joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e780
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x542578
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x25], bl
mov byte [esp + 0x24], bl
mov eax, dword [esi + 0x268]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x57fc50
push eax
mov dword [esp + 0x50], ebx
xor edi, edi
call dword [0x553b08]
mov eax, dword [esi + 0x22c]
add esp, 0x10
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x28]
push eax
push ecx
push edx
mov edx, dword [esp + 0x18]
sub esp, 0x10
mov eax, 0x800
mov ecx, esp
add esi, 0x270
push edx
mov dword [ecx], edi
mov dword [ecx + 4], ebx
mov dword [ecx + 8], eax
mov eax, 0x600
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x30]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push esi
call fcn.0053ffb4
call fcn.0040e350
mov al, byte [esp + 0x4d]
add esp, 0x28
fstp qword [esp + 0x14]
cmp al, bl
mov dword [esp + 0x40], 0xffffffff
jne 0x40e886
cmp byte [esp + 0x24], bl
je 0x40e863
mov eax, dword [esp + 0x20]
xor esi, esi
cmp eax, ebx
jbe 0x40e886
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + esi*4]
push edx
call fcn.0053feee
mov eax, dword [esp + 0x24]
add esp, 4
inc esi
cmp esi, eax
jb 0x40e848
jmp 0x40e886
mov eax, dword [esp + 0x20]
xor esi, esi
cmp eax, ebx
jbe 0x40e886
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + esi*4]
push ecx
call fcn.0053feee
mov eax, dword [esp + 0x24]
add esp, 4
inc esi
cmp esi, eax
jb 0x40e86d
mov edx, dword [esp + 0x1c]
push edx
call dword [0x553b00]
mov ecx, dword [esp + 0x3c]
add esp, 4
fld qword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x38
ret
Function at 0x422e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe8
mov edx, dword [esp + 0xec]
push ebx
push ebp
push esi
mov ebp, dword [edx]
mov eax, 0x1e0
xor ecx, ecx
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x280
mov dword [esp + 0x1c], 0x2d0
mov dword [esp + 0x20], 0x300
mov dword [esp + 0x24], 0x320
mov dword [esp + 0x28], 0x360
mov dword [esp + 0x2c], 0x384
mov dword [esp + 0x30], 0x3c0
mov dword [esp + 0x34], 0x400
mov dword [esp + 0x38], 0x41a
mov dword [esp + 0x3c], 0x480
mov dword [esp + 0x40], 0x4b0
mov dword [esp + 0x44], 0x500
mov dword [esp + 0x48], 0x578
mov dword [esp + 0x4c], 0x5a0
mov dword [esp + 0x50], 0x600
mov dword [esp + 0x54], 0x640
mov dword [esp + 0x58], 0x690
mov dword [esp + 0x5c], 0x780
mov dword [esp + 0x60], 0x800
mov dword [esp + 0x64], 0x834
mov dword [esp + 0x68], 0x900
mov dword [esp + 0x6c], 0x960
mov dword [esp + 0x70], 0xa00
mov dword [esp + 0x74], 0xaf0
mov dword [esp + 0x78], 0xb40
mov dword [esp + 0x7c], 0xc00
mov dword [esp + 0x80], 0xc80
mov dword [esp + 0x84], 0xd20
mov dword [esp + 0x88], 0xf00
mov dword [esp + 0x8c], 0x1000
mov dword [esp + 0x90], 0x1068
mov dword [esp + 0x94], 0x1200
mov dword [esp + 0x98], 0x12c0
mov dword [esp + 0x9c], 0x1400
mov dword [esp + 0xa0], 0x1900
mov dword [esp + 0xa4], 0x1c20
mov dword [esp + 0xa8], 0x1e00
mov dword [esp + 0xac], 0x1f40
mov dword [esp + 0xb0], 0x21c0
mov dword [esp + 0xb4], 0x2580
mov dword [esp + 0xb8], 0x2800
mov dword [esp + 0xbc], 0x2904
mov dword [esp + 0xc0], 0x2d00
mov dword [esp + 0xc4], 0x2ee0
mov dword [esp + 0xc8], 0x3200
mov dword [esp + 0xcc], 0x36b0
mov dword [esp + 0xd0], 0x3840
mov dword [esp + 0xd4], 0x3c00
mov dword [esp + 0xd8], 0x3e80
mov dword [esp + 0xdc], 0x41a0
mov dword [esp + 0xe0], 0x4b00
mov dword [esp + 0xe4], 0x5000
mov dword [esp + 0xe8], 0x5208
mov dword [esp + 0xec], 0x5a00
mov dword [esp + 0xf0], 0x6400
mov dword [esp + 0xf4], ecx
xor ebx, ebx
mov dword [esp + 0x10], ecx
mov edi, 0x2710
lea esi, [esp + 0x14]
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
cmp eax, edi
jge 0x423062
mov ebx, ecx
mov edi, eax
mov eax, dword [esi + 4]
add esi, 4
inc ecx
test eax, eax
jne 0x423053
mov ecx, dword [esp + 0xfc]
mov eax, dword [esp + ebx*4 + 0x14]
mov ebp, dword [esp + 0x100]
mov edi, 0x2710
mov dword [ecx], eax
xor ecx, ecx
mov ebx, dword [ebp]
mov eax, 0x1e0
lea esi, [esp + 0x14]
sub eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, edi
jge 0x4230a5
mov dword [esp + 0x10], ecx
mov edi, eax
mov eax, dword [esi + 4]
add esi, 4
inc ecx
test eax, eax
jne 0x423094
mov edx, dword [esp + 0x10]
pop edi
pop esi
mov eax, dword [esp + edx*4 + 0xc]
mov dword [ebp], eax
pop ebp
pop ebx
add esp, 0xe8
ret 8
Function at 0x43b760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
mov eax, 0x80
push ebx
mov ebx, dword [esp + 0x98]
mov dword [esp + 8], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
push esi
mov esi, dword [esp + 0xa4]
mov edx, 0x100
mov eax, 0x400
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x74], eax
mov ecx, 0x200
mov edx, 0x1e0
mov eax, 0x800
mov dword [esp + 0x38], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x58], edx
mov dword [esp + 0x64], edx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x78], eax
mov dword [esp + 0x80], eax
mov dword [edi], 0
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], 0xac
mov dword [esp + 0x18], 0x40
mov dword [esp + 0x34], 0xe6
mov dword [esp + 0x3c], 0x140
mov dword [esp + 0x44], 0x27f
mov dword [esp + 0x4c], 0x12c
mov dword [esp + 0x54], 0x230
mov dword [esp + 0x60], 0x277
mov dword [esp + 0x68], 0x2f8
mov dword [esp + 0x7c], 0x300
mov dword [esp + 0x84], 0x801
mov dword [esp + 0x88], 0x3c0
mov dword [esp + 0x8c], 0x2800
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
lea ecx, [esp + 0xc]
mov dword [esi], 0
mov edx, 1
lea eax, [esp + 0xc]
cmp ebx, edx
jl 0x43b8bb
mov edx, dword [ecx + 8]
cmp ebx, edx
jg 0x43b8bb
mov ecx, dword [ecx + 4]
mov dword [esi], ecx
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
mov dword [edi], edx
jg 0x43b8c7
test ecx, ecx
je 0x43b8c7
mov edx, dword [eax + 0xc]
add eax, 0xc
test edx, edx
mov ecx, eax
jne 0x43b89e
cmp dword [esi], 0
mov eax, dword [esp + 0xa4]
jne 0x43b8e0
cmp dword [edi], 0
jne 0x43b8e0
mov dword [esi], 0x80
mov dword [edi], eax
cmp dword [edi], eax
jle 0x43b8e6
mov dword [edi], eax
mov eax, dword [edi]
mov ecx, dword [esi]
cmp ecx, eax
jle 0x43b8f5
cdq
sub eax, edx
sar eax, 1
mov dword [esi], eax
cmp dword [esi], 0
jne 0x43b900
mov dword [esi], 0x80
cmp dword [edi], 0
jne 0x43b90b
mov dword [edi], 0x100
pop edi
pop esi
pop ebx
add esp, 0x90
ret 0x10
Function at 0x446bf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5463d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push 1
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0
mov dword [esp + 0x20], 4
call fcn.0053ff24
mov esi, dword [esp + 0x34]
push eax
push esi
call dword [0x553018]
test eax, eax
jne 0x446c4c
mov edi, dword [esp + 8]
jmp 0x446cb9
mov eax, dword [esp + 0x2c]
push 4
mov dword [esp + 0xc], eax
mov edi, eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x2c]
push eax
push 4
push 0
push 1
call fcn.0053ff24
push eax
push esi
call dword [0x55301c]
test eax, eax
je 0x446cb9
lea ecx, [esp + 0x24]
call fcn.0053fedc
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x24]
push ecx
push str.Failed_to_save_to_registry:__s
push edx
mov byte [esp + 0x28], 1
call fcn.00540122
mov eax, dword [esp + 0x30]
add esp, 0xc
push 0
push 0
push eax
call fcn.0053ff2a
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 0
call fcn.0053feb8
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0053feb8
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x447e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x546568
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push str.Control_PanelDesktopWindowMetrics
lea ecx, [esp + 0xc]
call fcn.0053ffba
lea eax, [esp + 0x14]
lea ecx, [esp + 4]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 1
lea ecx, [esp + 0x28]
mov dword [esp + 0x54], 0
call fcn.0053ff24
push eax
push 0x80000001
call dword [0x553020]
test eax, eax
je 0x447e85
lea ecx, [esp + 8]
mov dword [esp + 0x34], 0xffffffff
call fcn.0053feb8
mov eax, 0x11
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
mov eax, dword [esp + 4]
test eax, eax
jne 0x447eb2
lea ecx, [esp + 8]
mov dword [esp + 0x34], 0xffffffff
call fcn.0053feb8
mov eax, 0x11
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
push str._255
lea ecx, [esp + 4]
call fcn.0053ffba
push str.ScrollWidth
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 1
call fcn.0053ffba
xor edx, edx
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], edx
push eax
mov dword [esp + 0x28], edx
push ecx
mov dword [esp + 0x30], edx
lea edx, [esp + 0x20]
push edx
push 0
push 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 2
mov dword [esp + 0x24], 0x10
call fcn.0053ff24
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [0x553018]
test eax, eax
jne 0x447f37
lea ecx, [esp + 0x1c]
lea edx, [esp]
push ecx
push 0x5822ac
push edx
call fcn.00540122
add esp, 0xc
jmp 0x447f86
push str._255
lea ecx, [esp + 4]
call fcn.0053fed6
mov eax, dword [esp]
lea ecx, [esp]
mov eax, dword [eax - 8]
push eax
push 1
call fcn.0053ff24
push eax
push 1
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.0053ff24
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [0x55301c]
test eax, eax
je 0x447f86
push 0
push 0
push str.Failed_to_save_default_string_to_registry.
call fcn.0053ff2a
mov edx, dword [esp + 4]
push esi
push edx
call dword [section..rdata]
push 1
lea ecx, [esp + 8]
call fcn.0053ff24
push eax
call dword [0x553b2c]
mov ecx, eax
mov eax, 0x77777777
imul ecx
sub edx, ecx
add esp, 4
sar edx, 3
mov eax, edx
lea ecx, [esp + 0x10]
shr eax, 0x1f
add edx, eax
mov byte [esp + 0x38], 1
mov esi, edx
call fcn.0053feb8
lea ecx, [esp + 4]
mov byte [esp + 0x38], 0
call fcn.0053feb8
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0053feb8
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x45eb50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x548108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push str.SoftwareThinking_SystemsThinkingNetMDStationSettingsDefaults
lea ecx, [esp + 0x18]
call fcn.0053ffba
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 1
lea ecx, [esp + 0x34]
mov dword [esp + 0x50], ebx
call fcn.0053ff24
push eax
push 0x80000002
call dword [0x553020]
test eax, eax
je 0x45ebd2
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.0053feb8
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
cmp dword [esp + 0xc], ebx
jne 0x45ebfc
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.0053feb8
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
lea ecx, [esp + 0x1c]
mov dword [esp + 8], ebx
call fcn.0053fedc
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.0053fedc
push str.PatientMatchingCriteria
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 2
call fcn.0053fed6
lea edx, [esp + 0x18]
lea eax, [esp + 8]
push edx
lea ecx, [esp + 0x28]
push eax
push ecx
push ebx
push 1
lea ecx, [esp + 0x24]
mov dword [esp + 0x2c], 4
call fcn.0053ff24
mov edx, dword [esp + 0x1c]
push eax
push edx
call dword [0x553018]
test eax, eax
jne 0x45ec69
mov eax, dword [esp + 8]
mov dword [esi + 0x104], eax
jmp 0x45ec94
lea ecx, [esp + 8]
push 4
push ecx
push 4
push ebx
push 1
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ebx
call fcn.0053ff24
mov edx, dword [esp + 0x1c]
push eax
push edx
call dword [0x55301c]
mov dword [esi + 0x104], ebx
mov eax, dword [esp + 0xc]
push eax
call dword [section..rdata]
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.0053feb8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.0053feb8
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.0053feb8
mov ecx, dword [esp + 0x28]
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4614f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x548348
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov edx, dword [esp + 0x24]
test edx, edx
jne 0x46155c
mov esi, dword [esp + 0x20]
add edi, 0x1d4
mov eax, esi
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
mov ecx, dword [edi + 8]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x28]
mov edx, dword [edi + 0xc]
mov dword [eax + 0xc], edx
call fcn.0053feb8
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
mov eax, dword [esp + 0x28]
lea esi, [esp + 8]
push ebx
push esi
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [edx + 8]
push eax
call dword [0x553110]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
cdq
mov esi, dword [esp + 0xc]
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x30]
add edi, 0x1d4
add esi, edx
add eax, ecx
mov dword [esp + 0x1c], 0xffffffff
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [edi + 8], esi
mov dword [edi + 0xc], eax
mov edi, dword [esp + 0x24]
mov ebx, edi
mov dword [ebx], edx
mov dword [ebx + 4], ecx
lea ecx, [esp + 0x2c]
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], eax
call fcn.0053feb8
mov ecx, dword [esp + 0x14]
mov eax, edi
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
Function at 0x481200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54af76
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
push 0
push 0x168
mov dword [esp + 0x10], esi
call fcn.005401b2
lea edi, [esi + 0x90]
mov dword [esp + 0x14], 0
mov ecx, edi
call fcn.00449320
push 0x57fd84
push str.1_1_1_1
push str.00281050
push str.00280031
push str.0008103e00200013
push str.000800800010001000100020
push 0x587b74
mov ecx, edi
mov byte [esp + 0x30], 1
mov dword [esi], 0x55e5b8
mov dword [edi], 0x55e588
call fcn.00449420
mov ecx, edi
call fcn.004499f0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4842c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54b356
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
push 0
push 0x173
mov dword [esp + 0x10], esi
call fcn.005401b2
lea edi, [esi + 0x90]
mov dword [esp + 0x14], 0
mov ecx, edi
call fcn.00449320
push 0x57fd84
push str.1_1_1_1
push str.0028105000181149
push str.00181030
push str.00200013000810300008103e0008002000080030
push str.000800800010001000100020000810700008002000080030
push 0x587d08
mov ecx, edi
mov byte [esp + 0x30], 1
mov dword [esi], 0x55ee28
mov dword [edi], 0x55edf8
mov dword [esi + 0xe0], 0
mov dword [esi + 0xec], 0
call fcn.00449420
mov ecx, edi
call fcn.004499f0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x487620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54b820
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
mov esi, dword [esp + 0x30]
mov ebp, ecx
test esi, esi
mov dword [esp + 0xc], ebp
mov byte [esp + 0xb], 1
jne 0x487676
push 0x3e8
call fcn.0053ff18
mov eax, dword [eax + 0x20]
push eax
call dword [0x553da4]
push eax
call fcn.00540008
mov esi, eax
test esi, esi
je 0x487745
mov byte [esp + 0xb], 0
mov ecx, dword [esp + 0x44]
push ebx
push edi
push ecx
push 1
push 0
lea ecx, [esp + 0x24]
call fcn.005401ee
lea edx, [esp + 0x18]
mov ecx, esi
push edx
mov dword [esp + 0x34], 0
call fcn.005401e8
mov edi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0xd8]
sub edi, eax
sub ebx, eax
mov eax, dword [ebp + 0xdc]
mov ebp, dword [esp + 0x40]
sub ebp, eax
sub ecx, eax
push ebp
lea eax, [esp + 0x24]
mov dword [esp + 0x4c], ecx
push edi
push eax
mov ecx, esi
call fcn.005401e2
push ebp
push ebx
mov ecx, esi
call fcn.005401dc
mov ecx, dword [esp + 0x48]
push ecx
push ebx
mov ecx, esi
call fcn.005401dc
mov edx, dword [esp + 0x48]
mov ecx, esi
push edx
push edi
call fcn.005401dc
push ebp
push edi
mov ecx, esi
call fcn.005401dc
mov eax, dword [esp + 0x38]
mov ecx, esi
push eax
call fcn.005401e8
mov al, byte [esp + 0x13]
pop edi
test al, al
pop ebx
jne 0x48772c
mov edx, dword [esp + 0xc]
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [edx + 0x20]
push eax
call dword [0x553d40]
mov dword [esp + 0x10], 0x5555a8
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 1
call fcn.005400f8
mov ecx, dword [esp + 0x20]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret 0x18
Function at 0x49b6a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54d686
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
push 0
push 0x175
mov dword [esp + 0x10], esi
call fcn.005401b2
lea edi, [esi + 0x90]
mov dword [esp + 0x14], 0
mov ecx, edi
call fcn.00449320
push 0
push 0
push 0x5d9178
push str.00280031
push str.002000130x00280010
push 0x5d9178
push 0x581be0
mov ecx, edi
mov byte [esp + 0x30], 1
mov dword [esi], 0x562388
mov dword [edi], 0x562358
call fcn.00449420
mov ecx, edi
call fcn.004499f0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x49dd80
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x54d8b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x24]
call fcn.0053fedc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0xf0]
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x17c]
xor ebp, ebp
mov dword [esp + 0x1c], 0xff
cmp ecx, ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x20], ebp
mov byte [esp + 0x18], 0
mov dword [esp + 0x14], eax
je 0x49deb0
call fcn.00452d60
mov ecx, dword [esp + 0x38]
cmp ecx, eax
jge 0x49deb0
push ecx
mov ecx, dword [esi + 0x17c]
call fcn.004df390
mov ebx, eax
push ebp
mov ecx, ebx
call fcn.004ddf80
cmp eax, ebp
je case.default.0x49de1f
push eax
call fcn.004849b0
add esp, 4
cmp eax, 6
mov dword [esp + 0x10], eax
ja case.default.0x49de1f
mov edx, eax
jmp dword [edx*4 + 0x49df30]
mov dword [esp + 0x14], 0x3f800000
jmp 0x49de7d
mov ecx, ebx
call fcn.004ddf70
fstp dword [esp + 0x14]
jmp 0x49de7d
xor edi, edi
mov byte [esp + 0x18], 0
push ebp
mov ecx, ebx
call fcn.004ddf50
cmp eax, ebp
je 0x49deb4
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x20]
push ecx
push edx
push 0x581abc
push eax
call dword [0x553b08]
add esp, 0x10
jmp 0x49deb4
xor edi, edi
mov byte [esp + 0x18], 1
jmp 0x49de44
mov edi, dword [esp + 0x38]
cmp edi, 1
jne 0x49de44
lea edi, [esi + 0x64]
lea ebp, [esi + 0x60]
push 0
mov ecx, ebx
mov dword [edi], 0x80
mov dword [ebp], 0x100
call fcn.004ddf50
test eax, eax
je 0x49deb9
push ebp
push edi
push 0x581abc
push eax
call dword [0x553b08]
add esp, 0x10
jmp 0x49deb9
mov edi, dword [esp + 0x38]
cmp edi, 1
jne 0x49dee1
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x49decb
mov ecx, dword [esi + 0xf4]
test ecx, ecx
je 0x49ded8
mov ecx, dword [esp + 0x14]
push ecx
push eax
mov ecx, esi
call fcn.0049d3a0
mov ecx, esi
call fcn.0049c190
jmp 0x49df07
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
and edx, 0xff
push edx
mov edx, dword [esi + 0x154]
push eax
push ecx
mov ecx, dword [edx + 0xae4]
call fcn.00408290
lea ecx, [esp + 0x24]
mov dword [esp + 0x30], 0xffffffff
call fcn.0053feb8
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x4c8e10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov edx, 1
cmp dword [esi + 0x1c], edx
jbe 0x4c8f1b
push ebx
push edi
lea eax, [esi + 0x32]
xor ebx, ebx
xor ecx, ecx
mov bl, byte [eax - 1]
mov cl, byte [eax + 1]
add eax, 0x10
mov edi, dword [ebx*4 + 0x58e7cc]
mov ecx, dword [ecx*4 + 0x58efcc]
xor ebx, ebx
xor ecx, edi
mov bl, byte [eax - 0x10]
mov edi, dword [ebx*4 + 0x58ebcc]
xor ebx, ebx
mov bl, byte [eax - 0x12]
xor ecx, edi
mov edi, dword [ebx*4 + 0x58e3cc]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0x12], ecx
mov bl, byte [eax - 0xc]
xor ecx, ecx
mov cl, byte [eax - 0xb]
mov edi, dword [ebx*4 + 0x58ebcc]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x58efcc]
mov bl, byte [eax - 0xd]
xor ecx, edi
mov edi, dword [ebx*4 + 0x58e7cc]
xor ebx, ebx
mov bl, byte [eax - 0xe]
xor ecx, edi
mov edi, dword [ebx*4 + 0x58e3cc]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xe], ecx
mov bl, byte [eax - 8]
xor ecx, ecx
mov cl, byte [eax - 7]
mov edi, dword [ebx*4 + 0x58ebcc]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x58efcc]
mov bl, byte [eax - 9]
xor ecx, edi
mov edi, dword [ebx*4 + 0x58e7cc]
xor ebx, ebx
mov bl, byte [eax - 0xa]
xor ecx, edi
mov edi, dword [ebx*4 + 0x58e3cc]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xa], ecx
mov bl, byte [eax - 4]
xor ecx, ecx
mov cl, byte [eax - 3]
mov edi, dword [ebx*4 + 0x58ebcc]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x58efcc]
mov bl, byte [eax - 5]
xor ecx, edi
mov edi, dword [ebx*4 + 0x58e7cc]
xor ebx, ebx
mov bl, byte [eax - 6]
xor ecx, edi
mov edi, dword [ebx*4 + 0x58e3cc]
xor ecx, edi
inc edx
mov dword [eax - 6], ecx
mov ecx, dword [esi + 0x1c]
cmp edx, ecx
jb 0x4c8e26
pop edi
pop ebx
pop esi
ret