joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418fa0
Capabilities:
Access peb ldr_data
Check os version
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5d8199
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
mov eax, dword [0x666d08]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
lea edi, [esi + 0x38]
mov dword [edi], eax
xor ebp, ebp
mov ebx, 1
push 0x640154
mov ecx, edi
mov dword [esp + 0xb8], ebp
mov dword [esi], 0x5ed5ec
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], ebp
call fcn.005c0d71
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x94
push ecx
call dword [0x5ec45c]
test eax, eax
je 0x41917d
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esi + 0x28], eax
dec eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], edx
je 0x4190f1
dec eax
jne 0x419130
mov edx, dword [esp + 0x24]
cmp ecx, 3
mov dword [esi + 0x34], edx
jne 0x41906f
push 0x640144
mov ecx, edi
call fcn.005c0d71
mov dword [esi + 0x10], ebx
cmp dword [esi + 0x2c], 4
jne 0x419084
push 0x640134
mov ecx, edi
call fcn.005c0d71
mov dword [esi + 0x14], ebx
cmp dword [esi + 0x2c], 5
jne 0x4190da
cmp dword [esi + 0x30], ebp
jne 0x41909e
push 0x640124
mov ecx, edi
call fcn.005c0d71
mov dword [esi + 0x18], ebx
cmp dword [esi + 0x2c], 5
jne 0x4190da
cmp dword [esi + 0x30], 2
jne 0x4190b9
push 0x64010c
mov ecx, edi
call fcn.005c0d71
mov dword [esi + 0x20], ebx
cmp dword [esi + 0x2c], 5
jne 0x4190da
mov eax, dword [esi + 0x30]
cmp eax, ebp
je 0x4190da
cmp eax, 2
je 0x4190da
push 0x640100
mov ecx, edi
call fcn.005c0d71
mov dword [esi + 0x1c], ebx
cmp dword [esi + 0x2c], 6
jne 0x419130
push 0x6400f0
mov ecx, edi
call fcn.005c0d71
mov dword [esi + 0x24], ebx
jmp 0x419130
mov eax, dword [esp + 0x24]
and eax, 0xffff
cmp ecx, 4
mov dword [esi + 0x34], eax
ja 0x419112
jne 0x419108
cmp edx, ebp
ja 0x419112
mov dword [esi + 4], ebx
push 0x6400e4
jmp 0x419129
cmp edx, 0xa
ja 0x419121
mov dword [esi + 8], ebx
push 0x6400d8
jmp 0x419129
mov dword [esi + 0xc], ebx
push 0x6400cc
mov ecx, edi
call fcn.005c0d71
mov ecx, dword [0x666d08]
mov dword [esp + 0x10], ecx
mov edx, dword [esi + 0x30]
mov eax, dword [esi + 0x2c]
mov ecx, dword [edi]
push edx
push eax
push ecx
lea edx, [esp + 0x1c]
push 0x6400c0
push edx
mov byte [esp + 0xc8], bl
call fcn.005bd24e
add esp, 0x14
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.005c0d21
lea ecx, [esp + 0x10]
mov byte [esp + 0xb4], 0
call fcn.005c0be8
jmp 0x419180
mov dword [esi + 4], ebx
mov ecx, dword [esp + 0xac]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa8
ret
Function at 0x41c42d
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d8961
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x666d08]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 4]
mov dword [edi], eax
mov ecx, dword [0x666d08]
lea ebx, [esi + 8]
mov dword [esp + 0x1c], 0
mov dword [ebx], ecx
push 0x66b9a0
push 0
lea ebp, [esi + 0xc]
push 1
push 0
push 0
mov ecx, ebp
mov byte [esp + 0x30], 1
call fcn.0040ebb0
mov ecx, edi
mov byte [esp + 0x1c], 2
mov dword [esi], 0x5ed624
call fcn.005c0b73
mov ecx, ebx
call fcn.005c0b73
push 0x66b9a0
push 0
push 1
push 0x63ee38
push 0x66b9a0
mov ecx, ebp
call fcn.0040ece0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x422ee0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d968f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov dword [esp + 0x24], 0
push 0x66b9a0
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 1
call fcn.005c0c56
mov eax, dword [esp + 0x40]
mov bl, 2
sub eax, 0
mov byte [esp + 0x30], bl
je 0x423068
dec eax
je 0x422ff5
dec eax
jne 0x4230da
lea eax, [esp + 0x40]
push 7
push eax
lea ecx, [esp + 0x44]
call fcn.005bce2e
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 7
call fcn.005c0d21
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], bl
call fcn.005c0be8
mov ecx, dword [esp + 8]
push 0x63ff90
push ecx
call fcn.005a456e
add esp, 8
test eax, eax
je 0x4230da
lea edx, [esp + 0xc]
push 8
push edx
lea ecx, [esp + 0x44]
call fcn.005bce2e
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 8
call fcn.005c0d21
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], bl
call fcn.005c0be8
mov eax, dword [esp + 8]
push 0x640a14
push eax
call fcn.005a456e
add esp, 8
test eax, eax
je 0x4230da
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x10]
push ecx
push 0x640a14
push edx
call fcn.005c0ef1
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 9
call fcn.005c0d21
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x10]
jmp 0x4230d5
lea eax, [esp + 0x14]
push 7
push eax
lea ecx, [esp + 0x44]
call fcn.005bce2e
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 5
call fcn.005c0d21
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call fcn.005c0be8
mov ecx, dword [esp + 8]
push 0x63ff90
push ecx
call fcn.005a456e
add esp, 8
test eax, eax
je 0x4230da
lea edx, [esp + 0x3c]
lea eax, [esp + 0x18]
push edx
push 0x63ff90
push eax
call fcn.005c0ef1
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 6
call fcn.005c0d21
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x18]
jmp 0x4230d5
lea ecx, [esp + 0x1c]
push 6
push ecx
lea ecx, [esp + 0x44]
call fcn.005bce2e
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 3
call fcn.005c0d21
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.005c0be8
mov edx, dword [esp + 8]
push 0x640a0c
push edx
call fcn.005a456e
add esp, 8
test eax, eax
je 0x4230da
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x20]
push eax
push 0x640a0c
push ecx
call fcn.005c0ef1
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 4
call fcn.005c0d21
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x20]
call fcn.005c0be8
mov esi, dword [esp + 0x38]
lea edx, [esp + 0x3c]
push edx
mov ecx, esi
call fcn.005c095d
mov dword [esp + 0x24], 1
lea ecx, [esp + 8]
mov byte [esp + 0x30], 1
call fcn.005c0be8
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 0
call fcn.005c0be8
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x42c0e0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x5d9db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, 0x11
mov eax, 0xa
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], 0x5ed8e4
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esi + 0x20], 0x5ed8d4
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], eax
push eax
lea ecx, [esi + 0x40]
mov byte [esp + 0x24], 1
mov byte [esi + 0x3c], bl
call fcn.005bf198
lea edi, [esi + 0x70]
push 0xa
mov ecx, edi
mov byte [esp + 0x24], 2
mov dword [esi + 0x5c], 0xffffffff
mov byte [esi + 0x60], bl
mov byte [esi + 0x61], bl
mov byte [esi + 0x62], bl
mov dword [esi + 0x64], ebx
mov byte [esi + 0x68], 1
mov dword [esi + 0x6c], ebx
call fcn.005bf198
lea ecx, [esi + 0x8c]
mov byte [esp + 0x20], 3
call fcn.005bfb4b
mov byte [esi + 0xa0], bl
mov byte [esi + 0xa1], bl
mov byte [esi + 0xa2], bl
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
lea ecx, [esi + 0xd4]
mov byte [esp + 0x20], 4
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], 0xffffffff
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], 0xbb8
call fcn.0042ea10
push 0x640fa0
mov ecx, edi
mov byte [esp + 0x24], 5
mov byte [esi + 0x14c], bl
mov byte [esi + 0x14d], bl
mov byte [esi + 0x14e], bl
mov dword [esi + 0x150], 0x64
mov dword [esi + 0x154], 0x100
mov dword [esi + 0x158], 1
mov dword [esi + 0x15c], 0xff
mov dword [esi + 0x160], ebx
mov dword [esi + 0x164], ebx
mov dword [esi], 0x5ed8cc
call fcn.005bf341
push 0x640f98
mov ecx, edi
call fcn.005bf341
push 0x640f90
mov ecx, edi
call fcn.005bf341
push 0x640f88
mov ecx, edi
call fcn.005bf341
push 0x640f80
mov ecx, edi
call fcn.005bf341
push 0x640f78
mov ecx, edi
call fcn.005bf341
push 0x640f70
mov ecx, edi
call fcn.005bf341
push 0x640f68
mov ecx, edi
call fcn.005bf341
push 0x640f60
mov ecx, edi
call fcn.005bf341
push 0x640f58
mov ecx, edi
call fcn.005bf341
push 0x640f50
mov ecx, edi
call fcn.005bf341
push 0x640f48
mov ecx, edi
call fcn.005bf341
lea eax, [esp + 0x10]
push 8
push eax
call dword [0x5ec8a8]
mov eax, dword [esp + 0x10]
cmp eax, 0xa
mov ecx, eax
ja 0x42c2ff
mov ecx, 0xa
mov edx, dword [esp + 0x14]
cmp ecx, edx
jae 0x42c313
cmp eax, 0xa
ja 0x42c315
mov eax, 0xa
jmp 0x42c315
mov eax, edx
mov ecx, esi
mov dword [esi + 0x150], eax
call fcn.0042cf40
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x42ef90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5da0ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push 0x66b9a0
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.005c0c56
mov ecx, dword [esp + 0x20]
push 0
lea eax, [esp + 4]
push 0
push eax
push 0x400
push ecx
push 0
push 0x1100
mov dword [esp + 0x30], 1
mov dword [esp + 0x1c], 0
call dword [0x5ec474]
mov eax, dword [esp]
test eax, eax
je 0x42f00b
push eax
lea ecx, [esp + 8]
call fcn.005c0d71
mov edx, dword [esp]
push edx
call dword [0x5ec470]
push esi
mov esi, dword [esp + 0x20]
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.005c095d
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.005c0be8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x458700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5de24f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x666d08]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov ecx, dword [ecx + 0x1c]
lea eax, [esp + 0xc]
push eax
push 2
lea edx, [esp + 0xc]
push 0x44a
push ecx
mov dword [esp + 0x30], 1
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], 0x457dd0
call dword [0x5ec83c]
mov esi, dword [esp + 0x28]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.005c095d
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x20], 0
call fcn.005c0be8
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x45cfe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5de8a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x14], ebx
mov eax, dword [0x666d08]
mov dword [esp + 0x20], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
push ebx
push 7
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x34], 2
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
call fcn.0045d310
test eax, eax
jne 0x45d047
lea eax, [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
call fcn.005c0d21
cmp dword [esp + 0x10], ebx
je 0x45d07d
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x45d07d
push eax
call fcn.0045e4c0
mov ecx, dword [esp + 0xc]
add esp, 4
push ecx
lea ecx, [esp + 0x10]
call fcn.005c0d71
mov edx, dword [esp + 8]
push edx
call fcn.005c0952
add esp, 4
mov dword [esp + 8], ebx
mov esi, dword [esp + 0x28]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.005c095d
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call fcn.005c0be8
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], bl
call fcn.005c0be8
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
Function at 0x465620
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d5a80
push eax
mov dword fs:[0], esp
sub esp, 0xc
xor eax, eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edx, dword [esi + 0x164]
test edx, edx
jle 0x46566f
mov ecx, dword [esi + 0x104]
mov edi, dword [ecx]
cmp edi, eax
jne 0x465665
test edi, edi
jl 0x465686
cmp edi, 3
jle 0x465665
cmp edi, 0x11
jne 0x465686
inc ebx
add ecx, 4
cmp ebx, edx
mov eax, edi
jl 0x465651
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
push ecx
mov dword [esi + 4], 1
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x66b9a0
call 0x620c56
push ecx
mov dword [esp + 0x28], 0
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x66b9a0
call 0x620c56
lea eax, [esp + 0x14]
push edi
push eax
mov ecx, esi
mov dword [esp + 0x30], 0xffffffff
call fcn.00465850
mov ecx, dword [eax]
lea edx, [esi + 0x14]
push ecx
push 0x63ec68
push edx
mov dword [esp + 0x2c], 1
call 0x61d24e
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call 0x620be8
mov eax, dword [esi + 0x118]
pop edi
mov ecx, dword [eax + ebx*4 - 4]
mov dword [esi + 0xc], ecx
mov edx, dword [esi + 0x12c]
mov eax, dword [esi + 0x118]
mov ecx, dword [edx + ebx*4]
mov edx, dword [eax + ebx*4]
lea eax, [ecx + edx - 1]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x10], eax
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret
Function at 0x465850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d5ac7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x14], 0
mov ebx, 1
mov dword [esp + 0x20], ebx
mov eax, dword [0x666d08]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x2c]
mov byte [esp + 0x20], 4
lea eax, [edi - 1]
cmp eax, 0x12
ja case.default.0x46589c
jmp dword [eax*4 + 0x405a1c]
push 0x63ecf0
lea ecx, [esp + 0x10]
call 0x620d71
mov eax, dword [esp + 0x30]
push 0x66b9a0
push eax
call 0x604853
add esp, 8
test eax, eax
jne 0x465954
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call 0x62095d
mov dword [esp + 0x14], ebx
jmp 0x4659cc
mov ecx, dword [esi + edi*4 + 0x20]
mov eax, ecx
and eax, 3
dec eax
je 0x465986
dec eax
jne 0x4659b8
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
lea edx, [esp + 0x1c]
push 0x63ece0
push edx
call 0x61d24e
add esp, 0x14
jmp 0x4659b8
test cl, 4
je 0x46599c
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
push eax
push ecx
push 0x63ecd8
jmp 0x4659ab
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
push eax
push ecx
push 0x63ecd0
lea edx, [esp + 0x1c]
push edx
call 0x61d24e
add esp, 0x10
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call 0x62095d
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 3
call 0x620be8
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call 0x620be8
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], bl
call 0x620be8
lea ecx, [esp + 0x34]
mov byte [esp + 0x20], 0
call 0x620be8
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10

Function at 0x465a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d5b0f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x24]
push eax
call str.QSUVW
mov ecx, dword [esp + 0x30]
mov esi, eax
push ecx
mov edi, edx
call str.QSUVW
mov ecx, dword [0x666d08]
add esp, 8
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x18], 3
add ecx, 0xfffffffc
cmp ecx, 0xf
ja case.default.0x465ad4
jmp dword [ecx*4 + 0x405d40]
push 0x63e5cc
lea ecx, [esp + 0xc]
call 0x620d71
mov esi, dword [esp + 0x20]
lea edx, [esp + 8]
push edx
mov ecx, esi
call 0x62095d
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x18], 2
call 0x620be8
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], 1
call 0x620be8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x18], 0
call 0x620be8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10
Function at 0x465e40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d5b77
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
mov dword [esp + 8], 0
push ecx
lea eax, [ebp + 0x14]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
mov dword [esp + 0x30], 2
call 0x62095d
push ecx
lea edx, [ebp + 0xc]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
mov byte [esp + 0x34], 3
call 0x62095d
mov ecx, esi
mov byte [esp + 0x30], 2
call fcn.00465d80
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
call 0x604ab4
mov ecx, dword [ebp + 0x14]
fstp qword [esp + 0x18]
push ecx
call 0x604ab4
mov edx, dword [0x666d08]
add esp, 8
fstp qword [esp + 0xc]
mov dword [esp + 4], edx
mov eax, dword [ebp + 0x10]
mov byte [esp + 0x28], 4
add eax, 0xfffffffc
cmp eax, 0xf
ja case.default.0x465edf
jmp dword [eax*4 + 0x4061c4]
push 0x63e5cc
lea ecx, [esp + 8]
call 0x620d71
mov esi, dword [ebp + 8]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call 0x62095d
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x28], 2
call 0x620be8
lea ecx, [ebp + 0xc]
mov byte [esp + 0x28], 1
call 0x620be8
lea ecx, [ebp + 0x14]
mov byte [esp + 0x28], 0
call 0x620be8
mov ecx, dword [esp + 0x20]
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x466210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d5c1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x24], 1
mov eax, dword [0x666d08]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x34]
mov bl, 3
mov byte [esp + 0x24], bl
lea eax, [ecx - 4]
cmp eax, 0xc
ja case.default.0x46625b
jmp dword [eax*4 + 0x406630]
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0xc]
call 0x620d21
mov esi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call 0x62095d
mov dword [esp + 0x10], 1
lea ecx, [esp + 8]
mov byte [esp + 0x24], 2
call 0x620be8
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 1
call 0x620be8
lea ecx, [esp + 0x38]
mov byte [esp + 0x24], 0
call 0x620be8
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x468c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d5f4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x666d08]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
mov dword [ecx], eax
xor edi, edi
push 0x66b9a0
mov dword [esp + 0x1c], edi
call 0x620d71
lea ecx, [esp + 0xc]
or eax, 0xffffffff
mov dword [esi + 0x10], edi
push ecx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov dword [esi + 8], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x14], edi
mov dword [esi], edi
call 0x61d5d8
lea edx, [esp + 0xc]
push edx
call 0x61d5d8
lea eax, [esp + 0xc]
push eax
call 0x61d5d8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x468c7d
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d5f4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x666d08]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
mov dword [ecx], eax
xor edi, edi
push 0x66b9a0
mov dword [esp + 0x1c], edi
call 0x620d71
lea ecx, [esp + 0xc]
or eax, 0xffffffff
mov dword [esi + 0x10], edi
push ecx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov dword [esi + 8], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x14], edi
mov dword [esi], edi
call 0x61d5d8
lea edx, [esp + 0xc]
push edx
call 0x61d5d8
lea eax, [esp + 0xc]
push eax
call 0x61d5d8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x468d00
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d5f70
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
xor ebx, ebx
lea eax, [edi + 0x2c]
mov dword [esp + 0x18], ebx
push eax
push ecx
push edx
call 0x620e7d
push eax
lea ecx, [esi + 4]
mov byte [esp + 0x1c], 1
call 0x620d21
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], bl
call 0x620be8
mov eax, dword [edi]
push 1
mov dword [esi + 8], eax
mov ecx, dword [edi + 0x1c]
push ebx
push ebx
push ecx
call 0x604a80
mov ecx, dword [edi + 0x20]
xor ebp, ebp
add eax, ecx
mov dword [esi + 0x30], ebx
adc edx, ebp
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
lea edx, [esi + 0x18]
lea eax, [edi + 4]
push edx
push eax
mov dword [esi + 0x2c], ebx
call fcn.00468dd0
lea ecx, [esi + 0x1c]
lea edx, [edi + 0xc]
push ecx
push edx
call fcn.00468dd0
lea eax, [esi + 0x20]
add edi, 0x14
push eax
push edi
call fcn.00468dd0
mov ecx, dword [esp + 0x40]
add esp, 0x18
mov dword [esi], ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call 0x620be8
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x46fab0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5d6bcf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword [0x666d08]
push esi
push edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x38], 1
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov ecx, 0x14
mov eax, esi
mov byte [esp + 0x38], 3
call 0x605940
mov edi, dword [0x5ec728]
push eax
lea eax, [esp + 0x20]
push 0x63fc34
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call 0x620d71
and esi, 0xfffff
lea edx, [esp + 0x1c]
lea eax, [esi + esi*4]
shl eax, 1
shr eax, 0x14
push eax
push 0x63fc34
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x1c]
lea ecx, [esp + 0xc]
push eax
call 0x620d71
lea ecx, [esp + 0x10]
push 0x63ee94
lea edx, [esp + 0x18]
push ecx
push edx
call 0x620e7d
lea ecx, [esp + 0xc]
lea edx, [esp + 0x44]
push ecx
push eax
push edx
mov byte [esp + 0x44], 4
call 0x620e17
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 5
call 0x620d21
lea ecx, [esp + 0x44]
mov byte [esp + 0x38], 4
call 0x620be8
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 3
call 0x620be8
mov esi, dword [esp + 0x40]
lea eax, [esp + 8]
push eax
mov ecx, esi
call 0x62095d
mov dword [esp + 0x18], 1
lea ecx, [esp + 8]
mov byte [esp + 0x38], 2
call 0x620be8
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 1
call 0x620be8
mov byte [esp + 0x38], 0
lea ecx, [esp + 0x10]
call 0x620be8
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret

Function at 0x474940
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5d7738
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x50]
push eax
mov eax, dword [esi + 0x54]
push ecx
push edx
push eax
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov dword [esp + 0x2c], 1
call 0x62095d
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x30], 2
call 0x62095d
mov edx, dword [esi]
mov ecx, esi
mov byte [esp + 0x2c], 1
call dword [edx + 8]
lea ecx, [esp + 0x1c]
mov esi, eax
mov byte [esp + 0x14], 0
call 0x620be8
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 0xffffffff
call 0x620be8
mov ecx, dword [esp + 0xc]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 8