joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ca0bf90
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x220
mov eax, dword [0x6ca1e0e0]
test eax, eax
je 0x6ca0c038
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x6ca0bfc8
mov eax, dword [ebx]
add esp, 0x220
pop ebx
pop esi
pop edi
ret
lea edi, [esp + 0x18]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x6ca0bfb9
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x6ca0c06d
mov dword [esp + 4], 0x6ca18070
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6ca1e0e0], eax
sub esp, 8
test eax, eax
jne 0x6ca0bfaa
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x6ca0bfbb
Function at 0x401c20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x45ffac]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
mov ebp, ecx
mov edx, dword [ebp + 0x1c]
sub edx, 6
xor eax, eax
cmp edx, eax
push esi
push edi
jle 0x401c4c
mov esi, dword [esp + 0x40]
mov ecx, edx
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp edx, eax
mov dword [esp + 0x10], eax
jle 0x401c98
lea esi, [ecx + 8]
lea esp, [esp]
mov edi, dword [esp + 0x10]
cmp edi, dword [ebp + 0x1c]
ja 0x401c98
cmp ecx, edx
jge 0x401c86
lea ecx, [ecx]
cmp eax, 4
jge 0x401c89
mov ebx, dword [esp + ecx*4 + 0x18]
lea edi, [esi + eax]
inc ecx
inc eax
cmp ecx, edx
mov dword [ebp + edi*4], ebx
jl 0x401c70
cmp eax, 4
jne 0x401c94
inc dword [esp + 0x10]
add esi, 4
xor eax, eax
cmp ecx, edx
jl 0x401c60
mov ecx, dword [esp + 0x10]
cmp ecx, dword [ebp + 0x1c]
ja 0x401dd6
mov esi, 0x45e218
jmp 0x401cb4
mov esi, dword [esp + 0x14]
movzx edi, byte [esp + edx*4 + 0x15]
mov cl, byte [esp + 0x18]
xor cl, byte [edi + 0x45b018]
add esi, 4
mov byte [esp + 0x18], cl
movzx edi, byte [esp + edx*4 + 0x16]
movzx ebx, byte [edi + 0x45b018]
xor byte [esp + 0x19], bl
movzx edi, byte [esp + edx*4 + 0x17]
movzx ebx, byte [edi + 0x45b018]
xor byte [esp + 0x1a], bl
movzx edi, byte [esp + edx*4 + 0x14]
xor cl, byte [esi - 4]
movzx ebx, byte [edi + 0x45b018]
xor byte [esp + 0x1b], bl
mov byte [esp + 0x18], cl
mov dword [esp + 0x14], esi
mov ecx, 1
cmp edx, 8
je 0x401d22
cmp edx, ecx
jle 0x401d83
mov esi, dword [esp + ecx*4 + 0x14]
xor dword [esp + ecx*4 + 0x18], esi
inc ecx
cmp ecx, edx
jl 0x401d13
jmp 0x401d83
mov esi, dword [esp + ecx*4 + 0x14]
xor dword [esp + ecx*4 + 0x18], esi
inc ecx
cmp ecx, 4
jl 0x401d22
movzx ecx, byte [esp + 0x24]
movzx ecx, byte [ecx + 0x45b018]
xor byte [esp + 0x28], cl
movzx ecx, byte [esp + 0x25]
movzx ecx, byte [ecx + 0x45b018]
xor byte [esp + 0x29], cl
movzx ecx, byte [esp + 0x26]
movzx ecx, byte [ecx + 0x45b018]
xor byte [esp + 0x2a], cl
movzx ecx, byte [esp + 0x27]
movzx ecx, byte [ecx + 0x45b018]
xor byte [esp + 0x2b], cl
mov ecx, 5
mov esi, dword [esp + ecx*4 + 0x14]
xor dword [esp + ecx*4 + 0x18], esi
inc ecx
cmp ecx, 8
jl 0x401d75
xor ecx, ecx
test edx, edx
jle 0x401dc9
mov esi, dword [esp + 0x10]
lea esi, [esi*4 + 8]
mov edi, dword [esp + 0x10]
cmp edi, dword [ebp + 0x1c]
ja 0x401dc9
cmp ecx, edx
jge 0x401db7
cmp eax, 4
jge 0x401dba
mov ebx, dword [esp + ecx*4 + 0x18]
lea edi, [esi + eax]
inc ecx
inc eax
cmp ecx, edx
mov dword [ebp + edi*4], ebx
jl 0x401da1
cmp eax, 4
jne 0x401dc5
inc dword [esp + 0x10]
add esi, 4
xor eax, eax
cmp ecx, edx
jl 0x401d94
mov ecx, dword [esp + 0x10]
cmp ecx, dword [ebp + 0x1c]
jbe 0x401cb0
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00431b61
add esp, 0x2c
ret 4
Function at 0x401df0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 1
cmp dword [ecx + 0x1c], edx
jbe 0x401eda
push esi
lea eax, [ecx + 0x32]
push edi
jmp 0x401e10
movzx esi, byte [eax + 1]
mov esi, dword [esi*4 + 0x45de18]
movzx edi, byte [eax - 1]
xor esi, dword [edi*4 + 0x45d618]
movzx edi, byte [eax]
xor esi, dword [edi*4 + 0x45da18]
movzx edi, byte [eax - 2]
xor esi, dword [edi*4 + 0x45d218]
inc edx
mov dword [eax - 2], esi
movzx esi, byte [eax + 5]
mov esi, dword [esi*4 + 0x45de18]
movzx edi, byte [eax + 4]
xor esi, dword [edi*4 + 0x45da18]
movzx edi, byte [eax + 3]
xor esi, dword [edi*4 + 0x45d618]
movzx edi, byte [eax + 2]
xor esi, dword [edi*4 + 0x45d218]
add eax, 0x10
mov dword [eax - 0xe], esi
movzx esi, byte [eax - 7]
mov esi, dword [esi*4 + 0x45de18]
movzx edi, byte [eax - 8]
xor esi, dword [edi*4 + 0x45da18]
movzx edi, byte [eax - 9]
xor esi, dword [edi*4 + 0x45d618]
movzx edi, byte [eax - 0xa]
xor esi, dword [edi*4 + 0x45d218]
mov dword [eax - 0xa], esi
movzx esi, byte [eax - 3]
movzx edi, byte [eax - 4]
mov esi, dword [esi*4 + 0x45de18]
xor esi, dword [edi*4 + 0x45da18]
movzx edi, byte [eax - 5]
xor esi, dword [edi*4 + 0x45d618]
movzx edi, byte [eax - 6]
xor esi, dword [edi*4 + 0x45d218]
mov dword [eax - 6], esi
cmp edx, dword [ecx + 0x1c]
jb 0x401e10
pop edi
pop esi
ret
Function at 0x40a3c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x44687f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x45ffac]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.00402a70
add eax, 0x10
mov dword [esi], eax
mov eax, dword [edi + 4]
sub eax, 0x10
push eax
mov dword [esp + 0x20], 0
call fcn.00402a70
add eax, 0x10
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
sub eax, 0x10
push eax
mov byte [esp + 0x24], 1
call fcn.00402a70
add eax, 0x10
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
sub eax, 0x10
push eax
mov byte [esp + 0x28], 2
call fcn.00402a70
add eax, 0x10
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
sub eax, 0x10
push eax
mov byte [esp + 0x2c], 3
call fcn.00402a70
add eax, 0x10
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
sub eax, 0x10
push eax
mov byte [esp + 0x30], 4
call fcn.00402a70
add eax, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
sub eax, 0x10
push eax
mov byte [esp + 0x34], 5
call fcn.00402a70
add esp, 0x1c
add eax, 0x10
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x40c710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x446c8e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x45ffac]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x44c7dc
mov dword [esi + 4], 0x44c714
mov dword [esi + 8], 0x44c6d4
mov eax, dword [0x46147c]
mov edx, dword [eax + 0xc]
mov ecx, 0x46147c
call edx
add eax, 0x10
mov dword [esi + 0xc], eax
mov eax, dword [0x46147c]
mov edx, dword [eax + 0xc]
mov ecx, 0x46147c
mov dword [esp + 0x14], 0
call edx
add eax, 0x10
mov dword [esi + 0x10], eax
mov eax, dword [0x46147c]
mov edx, dword [eax + 0xc]
mov ecx, 0x46147c
mov byte [esp + 0x14], 1
call edx
add eax, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [0x46147c]
mov edx, dword [eax + 0xc]
mov ecx, 0x46147c
mov byte [esp + 0x14], 2
call edx
add eax, 0x10
mov dword [esi + 0x18], eax
mov eax, dword [0x46147c]
mov edx, dword [eax + 0xc]
mov ecx, 0x46147c
mov byte [esp + 0x14], 3
call edx
add eax, 0x10
mov dword [esi + 0x1c], eax
mov eax, dword [0x46147c]
mov edx, dword [eax + 0xc]
mov ecx, 0x46147c
mov byte [esp + 0x14], 4
call edx
add eax, 0x10
mov dword [esi + 0x20], eax
mov eax, dword [0x46147c]
mov edx, dword [eax + 0xc]
mov ecx, 0x46147c
mov byte [esp + 0x14], 5
call edx
add eax, 0x10
mov dword [esi + 0x24], eax
mov eax, dword [0x46147c]
mov edx, dword [eax + 0xc]
mov ecx, 0x46147c
mov byte [esp + 0x14], 6
call edx
add eax, 0x10
mov dword [esi + 0x28], eax
mov eax, dword [0x46147c]
mov edx, dword [eax + 0xc]
mov ecx, 0x46147c
call edx
add eax, 0x10
mov dword [esi + 0x2c], eax
mov eax, dword [0x46147c]
mov edx, dword [eax + 0xc]
mov ecx, 0x46147c
mov byte [esp + 0x14], 7
call edx
add eax, 0x10
mov dword [esi + 0x30], eax
mov eax, dword [0x46147c]
mov ecx, 0x46147c
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [esi + 0x34], eax
mov eax, dword [0x46147c]
mov edx, dword [eax + 0xc]
mov ecx, 0x46147c
call edx
add eax, 0x10
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x3c]
mov byte [esp + 0x14], 8
call fcn.0040bba0
lea ecx, [esi + 0x54]
mov byte [esp + 0x14], 9
call fcn.0040bba0
mov eax, dword [0x46147c]
mov edx, dword [eax + 0xc]
mov ecx, 0x46147c
call edx
add eax, 0x10
mov dword [esi + 0x6c], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x413240
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
mov eax, dword [0x45ffac]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x60]
xor ecx, ecx
push esi
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x68]
push ecx
push eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.004130a0
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00413160
mov ecx, dword [esp + 0x70]
add esp, 0x14
pop esi
xor ecx, esp
call fcn.00431b61
add esp, 0x5c
ret
Function at 0x4136a0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x14]
push edi
xor eax, eax
push eax
push eax
push eax
push eax
push esi
call edx
mov edx, dword [esi]
xor ecx, ecx
xor eax, eax
push ecx
push eax
mov eax, dword [edx + 0x18]
push esi
call eax
mov ebp, dword [esp + 0x18]
push ebp
call fcn.004127a0
mov ebx, eax
push ebx
call fcn.00431a2e
mov edi, eax
xor eax, eax
add esp, 8
cmp edi, eax
jne 0x4136e8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push eax
push 0x40
push 0x8000
lea ecx, [esp + 0x28]
push ebp
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
call fcn.0043558d
add esp, 0x14
test eax, eax
jne 0x413761
mov edx, dword [esp + 0x1c]
push 0x44b9fc
push edx
call fcn.00434c0d
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x413754
push ebp
push 1
push ebx
push edi
call fcn.0043346a
push ebx
push edi
push esi
call fcn.004058d0
push ebp
mov dword [esp + 0x30], eax
call fcn.0043314e
add esp, 0x20
push edi
call fcn.00431a95
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x1c]
push eax
call fcn.00434b40
add esp, 4
push edi
call fcn.00431a95
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x414270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4475c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x45ffac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [0x46147c]
mov edx, dword [eax + 0xc]
xor ebx, ebx
xor edi, edi
mov ecx, 0x46147c
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], ebx
call edx
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push eax
push ecx
mov byte [ebp - 4], 1
call fcn.00414180
add esp, 8
cmp eax, ebx
je 0x414344
mov edx, dword [ebp + 8]
push 0x44d37c
push edx
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], ebx
call fcn.0043354d
add esp, 0xc
test eax, eax
jne 0x414344
mov ecx, dword [ebp - 0x18]
push ecx
push 1
lea edx, [ebp - 0x14]
push 2
push edx
mov byte [ebp - 0x14], 0xff
mov byte [ebp - 0x13], 0xfe
call fcn.0043418d
mov esi, dword [ebp - 0x1c]
mov eax, esi
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x414312
mov ecx, dword [ebp - 0x18]
sub eax, edx
push ecx
sar eax, 1
push 1
lea edx, [eax + eax]
push edx
push esi
call fcn.0043418d
mov eax, dword [ebp - 0x18]
push eax
call fcn.0043314e
add esp, 0x14
mov edi, 1
jmp 0x414347
mov esi, dword [ebp - 0x1c]
lea eax, [esi - 0x10]
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414383
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414640
Capabilities:
Hash data with md5

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x70
push 0xffffffffffffffff
push 0x447678
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x45ffac]
xor eax, ebp
mov dword [ebp + 0x6c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x7c]
mov esi, dword [ebp + 0x78]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x14]
xor ebx, ebx
push ebx
push ebx
mov dword [ebp + 4], eax
xor eax, eax
push eax
push eax
push esi
mov dword [ebp], esi
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x14], 0x67452301
mov dword [ebp + 0x18], 0xefcdab89
mov dword [ebp + 0x1c], 0x98badcfe
mov dword [ebp + 0x20], 0x10325476
mov dword [ebp - 0x14], ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
call edx
push 0x400
call fcn.00431a2e
add esp, 4
mov edi, eax
push esi
mov dword [ebp + 8], edi
call fcn.00405800
mov ecx, eax
add esp, 4
shr ecx, 0xa
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov dword [ebp + 0xc], ecx
cmp ebx, ecx
jge 0x414749
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
lea ecx, [ebp + 0x10]
push ecx
push 0x400
push edi
push esi
mov dword [ebp + 0x10], 0
call edx
test eax, eax
jl 0x41470d
cmp dword [ebp + 0x10], 0x400
je 0x41472e
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp + 0x10], 0x44d728
call fcn.004324bd
push 0x455fa4
lea ecx, [ebp - 0x38]
push ecx
call fcn.0043215b
push 0x400
lea edx, [ebp + 0x14]
push edi
push edx
call fcn.004130a0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
add esp, 0xc
inc ebx
jmp 0x4146e3
and eax, 0x3ff
mov ebx, eax
je 0x41479f
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
lea ecx, [ebp + 0x10]
push ecx
push ebx
push edi
push esi
mov dword [ebp + 0x10], 0
call edx
test eax, eax
jl 0x414770
cmp dword [ebp + 0x10], ebx
je 0x414791
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp + 0xc], 0x44d728
call fcn.004324bd
push 0x455fa4
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0043215b
push ebx
lea edx, [ebp + 0x14]
push edi
push edx
call fcn.004130a0
add esp, 0xc
mov ebx, 1
mov dword [ebp - 4], 0xffffffff
jmp 0x4147f4
push edi
call fcn.00431a95
mov edx, dword [ebp + 4]
lea ecx, [ebp + 0x14]
push ecx
push edx
call fcn.00413160
mov ecx, dword [esi]
mov edx, dword [ecx + 0x14]
add esp, 0xc
xor eax, eax
push eax
push eax
push eax
push eax
push esi
call edx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x6c]
xor ecx, ebp
call fcn.00431b61
add ebp, 0x70
mov esp, ebp
pop ebp
ret
Function at 0x416d40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447a90
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x45ffac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
xor esi, esi
push ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
call fcn.004127a0
push esi
push 0x40
push 0x8000
mov edi, eax
lea eax, [ebp - 0x14]
push ebx
push eax
mov dword [ebp - 0x14], esi
call fcn.0043558d
add esp, 0x18
test eax, eax
jne 0x416e23
mov ecx, dword [ebp - 0x14]
push 0x44b9fc
push ecx
call fcn.00434c0d
add esp, 8
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x416e17
lea ebx, [edi + 4]
push ebx
call fcn.00431a2e
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], eax
test esi, esi
je 0x416e01
push ebx
push 0
push esi
call fcn.00431b70
mov edx, dword [ebp - 0x18]
push edx
push 1
push edi
push esi
call fcn.0043346a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
push edi
push esi
call fcn.004169d0
add esp, 0x34
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0043314e
jmp 0x416e20
mov edx, dword [ebp - 0x14]
push edx
call fcn.00434b40
add esp, 4
push esi
call fcn.00431a95
mov eax, dword [ebp - 0x20]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417540
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x447b58
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x45ffac]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 0
push eax
push edx
lea eax, [esp + 0x30]
push eax
call fcn.00416280
mov ecx, dword [esp + 0x24]
push ecx
mov dword [esp + 0x1c], 0
call fcn.00435af5
mov esi, eax
lea edx, [esp + 0x24]
push esi
push edx
call fcn.00414c80
lea ecx, [esp + 0x30]
push ecx
push eax
call fcn.004138b0
mov bl, al
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
or edi, 0xffffffff
add esp, 0x14
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4175ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esp + 0x18], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test bl, bl
je 0x417608
test edi, edi
jg 0x4175ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
test edi, edi
jg 0x417616
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
Function at 0x418810
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x447d88
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x45ffac]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0
call fcn.004185e0
mov esi, eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x24], 0
call fcn.00415440
push esi
push eax
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x30], 1
call fcn.004082b0
mov esi, dword [esp + 0x38]
push 0x44da58
push eax
push esi
mov byte [esp + 0x3c], 2
call fcn.004071d0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x20
mov byte [esp + 0x1c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4188a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x1c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4188cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4188f5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret
Function at 0x41dae0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4482d0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x45ffac]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
call fcn.0041d960
mov esi, eax
cmp esi, ebx
jne 0x41db44
mov eax, dword [0x46147c]
mov edx, dword [eax + 0xc]
mov ecx, 0x46147c
call edx
mov ecx, eax
mov eax, dword [esp + 0x30]
add ecx, 0x10
mov dword [eax], ecx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
lea edx, [esp + 0x14]
push edx
call fcn.0041cce0
lea eax, [esp + 0x20]
push esi
push eax
mov dword [esp + 0x34], ebx
call fcn.00414c80
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x40], 1
call fcn.004082b0
push 0x44d364
push eax
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x4c], 2
call fcn.004071d0
add esp, 0x24
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
or edi, 0xffffffff
mov byte [esp + 0x28], 4
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41dbb1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x28], 5
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41dbd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x44b2dc]
test eax, eax
jne 0x41dbf6
mov edx, dword [0x46147c]
mov eax, dword [edx + 0xc]
mov ecx, 0x46147c
call eax
jmp 0x41dc06
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
push eax
call fcn.00402a70
add esp, 4
mov esi, dword [esp + 0x30]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov edx, edi
lea ecx, [eax + 0xc]
mov byte [esp + 0x28], bl
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41dc32
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov dword [esp + 0x28], edi
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x41dc53
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x41e420
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x14]
push edi
xor ebp, ebp
push ebp
push ebp
xor eax, eax
push eax
push eax
push esi
call edx
push esi
call fcn.00405800
mov edi, eax
push edi
call fcn.00431a2e
mov ebx, eax
add esp, 8
cmp ebx, ebp
jne 0x41e456
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp edi, ebp
je 0x41e477
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
lea ecx, [esp + 0x14]
push ecx
push edi
push ebx
push esi
mov dword [esp + 0x24], ebp
call edx
test eax, eax
jl 0x41e4b6
cmp dword [esp + 0x14], edi
jne 0x41e4b6
mov eax, dword [esp + 0x18]
push 0x44d37c
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], ebp
call fcn.0043354d
add esp, 0xc
test eax, eax
jne 0x41e4b6
mov edx, dword [esp + 0x14]
push edx
push 1
push edi
push ebx
call fcn.0043418d
mov eax, dword [esp + 0x24]
push eax
mov ebp, 1
call fcn.0043314e
add esp, 0x14
push ebx
call fcn.00431a95
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret