joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
test eax, eax
jns 0x44158f
mov edx, dword [edi + 0xc]
xor eax, eax
test edx, edx
jle 0x441451
mov ecx, dword [edi + 0x10]
nop
cmp dword [ecx], 0
je 0x441587
inc eax
add ecx, 0x6c
cmp eax, edx
jl 0x441440
or eax, 0xffffffff
xor edx, edx
imul ebx, eax, 0x6c
test edx, edx
je 0x4415cc
mov dword [edx], 0x100
mov dword [edx + 0x20], 1
mov dword [edx + 0xc], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov ecx, dword [edi + 0x98]
mov dword [edx + 0x24], ecx
mov ecx, dword [edi + 0x9c]
mov dword [edx + 0x28], ecx
mov ecx, dword [edi + 0xa0]
mov dword [edx + 0x2c], ecx
mov ecx, dword [edi + 0xa4]
mov dword [edx + 0x30], ecx
mov dword [edx + 0x34], 0
mov dword [edx + 0x38], 0
mov dword [edx + 0x3c], 0
mov dword [edx + 0x40], 0
mov ecx, dword [edi + 0x78]
mov dword [edx + 0x44], ecx
mov ecx, dword [edi + 0x78]
mov dword [edx + 0x48], ecx
mov ecx, dword [ebp + 0x18]
mov dword [edx + 0x34], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [edx + 0x4c], 0
mov dword [edx + 0x50], 0
mov dword [edx + 0x54], 0
mov dword [edx + 0x58], 0
mov dword [edx + 0x68], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov dword [edx + 0x1c], 0xffffffff
mov dword [edx + 0x18], 0
mov dword [edx + 0x5c], 0
mov dword [edx + 0x60], 0
mov dword [edx + 0x64], 0
mov dword [edx + 0x38], ecx
test eax, eax
js 0x4415cf
mov ecx, dword [edi + 0xc]
push esi
cmp eax, ecx
jge 0x4415c5
mov edx, dword [edi + 0x10]
add edx, ebx
mov dword [ebp + 8], edx
je 0x441566
mov ecx, dword [edi + 0x74]
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
shl esi, cl
shl edx, cl
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], esi
mov dword [ecx + 8], edx
mov ecx, dword [edi + 0xc]
cmp eax, ecx
jge 0x4415c5
mov edx, dword [edi + 0x10]
add edx, ebx
je 0x4415c5
mov esi, dword [ebp + 0x14]
test esi, esi
js 0x4415a5
cmp esi, dword [edi + 0x14]
jge 0x4415a5
mov ecx, esi
shl ecx, 5
add ecx, dword [edi + 0x18]
jmp 0x4415a7
test eax, eax
js 0x441454
cmp eax, dword [edi + 0xc]
jge 0x441454
mov edx, dword [edi + 0x10]
imul ebx, eax, 0x6c
add edx, ebx
jmp 0x441459
xor ecx, ecx
mov dword [edi + 0x1c], ecx
test ecx, ecx
je 0x4415c5
mov dword [edx + 0x1c], esi
mov ecx, dword [edi + 0x1c]
movsx ecx, word [ecx + 4]
mov dword [edx + 0x18], ecx
mov ecx, dword [edi + 0x1c]
movsx ecx, word [ecx + 2]
mov dword [edx + 0x3c], ecx
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
or eax, 0xffffffff
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x451a00
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push dword [0x4aeba0]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x451a5f
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x451a5f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
call fcn.00433280
add esp, 4
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, edi
sub edx, eax
nop dword [eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x451a40
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop edi
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x4531c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x4531db
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [0x4aeba0]
je 0x4531db
xor eax, eax
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
push edi
push 0x25
call ebx
movzx esi, ax
push 0x26
shr esi, 0xf
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 2
and ax, cx
push 0x27
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 4
and ax, cx
push 0x28
cmove esi, edi
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 8
and ax, cx
push 0x20
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 0x10
and ax, cx
push 0xd
cmove esi, edi
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 0x20
and ax, cx
push 0x11
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 0x40
and ax, cx
push 0x1b
cmove esi, edi
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 0x80
and ax, cx
push 1
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 0x100
and ax, cx
push 2
cmove esi, edi
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 0x200
and ax, cx
push 9
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 0x400
and ax, cx
push 0x5a
cmove esi, edi
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 0x800
and ax, cx
push 0x58
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 0x1000
and ax, cx
push 0x43
cmove esi, edi
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 0x2000
and ax, cx
push 0x41
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 0x4000
and ax, cx
push 0x57
cmove esi, edi
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, ecx
and ax, cx
push 0x44
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 0x10000
and ax, cx
push 0x53
cmove esi, edi
call ebx
mov cx, ax
mov eax, 0x8000
and cx, ax
mov eax, esi
or eax, 0x20000
test cx, cx
pop edi
cmove eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x453be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x4aef08
nop dword [eax + eax]
xor ecx, ecx
mov word [eax], cx
add eax, 0x24
cmp eax, 0x4b3708
jl 0x453bf0
mov eax, dword [0x4b3728]
push esi
push edi
push 0
mov ecx, dword [eax]
push 0
push eax
mov dword [0x4b3710], 0xffffffff
call dword [ecx + 0xf4]
push 0x10000
mov dword [0x4b372c], 0
mov dword [0x4b3730], 0
mov dword [0x4b3738], 0
call fcn.0045d551
add esp, 4
mov dword [0x4b3734], eax
xor esi, esi
mov dword [0x4d3740], 0
mov dword [0x4b373c], 1
xor edi, edi
mov eax, esi
mov edx, esi
and eax, 0x1fe01
not edx
cmp eax, 0x1fe00
mov eax, edx
setne cl
shl edx, 0xc
dec cl
shr eax, 3
xor edx, esi
and cl, 0x80
and al, 0x3f
shr esi, 1
or cl, al
and edx, 0x1000
shl edx, 4
mov byte [edi + 0x4b3740], cl
or esi, edx
inc edi
cmp edi, 0x1ffff
jl 0x453c65
mov dword [ebp - 0x10], 0
xor edi, edi
mov dword [ebp - 0xc], 0xc2
mov dword [ebp - 8], 0xd6
mov dword [ebp - 4], 0xff
mov edx, edi
mov eax, edi
sar edx, 2
and eax, 0x10
mov ecx, edx
and edx, 2
and ecx, 8
or ecx, eax
mov eax, edi
shr ecx, 3
and eax, 4
or edx, eax
mov eax, edi
shr edx, 1
and eax, 1
add eax, eax
mov esi, dword [ebp + ecx*4 - 0x10]
mov ecx, edi
add esi, 0xff00
sar ecx, 1
shl esi, 8
and ecx, 1
add esi, dword [ebp + edx*4 - 0x10]
or ecx, eax
shl esi, 8
add esi, dword [ebp + ecx*4 - 0x10]
mov dword [edi*4 + 0x4d3748], esi
inc edi
cmp edi, 0x40
jl 0x453cc5
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4548c0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4794a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x10], esp
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [0x4d384c]
test byte [eax + 0x30c], 2
je 0x454940
mov eax, dword [esi + 4]
cmp eax, 0x200
jne 0x45498e
cmp dword [0x4d387c], 0
movzx ecx, word [esi + 0xc]
movzx eax, word [esi + 0xe]
jne 0x454935
cmp dword [0x4d3880], ecx
jne 0x4549b1
cmp dword [0x4d3884], eax
jne 0x4549b1
jmp 0x454940
mov dword [0x4d3880], ecx
mov dword [0x4d3884], eax
cmp dword [esi + 4], 0x100
jne 0x45497d
push 2
push dword [esi + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ebx, dword [esi + 8]
mov edi, eax
push 2
call fcn.00432f30
add esp, 4
test eax, eax
je 0x45497d
push dword [esi + 0xc]
push ebx
push edi
push 2
call fcn.00433110
add esp, 0x10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x100
jne 0x454940
cmp dword [0x4d387c], 0
je 0x4549c6
jmp 0x454940
push 0x495c90
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
call fcn.0045912a
push 0x495c90
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
call fcn.0045912a
int3
Function at 0x455ed0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push esi
mov esi, ecx
push 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0
mov dword [esi + 0xc18], 0
mov byte [esi + 0x818], 0
mov dword [esi + 0xc1c], 0
mov dword [esi + 0xf28], 0
mov dword [esi + 0xf24], 0
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x455f46
mov ecx, 0x4829d4
mov dword [esi + 0x10], 0xffffffff
mov edx, esi
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx + 0xc1f], al
test al, al
jne 0x455f32
mov eax, esi
pop esi
ret
mov ecx, esi
call fcn.00456360
mov eax, esi
pop esi
ret
Function at 0x456360
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
call fcn.00456520
mov eax, dword [esi + 0xc]
lea edx, [esi + 0x818]
test eax, eax
mov ecx, str.HSP3Dish_Windows_
cmovne ecx, eax
cmp byte [edx], 0
je 0x4563a1
push edi
xor edi, edi
mov eax, str._local_
cmp dword [esi + 0xc18], edi
push 0
cmove eax, edi
push eax
push edx
push 3
push ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
pop edi
jmp 0x4563b0
push 0
push 0
push 0
push 1
push ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
test eax, eax
jne 0x4563d6
mov ecx, 0x4829bc
mov dword [esi + 0x10], 0xffffffff
sub esi, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx + 0xc1f], al
test al, al
jne 0x4563c4
pop esi
ret
mov dword [esi + 0x10], 1
pop esi
ret

Function at 0x467ccc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00467b4b
Function at 0x403c01
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004048b9
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00403d61
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x403d4b
test ebx, ebx
jl 0x403cef
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcba065
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x403d10
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x403d02
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004056d1
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004056d1
add esp, 8
mov ebx, 0x80070057
jmp 0x403cef

Function at 0x417a10
Capabilities:
Accept command line arguments
Check os version

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 1
mov edi, eax
call dword [sym.imp.GDI32.dll_GetStockObject]
xor ebx, ebx
mov esi, eax
mov bl, byte [esp + 0xd]
call dword [sym.imp.KERNEL32.dll_GetVersion]
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp esi, 5
jne 0x417a54
cmp ebx, 1
jae 0x417a62
mov dword [0x4c3f58], 0x409
jmp 0x417a6c
ja 0x417a62
mov dword [0x4c3f58], 0x409
jmp 0x417a6c
mov dword [0x4c3f58], 0x7f
test eax, eax
je 0x417a82
mov ecx, dword [0x4c4a84]
push 0x4c4770
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ecx
ret
Function at 0x41aa11
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0041b6c9
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0041ab71
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41ab5b
test ebx, ebx
jl 0x41aaff
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcd0e75
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41ab20
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x41ab12
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0041c4e1
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0041c4e1
add esp, 8
mov ebx, 0x80070057
jmp 0x41aaff
Function at 0x4318a1
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00432559
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00431a01
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4319eb
test ebx, ebx
jl 0x43198f
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce7d05
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4319b0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4319a2
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00433371
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00433371
add esp, 8
mov ebx, 0x80070057
jmp 0x43198f
Function at 0x4482e1
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00448f99
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00448441
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x44842b
test ebx, ebx
jl 0x4483cf
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcfe745
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4483f0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4483e2
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00449db1
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00449db1
add esp, 8
mov ebx, 0x80070057
jmp 0x4483cf
Function at 0x45ed41
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0045f9f9
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0045eea1
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45ee8b
test ebx, ebx
jl 0x45ee2f
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd151a5
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45ee50
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x45ee42
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00460811
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00460811
add esp, 8
mov ebx, 0x80070057
jmp 0x45ee2f
Function at 0x475b41
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004767f9
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00475ca1
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x475c8b
test ebx, ebx
jl 0x475c2f
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2bfa5
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x475c50
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x475c42
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00477611
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00477611
add esp, 8
mov ebx, 0x80070057
jmp 0x475c2f