joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4238a0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
cmp dword [0x42b444], 0
jne 0x4238c4
push 0x1019
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x4238c4
xor eax, eax
jmp 0x4238f9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp eax, 0xfffffffe
je 0x4238d3
xor eax, eax
jmp 0x4238f9
push 0x11
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 0x1f4
jle 0x4238f1
mov eax, section..text
sub eax, 0x51615
mov dword [0x42b448], eax
mov eax, dword [0x42b448]
add eax, 4
mov esp, ebp
pop ebp
ret

Function at 0x423a60
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x423a78
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x423b1c
mov edx, dword [ebp - 4]
sub edx, 0x231d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 + 0x463a]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr eax, 0xc
cmp eax, 3
jne 0x423b17
mov ecx, dword [ebp - 8]
push ecx
call fcn.00423f80
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x423ad6
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x423ad6
xor eax, eax
jmp 0x423b1c
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x4c3f8]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x4c3f8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x423a6f
mov esp, ebp
pop ebp
ret

Function at 0x40f2e6
Capabilities:
Encode data using xor

Disassembly:
push esp
pop esi
add al, 0x6f
outsd dx, dword [esi]
xor al, 0xb1
xchg esi, eax
jbe 0x40f29d
leave
add ah, dl
dec ecx
or dword [eax], eax
invalid
lock add byte [edi - 0x11], ah
out dx, eax
call dword [ebx - 0x4a]
add al, cl
invalid
mov dh, 0
enter 0x40f0, 0x47
out dx, eax
jecxz 0x40f298
into
outsd dx, dword [esi]
outsd dx, dword [esi]
outsd dx, dword [esi]
outsd dx, dword [esi]
add dl, cl
salc
inc eax
push cs
jecxz 0x40f2e4
shr byte [edi + 0x6f], cl
outsd dx, dword [esi]
outsd dx, dword [esi]
mov ch, byte [edx + 0x7017380a]
outsd dx, dword [esi]
leave
add ah, dl
call esp
jo 0x40f2c0
test eax, 0xc740d689
salc
or eax, 0x69696957
jbe 0x40f289
imul ebp, dword [ecx + 0x76], 0xc576d6c5
salc
jbe 0x40f28c
int1
jbe 0x40f28f
jno 0x40f342
invalid
retf 0xa9f7
outsd dx, dword [esi]
cmp edx, dword [esi - 6]
daa
outsd dx, dword [esi]
ror al, 0x5a
or eax, 0x53c74037
add bh, al
jb 0x40f394
invalid
invalid
Function at 0x80039fd
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043a0], 0x30
mov dword [0x80043a8], 0x80032e8
mov dword [0x80043a4], 2
mov dword [0x80043ac], 0
mov dword [0x80043b0], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003a40
mov dword [0x80043b4], eax
mov dword [0x80043c8], 0x80041d4
mov dword [0x80043c0], 0xf
mov dword [0x80040f6], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043b8], eax
mov dword [0x80043cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040fe], ebp
mov dword [0x80043bc], eax
push 0x80043a0
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004420], eax
push 0
push dword [0x80040f6]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004418], eax
push 1
push dword [0x8004418]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004418]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003afe
xor edi, edi
lea ebx, [0x80043d0]
jmp 0x8003b16
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003b08
jmp 0x8003b2a
mov eax, dword [0x80043d8]
call 0x80029cd
ret

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x408943
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0x4085d8
pop eax
sub edx, 0x1325b779
add edx, 0x775d4a2
call fcn.00408971
xor dword [ecx], eax
or edx, esi
inc ecx
mov edx, 0x4e84f260
cmp ecx, ebx
jne fcn.00408943
ret

Function at 0x438cb3
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
sub edi, 0x689fce77
inc edi
call fcn.00438ce8
dec edi
or edi, edi
xor dword [edx], esi
and ebx, edi
inc edx
push edi
pop ebx
mov ebx, 0xa38bdada
cmp edx, eax
jne fcn.00438cb3
dec edi
push ebx
mov edi, dword [esp]
add esp, 4
ret
Function at 0x4340b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x402266
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x4014b8
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
mov ecx, eax
call dword [sym.imp.MSVBVM60.DLL___vbaI2I4]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov di, word [ecx]
cmp di, word [ebp - 0x4c]
jg 0x43416d
mov ecx, dword [ebx]
lea edx, [ebp - 0x30]
movsx eax, di
push edx
push eax
push ecx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x30], 2
call dword [sym.imp.MSVBVM60.DLL_rtcMidCharBstr]
mov edx, eax
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, dword [0x451060]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov esi, eax
lea ecx, [ebp - 0x20]
neg esi
sbb esi, esi
inc esi
neg esi
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
test si, si
jne 0x43416d
mov eax, 1
add ax, di
jo 0x4341e8
mov edi, eax
jmp 0x434101
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x30]
push ecx
mov dword [ebp - 0x30], 2
mov ax, word [eax]
movsx edx, ax
sub di, ax
mov eax, dword [ebx]
push edx
push eax
jo 0x4341e8
mov word [ebp - 0x28], di
call dword [sym.imp.MSVBVM60.DLL_rtcMidCharBstr]
mov edx, eax
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
push 0x4341d2
jmp 0x4341d1
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
Function at 0x40181c
Capabilities:
Hash data using murmur3

Disassembly:
ror ecx, 0x10
mov dword [ebp - 0x74], ecx
pop ebx
pop esi
pop edi
ret
push edi
push esi
push ebx
mov ebx, dword [ebp - 0x60]
test ebx, ebx
rol ebx, 0xf
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x20]
test ebx, eax
ror eax, 0x11
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x200000
rol ecx, 0xd
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x24]
test edi, eax
rol eax, 0xc
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x800000
ror ecx, 0x15
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x2c]
test edi, eax
rol eax, 0x12
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x8000000
ror ecx, 0x19
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x38]
test esi, eax
ror eax, 0xc
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x1000
ror ecx, 0xa
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
test esi, eax
rol eax, 0xf
cmp ecx, eax
jne 0x4018d4
jmp 0x401990
xor ecx, eax
xor esi, esi
mov edx, 0xff
ror edx, 8
jmp 0x401a00
cmp ecx, esi
je 0x401990
mov ecx, esi
jmp 0x401808
inc ecx
jmp 0x401808
mov edi, eax
and edi, edx
cmp edi, edx
jne 0x40197c
shl ecx, 8
shl eax, 8
jmp 0x401a00

Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x463d20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e83c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x588e74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp dword [ebp + 8], 0
mov dword [ebp - 0x14], 0
je 0x463d94
mov dword [ebx], 0x444164
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x50], 0x4440d0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
mov eax, dword [ebx]
lea esi, [ebx + 4]
push 0
push esi
mov dword [ebp - 0x10], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x4440d8
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.0046f050
mov eax, dword [ebx]
push 8
mov dword [ebp - 4], 2
mov dword [ebp - 0x1c], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x444160
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + ebx - 4], eax
mov dword [esi], 0x4440e0
call fcn.00516384
mov esi, eax
add esp, 4
test esi, esi
je 0x463e13
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov byte [ebp - 4], 3
call fcn.00517fd4
add esp, 4
mov dword [esi + 4], eax
jmp 0x463e15
xor esi, esi
lea eax, [ebx + 4]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
lea edi, [eax + 0x14]
mov dword [eax + 0x1c], edi
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea edx, [eax + 0x24]
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax], 0x444120
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x463ea0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e860
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x588e74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], 0x4440e0
call fcn.00516384
mov esi, eax
add esp, 4
test esi, esi
je 0x463f00
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00517fd4
add esp, 4
mov dword [esi + 4], eax
jmp 0x463f02
xor esi, esi
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4641d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e8f3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x588e74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 4], eax
mov dword [ebx + 8], 0
mov byte [ebx + 0xc], 0
mov dword [ebx], 0x443fd0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
lea edi, [ebx + 0x18]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], edi
mov dword [edi], 0x443f18
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea esi, [edi + 0x18]
mov byte [ebp - 4], 1
push 0x20
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00516384
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov word [edi + 0x30], 0
lea esi, [ebx + 0x50]
mov dword [ebx], 0x443fec
mov dword [edi], 0x444008
push 0x20
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00516384
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, ebx
mov dword [ebx], 0x44402c
mov dword [edi], 0x444048
mov dword [ebx + 0x58], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x464de0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53eb42
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x588e74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebx], 0x443f94
mov dword [ebx + 8], 0x443f5c
mov dword [ebx + 0xc], 0xffffffff
mov dword [ebx + 0x10], 0
mov byte [ebx + 0x14], 0
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x20], 0
mov byte [ebx + 0x24], 0
mov dword [ebx + 0x18], 0x443f6c
mov dword [ebx + 0x28], 0
mov dword [ebp - 4], 0
mov byte [ebx + 0x2c], 0
lea ecx, [ebx + 0x30]
mov byte [ebp - 4], 1
call fcn.00477050
lea edi, [ebx + 0x34]
mov byte [ebp - 4], 2
push 0x40
lea eax, [edi + 5]
mov dword [ebp - 0x10], edi
push 0
push eax
mov dword [edi], 0x443f74
mov byte [edi + 4], 0
call fcn.0052ee50
lea esi, [edi + 0x48]
mov dword [esi], 0
push 0x50
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0
call fcn.00516384
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x50]
mov byte [ebp - 4], 3
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00516384
add esp, 0x14
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea ecx, [edi + 0x58]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
push 0x20
mov byte [ebp - 4], 5
call fcn.0046d0c0
lea ecx, [ebx + 0x98]
mov byte [ebp - 4], 6
mov word [ecx + 0x18], 0
call fcn.00477150
mov eax, dword [ebp + 8]
mov dword [ebx + 0xb4], eax
mov dword [ebx + 0xb8], 0
mov dword [ebx + 0xbc], 0xffffffff
mov dword [ebx + 0xc0], 0xffffffff
mov dword [ebx + 0xc4], 0
mov word [ebx + 0xc8], 0
mov byte [ebx + 0xca], 0
mov dword [ebx + 0xd0], 0
mov dword [ebx + 0xd4], 0
mov dword [ebx + 0xd8], 0
mov dword [ebx + 0xdc], 0
mov dword [ebx + 0xe0], 0
mov dword [ebx + 0xe4], 0
mov eax, ebx
mov dword [ebx + 0xe8], 0
mov dword [ebx + 0xec], 0
mov dword [ebx + 0xf0], 0
mov dword [ebx + 0xf4], 0
mov dword [ebx + 0xf8], 0
mov dword [ebx + 0xfc], 0
mov dword [ebx + 0x100], 0
mov dword [ebx + 0x104], 0
mov dword [ebx + 0x108], 0
mov dword [ebx + 0x10c], 0
mov dword [ebx + 0x110], 0
mov dword [ebx + 0x114], 0
mov byte [ebx + 0x118], 0
mov dword [ebx + 0x11c], 0xc8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x465040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ebcd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x588e74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
call fcn.00464de0
push 0x4677a0
push 0x464a80
push 2
push 0x18
lea eax, [ebx + 0x140]
mov dword [ebx], 0x44406c
mov byte [ebx + 0x120], 0
push eax
mov dword [ebp - 4], 0
mov dword [ebx + 0x124], 0
mov dword [ebx + 0x128], 0
mov dword [ebx + 0x130], 0
mov dword [ebx + 0x134], 0
mov dword [ebx + 0x138], 0
mov dword [ebx + 0x13c], 0
call fcn.005161fb
mov byte [ebp - 4], 1
call fcn.0046a930
add ebx, 0x170
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 4], eax
mov dword [ebx + 8], 0
mov byte [ebx + 0xc], 0
mov dword [ebx], 0x443fd0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
lea edi, [ebx + 0x18]
mov dword [ebp - 0x20], edi
mov dword [edi], 0x443f18
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea esi, [edi + 0x18]
mov byte [ebp - 4], 3
push 0x20
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00516384
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov word [edi + 0x30], 0
lea esi, [ebx + 0x50]
mov dword [ebx], 0x443fec
mov dword [edi], 0x444008
push 0x20
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00516384
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [ebx], 0x44402c
mov dword [edi], 0x444048
mov dword [ebx + 0x58], 0
mov edi, dword [ebp - 0x14]
mov byte [ebp - 4], 5
lea esi, [edi + 0x1d0]
mov dword [ebp - 0x10], esi
push 0x78
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00516384
add esp, 0xc
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x1d8]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
lea ecx, [edi + 0x204]
mov byte [ebp - 4], 7
call fcn.00464800
push 0x2c
push 0
push esi
call fcn.0052ee50
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4