joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56aea0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x56aed3
push esi
call fcn.0056fe40
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x56aecc
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x56af59
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x56af42
mov eax, dword [esi + 8]
test eax, eax
je 0x56aef7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x56af3e
cmp eax, 2
je 0x56af42
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x56aeea
cmp eax, 3
je 0x56af1d
cmp eax, 1
jne 0x56aeea
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x56aeea
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x56aeea
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0056af90
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x56af79
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0056af90
add esp, 4
pop esi
ret

Function at 0x59ba20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x59ba2b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x59bb2e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x7115d0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x7115d0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x7115d0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x7115d0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x7115d0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x7115d0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x7115d0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x7115d0]
xor eax, edx
inc ecx
dec edi
jne 0x59ba46
pop edi
test esi, esi
je 0x59bb50
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x7115d0]
xor eax, edx
inc ecx
dec esi
jne 0x59bb32
pop esi
pop ebx
not eax
ret
Function at 0x5bd83f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5bd85f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005bfb4a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x5bd882
test byte [esp + 8], 2
je 0x5bd882
call fcn.005bfbbd
mov dword [eax], 0xd
call fcn.005bfbc6
mov dword [eax], 5
jmp 0x5bd85b
xor eax, eax
ret

Function at 0x5cf219
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x5cf23b
cmp dword [edi + 0x3c], 0
jne 0x5cf23b
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.005d8dd4
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.005cf268
pop edi
pop esi
pop ebx
ret 8

Function at 0x5d08cc
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5d0904
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005ce841
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005ce819
jmp 0x5d0910
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5d2246
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5d2288
call fcn.005d8dd4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5d2288
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5d227f
xor eax, eax
jmp 0x5d2290
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005d2296
pop edi
pop esi
pop ebx
ret 4

Function at 0x5d9304
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5d9332
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5d9350
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005d926a
jmp 0x5d9350
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5d9350
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005d926a
test edi, edi
mov eax, edi
jne 0x5d933a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x5dbcca
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x5dbcf2
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x5dbd03
push 2
call edi
test ax, ax
jge 0x5dbd03
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.005cff02
cmp dword [esi + 0x30], ebx
jne 0x5dbddd
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.005cff02
cmp eax, dword [esp + 0x34]
jne 0x5dbddd
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x5dbd79
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x5dbdbe
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x5dbddd
cmp eax, 0x205
je 0x5dbddd
cmp eax, 0x201
je 0x5dbddd
cmp eax, 0x204
je 0x5dbddd
cmp eax, ebx
jne 0x5dbda4
cmp dword [esp + 0x1c], 0x1b
je 0x5dbddd
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x7db630]
jbe 0x5dbdd3
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x5dbd36
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4

Function at 0x100059e0
Capabilities:
Encode data using xor

Disassembly:
adc dword [esi], edx
and dword [esi], ebx
cld
aaa
dec ecx
jnp 0x100059e9
push cs
push esi
dec edx
or eax, 0x4f36503c
push ss
aam 0x83
loope 0x10005998
movsb byte es:[edi], byte [esi]
push eax
or ebp, dword [ecx - 0x63]
mov ebp, 0xd228d71d
jo 0x10005a50
invalid
xchg esp, eax
out 0xb1, al
nop
aad 0x3c
sub eax, 0x317eff25
push 0x30669b97
scasd eax, dword es:[edi]
mov bh, 0xee
cmp bh, byte [0xc273557c]
pop ebp
lds ebx, [ebp + 0x65]
cdq
int1
sbb dword [esi], ebx
invalid
cmp edi, ebx
dec edi
movsd dword es:[edi], dword [esi]
out dx, eax
lcall 0xbbec, 0xccac4f9f
mov ebp, 0xf9e8b511
and edi, edx
scasb al, byte es:[edi]
inc edx
sti
test edx, edx
popal
add eax, 0x5dbed4e7
jge 0x100059f3
pop ds
mov cl, 0xaf
xchg edx, eax
jb 0x10005a16
mov eax, 0xf67fdd9a
rol ecx, cl
and dh, 0x7a
test bh, ah
mov dh, 0x45
mov ecx, 0x81c38aa4
test eax, 0xc43389b5
push ebp
cmp dh, byte [ebx - 0x35]
insd dword es:[edi], dx
add esp, esp
inc edi
pop ebx
mov cl, 0x9e
cld
sbb al, byte [eax + 4]
sbb byte [edx], dl
invalid
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x403203
pop dword [ebp - 0x38]
mov eax, 0x6de97b75
sub eax, 0x6da94972
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xd8baf7d4
sub dword [ebp - 0x48], 0x8a68b289
mov dword [ebp - 0x44], 0x9e6f753e
add dword [ebp - 0x44], 0x93c3d707
mov dword [ebp - 0x40], 0xe4c95472
sub dword [ebp - 0x40], 0x987d1044
mov dword [ebp - 0x3c], 0xc120e983
add dword [ebp - 0x3c], 0x3edf167d
lea eax, [ebp - 0x48]
push eax
mov eax, 0xa577a96e
add eax, 0x5ac8c6f6
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x9ba59fe8
add dword [ebp - 0x48], 0xd8ccc96e
mov dword [ebp - 0x44], 0x3a0cd831
sub dword [ebp - 0x44], 0xf8a076bc
mov dword [ebp - 0x40], 0xf2252f9f
sub dword [ebp - 0x40], 0x8eb5c333
mov dword [ebp - 0x3c], 0x1b75261d
add dword [ebp - 0x3c], 0xe48ad9e3
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xd56c0ebf
add eax, 0x2ad461e9
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x36305
push 0
call eax
mov ecx, 0x4661
mov edx, eax
mov ebx, 0x7b0eb9d6
add ebx, 0x8532462a
add ebx, dword [ebp - 0x38]
mov edi, 0x6c252582
add edi, 0xc42e3972
sub dword [ebp - 0x2c], 0xc45426fc
mov esi, dword [ebx]
mov dword [ebp - 0x18], 0xf43d0ba5
xor esi, edi
mov dword [ebp - 0x2c], 0xdc29dee9
mov dword [edx], esi
sub dword [ebp - 8], 0xe74506d8
add edx, 4
add ebx, 0x571244c6
add ebx, 0xa8edbb3e
loop 0x40331f
add eax, 0x800d361c
sub eax, 0x800c29c5
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x223b09a5
add ecx, 0xde04f65b
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x32f8324d
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..text_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x31d2643c
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x403a4d
Capabilities:
Encode data using xor

Disassembly:
pop ss
inc ecx
add byte [ebp + 0x1789ec4d], cl
invalid
clc
inc edx
jne fcn.00403a4d
mov dl, 0x6a
js 0x403ac5
pop edi
pop esi
mov esi, 0xf5de58b
fld qword [esi - 0xc]
cmc
add byte [eax], al
mov dl, 0x8b
js 0x403a38
add al, byte [ecx + 0x25]
inc edx
push esi
mov dword [0x4102a8], edx
mov bh, 0x25
out dx, al
invalid
xchg esi, eax
mov ah, 2
inc ecx
add byte [ecx], al
jne 0x403ad7
sbb eax, dword [esi + 0x54]
mov dword [0x41028c], eax
jmp 0x403afb
mov esi, dword [edi]
sti
mov eax, dword [0x41d65b]
cmp ecx, eax
je 0x403afb
mov ecx, dword [0x4102b8]
mov eax, dword [0x410289]
inc ecx
cld
mov dword [edi], ebp
mov eax, 0xa3b4410c
rol byte [edx], 0x41
add byte [ecx + 0x4102ac], ah
mov eax, dword [0x4102ac]
mov eax, eax
adc al, dl
inc eax
add byte [edi], al
ror dword [edi], 0xc0
pop ss
add dword [eax], eax
add byte [ebp + 0x410bc815], bl
add byte [ebx - 0x30183e08], cl
add edi, edx
inc eax
mov dword [0x4102ac], eax
call 0x38406a00
mov dword [0x38410ba0], eax
or dword [0x410ba4], edx
mov dword [esi - 0x2fff7b0], eax
mov edx, dword [0x4135a4]
mov eax, dword [esi + 0xe867]
mov dword [ebp + 0xa], ecx
or byte [eax], al
add byte [ecx + 0x348e8b07], cl
or byte [edi], cl
dec edi
lea eax, [ebx + ecx*4]
invalid

Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
add dl, 0x30
cmpsb byte [esi], byte es:[edi]
push ss
inc esi
add cl, 0x30
mov byte [esi], cl
jmp 0x3fd20c
push ebp
mov ebp, esp
adc esp, 0x14
cmp dword [ebp + 0x10], 0x4f
rcl byte [edx]
je 0x407f72
adc byte [esi], cl
add byte [eax], al
sbb dword [ebp + 8], eax
fsub qword [ebx + 0x30]
arpl word [eax], si
or byte [edi], bh
mov ecx, dword [ebp + 0x50]
push ebx
mov ebx, dword [ebp + 0x20]
sal byte [ebx], cl
not byte [edi - 0x21]
loopne 0x407ea3
jne 0x407f18
mov dword [ecx], esi
idiv byte [eax + 0x7afb8b8e]
push cs
fld qword [ebp + 8]
fchs
fstp qword [ebp + 8]
add dword [ecx], 0x5b000001
mov ecx, dword [ebp + 0xc]
mov ecx, dword [0x34458d9a]
push eax
push ecx
push edx
call dword [0x40c111]
fst st(3)
or ch, bl
inc ebp
in al, dx
fmul qword [ebx]
xor dl, al
inc eax
movsd dword es:[edi], dword [esi]
add esp, 0xc
fnstsw ax
test ah, 0x44
jnp 0x407fcd
lea esi, [ebx + 0x50]
mov ch, 0xf3
jbe 0x407fba
fnsave dword [edi]
leave
fadd qword [edi]
xor dl, al
inc eax
add bh, bl
loopne 0x407f64
les eax, [ebx + edi*2 + 0x48]
invalid
invalid
fld qword [ebp - 0x28]
jno 0x407fef
xor dl, al
inc eax
cli
fbld tbyte [ebp - 0x455cc5db]
jbe 0x408053
fld qword ds:[ebp + 8]
js 0x407ff1
mov ah, 0xc2
inc eax
add ch, bl
push ebp
hlt
rcr ah, 0x1d
sub dl, al
inc eax
add bh, bl
loopne 0x407fec
inc edx
add eax, 0xdcdd217a
or ah, bl
cld
clc
ret 0x40
lea eax, [ebx + 0x50]
or ebp, esp
jae 0x407fff
fmul qword [0x40c2f8]
invalid
Function at 0x403340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5397a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00436a40
mov dword [esp + 0x30], 0
push 5
push 1
lea ecx, [esp + 0xc]
call fcn.004369a0
push 0
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0xc]
call fcn.00437120
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x40]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00401900
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004031e0
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret 0x20

Function at 0x403358
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5397a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00436a40
mov dword [esp + 0x30], 0
push 5
push 1
lea ecx, [esp + 0xc]
call fcn.004369a0
push 0
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0xc]
call fcn.00437120
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x40]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00401900
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004031e0
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret 0x20

Function at 0x40b820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x539f93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00409000
xor edi, edi
mov dword [esp + 0x14], edi
lea ecx, [esi + 0xc]
call fcn.00409000
mov byte [esp + 0x14], 1
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40b836
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x539f93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00409000
xor edi, edi
mov dword [esp + 0x14], edi
lea ecx, [esi + 0xc]
call fcn.00409000
mov byte [esp + 0x14], 1
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x419630
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53b9be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
lea ecx, [esi + 0xa4]
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
call fcn.00409000
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x419646
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53b9be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
lea ecx, [esi + 0xa4]
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
call fcn.00409000
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x41abc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53beb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push esi
mov esi, dword [esp + 0x50]
push edi
lea eax, [esp + 8]
push esi
push eax
call fcn.0041aa30
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x34], edx
mov edx, dword [eax + 0x14]
add esp, 8
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x34], ecx
push 0x56a488
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], edx
call fcn.00405170
mov dword [esp + 0x48], 0
push 0
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.0043b7a0
mov dword [esp + 0x38], eax
or edi, 0xffffffff
mov dword [esp + 0x48], edi
mov eax, dword [esp + 8]
test eax, eax
je 0x41ac5a
push eax
call fcn.004ed9bb
add esp, 4
lea edx, [esp + 0x50]
push edx
push 0x56a480
lea ecx, [esp + 0x10]
call fcn.00405170
mov dword [esp + 0x48], 2
push 0
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0043b7a0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x48], edi
mov eax, dword [esp + 8]
test eax, eax
je 0x41ac9c
push eax
call fcn.004ed9bb
add esp, 4
mov eax, dword [esp + 0x50]
mov ecx, 8
lea esi, [esp + 0x20]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x40]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x44
ret
Function at 0x41bcc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53c22e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x20]
mov ecx, eax
mov esi, dword [ecx]
mov edx, ebx
mov dword [edx], esi
mov esi, dword [ecx + 4]
mov dword [edx + 4], esi
mov esi, dword [ecx + 8]
mov dword [edx + 8], esi
mov esi, dword [ecx + 0xc]
mov dword [edx + 0xc], esi
mov esi, dword [ecx + 0x10]
mov dword [edx + 0x10], esi
mov ecx, dword [ecx + 0x14]
mov dword [edx + 0x14], ecx
lea edx, [eax + 0x18]
mov esi, dword [edx]
lea ecx, [ebx + 0x18]
mov dword [ecx], esi
mov esi, dword [edx + 4]
mov dword [ecx + 4], esi
mov esi, dword [edx + 8]
mov dword [ecx + 8], esi
mov esi, dword [edx + 0xc]
mov dword [ecx + 0xc], esi
mov esi, dword [edx + 0x10]
mov dword [ecx + 0x10], esi
mov edx, dword [edx + 0x14]
mov dword [ecx + 0x14], edx
lea ecx, [eax + 0x30]
mov esi, dword [ecx]
lea edx, [ebx + 0x30]
mov dword [edx], esi
mov esi, dword [ecx + 4]
mov dword [edx + 4], esi
mov esi, dword [ecx + 8]
mov dword [edx + 8], esi
mov esi, dword [ecx + 0xc]
mov dword [edx + 0xc], esi
mov esi, dword [ecx + 0x10]
mov dword [edx + 0x10], esi
mov ecx, dword [ecx + 0x14]
mov dword [edx + 0x14], ecx
lea edx, [eax + 0x48]
mov esi, dword [edx]
lea ecx, [ebx + 0x48]
mov dword [ecx], esi
mov esi, dword [edx + 4]
mov dword [ecx + 4], esi
mov esi, dword [edx + 8]
mov dword [ecx + 8], esi
mov esi, dword [edx + 0xc]
mov dword [ecx + 0xc], esi
mov esi, dword [edx + 0x10]
mov dword [ecx + 0x10], esi
mov edx, dword [edx + 0x14]
mov dword [ecx + 0x14], edx
lea esi, [eax + 0x60]
lea edi, [ebx + 0x60]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x80]
lea edi, [ebx + 0x80]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0xa0]
lea edi, [ebx + 0xa0]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0xc0]
lea edi, [ebx + 0xc0]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0xe0]
lea edi, [ebx + 0xe0]
mov ecx, 9
add eax, 0x104
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebx + 0x104]
call fcn.0040bf30
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4