joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10185110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [ebp + 8]
mov dword [0x101a69f0], 0x1410
mov dword [ebp - 0x30], eax
call fcn.101853d0
xor ecx, ecx
mov dword [0x101a69ec], 0x163b
mov edx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
jmp 0x101851d2
lea eax, [0x1018717d]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x101a69ec], 0x3bc
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
call fcn.101861b0
mov dword [0x101a69f0], 0x17c9
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call fcn.10184ce0
mov ecx, eax
mov dword [0x101a6a08], eax
mov eax, esp
mov edx, dword [ebp - 0x48]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov dword [0x101a69f0], 0x1739
mov edx, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
jmp 0x10185222
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edx, section..data
imul esi, eax, 0x78
mov edi, edx
add edi, esi
add edi, 0x5c
mov esi, dword [edi]
imul edi, eax, 0x78
add edx, edi
add edx, 0x58
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x415
mov ecx, edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
je 0x1018514a
jmp 0x101851d2
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
lea edx, section..data
imul esi, eax, 0x78
mov edi, edx
add edi, esi
add edi, 0x5c
mov esi, dword [edi]
imul edi, eax, 0x78
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x78
add edx, ebx
add edx, 0x58
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x4c]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], edx
call fcn.101860a0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
add eax, ecx
mov edx, dword [ebp - 0x58]
add edx, 1
cmp edx, 0x415
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edx
jne 0x10185222
mov dword [0x101a69f0], 0x22ea
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x48]
mov dword [esp + 8], ecx
call fcn.101857b0
xor eax, eax
mov ecx, dword [ebp - 0x4c]
add ecx, 0x33aa2
mov edx, dword [ebp - 0x4c]
add edx, 0x2ed9f
mov esi, dword [ebp - 0x30]
mov dword [esi], ecx
mov dword [esi + 4], 0x149e00
mov dword [esi + 8], edx
mov dword [esi + 0xc], 0x2000
mov dword [0x101a69ec], 0x1434
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10185300
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.10185300]
mov dword [0x101a69ec], 0x2ba
mov dword [0x101a69f0], 0xffffe8fe
mov dword [ebp - 4], eax
jmp 0x1018532d
mov eax, dword [ebp - 8]
add esp, 8
pop ebp
ret
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 8], eax
jne 0x10185349
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x10185325
mov eax, dword [ebp - 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x101a69ec], 0xfffff2fa
mov dword [ebp - 4], eax
jmp 0x1018532d
Function at 0x10185860
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [0x101a69ec]
mov dword [0x101a69f4], 0
mov dword [0x101a69f8], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
mov dword [0x101a6a04], 0
mov eax, dword [ebp - 0x20]
add eax, 0xffffe517
mov dword [0x101a69f0], eax
mov eax, dword [0x101a69ec]
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov edx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
je 0x10185a12
jmp 0x10185a27
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov edx, 0x100
mov dword [0x101a69f0], ecx
mov dword [0x101a69ec], 0x14b6
mov ecx, dword [0x101a69f4]
add ecx, 1
mov dword [ebp - 0x34], eax
mov eax, ecx
mov dword [ebp - 0x38], edx
cdq
mov ecx, dword [ebp - 0x38]
idiv ecx
mov dword [0x101a69f4], edx
mov esi, dword [0x101a69f8]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x101a69f8], edx
mov dword [0x101a69ec], 0x44
mov edx, dword [0x101a69f4]
mov bl, byte [edi + edx]
mov byte [0x101a69fc], bl
mov dword [0x101a69ec], 0xe50
mov edx, dword [0x101a69f8]
mov bl, byte [edi + edx]
mov edx, dword [0x101a69f4]
mov byte [edi + edx], bl
mov bl, byte [0x101a69fc]
mov edx, dword [0x101a69f8]
mov byte [edi + edx], bl
mov edx, dword [0x101a69ec]
add edx, 0xb7f
mov dword [0x101a69f0], edx
mov edx, dword [0x101a69f4]
movzx edx, byte [edi + edx]
mov esi, dword [0x101a69f8]
movzx esi, byte [edi + esi]
add esi, edx
mov dword [0x101a69f0], 0x10dd
and esi, 0xff
mov dword [0x101a6a04], esi
mov edx, dword [0x101a69ec]
add edx, 0xffffe052
mov dword [0x101a69ec], edx
mov bl, byte [edi + esi]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x34]
movzx ecx, byte [edx + esi]
mov dword [esp], ecx
movzx ecx, bl
mov dword [esp + 4], ecx
call fcn.10001000
mov ecx, 0xc10
mov edx, 0x1fd
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x34]
mov byte [esi + edi], al
mov dword [0x101a69ec], 0xc10
add edi, 1
mov eax, dword [ebp - 0x10]
cmp edi, eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ecx
jne 0x101858d6
mov eax, dword [ebp - 0x28]
add eax, 0xffffdbf0
mov dword [0x101a69f0], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffff5ed
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
jmp 0x101858d6
Function at 0x10185e90
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [0x101a69ec], 0x9d2
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x101a69ec], 0x2420
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x10185f19
mov eax, 1
mov dword [0x101a69ec], 0x263b
mov dword [ebp - 0x14], eax
jmp 0x10186027
mov dword [0x101a69f0], 0x18b8
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10186027
mov eax, dword [ebp - 0x18]
mov dword [0x101a69ec], 0x568
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x10185f59
jmp 0x10185ee7
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edx
je 0x10185efb
mov dword [0x101a69f0], 0xffffe35a
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0x104
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
jl 0x10185f19
jmp 0x10185efb
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff4
shl eax, 1
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp word [eax], 0x6f
jne 0x10185ee7
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff5
mov dword [0x101a69ec], 0x23ba
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2], 0x61
jne 0x10185ee7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
sete dl
mov byte [ebp - 0x2d], dl
mov al, byte [ebp - 0x2d]
test al, 1
jne 0x10185fc0
jmp 0x10185ee7
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff7
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2], 0x64
jne 0x10185ee7
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff8
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x38]
cmp word [eax + ecx*2], 0x6c
jne 0x10185ee7
mov eax, dword [0x101a69f0]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add eax, 0x1815
mov dword [0x101a69f0], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0xe], 0x6c
je 0x10185ed0
jmp 0x10185ee7
mov eax, dword [ebp - 0x14]
add esp, 0x3c
pop ebp
ret
Function at 0x40a690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ca928
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x53856c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, 0x12345
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0xc
mov dword [esp + 0xc], 0x4def90
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0xe
mov dword [esp + 0x18], 0x4def6c
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x24], 0x4defb4
push edi
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov byte [esp + 0x40], 2
mov byte [esp + 0x13], 1
call fcn.00409e90
test al, al
jne 0x40a71e
mov byte [esp + 0xb], al
push edi
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.00409e90
test al, al
jne 0x40a733
mov byte [esp + 0xb], al
push edi
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.00409e90
test al, al
je 0x40a74b
cmp byte [esp + 0xb], 0
jne 0x40a779
mov ecx, ebx
call fcn.004384d0
push 0x4def28
push case.0x44a944.0
mov edx, eax
call fcn.004397d0
add esp, 8
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x34
ret
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x34
ret
Function at 0x415000
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
sub esp, 0x478
mov eax, dword [0x53856c]
xor eax, esp
mov dword [esp + 0x474], eax
mov eax, dword [esp + 0x47c]
push esi
push edi
push 0x4dfe1c
push eax
lea eax, [esp + 0x14]
push eax
mov edi, ecx
mov dword [esp + 0x18], 0
call fcn.004ac1e2
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x41505b
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x474]
xor ecx, esp
call fcn.004aac2b
add esp, 0x478
ret
push eax
push 0x400
lea ecx, [esp + 0x80]
push 1
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], 0x98badcfe
mov dword [esp + 0x34], 0x10325476
call fcn.004ac4d5
add esp, 0x10
test eax, eax
je 0x4150d5
lea edx, [esp + 0x78]
push edx
lea esi, [esp + 0x14]
call fcn.0043ec60
mov eax, dword [esp + 0x10]
push eax
push 0x400
lea ecx, [esp + 0x84]
push 1
push ecx
call fcn.004ac4d5
add esp, 0x14
test eax, eax
jne 0x4150a7
lea eax, [esp + 0x10]
call fcn.0043ed70
mov edx, dword [esp + 0xc]
push edx
call fcn.004ac569
mov ecx, dword [esp + 0x480]
add esp, 4
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.004aac2b
add esp, 0x478
ret
Function at 0x423ca0
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4c302d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x53856c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
fld dword [0x529790]
sub esp, 0xc
fstp dword [esp + 8]
lea esi, [edi + 0x804]
fld dword [str._s:_t_s_r_n]
lea eax, [esp + 0x18]
fstp dword [esp + 4]
mov dword [esp + 0x18], 0x4a39a2
fld dword [0x529788]
mov dword [esp + 0x1c], 0x4a3cd1
fstp dword [esp]
mov dword [esp + 0x20], fcn.004a38c5
call fcn.004259a0
mov dword [esp + 0x20], 0
fld dword [0x529790]
sub esp, 0xc
fstp dword [esp + 8]
lea esi, [edi + 0x840]
fld dword [str._s:_t_s_r_n]
lea eax, [esp + 0x18]
fstp dword [esp + 4]
mov dword [esp + 0x18], 0x4a39a2
fld dword [0x529788]
mov dword [esp + 0x1c], 0x4a3cd1
fstp dword [esp]
mov dword [esp + 0x20], fcn.004a38c5
call fcn.004259a0
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
push ecx
mov dword [edi + 0x890], eax
mov eax, dword [esp + 0x30]
push edx
push eax
mov eax, dword [esp + 0x48]
mov ecx, edi
mov dword [edi + 0x88c], 0
call fcn.00423c30
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0x18
Function at 0x438080
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4c88bb
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x53856c]
xor eax, esp
mov dword [esp + 0x12c], eax
push edi
mov eax, dword [0x53856c]
xor eax, esp
push eax
lea eax, [esp + 0x138]
mov dword fs:[0], eax
mov edi, 0x4df26c
call fcn.00442fa0
mov al, byte [eax + 0x977]
test al, al
je 0x4380d9
cmp al, 1
sete al
test al, al
je 0x4381f8
cmp byte [0x54b3a7], 0
jne 0x4381f8
mov ecx, esi
call fcn.00434fa0
test al, al
jne 0x43814c
cmp byte [esi + 0x11c], al
lea eax, [esi + 0xc]
jne 0x4380ff
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [0x4d6194]
cmp eax, 0xffffffff
je 0x438117
shr eax, 4
not al
and al, 1
jne 0x43814c
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x438126
mov eax, dword [esi + 8]
lea edi, [eax + 4]
call fcn.004453b0
call fcn.004453b0
cmp dword [eax + 0x124], 0
je 0x4381f8
push 1
call fcn.00448800
jmp 0x4381f8
mov ecx, 0x4df26c
mov eax, ecx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x438179
test dx, dx
je 0x438175
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x438179
add eax, 4
add ecx, 4
test dx, dx
jne 0x438153
xor eax, eax
jmp 0x43817e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4381cb
lea ecx, [esp + 0xc]
call fcn.00434660
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x144], 0
call fcn.00436570
cmp dword [esp + 0x10], 0
jne 0x4381ad
xor edi, edi
jmp 0x4381c2
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x4381bf
mov eax, dword [esp + 0x14]
lea edi, [eax + 4]
lea ecx, [esp + 0xc]
call fcn.00434c50
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4381da
mov eax, dword [esi + 8]
push edi
add eax, 4
push ebx
push eax
call fcn.004373f0
add esp, 0xc
push eax
push 0
push 0x430120
call fcn.004afba1
add esp, 0xc
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.004aac2b
add esp, 0x13c
ret

Function at 0x43b6c0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov ecx, dword [esp + 0x74]
xor eax, eax
push ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x64], eax
push edi
mov edi, dword [esp + 0x74]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.0043b780
mov byte [esp + 0x13], al
mov eax, dword [esp + 0x7c]
add esp, 4
lea ebx, [esp + 0x10]
call fcn.0044aa00
mov al, byte [esp + 0xf]
pop edi
pop ebx
add esp, 0x68
ret

Function at 0x43b730
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret
Function at 0x43d3c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c4243
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x53856c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
fld dword [0x529788]
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0x11
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
fstp dword [esi + 0xc]
fld dword [str._s:_t_s_r_n]
mov ecx, esi
fstp dword [esi + 0x10]
fld dword [0x529790]
fstp dword [esi + 0x14]
call fcn.00431120
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x43e0b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c69d0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push edi
mov eax, dword [0x53856c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor ebx, ebx
mov byte [esp + 0x10], bl
mov dword [esp + 0xc], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], 0x4a39a2
mov dword [esp + 0x28], 0x4a3cd1
mov dword [esp + 0x2c], fcn.004a38c5
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 0x1fff8
mov dword [esp + 0x20], 0x4dba34
mov eax, dword [esp + 0x4c]
push eax
push ecx
lea edx, [esp + 0x14]
push edx
lea edi, [esp + 0x20]
mov byte [esp + 0x4c], 1
call fcn.0043f9b0
test al, al
jne 0x43e191
mov byte [esp + 0x40], bl
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x43e159
push eax
call fcn.004aacc5
add esp, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0x4db6c4
call fcn.00410130
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], 0xffffffff
call fcn.00438470
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x38
ret 8
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.0043e640
mov byte [esp + 0x40], bl
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x43e1c1
push eax
call fcn.004aacc5
add esp, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0x4db6c4
call fcn.00410130
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], 0xffffffff
call fcn.00438470
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x38
ret 8
Function at 0x447940
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c4b76
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x53856c]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
mov eax, dword [0x53856c]
xor eax, esp
push eax
lea eax, [esp + 0x150]
mov dword fs:[0], eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0x521200
call fcn.00439140
xor ebx, ebx
mov eax, 0x52119c
lea edx, [esp + 0x28]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0x80000002
call fcn.00439300
mov dword [esp + 0x158], ebx
mov byte [esp + 0x10], bl
mov dword [esp + 0xc], ebx
push 1
push ebx
push ebx
push 0x51f3d0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x16c], 1
call fcn.00443b00
lea ecx, [esp + 0xc]
test al, al
jne 0x447a2c
mov byte [esp + 0x158], bl
call fcn.00438470
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], 0x521200
cmp eax, ebx
je 0x4479fe
push eax
call dword [0x4d6028]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], 0x51f564
cmp byte [esp + 0x144], bl
jne 0x447a28
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x34]
cmp eax, ecx
je 0x447a28
push eax
call fcn.004aacc5
add esp, 4
mov al, 1
jmp 0x447a96
push 4
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
mov eax, 0x5217d4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 4
call fcn.00443cc0
lea ecx, [esp + 0xc]
test al, al
jne 0x447a74
mov byte [esp + 0x158], bl
call fcn.00438470
lea ecx, [esp + 0x1c]
call fcn.00443ab0
mov al, 1
jmp 0x447a96
cmp dword [esp + 0x14], ebx
mov byte [esp + 0x158], bl
sete byte [esp + 0xb]
call fcn.00438470
lea ecx, [esp + 0x1c]
call fcn.00443ab0
mov al, byte [esp + 0xb]
mov ecx, dword [esp + 0x150]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.004aac2b
add esp, 0x154
ret
Function at 0x448640
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4c805f
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x53856c]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53856c]
xor eax, esp
push eax
lea eax, [esp + 0x154]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x164]
mov ecx, ebp
mov dword [esp + 0x20], ebp
call fcn.00439140
xor ebx, ebx
mov dword [esp + 0x15c], ebx
lea ecx, [esp + 0x24]
mov dword [ebp + 0x124], ebx
call fcn.00439140
mov byte [esp + 0x18], bl
mov dword [esp + 0x14], ebx
lea esi, [esp + 0x24]
lea edi, [esp + 0x14]
mov byte [esp + 0x15c], 2
call fcn.0043d300
test al, al
jne 0x4486f9
mov ecx, edi
mov byte [esp + 0x15c], 1
call fcn.00438470
mov dword [esp + 0x24], 0x51f564
cmp byte [esp + 0x140], bl
jne 0x4487c6
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
cmp eax, ecx
jmp 0x4487bb
lea eax, [esp + 0x30]
cmp byte [esp + 0x140], bl
jne 0x44870a
mov eax, dword [esp + 0x2c]
add eax, 4
mov edx, ebp
call fcn.00439300
push 0x5189c4
push case.0x44a944.0
mov edx, ebp
call fcn.004397d0
push 0x5217ac
push case.0x44a944.0
mov edx, ebp
call fcn.004397d0
push 0x230
call fcn.004aac60
add esp, 0x14
mov dword [esp + 0x1c], eax
mov byte [esp + 0x15c], 3
cmp eax, ebx
je 0x448762
push 5
push eax
mov edx, 0x521858
call fcn.004451e0
jmp 0x448764
xor eax, eax
mov dword [ebp + 0x128], eax
cmp byte [0x54b3a7], bl
jne 0x44878f
cmp byte [0x54d81d], bl
je 0x44878f
push ebp
push ebx
push 0x441770
call fcn.004afba1
add esp, 0xc
mov dword [ebp + 0x124], eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x15c], 1
call fcn.00438470
mov dword [esp + 0x24], 0x51f564
cmp byte [esp + 0x140], bl
jne 0x4487c6
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x30]
cmp eax, edx
je 0x4487c6
push eax
call fcn.004aacc5
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x154]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.004aac2b
add esp, 0x14c
ret 4