joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a6d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69cec8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi], 0x6adf48
mov dword [esp + 0x14], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 2
call fcn.00511260
push fcn.00515fc0
push fcn.00514f30
push 5
push 0xf50
lea eax, [esi + 0x51c]
push eax
mov byte [esp + 0x28], 3
call fcn.005bbc4b
lea ecx, [esi + 0x51ac]
mov byte [esp + 0x14], 4
call fcn.00511260
lea ecx, [esi + 0x5680]
mov byte [esp + 0x14], 5
call fcn.00511260
lea ecx, [esi + 0x5b54]
mov byte [esp + 0x14], 6
call fcn.00511260
lea ecx, [esi + 0x6028]
mov byte [esp + 0x14], 7
call fcn.00511260
lea ecx, [esi + 0x64fc]
mov byte [esp + 0x14], 8
call fcn.00511260
lea ecx, [esi + 0x69d0]
mov byte [esp + 0x14], 9
call fcn.00511260
lea ecx, [esi + 0x8178]
mov byte [esp + 0x14], 0xa
call fcn.004221b0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x6ea4], edi
mov dword [esi + 0x822c], edi
mov dword [esi + 0x8230], edi
mov dword [esi + 0x8228], 0xffffffff
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x493c80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69d451
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6adff8
mov dword [esp + 0x18], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
push fcn.005113d0
push fcn.00511260
push 3
push 0x4d4
lea eax, [esi + 0x48]
push eax
mov byte [esp + 0x2c], 2
call fcn.005bbc4b
lea ecx, [esi + 0xec4]
mov byte [esp + 0x18], 3
call fcn.00511260
lea ecx, [esi + 0x1398]
mov byte [esp + 0x18], 4
call fcn.00517610
lea ecx, [esi + 0x1408]
mov byte [esp + 0x18], 5
call fcn.00514f30
lea ecx, [esi + 0x2364]
mov byte [esp + 0x18], 6
call fcn.004221b0
mov al, 0xff
mov byte [esi + 0x2417], al
mov byte [esi + 0x2418], al
mov byte [esi + 0x241b], al
xor eax, eax
mov dword [esi + 0x2358], ebx
mov byte [esi + 0x2416], 1
mov byte [esi + 0x2415], bl
mov byte [esi + 0x2419], bl
mov byte [esi + 0x241a], bl
mov byte [esi + 0x241c], bl
mov byte [esi + 0x241e], bl
mov byte [esi + 0x241f], bl
mov byte [esi + 0x2420], bl
mov dword [esi + 0xc], 0x1f9
mov dword [esi + 0x10], 0x16b
mov ecx, 0x20
lea edi, [esi + 0x2429]
rep stosd dword es:[edi], eax
mov ecx, 0x20
lea edi, [esi + 0x24a9]
rep stosd dword es:[edi], eax
mov dword [esi + 0x235c], ebx
mov byte [esi + 0x2360], bl
mov byte [esi + 0x2421], bl
mov dword [esi + 0x2424], 0xffffffff
mov word [esi + 0x2422], bx
mov byte [esi + 0x2428], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x494760
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69d51f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6ae034
mov dword [esp + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
lea ecx, [esi + 0x68]
mov byte [esp + 0x14], 4
call fcn.00511260
lea ecx, [esi + 0x53c]
mov byte [esp + 0x14], 5
call fcn.004221b0
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x5ec], 1
mov byte [esi + 0x5ed], 0xff
mov dword [esi + 0x5f0], 1
mov dword [esi + 0xc], 0x14d
mov dword [esi + 0x10], 0x13a
mov eax, esi
pop esi
mov byte [0x21e9fd5], bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x49be80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69d95a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov edi, 1
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6ae280
mov dword [esp + 0x18], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
lea ecx, [esi + 0x78]
mov byte [esp + 0x18], 5
call fcn.00511260
lea ecx, [esi + 0x54c]
mov byte [esp + 0x18], 6
call fcn.004221b0
mov dword [esi + 0x824], edi
mov byte [0x21ec598], bl
cmp dword [esi + 0x824], ebx
mov byte [esi + 0x600], 1
mov byte [esi + 0x601], 0xff
mov byte [esi + 0x602], bl
mov dword [esi + 0x604], ebx
mov dword [esi + 0x718], edi
mov dword [esi + 0x5fc], ebx
mov dword [esi + 0x71c], ebx
je 0x49bf74
mov dword [esi + 0xc], 0x14d
mov dword [esi + 0x10], 0x17c
jmp 0x49bf82
mov dword [esi + 0xc], 0xfb
mov dword [esi + 0x10], 0x152
xor eax, eax
lea edi, [esi + 0x724]
mov ecx, 0x20
rep stosd dword es:[edi], eax
lea edi, [esi + 0x7a4]
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a29f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69d9fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6ae5d0
mov dword [esp + 0x18], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 1
call fcn.00511260
lea ecx, [esi + 0x50c]
mov byte [esp + 0x18], 2
call fcn.004221b0
mov edx, 0x20
xor eax, eax
mov byte [esi + 0x5c2], bl
mov dword [esi + 0x5c4], ebx
mov dword [esi + 0x5bc], ebx
mov byte [esi + 0x5c0], 1
mov byte [esi + 0x5c1], 0xff
lea edi, [esi + 0x6dc]
mov ecx, edx
rep stosd dword es:[edi], eax
lea edi, [esi + 0x75c]
mov ecx, edx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov eax, 7
mov dword [esi + 0x7fc], eax
mov dword [esi + 0x800], eax
mov eax, 6
mov dword [esi + 0x80c], eax
mov dword [esi + 0x810], eax
pop edi
mov dword [esi + 0x7dc], 0x100
mov dword [esi + 0x7e0], 0x200
mov dword [esi + 0xc], 0xfe
mov dword [esi + 0x10], 0x124
mov dword [esi + 0x7f4], edx
mov dword [esi + 0x7f8], edx
mov dword [esi + 0x7e4], 0xf
mov dword [esi + 0x7e8], edx
mov dword [esi + 0x7ec], 0xf2
mov dword [esi + 0x7f0], 0x103
mov dword [esi + 0x804], 0xe7
mov dword [esi + 0x808], 1
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a3960
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x69dabf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6ae660
mov dword [esp + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
push fcn.005113d0
push fcn.00511260
push 2
push 0x4d4
lea eax, [esi + 0x48]
push eax
mov byte [esp + 0x28], 2
call fcn.005bbc4b
lea ecx, [esi + 0x9f0]
mov byte [esp + 0x14], 3
call fcn.00511260
lea ecx, [esi + 0xec4]
mov byte [esp + 0x14], 4
call fcn.00517610
lea ecx, [esi + 0xf34]
mov byte [esp + 0x14], 5
call fcn.00514f30
mov dword [esi + 0x1e88], ebx
mov dword [esi + 0x1e84], ebx
mov dword [esi + 0x1e8c], ebx
mov dword [esi + 0x1e90], ebx
mov byte [esi + 0x1e9c], 0xff
mov byte [esi + 0x1e9d], bl
mov dword [esi + 0x1ea0], ebx
mov dword [esi + 0x1ea4], ebx
mov dword [esi + 0x1ea8], ebx
mov dword [esi + 0x1eac], ebx
lea eax, [esi + 0x1e9c]
mov byte [eax + 0x14], 0xff
mov byte [eax + 0x15], bl
add eax, 0x14
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
add eax, 0x14
mov byte [eax], 0xff
mov byte [eax + 1], bl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea ecx, [esi + 0x1fe0]
mov byte [esp + 0x14], 7
mov dword [eax + 0x10], ebx
call fcn.004221b0
mov byte [0x21e957e], bl
mov dword [0x21e9580], ebx
mov byte [0x21ecb4c], bl
mov dword [esi + 0x1e94], ebx
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x1edd], bl
mov dword [esi + 0x2094], ebx
mov byte [esi + 0x2090], bl
mov byte [esi + 0x1ed8], bl
mov byte [esi + 0x1ed9], bl
mov byte [esi + 0x1eda], 1
mov byte [esi + 0x1edb], 0xff
mov byte [esi + 0x1edc], 0xff
mov dword [esi + 0xc], 0x1f9
mov dword [esi + 0x10], 0x16b
mov dword [esi + 0x1e98], 0xffffffff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a5520
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x69dbcf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6ae69c
mov dword [esp + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
push fcn.005113d0
push fcn.00511260
push 2
push 0x4d4
lea eax, [esi + 0x48]
push eax
mov byte [esp + 0x28], 2
call fcn.005bbc4b
lea ecx, [esi + 0x9f0]
mov byte [esp + 0x14], 3
call fcn.00511260
lea ecx, [esi + 0xec4]
mov byte [esp + 0x14], 4
call fcn.00517610
lea ecx, [esi + 0xf34]
mov byte [esp + 0x14], 5
call fcn.00514f30
mov dword [esi + 0x1e88], ebx
mov dword [esi + 0x1e84], ebx
mov dword [esi + 0x1e8c], ebx
mov dword [esi + 0x1e90], ebx
mov byte [esi + 0x1e9c], 0xff
mov byte [esi + 0x1e9d], bl
mov dword [esi + 0x1ea0], ebx
mov dword [esi + 0x1ea4], ebx
mov dword [esi + 0x1ea8], ebx
mov dword [esi + 0x1eac], ebx
lea eax, [esi + 0x1e9c]
mov byte [eax + 0x14], 0xff
mov byte [eax + 0x15], bl
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
add eax, 0x14
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov byte [eax + 0x14], 0xff
add eax, 0x14
mov byte [eax + 1], bl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
add eax, 0x14
mov byte [eax], 0xff
mov byte [eax + 1], bl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov byte [esp + 0x14], 7
mov dword [eax + 0xc], ebx
lea ecx, [esi + 0x1ff4]
mov dword [eax + 0x10], ebx
call fcn.004221b0
mov ecx, dword [esp + 0xc]
mov byte [0x21e9584], bl
mov byte [0x21e957e], bl
mov dword [0x21e9580], ebx
mov byte [0x21ecb4c], bl
or eax, 0xffffffff
mov dword [0x21e9588], eax
mov dword [0x21e958c], eax
mov dword [esi + 0x1e98], eax
mov dword [esi + 0x1e94], ebx
mov byte [esi + 0x1ef1], bl
mov dword [esi + 0x20a8], ebx
mov byte [esi + 0x20a4], bl
mov byte [esi + 0x1eec], bl
mov byte [esi + 0x1eed], bl
mov byte [esi + 0x1eee], 1
mov byte [esi + 0x1eef], 0xff
mov byte [esi + 0x1ef0], 0xff
mov dword [esi + 0xc], 0x1f9
mov dword [esi + 0x10], 0x16b
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a5d30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69dcb5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6ae6d0
mov dword [esp + 0x14], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
push fcn.005113d0
push fcn.00511260
push 3
push 0x4d4
lea eax, [esi + 0x54]
push eax
mov byte [esp + 0x28], 2
call fcn.005bbc4b
lea ecx, [esi + 0xed0]
mov byte [esp + 0x14], 3
call fcn.00517610
lea ecx, [esi + 0xf40]
mov byte [esp + 0x14], 4
call fcn.00514f30
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x30], bl
mov dword [esi + 0x1e94], ebx
mov byte [esi + 0x1f98], bl
mov dword [esi + 0xc], 0xfa
mov dword [esi + 0x10], 0x17e
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a7070
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x69dd8f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6ae714
mov dword [esp + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
push fcn.005113d0
push fcn.00511260
push 2
push 0x4d4
lea eax, [esi + 0x48]
push eax
mov byte [esp + 0x28], 2
call fcn.005bbc4b
lea ecx, [esi + 0x9f0]
mov byte [esp + 0x14], 3
call fcn.00511260
lea ecx, [esi + 0xec4]
mov byte [esp + 0x14], 4
call fcn.00517610
lea ecx, [esi + 0xf34]
mov byte [esp + 0x14], 5
call fcn.00514f30
mov dword [esi + 0x1e88], ebx
mov dword [esi + 0x1e84], ebx
mov dword [esi + 0x1e8c], ebx
mov dword [esi + 0x1e90], ebx
mov byte [esi + 0x1e9c], 0xff
mov byte [esi + 0x1e9d], bl
mov dword [esi + 0x1ea0], ebx
mov dword [esi + 0x1ea4], ebx
mov dword [esi + 0x1ea8], ebx
mov dword [esi + 0x1eac], ebx
lea eax, [esi + 0x1e9c]
mov byte [eax + 0x14], 0xff
mov byte [eax + 0x15], bl
add eax, 0x14
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
add eax, 0x14
mov byte [eax], 0xff
mov byte [eax + 1], bl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea ecx, [esi + 0x1fe0]
mov byte [esp + 0x14], 7
mov dword [eax + 0x10], ebx
call fcn.004221b0
mov byte [0x21e957e], bl
mov dword [0x21e9580], ebx
mov byte [0x21ecb4c], bl
mov dword [esi + 0x1e94], ebx
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x1edd], bl
mov dword [esi + 0x2094], ebx
mov byte [esi + 0x2090], bl
mov byte [esi + 0x1ed8], bl
mov byte [esi + 0x1ed9], bl
mov byte [esi + 0x1eda], 1
mov byte [esi + 0x1edb], 0xff
mov byte [esi + 0x1edc], 0xff
mov dword [esi + 0xc], 0x1f9
mov dword [esi + 0x10], 0x16b
mov dword [esi + 0x1e98], 0xffffffff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4ac160
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x69dee8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x3c]
mov esi, edi
sub esi, ebx
sar esi, 2
lea eax, [esp + 0xc]
push esi
push eax
call fcn.004a7fd0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x50]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
push edi
push ebx
mov dword [esp + 0x4c], 0
call fcn.004abd40
mov eax, dword [esp + 0x30]
add esp, 0x1c
test eax, eax
pop edi
pop esi
pop ebx
je 0x4ac1e6
push eax
call fcn.005b9e6d
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x4ac200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x69dee8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x3c]
mov esi, edi
sub esi, ebx
sar esi, 2
lea eax, [esp + 0xc]
push esi
push eax
call fcn.004a7fd0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x50]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
push edi
push ebx
mov dword [esp + 0x4c], 0
call fcn.004abdf0
mov eax, dword [esp + 0x30]
add esp, 0x1c
test eax, eax
pop edi
pop esi
pop ebx
je 0x4ac286
push eax
call fcn.005b9e6d
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x4ac2a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x69dee8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x3c]
mov esi, edi
sub esi, ebx
sar esi, 2
lea eax, [esp + 0xc]
push esi
push eax
call fcn.004a7fd0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x50]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
push edi
push ebx
mov dword [esp + 0x4c], 0
call fcn.004abea0
mov eax, dword [esp + 0x30]
add esp, 0x1c
test eax, eax
pop edi
pop esi
pop ebx
je 0x4ac326
push eax
call fcn.005b9e6d
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4ac340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x69dee8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x3c]
mov esi, edi
sub esi, ebx
sar esi, 2
lea eax, [esp + 0xc]
push esi
push eax
call fcn.004a7fd0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x50]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
push edi
push ebx
mov dword [esp + 0x4c], 0
call fcn.004abf50
mov eax, dword [esp + 0x30]
add esp, 0x1c
test eax, eax
pop edi
pop esi
pop ebx
je 0x4ac3c6
push eax
call fcn.005b9e6d
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x4ac3e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x69dee8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x3c]
mov esi, edi
sub esi, ebx
sar esi, 2
lea eax, [esp + 0xc]
push esi
push eax
call fcn.004a7fd0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x50]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
push edi
push ebx
mov dword [esp + 0x4c], 0
call fcn.004ac000
mov eax, dword [esp + 0x30]
add esp, 0x1c
test eax, eax
pop edi
pop esi
pop ebx
je 0x4ac466
push eax
call fcn.005b9e6d
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x4ac480
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x69dee8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x3c]
mov esi, edi
sub esi, ebx
sar esi, 2
lea eax, [esp + 0xc]
push esi
push eax
call fcn.004a7fd0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x50]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
push edi
push ebx
mov dword [esp + 0x4c], 0
call fcn.004ac0b0
mov eax, dword [esp + 0x30]
add esp, 0x1c
test eax, eax
pop edi
pop esi
pop ebx
je 0x4ac506
push eax
call fcn.005b9e6d
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret