joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003a530
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x1003a561
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1003a561
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x1003a561
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4060b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021ba
and dword [ebp - 4], 0
cmp dword [0x40b654], 0
mov ebx, eax
jne 0x406167
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406218
push eax
call fcn.00402148
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b654], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b658], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b65c], eax
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b664], eax
test eax, eax
je 0x406167
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b660], eax
mov eax, dword [0x40b660]
cmp eax, ebx
je 0x4061bf
cmp dword [0x40b664], ebx
je 0x4061bf
push eax
call fcn.004021c3
push dword [0x40b664]
mov esi, eax
call fcn.004021c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061bf
test edi, edi
je 0x4061bf
call esi
test eax, eax
je 0x4061b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061b6
test byte [ebp - 0xc], 1
jne 0x4061bf
or dword [ebp + 0x10], 0x200000
jmp 0x4061f8
mov eax, dword [0x40b658]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4061f8
mov eax, dword [0x40b65c]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b654]
call fcn.004021c3
pop ecx
test eax, eax
je 0x406218
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40621a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x457aa0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ax, word [edi + 4]
test ax, ax
jne 0x457b13
mov ecx, dword [0x90dcbc]
mov ecx, dword [ecx + 4]
mov ebx, dword [ecx + 0x18]
xor eax, eax
mov ax, word [edi + 6]
push ebp
and eax, 0x7fff
movzx edx, ax
cmp edx, ebx
mov ebx, dword [esp + 0x14]
sbb eax, eax
and eax, edx
mov edx, dword [ecx + 0x20]
lea eax, [edx + eax*4]
mov eax, dword [eax]
mov esi, dword [eax + 0x10]
mov ebp, dword [esi]
push ebx
mov ecx, edi
call fcn.00453890
push eax
mov ecx, esi
call dword [ebp + 0xc]
mov eax, dword [esp + 0x18]
mov edx, dword [esi]
xor ecx, ecx
mov cx, word [edi + 6]
push eax
shr ecx, 0xc
and ecx, 8
lea edi, [ecx + edi + 8]
mov ecx, esi
call dword [edx]
pop ebp
mov dword [edi + ebx*4], eax
pop edi
pop esi
pop ebx
ret 8
mov esi, dword [esp + 0x14]
test esi, esi
je 0x457b42
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, edi
movzx ebx, ax
call fcn.00453890
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
ret 8
movzx esi, ax
mov eax, dword [esp + 0x10]
push eax
mov ecx, edi
call fcn.00453890
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov edi, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
pop ebx
ret 8

Function at 0x45bd70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x869fbf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x893ce8
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 4]
lea edi, [esi + 0x2c]
push ecx
mov ecx, edi
mov dword [esp + 0x1c], 5
call fcn.0045b9f0
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [edi + 8], 0
mov dword [eax], eax
mov eax, dword [edi + 4]
lea ebp, [esi + 0x1c]
mov ecx, ebp
mov dword [eax + 8], eax
call fcn.0045b040
lea ecx, [esi + 0x44]
mov byte [esp + 0x18], 4
call fcn.0045b230
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 3
call fcn.0045b1b0
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.0045b8c0
mov ecx, ebp
mov byte [esp + 0x18], 1
call fcn.0045b040
lea ecx, [esi + 8]
mov byte [esp + 0x18], 0
call fcn.0045b2b0
mov ecx, dword [esp + 0x10]
pop edi
mov dword [esi], 0x893c3c
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x45ca60
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
jle 0x45cac1
push edi
push ebx
mov edi, ecx
push esi
movzx esi, byte [edx]
mov ebx, eax
shr ebx, 0x18
xor ebx, esi
and ebx, 0xff
mov esi, dword [ebx*4 + 0x893d58]
shl eax, 8
inc edx
xor eax, esi
dec edi
jne 0x45ca75
test ecx, ecx
pop esi
pop ebx
jle 0x45cac0
jmp 0x45caa0
mov edx, eax
shr edx, 0x18
xor edx, ecx
and edx, 0xff
mov edi, dword [edx*4 + 0x893d58]
shl eax, 8
sar ecx, 8
xor eax, edi
test ecx, ecx
jg 0x45caa0
pop edi
not eax
ret
Function at 0x45cc70
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x90e630]
test eax, eax
je 0x45ccc5
mov eax, dword [0x90e634]
test eax, eax
push esi
mov esi, dword [esp + 0xc]
je 0x45ccaf
mov cl, byte [0x90e638]
test cl, cl
jne 0x45ccaf
movsx ecx, byte [esp + 8]
push esi
push ecx
mov byte [0x90e638], 1
call eax
add esp, 8
test al, al
mov byte [0x90e638], 0
jne 0x45ccc4
push esi
push 0x8941f8
call fcn.007c5e60
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
ret

Function at 0x470a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x34
fld dword [ebp + 0xc]
push ebx
fcomp dword [0x890968]
push esi
push edi
mov edi, ecx
fnstsw ax
test ah, 0x41
jne 0x470bde
mov ebx, dword [0x92ce9c]
mov eax, dword [0x92cea4]
lea ecx, [ebx + eax*4]
cmp ebx, ecx
je 0x470bde
mov esi, dword [ebx]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x88]
test al, al
je 0x470bc5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x44]
mov ecx, dword [eax]
cmp ecx, dword [0x92c4f4]
jne 0x470bc5
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
fld dword [eax + 8]
fld dword [eax]
mov ecx, dword [edi + 0x1c]
fchs
fxch st(1)
fsub dword [ecx + 0x40]
fstp dword [esp + 0x20]
fsub dword [ecx + 0x44]
fld st(0)
fmulp st(1)
fld dword [esp + 0x20]
fmul dword [esp + 0x20]
faddp st(1)
fsqrt
fst dword [esp + 0xc]
fcomp dword [0x8945c8]
fnstsw ax
test ah, 5
jp 0x470bc5
fld dword [0x8edf54]
mov eax, dword [0x8edf5c]
fld dword [0x8edf58]
mov edx, dword [0x8edf50]
fld dword [esp + 0xc]
mov dword [esp + 0x3c], eax
fmul dword [0x8916cc]
fsubr dword [0x89096c]
fmul dword [ebp + 0xc]
fld dword [0x8edf60]
fmul st(1)
fstp dword [esp + 0x10]
fld dword [0x8edf64]
fmul st(1)
fstp dword [esp + 0x14]
fld dword [0x8edf68]
fmul st(1)
fstp dword [esp + 0x18]
fmul dword [0x8edf6c]
mov dword [ecx + 0x70], edx
mov edx, dword [esp + 0x14]
mov dword [ecx + 0x7c], eax
fstp dword [esp + 0x1c]
fxch st(1)
fstp dword [ecx + 0x74]
fstp dword [ecx + 0x78]
mov eax, dword [edi + 0x1c]
mov ecx, dword [esp + 0x10]
add eax, 0x80
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov al, byte [ebp + 0x10]
test al, al
je 0x470b9f
fild dword [0x925ae8]
jmp 0x470ba5
fild dword [0x925b14]
mov ecx, dword [ebp + 8]
fmul dword [0x890984]
push 0x3f800000
fstp dword [esp + 0x10]
mov eax, dword [esp + 0x10]
push eax
push ecx
mov ecx, dword [edi + 0x1c]
call fcn.00467420
mov edx, dword [0x92ce9c]
mov eax, dword [0x92cea4]
add ebx, 4
lea ecx, [edx + eax*4]
cmp ebx, ecx
jne 0x470a98
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4eb610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x86d0ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
push ebx
push ebx
push ebx
lea ecx, [esi + 0x48]
mov dword [esp + 0x20], ebx
mov dword [esi], 0x899090
mov dword [esi + 0x44], ebx
call fcn.004ab370
push ebx
push ebx
push ebx
lea ecx, [esi + 0xd0]
mov byte [esp + 0x20], 1
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov byte [esi + 0x80], bl
mov dword [esi + 0xc8], ebx
call fcn.004ab370
push ebx
push ebx
push ebx
lea ecx, [esi + 0xe4]
mov byte [esp + 0x20], 2
call fcn.004d5730
push ebx
push ebx
push ebx
lea ecx, [esi + 0xf8]
mov byte [esp + 0x20], 3
call fcn.004d57f0
push ebx
push ebx
push ebx
lea ecx, [esi + 0x10c]
mov byte [esp + 0x20], 4
call fcn.004d5910
mov ecx, dword [esp + 0xc]
mov eax, 2
mov dword [esi + 0xb0], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0x44], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4f537b
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x86d538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov word [esi + 0x1c], bx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
push edi
mov dword [esp + 0xc], esi
mov dword [0x9142d8], ebx
mov dword [0x9142dc], ebx
push ebx
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push 0x894b1c
mov dword [esp + 0x28], ebx
mov dword [esi], 0x899320
call fcn.005cc240
add esp, 4
push 0x4ebd90
push esi
mov dword [edi], eax
call fcn.004eb060
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov dword [esi + 0x34], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret

Function at 0x4f55c9
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x86d5ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov word [esi + 0x1c], bx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov dword [0x9142d8], ebx
mov dword [0x9142dc], ebx
mov dword [esp + 8], esi
mov dword [esi + 0x24], ebx
lea ecx, [esi + 0x3c]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x899388
call fcn.004b0280
lea ecx, [esi + 0x7c]
mov byte [esp + 0x14], 1
call fcn.004ba280
push 3
lea ecx, [esi + 0x100]
mov byte [esp + 0x18], 2
call fcn.0065c540
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x28], bl
mov byte [esi + 0x78], bl
mov dword [esi + 0x68], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0x58], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4f59d6
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x86d670
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x89945c
mov edi, dword [esi + 0x30]
test edi, edi
mov dword [esp + 0x14], 0
je 0x4f5a07
mov ecx, dword [edi]
test ecx, ecx
je 0x4f59fe
call fcn.00831782
push edi
call fcn.00831682
add esp, 4
mov dword [esi + 0x30], 0
mov dword [esi], 0x8983e8
push esi
mov ecx, 0x912328
mov dword [esp + 0x18], 1
call fcn.004ca430
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x8967fc
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4f5eab
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x86d6f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov word [esi + 0x1c], bx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov dword [0x9142d8], ebx
mov dword [0x9142dc], ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 0x24], ebx
lea ecx, [esi + 0x34]
mov dword [esp + 0x1c], ebx
mov dword [esi], 0x899664
call fcn.004b0280
push ebx
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push str.FRONT_BARRIER
mov byte [esp + 0x28], 1
call fcn.005cc240
add esp, 4
push 0x4dc840
push esi
mov dword [edi], eax
call fcn.004eb0f0
add esp, 0x10
push ebx
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push 0x8987b0
mov dword [esi + 0x54], eax
call fcn.005cc240
add esp, 4
push 0x4e69b0
push esi
mov dword [edi], eax
call fcn.004eb0f0
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov dword [esi + 0x58], eax
mov dword [esi + 0x50], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret

Function at 0x4f6019
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x86d738
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov word [esi + 0x1c], bx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov dword [0x9142d8], ebx
mov dword [0x9142dc], ebx
mov dword [esp + 8], esi
mov dword [esi + 0x24], ebx
lea ecx, [esi + 0x44]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x899698
call fcn.004b0280
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x40], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4f6290
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x86d7b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x899704
mov ecx, dword [esi + 0x30]
xor ebx, ebx
cmp ecx, ebx
mov dword [esp + 0x18], ebx
je 0x4f62cb
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x30], ebx
mov edi, dword [esi + 0x38]
cmp edi, ebx
je 0x4f62e9
mov ecx, dword [edi]
cmp ecx, ebx
je 0x4f62dd
call fcn.00831782
push edi
call fcn.00831682
add esp, 4
mov dword [esi + 0x38], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi], 0x8983e8
push esi
mov ecx, 0x912328
mov dword [esp + 0x1c], 1
call fcn.004ca430
mov ecx, dword [esp + 0x10]
pop edi
mov dword [esi], 0x8967fc
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4f6766
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x86d870
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x89983c
mov edi, dword [esi + 0x28]
test edi, edi
mov dword [esp + 0x14], 0
je 0x4f6797
mov ecx, dword [edi]
test ecx, ecx
je 0x4f678e
call fcn.00831782
push edi
call fcn.00831682
add esp, 4
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov dword [esi], 0x8983e8
push esi
mov ecx, 0x912328
mov dword [esp + 0x18], 1
call fcn.004ca430
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x8967fc
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4f72a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x86d988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov word [esi + 0x1c], bx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov dword [0x9142d8], ebx
mov dword [0x9142dc], ebx
push edi
mov dword [esp + 0x18], esi
mov dword [esi + 0x24], ebx
push ebx
push ecx
mov dword [esp + 0x24], esp
mov edi, esp
push str.MomentStrm
mov dword [esp + 0x38], ebx
mov dword [esi], 0x899a24
call fcn.005cc240
add esp, 4
push 0x4f0ba0
push esi
mov dword [edi], eax
call fcn.004eb2a0
add esp, 0x10
push ebx
push ecx
mov dword [esp + 0x24], esp
mov edi, esp
push str.PursuitBreaker
mov dword [esi + 0x28], eax
call fcn.005cc240
add esp, 4
push 0x4f0fb0
push esi
mov dword [edi], eax
call fcn.004eb330
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x30], 0x899200
mov dword [esi + 0x540], ebx
mov dword [esi + 0x544], 3
mov dword [esi + 0x550], ebx
mov dword [esi + 0x554], ebx
mov dword [esi + 0x558], ebx
mov dword [esi + 0x560], ebx
mov dword [esi + 0x564], ebx
mov dword [esi + 0x568], ebx
mov dword [esi + 0x570], ebx
mov dword [esi + 0x574], ebx
mov dword [esi + 0x578], ebx
mov dword [esi + 0x580], ebx
mov byte [esi + 0x588], bl
mov dword [esi + 0x584], ebx
add esp, 0x10
mov byte [0x914354], bl
mov dword [0x91435c], esi
mov dword [esi + 0x58c], ebx
mov byte [esi + 0x590], bl
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f7600
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x86da18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov word [esi + 0x1c], bx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov dword [0x9142d8], ebx
mov dword [0x9142dc], ebx
mov dword [esp + 0xc], esi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], 0xc1200000
push ebx
lea ecx, [esi + 0x60]
mov dword [esp + 0x20], ebx
mov dword [esi], 0x899ac0
call fcn.00786940
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fd070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, ecx
xor ecx, ecx
xor ebx, ebx
cmp eax, 1
push edi
mov dword [esp + 0x10], ecx
jle 0x4fd0a0
lea ebx, [ebx]
inc ecx
mov edx, 1
shl edx, cl
cmp edx, eax
jl 0x4fd090
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x28]
xor ecx, ecx
cmp ebp, 1
mov dword [esp + 0x14], ecx
jle 0x4fd0c0
nop
inc ecx
mov edx, 1
shl edx, cl
cmp edx, ebp
jl 0x4fd0b0
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffffc
xor edi, edi
cmp ecx, 0x7d
ja case.0x4fd0d5.5
movzx ecx, byte [ecx + 0x4fd1f4]
jmp dword [ecx*4 + 0x4fd1dc]
mov edi, eax
jmp 0x4fd103
mov edi, eax
imul edi, ebp
shl edi, 1
jmp case.0x4fd0d5.5
mov edi, eax
imul edi, ebp
lea edi, [edi + edi*2]
jmp case.0x4fd0d5.5
mov edi, eax
imul edi, ebp
shl edi, 2
jmp case.0x4fd0d5.5
lea edi, [eax - 1]
and edi, 1
imul edi, ebp
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esi + 0xc]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [edx + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [esp + 0x1c]
mov dword [edx + 0x14], eax
push ecx
mov byte [esi + 0x23], bl
call fcn.00460bf0
mov cx, word [esp + 0x38]
mov dx, word [esp + 0x28]
mov dword [esi + 0x24], eax
mov al, byte [esp + 0x30]
mov byte [esi + 0x4a], al
mov al, byte [esp + 0x18]
mov word [esi + 0x44], dx
mov dl, byte [esp + 0x14]
mov word [esi + 0x4c], cx
mov cl, byte [esp + 0x3c]
mov byte [esi + 0x49], al
mov eax, 0x100
add esp, 4
mov byte [esi + 0x48], dl
mov dl, byte [esp + 0x3c]
mov byte [esi + 0x55], cl
mov ecx, dword [esp + 0x30]
mov word [esi + 0x62], ax
mov word [esi + 0x64], ax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x40], edi
mov dword [esi + 0x38], edi
pop edi
mov word [esi + 0x46], bp
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x4b], bl
mov byte [esi + 0x54], bl
mov byte [esi + 0x51], bl
mov byte [esi + 0x4f], bl
mov byte [esi + 0x57], bl
mov byte [esi + 0x52], bl
mov word [esi + 0x5e], bx
mov word [esi + 0x60], bx
mov dword [esi + 0x68], ebx
mov byte [esi + 0x4e], 1
mov byte [esi + 0x56], dl
mov dword [esi + 0x6c], esi
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], 1
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x28