joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x403203
pop dword [ebp - 0x14]
mov eax, 0x403203
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x8e9fd3fd
add dword [ebp - 0x24], 0xbfb2714e
mov dword [ebp - 0x20], 0xc0d024
add dword [ebp - 0x20], 0x31727c21
mov dword [ebp - 0x1c], 0xc6decc95
add dword [ebp - 0x1c], 0x856d7799
mov dword [ebp - 0x18], 0x62f6622d
add dword [ebp - 0x18], 0x9d099dd3
lea eax, [ebp - 0x24]
push eax
mov eax, 0x4ee9c194
add eax, 0xb156bef8
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xf034a879
add dword [ebp - 0x24], 0x843dc0dd
mov dword [ebp - 0x20], 0xca4159f5
add dword [ebp - 0x20], 0x772b0780
mov dword [ebp - 0x1c], 0x765ff7e3
sub dword [ebp - 0x1c], 0x12f08b77
mov dword [ebp - 0x18], 0xfded5aac
sub dword [ebp - 0x18], 0xfded5aac
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x240f9eb3
add eax, 0xdc30e221
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x39bad
push 0
call eax
mov ecx, 0x548b
mov esi, eax
mov edi, 0x91df0e53
add edi, 0x6e6201ad
add edi, dword [ebp - 0x14]
mov ebx, 0x64a7f693
add ebx, 0x31544cee
xor dword [ebp - 8], 0x262c711a
mov edx, dword [edi]
mov dword [ebp - 4], 0x6a27225c
sub edx, ebx
sub dword [ebp - 0xc], ecx
mov dword [esi], edx
mov dword [ebp - 4], 0xd447794e
add esi, 0xe2196e1a
sub esi, 0xe2196e16
add edi, 0xc98cdc4a
sub edi, 0xc98cdc46
loop 0x40331a
add eax, 0xea786f9c
sub eax, 0xea772a9d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xaa89e997
add ecx, 0x55b61669
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x402734
Capabilities:
Get common file path
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
xor ebx, ebx
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp ebx, 0x5c9f22f
jg 0x402764
inc ebx
cmp ebx, 0x1fa20be2
jl 0x40274a
cmp dword [0x452344], 0x400
jne 0x4027cc
push 0x448d50
push str.zudutalegexojefupo
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0x400]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push esi
call fcn.00402830
push esi
push esi
call fcn.0040286a
push esi
call fcn.00402b74
pop ecx
pop ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004029ba
fstp st(0)
push esi
call fcn.00402be8
add esp, 0xc
xor ebx, ebx
cmp ebx, 0xd0fe
jge 0x4027dd
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0x58bc6e
jg 0x4027f6
inc ebx
cmp ebx, 0xe52f
jl 0x4027ce
mov eax, dword [0x44b2e4]
mov dword [0x452344], eax
call fcn.004024b5
mov edi, 0x3078f
cmp dword [0x452344], 0x51f
jne 0x402824
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x40280a
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x4059be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44a598]
jne 0x4059c8
repz ret
jmp fcn.0040846a
Function at 0x406d0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44a598]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404270
and dword [ebp - 0x14], 0
cmp dword [0x44cef4], 0
mov dword [ebp - 0x18], eax
jne 0x406dbe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406e66
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406e66
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44cef4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44cef8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44cefc], eax
call edi
push eax
call esi
mov dword [0x44cf04], eax
test eax, eax
je 0x406dbe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44cf00], eax
mov eax, dword [0x44cf00]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406e17
cmp dword [0x44cf04], ecx
je 0x406e17
push eax
call esi
push dword [0x44cf04]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406e17
test ebx, ebx
je 0x406e17
call edi
test eax, eax
je 0x406e0e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406e0e
test byte [ebp - 8], 1
jne 0x406e17
or dword [ebp + 0x10], 0x200000
jmp 0x406e4a
mov eax, dword [0x44cef8]
cmp eax, dword [ebp - 0x18]
je 0x406e4a
push eax
call esi
test eax, eax
je 0x406e4a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406e4a
mov eax, dword [0x44cefc]
cmp eax, dword [ebp - 0x18]
je 0x406e4a
push eax
call esi
test eax, eax
je 0x406e4a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44cef4]
call esi
test eax, eax
je 0x406e66
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406e68
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004059be
leave
ret
Function at 0x407458
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x407467
pop dword [ebp - 0x34]
mov eax, 0xb8d2e7e9
add eax, 0x476d8c7e
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xd45f5687
add dword [ebp - 0x44], 0x79f2eec4
mov dword [ebp - 0x40], 0x30e47b41
add dword [ebp - 0x40], 0x14ed104
mov dword [ebp - 0x3c], 0xc9c7463
add dword [ebp - 0x3c], 0x3fafcfcb
mov dword [ebp - 0x38], 0x3bc8ea26
add dword [ebp - 0x38], 0xc43715da
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x2a32a100
sub dword [ebp - 0x44], 0xb5c037aa
mov dword [ebp - 0x40], 0x9020205c
add dword [ebp - 0x40], 0xb14c4119
mov dword [ebp - 0x3c], 0x3adda65b
add dword [ebp - 0x3c], 0x2891c611
mov dword [ebp - 0x38], 0x84079bd7
sub dword [ebp - 0x38], 0x84079bd7
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3a574
push 0
call eax
mov ecx, 0x54f5
mov ebx, eax
mov esi, 0xfcc6844f
sub esi, 0xfc80f24f
add esi, dword [ebp - 0x34]
mov edi, 0x498d166d
sub edi, 0x22b639dc
sub dword [ebp - 0x24], esi
mov edx, dword [esi]
xor dword [ebp - 4], edx
add edx, edi
xor dword [ebp - 0x28], eax
mov dword [ebx], edx
add dword [ebp - 0x2c], 0xb7a5c7f5
add ebx, 0x91cd8f48
sub ebx, 0x91cd8f44
add esi, 0x36ef6e1b
sub esi, 0x36ef6e17
loop 0x407579
add eax, 0xbc70e62d
add eax, 0x4390607a
xor ebx, ebx
add ebx, eax
add eax, 0x1ed9aa7d
add eax, 0xe1265588
mov ecx, 0xd5965a07
sub ecx, 0xd5565a07
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x404c3a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004058f2
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00404d9a
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x404d84
test ebx, ebx
jl 0x404d28
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcbb09e
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x404d49
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x404d3b
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0040670a
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0040670a
add esp, 8
mov ebx, 0x80070057
jmp 0x404d28

Function at 0x417810
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x10
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x1c]
mov ebx, eax
test esi, esi
je 0x417881
push edi
mov edi, dword [esp + 0x24]
push edi
push 0
push 0
mov dword [esi], edi
call dword [sym.imp.GDI32.dll_CreatePen]
mov dword [esi + 4], eax
lea eax, [esp + 0xc]
push eax
push ebx
mov dword [esp + 0x18], 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea ecx, [esp + 0x10]
mov ebx, eax
push ecx
mov dword [esp + 0x18], edi
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
test ebx, ebx
mov dword [esi + 8], eax
pop edi
je 0x417879
mov edx, dword [0x4c4a7c]
push 0x4c476c
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret
Function at 0x41b84a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0041c502
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0041b9aa
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41b994
test ebx, ebx
jl 0x41b938
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcd1cae
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41b959
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x41b94b
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0041d31a
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0041d31a
add esp, 8
mov ebx, 0x80070057
jmp 0x41b938
Function at 0x4324da
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00433192
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0043263a
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x432624
test ebx, ebx
jl 0x4325c8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce893e
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4325e9
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4325db
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00433faa
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00433faa
add esp, 8
mov ebx, 0x80070057
jmp 0x4325c8
Function at 0x448d1a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004499d2
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00448e7a
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x448e64
test ebx, ebx
jl 0x448e08
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcff17e
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x448e29
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x448e1b
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0044a7ea
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0044a7ea
add esp, 8
mov ebx, 0x80070057
jmp 0x448e08
Function at 0x45f57a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00460232
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0045f6da
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45f6c4
test ebx, ebx
jl 0x45f668
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd159de
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45f689
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x45f67b
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0046104a
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0046104a
add esp, 8
mov ebx, 0x80070057
jmp 0x45f668
Function at 0x47617a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00476e32
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004762da
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4762c4
test ebx, ebx
jl 0x476268
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2c5de
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x476289
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x47627b
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00477c4a
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00477c4a
add esp, 8
mov ebx, 0x80070057
jmp 0x476268