joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a383f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x10482e50
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10573d10
lea eax, [edi + 4]
push eax
push 0x10476134
mov ecx, esi
call fcn.0057f16f
push 0x105729fc
lea ecx, [edi + 0xc]
push ecx
push 0x1047612c
mov ecx, esi
call fcn.0057ea4f
push 0x105729fc
lea edx, [edi + 0xe]
push edx
push 0x10476124
mov ecx, esi
call fcn.0057ea4f
push esi
mov ecx, edi
call fcn.0059e34f
mov edi, eax
test edi, edi
je 0x5a3913
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x5aa13f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103b850d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x104868ac
mov eax, dword [esi + 0x40]
push eax
mov eax, dword [esi + 0x3c]
mov dword [esp + 0x18], 6
call eax
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x34]
push eax
mov byte [esp + 0x1c], 5
call ecx
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x2c]
push eax
mov byte [esp + 0x20], 4
call edx
mov eax, dword [esi + 0x28]
push eax
mov eax, dword [esi + 0x24]
mov byte [esp + 0x24], 3
call eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push eax
mov byte [esp + 0x28], 2
call ecx
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
push eax
mov byte [esp + 0x2c], 1
call edx
mov eax, dword [esi + 0x10]
push eax
mov eax, dword [esi + 0xc]
mov byte [esp + 0x30], 0
call eax
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push ecx
mov dword [esp + 0x34], 0xffffffff
call edx
add esp, 0x20
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5b38cf
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103b2776
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x104869a8
mov eax, dword [esi + 0x30]
push eax
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x18], 1
call eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
push ecx
mov byte [esp + 0x1c], 0
call edx
add esp, 8
cmp dword [esi + 0x1c], 8
jb 0x5b3931
mov eax, dword [esi + 8]
push eax
call fcn.00776c58
add esp, 4
xor ecx, ecx
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], 0
mov word [esi + 8], cx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x5b427f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103b9991
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x104869d8
mov eax, dword [esi + 0x3c]
push eax
mov eax, dword [esi + 0x38]
mov dword [esp + 0x18], 2
call eax
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x30]
push eax
mov byte [esp + 0x1c], 1
call ecx
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x28]
push edx
mov byte [esp + 0x20], 0
call eax
add esp, 0xc
cmp dword [esi + 0x1c], 8
jb 0x5b42ef
mov ecx, dword [esi + 8]
push ecx
call fcn.00776c58
add esp, 4
xor edx, edx
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], 0
mov word [esi + 8], dx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5b442f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b970e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x104869e4
mov eax, dword [esi + 0x98]
push eax
mov eax, dword [esi + 0x94]
mov edi, 7
mov dword [esp + 0x1c], edi
call eax
mov eax, dword [esi + 0x90]
mov ecx, dword [esi + 0x8c]
push eax
mov byte [esp + 0x20], 6
call ecx
mov eax, dword [esi + 0x88]
mov edx, dword [esi + 0x84]
push eax
mov byte [esp + 0x24], 5
call edx
mov eax, dword [esi + 0x80]
push eax
mov eax, dword [esi + 0x7c]
mov byte [esp + 0x28], 4
call eax
mov eax, dword [esi + 0x78]
mov ecx, dword [esi + 0x74]
push eax
mov byte [esp + 0x2c], 3
call ecx
mov edx, dword [esi + 0x70]
mov eax, dword [esi + 0x6c]
push edx
mov byte [esp + 0x30], 2
call eax
add esp, 0x18
cmp dword [esi + 0x64], 8
jb 0x5b44e0
mov ecx, dword [esi + 0x50]
push ecx
call fcn.00776c58
add esp, 4
xor edx, edx
mov dword [esi + 0x64], edi
mov dword [esi + 0x60], 0
mov word [esi + 0x50], dx
cmp dword [esi + 0x44], 8
jb 0x5b4502
mov eax, dword [esi + 0x30]
push eax
call fcn.00776c58
add esp, 4
xor ecx, ecx
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], 0
mov word [esi + 0x30], cx
cmp dword [esi + 0x24], 8
jb 0x5b4524
mov edx, dword [esi + 0x10]
push edx
call fcn.00776c58
add esp, 4
xor eax, eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], 0
mov word [esi + 0x10], ax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x5b4aef
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103aee6e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x10486a08
mov eax, dword [esi + 0xbc]
push eax
mov eax, dword [esi + 0xb8]
mov dword [esp + 0x18], 0xa
call eax
mov eax, dword [esi + 0xb4]
mov ecx, dword [esi + 0xb0]
push eax
mov byte [esp + 0x1c], 9
call ecx
mov eax, dword [esi + 0xac]
mov edx, dword [esi + 0xa8]
push eax
mov byte [esp + 0x20], 8
call edx
mov eax, dword [esi + 0xa4]
push eax
mov eax, dword [esi + 0xa0]
mov byte [esp + 0x24], 7
call eax
mov eax, dword [esi + 0x9c]
mov ecx, dword [esi + 0x98]
push eax
mov byte [esp + 0x28], 6
call ecx
mov eax, dword [esi + 0x94]
mov edx, dword [esi + 0x90]
push eax
mov byte [esp + 0x2c], 5
call edx
mov eax, dword [esi + 0x8c]
push eax
mov eax, dword [esi + 0x88]
mov byte [esp + 0x30], 4
call eax
mov eax, dword [esi + 0x84]
mov ecx, dword [esi + 0x80]
push eax
mov byte [esp + 0x34], 3
call ecx
mov eax, dword [esi + 0x7c]
mov edx, dword [esi + 0x78]
push eax
mov byte [esp + 0x38], 2
call edx
mov eax, dword [esi + 0x74]
mov ecx, dword [esi + 0x70]
push eax
mov byte [esp + 0x3c], 1
call ecx
add esp, 0x28
cmp dword [esi + 0x64], 8
jb 0x5b4bf1
mov edx, dword [esi + 0x50]
push edx
call fcn.00776c58
add esp, 4
xor eax, eax
mov dword [esi + 0x64], 7
mov dword [esi + 0x60], 0
mov word [esi + 0x50], ax
cmp dword [esi + 0x38], 8
jb 0x5b4c17
mov ecx, dword [esi + 0x24]
push ecx
call fcn.00776c58
add esp, 4
xor edx, edx
mov dword [esi + 0x38], 7
mov dword [esi + 0x34], 0
mov word [esi + 0x24], dx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5b53df
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b2738
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
mov byte [esi + 0x1c], bl
mov eax, 0x186a0
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov byte [esi + 0x24], bl
mov dword [esi + 0x28], ebx
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], eax
mov byte [esi + 0x34], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x40], bl
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov dword [esi + 0x50], 0x5265c0
mov byte [esi + 0x54], bl
mov dword [esi + 0x58], eax
mov byte [esi + 0x5c], bl
mov dword [esi + 0x60], eax
mov byte [esi + 0x64], bl
lea eax, [esp + 0x10]
mov dword [esi + 0x68], ebx
mov byte [esi + 0x6c], bl
push 0x104763d4
push eax
mov dword [esi + 0x70], ebx
mov byte [esi + 0x74], bl
call fcn.0057fb4f
add esp, 8
push 0xffffffffffffffff
push ebx
lea edi, [esi + 0x78]
push eax
mov ecx, edi
mov dword [esp + 0x40], ebx
call fcn.0040826f
cmp dword [esp + 0x28], 8
mov byte [edi + 0x1c], bl
jb 0x5b549b
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00776c58
add esp, 4
mov byte [esi + 0x98], 1
mov byte [esi + 0x99], bl
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret

Function at 0x5b664f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103ba378
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov byte [esi + 0x20], bl
lea eax, [esp + 0xc]
push 0x1047a5d8
push eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
call fcn.0057fb4f
add esp, 8
push 0xffffffffffffffff
push ebx
add esi, 0x38
push eax
mov ecx, esi
mov dword [esp + 0x3c], ebx
call fcn.0040826f
cmp dword [esp + 0x24], 8
mov byte [esi + 0x1c], bl
jb 0x5b66ce
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00776c58
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x5b708f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103af042
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x104869cc
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], al
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
xor ecx, ecx
mov dword [esi + 0x50], 7
mov dword [esi + 0x4c], eax
mov word [esi + 0x3c], cx
mov byte [esi + 0x54], al
mov ecx, 0x10259a00
mov dword [esp + 0x14], eax
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
mov ecx, 0x10259a00
mov dword [esi + 0x68], ecx
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], ecx
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], 0x10259a00
mov dword [esi + 0x7c], eax
mov ecx, esi
mov byte [esp + 0x14], 5
call fcn.005b664f
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x5b739f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103b8bb6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x10486a74
lea ecx, [esi + 0x40]
mov dword [esp + 0x18], 1
call fcn.006107ff
mov eax, dword [esi + 0x30]
xor edi, edi
cmp eax, edi
je 0x5b73f0
push eax
call fcn.00776c58
add esp, 4
mov eax, dword [esi + 0x24]
push eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
call fcn.00776c58
add esp, 4
cmp dword [esi + 0x1c], 8
jb 0x5b7417
mov ecx, dword [esi + 8]
push ecx
call fcn.00776c58
add esp, 4
xor edx, edx
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], edi
mov word [esi + 8], dx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x5b83ff
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x10482e50
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10575308
lea eax, [edi + 8]
push eax
push 0x1047a70c
mov ecx, esi
call fcn.0057f6af
push 0x10572178
add edi, 0x18
push edi
push 0x1047a704
mov ecx, esi
call fcn.0057ea4f
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
Function at 0x5b8ddf
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x10482e50
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10575308
lea eax, [edi + 8]
push eax
push 0x1047a6e4
mov ecx, esi
call fcn.0057f6af
push 0x10575308
lea ecx, [edi + 0x18]
push ecx
push 0x1047a6dc
mov ecx, esi
call fcn.0057f6af
push 0x105753a8
lea edx, [edi + 0x28]
push edx
push 0x104760b0
mov ecx, esi
call fcn.0057f0ff
mov ecx, dword [edi + 0x34]
push 0x1047c1f0
push esi
call fcn.0059d37f
mov edi, eax
test edi, edi
je 0x5b8eb9
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x5bac3f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x10482e50
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10571db4
lea eax, [edi + 4]
push eax
push 0x1047a934
mov ecx, esi
call fcn.0057eccf
push 0x10571db4
add edi, 0xc
push edi
push 0x10476310
mov ecx, esi
call fcn.0057eccf
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
Function at 0x5bb06f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x10482e50
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x105749f4
lea eax, [edi + 4]
push eax
push 0x1047a8bc
mov ecx, esi
call fcn.0057f0ff
push 0x105746c4
add edi, 0xc
push edi
push 0x1047a8ac
mov ecx, esi
call fcn.0057f0ff
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x5be23f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103b35f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x14]
call fcn.00753f2f
mov ebx, dword [esp + 0x30]
push ebx
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00580aef
push 0x10482e50
mov ecx, esi
call fcn.00753f5f
push 0
mov ecx, esi
call fcn.0075b4ff
push 0x10575b48
lea eax, [edi + 4]
push eax
push 0x1047c8f0
mov ecx, esi
call fcn.0057f16f
push 0x10576c30
add edi, 0xc
push edi
push 0x1047a91c
mov ecx, esi
call fcn.0057ed9f
push ebx
mov ecx, esi
call fcn.00580b7f
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00753f4f
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
Function at 0x5c8aef
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103af7a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x10]
call fcn.005c827f
lea ecx, [esp + 0xc]
push ecx
xor edi, edi
mov ecx, esi
mov dword [esp + 0x30], edi
call fcn.005d1dff
lea ecx, [esp + 0xc]
call fcn.0058590f
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x5c8b50
push eax
call fcn.00776c58
add esp, 4
mov edx, dword [esp + 0xc]
push edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call fcn.00776c58
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 4

Function at 0x5cb2bf
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103b95be
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x1048854c
mov eax, dword [esi + 0x58]
push eax
mov eax, dword [esi + 0x54]
mov dword [esp + 0x18], 9
call eax
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x4c]
push eax
mov byte [esp + 0x1c], 8
call ecx
mov eax, dword [esi + 0x48]
mov edx, dword [esi + 0x44]
push eax
mov byte [esp + 0x20], 7
call edx
mov eax, dword [esi + 0x40]
push eax
mov eax, dword [esi + 0x3c]
mov byte [esp + 0x24], 6
call eax
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x34]
push eax
mov byte [esp + 0x28], 5
call ecx
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x2c]
push eax
mov byte [esp + 0x2c], 4
call edx
mov eax, dword [esi + 0x28]
push eax
mov eax, dword [esi + 0x24]
mov byte [esp + 0x30], 3
call eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push eax
mov byte [esp + 0x34], 2
call ecx
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
push eax
mov byte [esp + 0x38], 1
call edx
mov eax, dword [esi + 0x10]
push eax
mov eax, dword [esi + 0xc]
mov byte [esp + 0x3c], 0
call eax
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push ecx
mov dword [esp + 0x40], 0xffffffff
call edx
add esp, 0x2c
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5cb76f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103afe87
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x104885b8
mov eax, dword [esi + 0x30]
push eax
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x18], 4
call eax
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x24]
push eax
mov byte [esp + 0x1c], 3
call ecx
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push eax
mov byte [esp + 0x20], 2
call edx
mov eax, dword [esi + 0x18]
push eax
mov eax, dword [esi + 0x14]
mov byte [esp + 0x24], 1
call eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
push eax
mov byte [esp + 0x28], 0
call ecx
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push edx
mov dword [esp + 0x2c], 0xffffffff
call eax
add esp, 0x18
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x5d016f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103b9991
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x10488620
mov eax, dword [esi + 0x3c]
push eax
mov eax, dword [esi + 0x38]
mov dword [esp + 0x18], 2
call eax
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x30]
push eax
mov byte [esp + 0x1c], 1
call ecx
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x28]
push edx
mov byte [esp + 0x20], 0
call eax
add esp, 0xc
cmp dword [esi + 0x1c], 8
jb 0x5d01df
mov ecx, dword [esi + 8]
push ecx
call fcn.00776c58
add esp, 4
xor edx, edx
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], 0
mov word [esi + 8], dx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5d061f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103b9a08
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x10488644
mov eax, dword [esi + 0x60]
push eax
mov eax, dword [esi + 0x5c]
mov dword [esp + 0x18], 7
call eax
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x54]
push eax
mov byte [esp + 0x1c], 6
call ecx
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x4c]
push eax
mov byte [esp + 0x20], 5
call edx
mov eax, dword [esi + 0x48]
push eax
mov eax, dword [esi + 0x44]
mov byte [esp + 0x24], 4
call eax
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x3c]
push eax
mov byte [esp + 0x28], 3
call ecx
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x34]
push eax
mov byte [esp + 0x2c], 2
call edx
mov eax, dword [esi + 0x30]
push eax
mov eax, dword [esi + 0x2c]
mov byte [esp + 0x30], 1
call eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
push ecx
mov byte [esp + 0x34], 0
call edx
add esp, 0x20
cmp dword [esi + 0x1c], 8
jb 0x5d06d5
mov eax, dword [esi + 8]
push eax
call fcn.00776c58
add esp, 4
xor ecx, ecx
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], 0
mov word [esi + 8], cx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x5d076f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103b7d97
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x10488650
mov eax, dword [esi + 0x48]
push eax
mov eax, dword [esi + 0x44]
mov dword [esp + 0x18], 4
call eax
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x3c]
push eax
mov byte [esp + 0x1c], 3
call ecx
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x34]
push eax
mov byte [esp + 0x20], 2
call edx
mov eax, dword [esi + 0x30]
push eax
mov eax, dword [esi + 0x2c]
mov byte [esp + 0x24], 1
call eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
push ecx
mov byte [esp + 0x28], 0
call edx
add esp, 0x14
cmp dword [esi + 0x1c], 8
jb 0x5d07fb
mov eax, dword [esi + 8]
push eax
call fcn.00776c58
add esp, 4
xor ecx, ecx
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], 0
mov word [esi + 8], cx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret