joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ecd15c
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fd90b4
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push esi
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x45ecd346
mov al, byte [0x4603ba49]
test al, al
jne 0x45ecd191
cmp dword [ebp + 0xc], ebx
je 0x45ecd38e
mov al, byte [0x4603ba49]
test al, al
jne 0x45ecd1a3
push 7
pop esi
lea eax, [esp + 0x60]
push eax
mov dword [esp + 0x38], 0x1aa7
mov dword [esp + 0x3c], 0x1aa6
mov dword [esp + 0x40], 0x6d64
mov dword [esp + 0x2c], 6
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 9
call fcn.45e2853c
mov dword [esp + 0x98], ebx
push dword [ebp + 8]
lea eax, [esp + 0x1c]
push eax
call fcn.45e1198f
mov byte [esp + 0x98], 1
push ebx
push dword [esp + 0x1c]
lea ecx, [esp + 0x68]
call fcn.45eea611
mov eax, dword [0x4603911c]
pop ecx
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x98], 2
push dword [ebp + 8]
lea ecx, [esp + 0x64]
sub esp, 0x2c
mov eax, esp
mov dword [esp + 0x44], esp
push eax
call fcn.45e275e2
mov byte [esp + 0xc8], 3
lea eax, [esp + 0x54]
push eax
mov byte [esp + 0xcc], 2
call fcn.45eea345
add esp, 0x34
mov byte [esp + 0x98], 4
push dword [eax]
lea eax, [esp + 0x14]
push 1
push 0x1aa5
push eax
call fcn.45f8c705
mov byte [esp + 0xa8], 2
mov eax, dword [esp + 0x34]
add eax, 0xfffffff4
push eax
call fcn.45f8f362
add esp, 0x14
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x24]
push eax
push 9
push esi
push 3
push 6
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x50]
push eax
push 3
push 0x45dcc110
push dword [esp + 0x38]
mov byte [esp + 0x3a], bl
push 0x7f03
push ebx
mov dword [esp + 0x54], esi
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
mov ecx, 0x1aa8
mov edx, 0x80d
call fcn.45f304db
cmp byte [esp + 0x3e], bl
mov ecx, dword [ebp + 0xc]
sete al
cmp dword [esp + 0x50], 6
mov byte [ecx], al
sete byte [esp + 0x3f]
mov byte [esp + 0xc8], 1
mov eax, dword [esp + 0x40]
add eax, 0xfffffff4
push eax
call fcn.45f8f362
add esp, 0x34
mov byte [esp + 0x98], bl
lea ecx, [esp + 0x18]
call fcn.45e26349
or dword [esp + 0x98], 0xffffffff
lea eax, [esp + 0x60]
push eax
call fcn.45e284c6
mov al, byte [esp + 0xf]
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 0x1c]
push eax
push 0x281e
push 0x45dcb69c
mov esi, 0x80004005
push esi
mov dword [esp + 0x2c], ebx
call fcn.45f85675
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov dword [esp + 0x48], eax
mov dword [esp + 0x40], 0x45dc096c
mov dword [esp + 0x44], esi
mov dword [esp + 0x4c], ebx
push 0x45ff0f98
lea eax, [esp + 0x44]
push eax
call fcn.45fb1416
lea eax, [esp + 0x14]
push eax
push 0x281f
push 0x45dcb69c
mov esi, 0x80004005
push esi
mov dword [esp + 0x24], ebx
call fcn.45f85675
mov eax, dword [esp + 0x24]
add esp, 0x10
mov dword [esp + 0x58], eax
mov dword [esp + 0x50], 0x45dc096c
mov dword [esp + 0x54], esi
mov dword [esp + 0x5c], ebx
push 0x45ff0f98
lea eax, [esp + 0x54]
jmp 0x45ecd388
Function at 0x45ece62b
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fee94e
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
push dword [ebp + 8]
lea eax, [esp + 0x54]
push eax
call fcn.45e281e2
xor ebx, ebx
mov dword [esp + 0x88], ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x54]
call fcn.45f3ce4d
mov byte [esp + 0x88], 1
mov eax, dword [0x4603911c]
mov dword [esp + 8], eax
mov byte [esp + 0x88], 2
mov eax, dword [0x4603911c]
mov dword [esp + 0x14], eax
mov byte [esp + 0x88], 3
lea eax, [esp + 0x24]
push eax
call fcn.45e2853c
mov byte [esp + 0x88], 4
mov eax, dword [0x4603911c]
mov dword [esp + 0x10], eax
mov byte [esp + 0x88], 5
mov eax, dword [0x4603911c]
mov dword [esp + 0xc], eax
mov byte [esp + 0x88], 6
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x64]
mov byte [esp + 0x2c], 1
mov byte [esp + 0x30], bl
call fcn.45ecf978
test al, al
je 0x45ece714
mov byte [esp + 0x1c], 1
mov ecx, dword [esp + 8]
push 6
pop eax
cmp dword [ecx - 8], ebx
je 0x45ece723
push 3
pop eax
push ebx
push dword [ebp + 0xc]
lea ecx, [esp + 0x2c]
push eax
push dword [esp + 0x24]
lea eax, [esp + 0x20]
push dword [esp + 0x2c]
push eax
sub esp, 0x2c
mov eax, esp
mov dword [esp + 0x60], esp
push eax
call fcn.45e275e2
mov byte [esp + 0xcc], 7
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x70]
push eax
mov byte [esp + 0xdc], 6
call fcn.45ece103
mov byte [esp + 0x88], 5
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.45f8f362
pop ecx
mov byte [esp + 0x88], 4
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.45f8f362
pop ecx
mov byte [esp + 0x88], 3
lea eax, [esp + 0x24]
push eax
call fcn.45e284c6
mov byte [esp + 0x88], 2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.45f8f362
pop ecx
mov byte [esp + 0x88], 1
mov eax, dword [esp + 8]
add eax, 0xfffffff4
push eax
call fcn.45f8f362
pop ecx
mov byte [esp + 0x88], bl
mov eax, dword [esp + 0x20]
add eax, 0xfffffff4
push eax
call fcn.45f8f362
pop ecx
or dword [esp + 0x88], 0xffffffff
lea eax, [esp + 0x50]
push eax
call fcn.45e284c6
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45ee0459
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fbc961
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push dword [ebp + 8]
mov esi, dword [0x4603ba4c]
lea eax, [esp + 0x10]
push eax
call fcn.45e11d17
and dword [esp + 0x30], 0
cmp dword [esp + 0xc], 0
je 0x45ee04e1
mov al, byte [0x4603ba49]
test al, al
jne 0x45ee049d
push dword [ebp + 0xc]
mov ecx, esi
push dword [esp + 0x10]
call fcn.45ee0c32
mov esi, eax
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.45df1a56
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
push 0x48
push 0x45dcca00
mov esi, 0x80004005
push esi
call fcn.45f85675
mov eax, dword [esp + 0x20]
and dword [esp + 0x30], 0
add esp, 0x10
mov dword [esp + 0x1c], eax
push 0x45ff0f98
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x45dc096c
mov dword [esp + 0x20], esi
call fcn.45fb1416
int3
Function at 0x45eeca16
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fdd868
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call fcn.45e11a70
and dword [esp + 0x30], 0
push dword [ebp + 0xc]
lea eax, [esp + 0x10]
call fcn.45e11c6d
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [ebp + 0x10]
lea edx, [esp + 0x14]
call fcn.45ee7e11
mov bl, al
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.45e11aad
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x45eeca9a
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fdd868
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [0x4603ba4c]
lea eax, [esp + 0xc]
push eax
call fcn.45e11a70
and dword [esp + 0x30], 0
push dword [ebp + 8]
lea eax, [esp + 0x10]
call fcn.45e11c6d
push dword [ebp + 0x14]
lea edx, [esp + 0x10]
push dword [ebp + 0x10]
mov ecx, esi
call fcn.45ee8bf3
mov bl, al
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.45e11aad
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45ef2b47
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fbf782
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
call fcn.45ef267b
mov esi, eax
cmp esi, 0xffffffff
jne 0x45ef2b8f
push 0xc9
push 0x45dcda10
call fcn.45f85b90
mov dword [esp + 0x10], esi
xor edx, edx
mov dword [esp + 0x20], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], edx
mov ecx, dword [eax - 8]
push edx
lea edi, [ecx + ecx]
lea ecx, [esp + 0x10]
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x45ef2bc2
push 0xd3
jmp 0x45ef2b85
cmp edi, dword [esp + 0xc]
je 0x45ef2bdc
push 0xd7
push 0x45dcda10
push 0x80004005
call fcn.45f85378
or dword [esp + 0x20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45ef2bff
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fcb024
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x46039020]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push esi
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov esi, edx
mov dword [esp + 0x14], ecx
call fcn.45f8f38d
mov ecx, esi
call fcn.45ef2588
mov esi, eax
cmp esi, 0xffffffff
jne 0x45ef2c68
push 0xe5
push 0x45dcda10
call fcn.45f85b90
mov dword [esp + 0x18], esi
and dword [esp + 0x248], 0
or dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45ef2c9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x45ef2c9d
push 0xef
jmp 0x45ef2c5e
test bl, 1
jne 0x45ef2d4f
test ebx, ebx
je 0x45ef2d4f
cmp dword [esp + 0xc], 0
jne 0x45ef2d4f
cmp ebx, 0x212
jae 0x45ef2d4f
xor ecx, ecx
and dword [esp + 0x10], ecx
mov eax, ebx
shr eax, 1
push ecx
mov word [esp + eax*2 + 0x20], cx
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45ef2cf5
push 0x100
jmp 0x45ef2c5e
cmp ebx, dword [esp + 0x10]
je 0x45ef2d0f
push 0x104
push 0x45dcda10
push 0x80004005
call fcn.45f85378
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.45f8f58f
or dword [esp + 0x248], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.45fa9e5d
mov esp, ebp
pop ebp
ret
push 0xf9
jmp 0x45ef2d00
Function at 0x45ef2d5b
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x28c
mov eax, 0x45fd60d7
call fcn.45fb1a70
mov eax, dword [ecx]
mov esi, edx
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x234], ecx
call dword [eax + 0x74]
mov ecx, esi
call fcn.45ef2588
mov ebx, eax
or esi, 0xffffffff
cmp ebx, esi
je 0x45ef2eba
mov dword [ebp - 0x240], ebx
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x230]
push eax
push ebx
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x230], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x238], eax
cmp eax, esi
je 0x45ef2eb0
cmp eax, 0x212
jae 0x45ef2eb0
cmp dword [ebp - 0x230], edi
jne 0x45ef2eb0
cmp eax, 0xc
jb 0x45ef2eb0
test al, 1
jne 0x45ef2eb0
push edi
lea ecx, [ebp - 0x22c]
push ecx
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45ef2eb0
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0x238]
jne 0x45ef2eb0
push 0xa
pop ecx
mov edi, 0x45db950c
lea esi, [ebp - 0x228]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x45ef2e36
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x45ef2e40
or dword [ebp - 4], 0xffffffff
jmp 0x45ef2eb3
shr eax, 1
sub eax, 5
xor ecx, ecx
mov word [ebp + eax*2 - 0x21e], cx
mov ecx, dword [ebp - 0x23c]
mov eax, dword [ecx]
lea edx, [ebp - 0x298]
push edx
call dword [eax + 0x1bc]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x21e]
push ecx
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.45f4114c
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x234]
call fcn.45e284a9
mov byte [ebp - 4], 1
lea eax, [ebp - 0x26c]
push eax
call fcn.45e284c6
mov byte [ebp - 4], 0
lea eax, [ebp - 0x298]
push eax
call fcn.45e284c6
jmp 0x45ef2e3a
mov dword [ebp - 4], esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.45fb1b02
ret
Function at 0x45ef3cd2
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fbf6f4
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
call fcn.45dda8a1
and dword [esp + 0x30], 0
cmp dword [esi + 4], 0
je 0x45ef3d62
mov al, byte [0x4603ba49]
test al, al
jne 0x45ef3d0f
push dword [ebp + 0x20]
mov eax, dword [esi + 4]
push dword [ebp + 0x1c]
mov ecx, dword [eax]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [ecx + 0x34]
mov esi, eax
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.45dda946
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x1c
and dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 0x149
push 0x45dcdab4
mov esi, 0x80004005
push esi
call fcn.45f85675
mov eax, dword [esp + 0x18]
and dword [esp + 0x30], 0
add esp, 0x10
mov dword [esp + 0x1c], eax
push 0x45ff0f98
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x45dc096c
mov dword [esp + 0x20], esi
call fcn.45fb1416
int3

Function at 0x45ef40a6
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fbf6f4
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
call fcn.45dda8a1
and dword [esp + 0x30], 0
cmp dword [esi + 4], 0
je 0x45ef412d
mov al, byte [0x4603ba49]
test al, al
jne 0x45ef40e3
push dword [ebp + 0x14]
mov eax, dword [esi + 4]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [ecx + 0x50]
mov esi, eax
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.45dda946
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
and dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 0x269
push 0x45dcdab4
mov esi, 0x80004005
push esi
call fcn.45f85675
mov eax, dword [esp + 0x18]
and dword [esp + 0x30], 0
add esp, 0x10
mov dword [esp + 0x1c], eax
push 0x45ff0f98
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x45dc096c
mov dword [esp + 0x20], esi
call fcn.45fb1416
int3
Function at 0x45ef440b
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fbf6f4
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
call fcn.45dda8a1
and dword [esp + 0x30], 0
cmp dword [esi + 4], 0
je 0x45ef4492
mov al, byte [0x4603ba49]
test al, al
jne 0x45ef4448
push dword [ebp + 0x14]
mov eax, dword [esi + 4]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [ecx + 0x40]
mov esi, eax
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.45dda946
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
and dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 0x2f3
push 0x45dcdab4
mov esi, 0x80004005
push esi
call fcn.45f85675
mov eax, dword [esp + 0x18]
and dword [esp + 0x30], 0
add esp, 0x10
mov dword [esp + 0x1c], eax
push 0x45ff0f98
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x45dc096c
mov dword [esp + 0x20], esi
call fcn.45fb1416
int3

Function at 0x45ef44e2
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fbf6f4
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
call fcn.45dda8a1
and dword [esp + 0x30], 0
cmp dword [esi + 4], 0
je 0x45ef4569
mov al, byte [0x4603ba49]
test al, al
jne 0x45ef451f
push dword [ebp + 0x14]
mov eax, dword [esi + 4]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [ecx + 0x74]
mov esi, eax
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.45dda946
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
and dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 0x308
push 0x45dcdab4
mov esi, 0x80004005
push esi
call fcn.45f85675
mov eax, dword [esp + 0x18]
and dword [esp + 0x30], 0
add esp, 0x10
mov dword [esp + 0x1c], eax
push 0x45ff0f98
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x45dc096c
mov dword [esp + 0x20], esi
call fcn.45fb1416
int3
Function at 0x45ef45b9
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fbf6f4
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
call fcn.45dda8a1
and dword [esp + 0x30], 0
cmp dword [esi + 4], 0
je 0x45ef463d
mov al, byte [0x4603ba49]
test al, al
jne 0x45ef45f6
push dword [ebp + 0x10]
mov eax, dword [esi + 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push dword [ebp + 8]
push eax
call dword [ecx + 0x4c]
mov esi, eax
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.45dda946
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
and dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 0x31a
push 0x45dcdab4
mov esi, 0x80004005
push esi
call fcn.45f85675
mov eax, dword [esp + 0x18]
and dword [esp + 0x30], 0
add esp, 0x10
mov dword [esp + 0x1c], eax
push 0x45ff0f98
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x45dc096c
mov dword [esp + 0x20], esi
call fcn.45fb1416
int3

Function at 0x45ef4897
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fbf6f4
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
call fcn.45dda8a1
and dword [esp + 0x30], 0
cmp dword [esi + 4], 0
je 0x45ef4921
mov al, byte [0x4603ba49]
test al, al
jne 0x45ef48d4
push dword [ebp + 0x18]
mov eax, dword [esi + 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [ecx + 0x64]
mov esi, eax
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.45dda946
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
and dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 0x367
push 0x45dcdab4
mov esi, 0x80004005
push esi
call fcn.45f85675
mov eax, dword [esp + 0x18]
and dword [esp + 0x30], 0
add esp, 0x10
mov dword [esp + 0x1c], eax
push 0x45ff0f98
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x45dc096c
mov dword [esp + 0x20], esi
call fcn.45fb1416
int3
Function at 0x45ef4a8b
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fbf6f4
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
call fcn.45dda8a1
and dword [esp + 0x30], 0
cmp dword [esi + 4], 0
je 0x45ef4b15
mov al, byte [0x4603ba49]
test al, al
jne 0x45ef4ac8
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esi + 4]
call dword [ebp + 0xc]
mov esi, eax
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.45dda946
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x1c
and dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 0x3b7
push 0x45dcdab4
mov esi, 0x80004005
push esi
call fcn.45f85675
mov eax, dword [esp + 0x18]
and dword [esp + 0x30], 0
add esp, 0x10
mov dword [esp + 0x1c], eax
push 0x45ff0f98
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x45dc096c
mov dword [esp + 0x20], esi
call fcn.45fb1416
int3

Function at 0x45ef4c0d
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fbf6f4
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x46039020]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
call fcn.45dda8a1
and dword [esp + 0x30], 0
cmp dword [esi + 4], 0
je 0x45ef4c9a
mov al, byte [0x4603ba49]
test al, al
jne 0x45ef4c4a
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esi + 4]
call dword [ebp + 0xc]
mov esi, eax
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.45dda946
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x20
and dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 0x3ff
push 0x45dcdab4
mov esi, 0x80004005
push esi
call fcn.45f85675
mov eax, dword [esp + 0x18]
and dword [esp + 0x30], 0
add esp, 0x10
mov dword [esp + 0x1c], eax
push 0x45ff0f98
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x45dc096c
mov dword [esp + 0x20], esi
call fcn.45fb1416
int3