dword [esp + 0x188]
mov ecx, dword [esi + 0x38e8]
mov edx, dword [ecx]
mov edx, dword [edx + 0x9c]
push ecx
fstp dword [esp]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push eax
call edx
mov ecx, dword [esi + 0x38f4]
lea eax, [esp + 0x80]
push eax
call fcn.005ecd70
fld dword [esp + 0x188]
mov ecx, dword [esi + 0x38f4]
mov edx, dword [ecx]
mov edx, dword [edx + 0x9c]
push ecx
fstp dword [esp]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push eax
call edx
mov ecx, dword [esi + 0x38ec]
lea eax, [esp + 0x80]
push eax
call fcn.0054c4b0
pop edi
pop esi
add esp, 0x178
ret 8
Function at 0x51b360
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x7789e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
push eax
call fcn.00521170
mov eax, dword [esp + 0x20]
mov dword [esi], vtable.CToolMenu.0
mov edx, dword [eax + 0x10]
add edx, 0x528
mov dword [esi + 8], edx
mov edx, dword [eax + 0x20]
mov edx, dword [edx + 0x14]
mov dword [esi + 0xc], edx
mov edx, dword [eax + 0x34]
add edx, 0x210
mov dword [esi + 0x10], edx
mov edx, dword [eax + 0x44]
mov edx, dword [edx + 8]
mov dword [esi + 0x14], edx
mov edx, dword [eax + 0x34]
add edx, 0x318
mov dword [esi + 0x18], edx
mov edx, dword [eax + 0x44]
mov edx, dword [edx + 0xc]
mov dword [esi + 0x1c], edx
mov edx, dword [eax + 0x34]
xor ecx, ecx
add edx, 0x420
mov dword [esi + 0x20], edx
mov eax, dword [eax + 0x44]
mov edx, dword [eax + 0x10]
mov eax, 1
mov dword [esp + 0x14], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x3c], ecx
mov ecx, esi
mov dword [esi + 0x24], edx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], 4
call fcn.0051b020
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8

Function at 0x51bbe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x778a48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x10], vtable.CDataStore.0
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0xffffffff
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x34], esi
call fcn.0051ba60
push esi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], esi
call fcn.0042c7d0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push eax
push ecx
push esi
push str.Tool_Windows
push str.WorldEdit
call sub.Storm.dll_Ordinal_424
cmp dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x10], vtable.CDataStore.0
je 0x51bc96
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1c]
call dword [0x799f80]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x51e6a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x778c8a
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
fld dword [0x83c898]
mov dword [esi + 0x2c], 0xffffffff
mov eax, 0xdeadbeef
xor edi, edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
fst dword [esi + 0x4c]
fst dword [esi + 0x50]
lea ecx, [esi + 0x5c]
fst dword [esi + 0x54]
fstp dword [esi + 0x58]
call fcn.00513aa0
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18c], edi
mov dword [esi + 0x190], edi
mov dword [esi + 0x194], edi
mov dword [esi + 0x198], edi
mov ax, word [esp + 0x28]
push edi
push 0x3d
push str..CBrushTree.cpp
push 0x9c
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 8], edi
mov dword [esi + 0x180], edi
mov dword [esi + 0x184], edi
mov dword [esi + 0x188], edi
mov dword [esi + 0x18], 1
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov word [esi], ax
call sub.Storm.dll_Ordinal_401
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], eax
cmp eax, edi
mov byte [esp + 0x1c], 2
je 0x51e797
movsx ecx, word [esi]
mov edx, dword [esp + 0x24]
push 0x180000
push ecx
push edx
mov ecx, eax
call fcn.00416c00
jmp 0x51e799
xor eax, eax
push esi
push 0x51e2c0
mov ecx, eax
mov byte [esp + 0x24], 1
mov dword [esi + 4], eax
call fcn.0040abf0
mov ecx, dword [esi + 4]
push esi
push 0x51c900
call fcn.0040c090
mov ecx, dword [esi + 4]
push edi
call fcn.0040ad30
mov edx, 1
lea ecx, [esp + 0x28]
call fcn.00411ce0
mov ecx, dword [esi + 4]
push eax
call fcn.0040b8d0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 8
Function at 0x520410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x778e69
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 4]
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], ecx
not ecx
mov dword [esi], eax
mov dword [esi + 8], ecx
fldz
fst dword [esi + 0x24]
lea ecx, [esi + 0x38]
fst dword [esi + 0x28]
mov dword [esp + 0x1c], eax
fst dword [esi + 0x2c]
fst dword [esi + 0x30]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
fst dword [esp + 0xc]
mov edx, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld1
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x10]
fstp dword [esi + 0x34]
mov byte [esp + 0x1c], 3
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], edx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
call fcn.004dff30
mov ecx, esi
call fcn.0051f860
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret

Function at 0x521760
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x778f2c
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
fldz
xor edi, edi
fst dword [esi + 0x10]
mov eax, 0xdeadbeef
fst dword [esi + 0x14]
fst dword [esi + 0x18]
fld dword [0x83c974]
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
fst dword [esi + 0x48]
fst dword [esi + 0x4c]
fst dword [esi + 0x50]
fstp dword [esi + 0x54]
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
fst dword [esp + 0x18]
mov eax, dword [esp + 0x18]
fst dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
fstp dword [esp + 0x20]
mov edx, dword [esp + 0x20]
push edi
push 0x22
mov dword [esi + 0x10], eax
push 0x7ba600
mov dword [esi + 0x14], ecx
push 0x74
mov dword [esp + 0x3c], edi
mov dword [esi + 0xc], edi
mov dword [esi], edi
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 8], 1
mov dword [esi + 4], edi
mov dword [esi + 0x24], 0xffffffff
call sub.Storm.dll_Ordinal_401
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
cmp eax, edi
mov byte [esp + 0x2c], 1
je 0x521841
mov ecx, eax
call fcn.005559b0
jmp 0x521843
xor eax, eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x28], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret
Function at 0x523ea0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x7790cf
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x24]
push eax
call fcn.00521170
xor edi, edi
mov dword [esi], vtable.CWEModule.0
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
push edi
push 0x22
push str..CWEModule.cpp
push 0x64
mov dword [esi + 0x80], 1
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
call sub.Storm.dll_Ordinal_401
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], eax
cmp eax, edi
mov byte [esp + 0x1c], 3
je 0x523f6e
push 2
push edi
mov ecx, eax
call fcn.00415ce0
jmp 0x523f70
xor eax, eax
push esi
push 0x523230
mov ecx, eax
mov byte [esp + 0x24], 2
mov dword [esi + 8], eax
call fcn.0040a9a0
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 4]
mov edx, 0x7adf98
call fcn.0040cb90
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x64], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4
Function at 0x5352a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x779b28
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
fldz
xor eax, eax
fst dword [esi + 0xc]
fst dword [esi + 0x10]
fst dword [esi + 0x14]
fst dword [esi + 0x1c]
fst dword [esi + 0x20]
fst dword [esi + 0x24]
fld1
fst dword [esi + 0x28]
fst dword [esi + 0x38]
fstp dword [esi + 0x48]
fst dword [esi + 0x2c]
fst dword [esi + 0x30]
fst dword [esi + 0x34]
fst dword [esi + 0x3c]
fst dword [esi + 0x40]
fst dword [esi + 0x44]
fst dword [esi + 0x4c]
fst dword [esi + 0x50]
fst dword [esi + 0x54]
fst dword [esi + 0x68]
fst dword [esi + 0x6c]
fst dword [esi + 0x70]
fst dword [esi + 0x74]
fst dword [esi + 0x78]
fst dword [esi + 0x7c]
mov dword [esi + 0x80], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xe0], eax
mov dword [esi + 0xe4], eax
mov dword [esi + 0xe8], eax
mov dword [esi + 0xec], eax
mov dword [esi + 0xf8], eax
mov dword [esi + 0xfc], eax
mov dword [esi + 0x100], eax
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], eax
mov dword [esi + 0x10c], eax
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x128], eax
mov dword [esi + 0x12c], eax
mov dword [esi + 0x130], eax
mov dword [esi + 0x134], eax
mov dword [esi + 0x15c], eax
mov dword [esi + 0x160], eax
mov dword [esi + 0x164], eax
mov dword [esi + 0x168], eax
fst dword [esi + 0x16c]
fst dword [esi + 0x170]
fstp dword [esi + 0x174]
mov dword [esi + 0x178], eax
mov dword [esi + 0x17c], eax
mov dword [esi + 0x180], eax
mov dword [esi + 0x184], eax
mov eax, dword [esp + 0x1c]
push eax
mov byte [esp + 0x18], 3
call fcn.00535030
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4