joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496fd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x551808
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ba870]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov dword [esp + 0x18], ecx
mov edi, dword [esp + 0x80]
test edi, edi
je 0x49700d
mov eax, dword [edi + 4]
test eax, eax
jne 0x497014
xor eax, eax
jmp 0x49718c
mov esi, dword [esp + 0x88]
test esi, esi
jne 0x497041
cmp dword [esp + 0x84], esi
jne 0x497041
push eax
call fcn.00429116
mov eax, dword [eax + 0x78]
mov ecx, dword [eax]
call fcn.004679e0
mov dword [esp + 0x88], eax
mov esi, eax
cmp dword [esp + 0x8c], 0
jne 0x4970a1
cmp dword [esp + 0x90], 0
jne 0x4970a1
test esi, esi
jle 0x4970a1
mov eax, dword [edi + 4]
lea ecx, [esp + 0x2c]
push ecx
push 0
push eax
call fcn.00429116
mov edx, dword [eax + 0x78]
mov ecx, dword [edx]
call fcn.004451a8
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
push ecx
call dword [0x560744]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x1c]
mov dword [esp + 0x90], eax
mov dword [esp + 0x8c], ecx
mov eax, dword [edi + 4]
push eax
call fcn.00429116
mov edx, dword [eax + 0x78]
mov ecx, dword [edx]
call fcn.004679e0
xor ecx, ecx
cmp eax, esi
sete cl
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test esi, esi
jle 0x497187
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4970e7
cmp dword [esp + 0x14], 0
jne 0x4970e7
cmp dword [eax + ebp*4], 0
je 0x49717e
mov eax, dword [edi + 4]
push 0
push ebx
push eax
call fcn.00429116
mov edx, dword [eax + 0x78]
mov ecx, dword [edx]
call fcn.00467b40
mov esi, eax
test esi, esi
je 0x49700d
mov eax, dword [esp + 0x84]
test eax, eax
je 0x497117
mov edi, dword [eax + ebp*4]
jmp 0x497119
mov edi, ebp
push 1
push esi
lea ecx, [esp + 0x54]
call fcn.004949a0
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x8c]
push eax
push ecx
mov ecx, dword [esp + 0x20]
push edx
push edi
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x8c], 0
call fcn.00496c70
lea ecx, [esp + 0x4c]
mov dword [esp + 0x78], 0xffffffff
call fcn.00494aa0
push esi
call dword [0x5605f0]
mov esi, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
inc ebx
inc ebp
cmp ebp, esi
jl 0x4970cb
mov eax, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret 0x18
Function at 0x497210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x551840
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x5ba870]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
call fcn.00429116
mov esi, dword [esp + 0x30]
mov edi, dword [eax + 0xc]
push esi
push edi
call fcn.00492080
add esp, 8
test eax, eax
je 0x4972ce
lea ecx, [esp + 0x14]
call fcn.005102b0
push 0x56ceb4
push esi
push edi
mov dword [esp + 0x34], 0
call dword [0x5602bc]
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.005101f0
test eax, eax
jne 0x4972a9
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x14], 0x562760
call fcn.00401f08
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4972b7
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
lea ecx, [esp + 0x14]
call fcn.0042a848
mov dword [esp + 0x14], 0x562760
lea ecx, [esp + 0x14]
jmp 0x49732e
call fcn.00429116
mov edi, dword [eax + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x562760
push esi
push edi
mov dword [esp + 0x30], 1
call fcn.00492130
mov ecx, dword [esp + 0x3c]
add esp, 8
test ecx, ecx
je 0x497302
mov dword [ecx], eax
test eax, eax
je 0x497312
push esi
push edi
call fcn.00492940
add esp, 8
jmp 0x497322
push 0x40
push 0
push 0
push 0
push esi
push edi
call dword [0x560570]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x562760
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00401f08
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x4ab660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x552b28
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ba870]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x56f38c
mov ecx, dword [esi + 0x30]
mov dword [esp + 0x14], 0
test ecx, ecx
je 0x4ab6a2
call fcn.004aaa10
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004aa9b0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x4ac2f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
push eax
mov esi, ecx
call fcn.004275d4
movzx ecx, word [edi + 6]
mov ebx, dword [esp + 0x18]
and eax, ecx
mov dword [ebx], eax
xor edx, edx
div dword [esi + 8]
mov eax, dword [esp + 0x14]
mov dword [eax], edx
mov esi, dword [esi + 4]
test esi, esi
je 0x4ac33f
mov esi, dword [esi + edx*4]
test esi, esi
je 0x4ac33f
mov ecx, dword [esi + 0x10]
cmp ecx, dword [ebx]
jne 0x4ac338
push edi
push esi
call fcn.004ab4d0
test eax, eax
jne 0x4ac347
mov esi, dword [esi + 0xc]
test esi, esi
jne 0x4ac326
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc

Function at 0x4b6c30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x553668
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ba870]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x570a7c
mov ecx, dword [esi + 0x30]
mov dword [esp + 0x14], 0
test ecx, ecx
je 0x4b6c79
call fcn.004aaa10
mov dword [esi + 0x30], 0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004b6b40
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4baa40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.004b8c90
mov ecx, eax
jmp fcn.004ba000
Function at 0x4c54b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x558408
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ba870]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, ecx
push 0xa
lea ecx, [esp + 0x18]
call fcn.00467890
mov ecx, dword [esp + 0x44]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
lea edx, [esp + 0x14]
push edx
push 0
mov dword [esp + 0x40], 0
call eax
cmp dword [esp + 0x20], 0
je 0x4c5584
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4c5519
call fcn.00427c17
mov eax, dword [eax + 8]
test eax, eax
je 0x4c5525
add eax, 0xffffffe0
jmp 0x4c5527
xor eax, eax
push eax
mov ecx, ebp
call fcn.004c4e60
mov ebx, eax
test ebx, ebx
je 0x4c5584
cmp dword [ebx + 8], 0
je 0x4c5584
mov ecx, dword [esp + 0x40]
mov esi, dword [ecx + 0x90]
test esi, esi
je 0x4c5584
mov eax, esi
mov eax, dword [eax + 8]
mov esi, dword [esi]
test eax, eax
je 0x4c5559
lea edi, [eax - 0x54]
jmp 0x4c555b
xor edi, edi
lea ecx, [edi + 0x54]
call fcn.0052d670
test eax, eax
je 0x4c5580
add eax, 0xffffffe0
je 0x4c5580
push eax
mov ecx, ebp
call fcn.004c4e60
test eax, eax
je 0x4c5580
mov edx, dword [eax + 8]
cmp edx, dword [ebx + 8]
je 0x4c55ad
test esi, esi
jne 0x4c5549
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.004678c0
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
push 2
lea eax, [esp + 0x18]
push eax
push edi
mov ecx, ebp
call fcn.004c4e90
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.004678c0
mov eax, 1
jmp 0x4c5597
Function at 0x4d0240
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x558408
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ba870]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0xa
lea ecx, [esp + 0x18]
call fcn.00467890
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
lea edx, [esp + 0x14]
xor ebp, ebp
push edx
push ebp
mov dword [esp + 0x40], ebp
call eax
cmp dword [esp + 0x20], ebp
jne 0x4d02a9
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.004678c0
xor eax, eax
jmp 0x4d03b1
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
mov dword [esi + 0x114], edx
mov edx, dword [esp + 0x54]
mov dword [esi + 0x14c], ecx
mov ecx, dword [esp + 0x50]
mov dword [esi + 0x118], eax
mov eax, dword [esi + 0xf8]
lea edi, [esi + 0xf8]
mov dword [esi + 0x11c], ecx
mov dword [esi + 0x120], edx
mov edx, dword [eax + 0x5c]
mov ecx, edi
call edx
mov ecx, edi
call fcn.004d04f0
mov ecx, dword [esi + 0x104]
mov edx, dword [eax]
mov edx, dword [edx + 0x144]
push ecx
push 1
mov ecx, eax
call edx
cmp eax, ebp
je 0x4d0317
add eax, 0xffffffac
mov dword [esp + 0x40], eax
jmp 0x4d031b
mov dword [esp + 0x40], ebp
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x4d0369
mov eax, ebx
mov eax, dword [eax + 8]
mov ebx, dword [ebx]
test eax, eax
je 0x4d0333
lea edi, [eax - 0x20]
jmp 0x4d0335
xor edi, edi
mov ecx, dword [edi + 0x30]
test ecx, ecx
je 0x4d0347
mov edx, dword [ecx]
lea eax, [edi + 0x20]
push eax
mov eax, dword [edx + 0x4c]
call eax
mov ecx, dword [esp + 0x40]
test ebp, ebp
jne 0x4d0358
push esi
push edi
call fcn.004d3260
jmp 0x4d0360
push 0
push edi
call fcn.004d28f0
mov ebp, 1
test ebx, ebx
jne 0x4d0323
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4d0376
add eax, 0x54
jmp 0x4d0378
xor eax, eax
push eax
mov ecx, esi
call fcn.004cfdd0
mov edx, dword [esi + 0xf8]
mov eax, dword [edx + 0x28]
lea ecx, [esi + 0xf8]
call eax
lea ecx, [esp + 0x14]
mov dword [esi + 0xe4], 0
mov dword [esp + 0x38], 0xffffffff
call fcn.004678c0
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x18
Function at 0x4d5690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54ef78
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x5ba870]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x58]
cmp eax, 1
je 0x4d56c8
cmp eax, 3
je 0x4d56c8
xor esi, esi
jmp 0x4d56cd
mov esi, 1
test eax, eax
je 0x4d56da
cmp eax, 1
je 0x4d56da
xor ebx, ebx
jmp 0x4d56df
mov ebx, 1
push 0xa
lea ecx, [esp + 0x24]
call fcn.00467890
mov edi, dword [esp + 0x50]
push edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x48], 0
call fcn.00504dd0
test esi, esi
mov esi, dword [esp + 0x54]
lea ecx, [esp + 0x20]
push esi
je 0x4d5714
call fcn.00504dd0
jmp 0x4d5719
call fcn.004c5760
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.004d06a0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x50]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x34]
push eax
push ebx
push esi
call fcn.004d48d0
add esp, 0x20
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], 0xffffffff
call fcn.004678c0
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x38
ret
Function at 0x4d6630
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x558408
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ba870]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
xor edi, edi
cmp eax, 0xffffffff
jne 0x4d6672
cmp ecx, 0xffffffff
jne 0x4d6672
lea edx, [edi + 1]
jmp 0x4d6674
xor edx, edx
mov dword [esi + 0x124], edx
cmp edx, edi
je 0x4d66ac
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x4c]
add eax, ecx
mov ecx, dword [esp + 0x50]
cdq
add ecx, 0xf
sub eax, edx
sar eax, 1
push ecx
push eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
call dword [0x5607f8]
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
push ecx
push eax
lea edx, [esp + 0x54]
push edx
mov dword [esi + 0xec], eax
mov dword [esi + 0xf0], ecx
mov dword [esi + 0xf4], eax
mov dword [esi + 0xf8], ecx
call fcn.004d5930
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
mov ebp, dword [esp + 0x4c]
mov dword [esi + 0xfc], eax
mov dword [esi + 0x10c], eax
mov eax, dword [esi + 0x11c]
mov dword [esi + 0x100], ecx
mov dword [esi + 0x110], ecx
mov dword [esi + 0x104], edx
mov dword [esi + 0x114], edx
mov edx, 1
add esp, 0xc
mov dword [esi + 0x120], ebp
mov dword [esi + 0x108], ebx
mov dword [esi + 0x118], ebx
mov dword [esi + 0x190], edi
mov dword [esi + 0x12c], edi
mov dword [esi + 0x140], edi
mov dword [esi + 0x144], edi
mov dword [esi + 0x14c], edx
mov dword [esi + 0x150], edx
mov dword [esi + 0x148], edi
cmp dword [eax + 0x110], edi
je 0x4d6766
cmp dword [esi + 0xac], edi
je 0x4d6766
mov ecx, edx
jmp 0x4d6768
xor ecx, ecx
mov dword [esi + 0xb4], ecx
cmp dword [eax + 0x114], edi
je 0x4d677e
cmp ecx, edi
je 0x4d677e
mov eax, edx
jmp 0x4d6780
xor eax, eax
push 0xa
lea ecx, [esp + 0x18]
mov dword [esi + 0xb0], eax
call fcn.00467890
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
lea ecx, [esp + 0x14]
push ecx
push edi
mov ecx, ebp
mov dword [esp + 0x40], edi
call edx
mov ebp, dword [esp + 0x18]
cmp ebp, edi
je 0x4d6802
lea ecx, [ecx]
mov eax, ebp
mov eax, dword [eax + 8]
mov ebp, dword [ebp]
cmp eax, edi
je 0x4d67c1
lea ebx, [eax - 0x20]
jmp 0x4d67c3
xor ebx, ebx
mov ecx, dword [esi + 0x11c]
push edi
push edi
push ebx
push edi
call fcn.00466910
test eax, eax
je 0x4d67dc
mov dword [esi + 0x14c], edi
mov ecx, ebx
call fcn.0046c4d0
test al, 4
je 0x4d67ed
mov dword [esi + 0x14c], edi
mov ecx, ebx
call fcn.0046c4d0
test al, 0x20
je 0x4d67fe
mov dword [esi + 0x150], edi
cmp ebp, edi
jne 0x4d67b0
mov eax, dword [esi + 0x11c]
cmp dword [eax + 0xbc], edi
je 0x4d6828
call fcn.00429116
push 0x7f86
push edi
call dword [0x560690]
push eax
call dword [0x56069c]
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.004678c0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x1c
Function at 0x4d6870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x558408
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ba870]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
push 0xa
lea ecx, [esp + 0x18]
call fcn.00467890
mov ecx, dword [edi + 0x120]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
lea edx, [esp + 0x14]
push edx
push 0
mov dword [esp + 0x40], 0
call eax
mov esi, dword [esp + 0x18]
test esi, esi
je 0x4d68fa
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov eax, esi
mov eax, dword [eax + 8]
mov esi, dword [esi]
test eax, eax
je 0x4d68e0
add eax, 0xffffffe0
jmp 0x4d68e2
xor eax, eax
mov ecx, dword [edi + 0x11c]
push ebx
push ebp
push eax
push 4
call fcn.00466910
test eax, eax
jne 0x4d6926
test esi, esi
jne 0x4d68d0
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.004678c0
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.004678c0
xor eax, eax
jmp 0x4d6910
Function at 0x4d7b90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x554a78
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ba870]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], 0x562760
mov dword [esp + 0x70], ebx
call fcn.004daa90
mov ecx, dword [esp + 0x7c]
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
push ecx
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
call edx
push eax
call fcn.004a45e0
mov esi, dword [esp + 0x84]
mov edi, dword [esi + 0x14]
mov ebp, dword [esi + 0x10]
sub edi, dword [esi + 0xc]
sub ebp, dword [esi + 8]
add esp, 4
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 0x562760
mov ebx, dword [esp + 0x78]
mov eax, dword [ebx + 4]
push edi
push ebp
push eax
mov byte [esp + 0x7c], 1
call dword [0x560114]
push eax
lea ecx, [esp + 0x1c]
call fcn.0042a81c
cmp dword [esp + 0x1c], 0
je 0x4d7c98
lea ecx, [esp + 0x18]
push ecx
push ebx
lea ecx, [esp + 0x5c]
call fcn.004ad960
lea edx, [esp + 0x20]
push edx
push ebx
lea ecx, [esp + 0x48]
mov byte [esp + 0x78], 2
call fcn.004ad960
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push 0xcc0020
push eax
mov eax, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x64]
push eax
push edi
push ebp
push 0
push 0
push ecx
call dword [0x56010c]
lea ecx, [esp + 0x40]
call fcn.004ada70
lea ecx, [esp + 0x54]
mov byte [esp + 0x70], 1
call fcn.004ada70
xor eax, eax
cmp dword [esp + 0x84], eax
jne 0x4d7caf
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea esi, [esp + 0x28]
mov edx, dword [esi]
mov eax, dword [esi + 4]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x3c], edx
lea edx, [esp + 0x34]
mov dword [esp + 0x40], eax
push edx
lea eax, [esp + 0x40]
push eax
push ebx
call fcn.004d63d0
mov esi, 0x562760
lea ecx, [esp + 0x18]
mov byte [esp + 0x70], 0
mov dword [esp + 0x18], esi
call fcn.00401f08
lea ecx, [esp + 0x20]
mov dword [esp + 0x70], 0xffffffff
mov dword [esp + 0x20], esi
call fcn.00401f08
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 0x10
Function at 0x4f3860
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x556090
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5ba870]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ba870]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, ecx
mov eax, 0x55
mov edx, eax
mov ecx, 0xaa
mov word [esp + 0x2c], ax
mov eax, ecx
mov word [esp + 0x2e], cx
mov ecx, edx
mov word [esp + 0x30], dx
mov edx, eax
mov word [esp + 0x32], ax
mov eax, ecx
mov word [esp + 0x34], cx
mov ecx, edx
xor ebx, ebx
mov word [esp + 0x36], dx
mov word [esp + 0x38], ax
mov word [esp + 0x3a], cx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], 0x562760
lea edx, [esp + 0x2c]
push edx
push 1
push 1
push 8
push 8
mov dword [esp + 0x5c], ebx
call dword [0x5600f8]
push eax
lea ecx, [esp + 0x24]
call fcn.0042a81c
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 0x562750
mov eax, dword [esp + 0x24]
push eax
mov byte [esp + 0x4c], 1
call dword [0x5600d4]
push eax
lea ecx, [esp + 0x1c]
call fcn.0042a81c
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.0042a957
mov edx, dword [esi]
push 0xf
mov ecx, ebp
mov ebx, eax
mov dword [esp + 0x18], edx
call fcn.00475010
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax + 0x2c]
mov ecx, esi
call edx
mov dword [esp + 0x28], eax
mov eax, dword [esi]
push 0x14
mov ecx, ebp
mov dword [esp + 0x18], eax
call fcn.00475010
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [edx + 0x30]
mov ecx, esi
call eax
mov ecx, dword [edi + 4]
mov edx, dword [edi]
mov ebp, eax
mov eax, dword [edi + 0xc]
mov edi, dword [edi + 8]
push 0xf00021
sub eax, ecx
push eax
sub edi, edx
push edi
push ecx
mov ecx, dword [esi + 4]
push edx
push ecx
call dword [0x5600f0]
push ebx
mov ecx, esi
call fcn.0042a957
mov edx, dword [esi]
mov eax, dword [esp + 0x28]
mov edx, dword [edx + 0x2c]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ebp
mov ecx, esi
call edx
lea ecx, [esp + 0x18]
call fcn.0042a874
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 0
mov dword [esp + 0x18], 0x562750
call fcn.00401f08
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x20], 0x562760
call fcn.00401f08
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00448f8e
add esp, 0x38
ret 8

Function at 0x4fc8d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x556688
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ba870]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004fc880
lea ecx, [esi + 0x5e4]
mov dword [esp + 0x14], 0
mov dword [esi], 0x57b7fc
call fcn.004b8370
lea ecx, [esi + 0x604]
call fcn.004b8350
lea ecx, [esi + 0x610]
call fcn.004b8350
mov eax, dword [esi + 0x46c]
mov dword [esi + 0x80], 0xa
mov dword [eax + 0x30], 1
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x52d740
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x558408
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ba870]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
call fcn.004d04f0
push 0xa
lea ecx, [esp + 0x18]
mov ebx, eax
call fcn.00467890
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
lea ecx, [esp + 0x14]
push ecx
push 0
mov ecx, edi
mov dword [esp + 0x40], 0
call edx
mov esi, dword [esp + 0x18]
test esi, esi
je 0x52d7c6
mov ebp, dword [esp + 0x40]
nop
mov eax, esi
mov eax, dword [eax + 8]
mov esi, dword [esi]
test eax, eax
je 0x52d7b0
add eax, 0xffffffe0
jmp 0x52d7b2
xor eax, eax
push 0
push edi
push eax
push ebp
mov ecx, ebx
call fcn.00466910
test eax, eax
jne 0x52d7ef
test esi, esi
jne 0x52d7a0
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.004678c0
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.004678c0
mov eax, 1
jmp 0x52d7d9