joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bf0b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
lea eax, [esp + 0x13]
xor ebx, ebx
push eax
mov dword [esp + 0x28], ebx
call fcn.00441c50
push 8
mov byte [esp + 0x28], 2
call fcn.00489cc9
lea ecx, [eax + 8]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
add esp, 4
mov byte [eax], bl
lea ecx, [esi + 0xc]
mov dword [esp + 0x24], 3
call fcn.00406850
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
lea edi, [esi + 0x3c]
mov dword [esp + 0x24], 4
mov dword [esp + 0x18], edi
lea ebp, [edi + 8]
lea edx, [esp + 0x13]
push ebx
push edx
mov ecx, ebp
mov byte [esp + 0x2c], 5
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.00446b10
push 8
mov byte [esp + 0x28], 7
call fcn.00489cc9
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [ebp], ecx
add esp, 4
mov byte [eax], bl
lea edi, [esi + 0x50]
mov dword [esp + 0x18], edi
lea ebp, [edi + 8]
lea edx, [esp + 0x13]
push ebx
push edx
mov ecx, ebp
mov byte [esp + 0x2c], 9
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.00446b10
push 8
mov byte [esp + 0x28], 0xb
call fcn.00489cc9
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [ebp], ecx
add esp, 4
mov byte [eax], bl
lea edi, [esi + 0x5c]
mov dword [esp + 0x18], edi
lea ebp, [edi + 8]
lea edx, [esp + 0x13]
push ebx
push edx
mov ecx, ebp
mov byte [esp + 0x2c], 0xd
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.00446b10
push 8
mov byte [esp + 0x28], 0xf
call fcn.00489cc9
lea ecx, [eax + 8]
add esp, 4
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [ebp], ecx
mov ecx, dword [esp + 0x1c]
mov byte [eax], bl
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x45676a
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bf0b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
lea eax, [esp + 0x13]
xor ebx, ebx
push eax
mov dword [esp + 0x28], ebx
call fcn.00441c50
push 8
mov byte [esp + 0x28], 2
call fcn.00489cc9
lea ecx, [eax + 8]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
add esp, 4
mov byte [eax], bl
lea ecx, [esi + 0xc]
mov dword [esp + 0x24], 3
call fcn.00406850
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
lea edi, [esi + 0x3c]
mov dword [esp + 0x24], 4
mov dword [esp + 0x18], edi
lea ebp, [edi + 8]
lea edx, [esp + 0x13]
push ebx
push edx
mov ecx, ebp
mov byte [esp + 0x2c], 5
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.00446b10
push 8
mov byte [esp + 0x28], 7
call fcn.00489cc9
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [ebp], ecx
add esp, 4
mov byte [eax], bl
lea edi, [esi + 0x50]
mov dword [esp + 0x18], edi
lea ebp, [edi + 8]
lea edx, [esp + 0x13]
push ebx
push edx
mov ecx, ebp
mov byte [esp + 0x2c], 9
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.00446b10
push 8
mov byte [esp + 0x28], 0xb
call fcn.00489cc9
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [ebp], ecx
add esp, 4
mov byte [eax], bl
lea edi, [esi + 0x5c]
mov dword [esp + 0x18], edi
lea ebp, [edi + 8]
lea edx, [esp + 0x13]
push ebx
push edx
mov ecx, ebp
mov byte [esp + 0x2c], 0xd
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.00446b10
push 8
mov byte [esp + 0x28], 0xf
call fcn.00489cc9
lea ecx, [eax + 8]
add esp, 4
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [ebp], ecx
mov ecx, dword [esp + 0x1c]
mov byte [eax], bl
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x45a1c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c01c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov eax, dword [esp + 0x1c]
sub ecx, edx
push ebx
xor ebx, ebx
sar ecx, 2
cmp eax, ecx
push esi
mov dword [esp + 0xc], ebx
jb 0x45a2ce
mov edx, dword [esp + 0x28]
push edi
push edx
push eax
push 0x4e8d24
push 2
call fcn.0042f5b0
push eax
call fcn.0042f860
mov esi, dword [esp + 0x38]
add esp, 0x14
mov ecx, esi
call fcn.00406850
lea ecx, [esi + 0xc]
mov dword [esp + 0x1c], ebx
call fcn.00406850
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
lea edi, [esi + 0x3c]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x10], edi
lea eax, [esp + 0x28]
mov ecx, edi
push eax
mov byte [esp + 0x20], 2
call fcn.00441c50
push 8
mov byte [esp + 0x20], 4
call fcn.00489cc9
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov byte [eax], bl
lea edi, [esi + 0x50]
mov dword [esp + 0x10], edi
lea edx, [esp + 0xf]
mov ecx, edi
push edx
mov byte [esp + 0x20], 6
call fcn.00441c50
push 8
mov byte [esp + 0x20], 8
call fcn.00489cc9
lea ecx, [eax + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov byte [eax], bl
lea ecx, [esi + 0x5c]
mov byte [esp + 0x1c], 9
call fcn.00406850
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
mov eax, dword [edx + eax*4]
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
push ecx
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx + 0x10]
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x45cdc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c0816
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, ecx
lea eax, [esp + 0x12]
mov ecx, edi
push eax
mov dword [esp + 0x18], esi
call fcn.00424d90
push eax
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00441c50
mov ecx, dword [edi + 4]
mov edx, dword [edi]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x2c], 2
call fcn.00404480
lea eax, [edi + 0xc]
lea ecx, [esi + 0xc]
push eax
mov dword [esp + 0x28], 3
call fcn.004076e0
mov ecx, dword [edi + 0x18]
mov dword [esi + 0x18], ecx
mov edx, dword [edi + 0x1c]
mov dword [esi + 0x1c], edx
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov ecx, dword [edi + 0x24]
mov dword [esi + 0x24], ecx
mov edx, dword [edi + 0x28]
lea eax, [edi + 0x2c]
mov dword [esi + 0x28], edx
lea ecx, [esi + 0x2c]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x2c]
lea ebp, [edi + 0x3c]
lea ebx, [esi + 0x3c]
push ecx
mov ecx, ebp
mov dword [esp + 0x28], 4
mov dword [esp + 0x1c], ebx
call fcn.00424d90
push 0
push eax
lea ecx, [ebx + 8]
mov byte [esp + 0x2c], 5
mov dword [ebx], 0
mov dword [ebx + 4], 0
call fcn.00446b10
mov edx, dword [ebp + 4]
mov eax, dword [ebp]
push edx
push eax
mov ecx, ebx
mov byte [esp + 0x2c], 7
call fcn.00404480
mov ecx, dword [edi + 0x48]
mov byte [esp + 0x24], 8
mov dword [esi + 0x48], ecx
mov edx, dword [edi + 0x4c]
lea ebp, [edi + 0x50]
lea eax, [esp + 0x12]
lea ebx, [esi + 0x50]
push eax
mov ecx, ebp
mov dword [esi + 0x4c], edx
mov dword [esp + 0x1c], ebx
call fcn.00424d90
push 0
push eax
lea ecx, [ebx + 8]
mov byte [esp + 0x2c], 9
mov dword [ebx], 0
mov dword [ebx + 4], 0
call fcn.00446b10
mov ecx, dword [ebp + 4]
mov edx, dword [ebp]
push ecx
push edx
mov ecx, ebx
mov byte [esp + 0x2c], 0xb
call fcn.00404480
lea ebx, [edi + 0x5c]
lea eax, [esp + 0x13]
lea ebp, [esi + 0x5c]
push eax
mov ecx, ebx
mov byte [esp + 0x28], 0xc
mov dword [esp + 0x1c], ebp
call fcn.00424d90
push eax
mov ecx, ebp
mov byte [esp + 0x28], 0xd
call fcn.00441c50
mov cl, byte [esp + 0x2c]
mov eax, dword [ebx + 4]
lea edx, [esp + 0x2c]
mov byte [esp + 0x2c], cl
mov ecx, dword [ebx]
push edx
push eax
push ecx
mov ecx, ebp
mov byte [esp + 0x30], 0xf
call fcn.00402130
mov edx, dword [edi + 0x68]
mov dword [esi + 0x68], edx
mov eax, dword [edi + 0x6c]
mov dword [esi + 0x6c], eax
mov ecx, dword [edi + 0x70]
mov dword [esi + 0x70], ecx
mov edx, dword [edi + 0x74]
mov dword [esi + 0x74], edx
mov eax, dword [edi + 0x78]
mov dword [esi + 0x78], eax
mov ecx, dword [edi + 0x7c]
mov dword [esi + 0x7c], ecx
mov edx, dword [edi + 0x80]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x80], edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x45f9b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c0d97
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
cmp edi, ebx
je 0x45fb33
mov dword [ebp + 0xc], esi
test esi, esi
mov byte [ebp - 4], 1
je 0x45fab9
push edi
mov ecx, esi
call fcn.004076e0
lea eax, [edi + 0xc]
lea ecx, [esi + 0xc]
push eax
mov byte [ebp - 4], 2
call fcn.004076e0
mov ecx, dword [edi + 0x18]
mov dword [esi + 0x18], ecx
mov edx, dword [edi + 0x1c]
mov dword [esi + 0x1c], edx
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov ecx, dword [edi + 0x24]
mov dword [esi + 0x24], ecx
mov edx, dword [edi + 0x28]
lea eax, [edi + 0x2c]
mov dword [esi + 0x28], edx
lea ecx, [esi + 0x2c]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
lea ecx, [edi + 0x3c]
mov byte [ebp - 4], 3
push ecx
lea ecx, [esi + 0x3c]
call fcn.004076e0
mov edx, dword [edi + 0x48]
lea ecx, [edi + 0x50]
mov dword [esi + 0x48], edx
mov eax, dword [edi + 0x4c]
push ecx
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 4
mov dword [esi + 0x4c], eax
call fcn.004076e0
lea edx, [edi + 0x5c]
lea ecx, [esi + 0x5c]
push edx
mov byte [ebp - 4], 5
call fcn.004076e0
mov eax, dword [edi + 0x68]
mov dword [esi + 0x68], eax
mov ecx, dword [edi + 0x6c]
mov dword [esi + 0x6c], ecx
mov edx, dword [edi + 0x70]
mov dword [esi + 0x70], edx
mov eax, dword [edi + 0x74]
mov dword [esi + 0x74], eax
mov ecx, dword [edi + 0x78]
mov dword [esi + 0x78], ecx
mov edx, dword [edi + 0x7c]
mov dword [esi + 0x7c], edx
mov eax, dword [edi + 0x80]
mov dword [esi + 0x80], eax
add edi, 0x84
add esi, 0x84
mov byte [ebp - 4], 0
mov dword [ebp - 0x14], esi
jmp 0x45f9e4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45fb50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c0de7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
test ebx, ebx
jbe 0x45fcce
mov dword [ebp + 0x10], esi
test esi, esi
mov byte [ebp - 4], 1
je 0x45fc59
push edi
mov ecx, esi
call fcn.004076e0
lea eax, [edi + 0xc]
lea ecx, [esi + 0xc]
push eax
mov byte [ebp - 4], 2
call fcn.004076e0
mov ecx, dword [edi + 0x18]
mov dword [esi + 0x18], ecx
mov edx, dword [edi + 0x1c]
mov dword [esi + 0x1c], edx
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov ecx, dword [edi + 0x24]
mov dword [esi + 0x24], ecx
mov edx, dword [edi + 0x28]
lea eax, [edi + 0x2c]
mov dword [esi + 0x28], edx
lea ecx, [esi + 0x2c]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
lea ecx, [edi + 0x3c]
mov byte [ebp - 4], 3
push ecx
lea ecx, [esi + 0x3c]
call fcn.004076e0
mov edx, dword [edi + 0x48]
lea ecx, [edi + 0x50]
mov dword [esi + 0x48], edx
mov eax, dword [edi + 0x4c]
push ecx
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 4
mov dword [esi + 0x4c], eax
call fcn.004076e0
lea edx, [edi + 0x5c]
lea ecx, [esi + 0x5c]
push edx
mov byte [ebp - 4], 5
call fcn.004076e0
mov eax, dword [edi + 0x68]
mov dword [esi + 0x68], eax
mov ecx, dword [edi + 0x6c]
mov dword [esi + 0x6c], ecx
mov edx, dword [edi + 0x70]
mov dword [esi + 0x70], edx
mov eax, dword [edi + 0x74]
mov dword [esi + 0x74], eax
mov ecx, dword [edi + 0x78]
mov dword [esi + 0x78], ecx
mov edx, dword [edi + 0x7c]
mov dword [esi + 0x7c], edx
mov eax, dword [edi + 0x80]
mov dword [esi + 0x80], eax
dec ebx
add esi, 0x84
mov byte [ebp - 4], 0
mov dword [ebp - 0x14], esi
jmp 0x45fb84
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4628b0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c1390
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x3c]
mov esi, ecx
cmp ebx, edi
jle 0x4628fd
push 0xea
push 0x4e908c
push 0x4e907c
push 0x4e51c4
push 3
call fcn.0042f5b0
push eax
call fcn.0042f860
add esp, 0x18
fild dword [esp + 0x38]
sub edi, ebx
mov dword [esp + 0x38], edi
fst dword [esi]
fild dword [esp + 0x3c]
fstp dword [esi + 4]
fild dword [esp + 0x38]
fmul dword [0x4c8330]
fstp dword [esi + 0xc]
fstp dword [esi + 8]
xor ebx, ebx
lea eax, [esp + 0x3c]
push ebx
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.00446b10
mov edi, 0x4e9070
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [esp + 0x38]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x38]
add ecx, 0x4e9070
push eax
push ecx
push 0x4e9070
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 1
mov byte [esp + 0x44], dl
call fcn.00402130
lea ecx, [esp + 0xf]
push ebx
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 3
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00446b10
mov edi, 0x4e9054
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [esp + 0x38]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x38]
add ecx, 0x4e9054
push eax
push ecx
push 0x4e9054
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 4
mov byte [esp + 0x44], dl
call fcn.00402130
mov ecx, dword [0x4f9640]
mov byte [esp + 0x30], 5
mov edx, dword [ecx]
call dword [edx + 0x3c]
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call dword [edx + 4]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov byte [esp + 0x30], 6
sub edx, eax
push edx
push eax
lea ecx, [esp + 0x20]
call fcn.0045d8c0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
sub ecx, eax
mov byte [esp + 0x30], 7
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.0045d8c0
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x467b20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4c22e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x58]
push edi
mov edi, ecx
push esi
call fcn.00468540
mov ecx, dword [edi]
mov dword [esp + 0xc], eax
cmp eax, ecx
je 0x467b70
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0x10]
mov edx, dword [esi + 4]
mov ebx, dword [esi]
push ecx
push eax
push edx
push ebx
call fcn.004046a0
add esp, 0x10
test eax, eax
jge 0x467c51
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00469110
add esp, 8
mov ebx, eax
lea ecx, [esp + 0x5c]
mov dword [esp + 0x54], 0
push ecx
mov ecx, esi
call fcn.00424d90
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], 1
call fcn.00441c50
mov edx, dword [esi + 4]
mov eax, dword [esi]
push edx
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x5c], 3
call fcn.00404480
push ebx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x58], 4
call fcn.00468410
lea ecx, [esp + 0x2c]
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x60], 5
call fcn.004284f0
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call fcn.004680c0
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x40]
mov byte [esp + 0x54], 6
call fcn.00421180
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 7
call fcn.00421180
lea edx, [esp + 0x20]
mov dword [esp + 0x5c], edx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
sub ecx, eax
mov dword [esp + 0x54], 8
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.0045d8c0
mov edx, dword [esp + 0xc]
lea eax, [edx + 0x1c]
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x4c
ret 4
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
add eax, 0x1c
mov dword fs:[0], ecx
pop ebx
add esp, 0x4c
ret 4
Function at 0x4733f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c373e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov esi, ecx
lea eax, [esp + 9]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x3c], 0
call fcn.00441c50
push 8
mov byte [esp + 0x3c], 2
call fcn.00489cc9
lea ecx, [eax + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
add esp, 4
mov byte [eax], 0
lea edx, [esp + 0xa]
lea ecx, [esp + 0x18]
push edx
mov dword [esp + 0x3c], 4
call fcn.0044b880
lea eax, [esp + 0xb]
push 0
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 7
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.00446b10
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0xc]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x40], 8
call fcn.00472f70
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.004736c0
mov dword [esp + 0x38], 9
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x24]
cmp esi, eax
mov dword [esp + 0x40], ecx
mov edi, eax
je 0x4734d3
mov ecx, esi
call fcn.00406290
add esi, 0x2c
cmp esi, edi
jne 0x4734c1
mov esi, dword [esp + 0x24]
test esi, esi
mov byte [esp + 0x38], 0xb
je 0x4734fe
mov ecx, dword [esp + 0x2c]
mov eax, 0x2e8ba2e9
sub ecx, esi
imul ecx
sar edx, 3
mov eax, edx
lea ecx, [esp + 0x2c]
shr eax, 0x1f
add edx, eax
push edx
push esi
call fcn.0045d8c0
lea ecx, [esp + 0x18]
mov dword [esp + 0x40], ecx
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
cmp esi, edi
mov byte [esp + 0x38], 0xc
je 0x473529
mov ecx, esi
call fcn.00421180
add esi, 0x14
cmp esi, edi
jne 0x473517
mov esi, dword [esp + 0x18]
test esi, esi
mov byte [esp + 0x38], 0xd
je 0x473554
mov ecx, dword [esp + 0x20]
mov eax, 0x66666667
sub ecx, esi
imul ecx
sar edx, 3
mov eax, edx
lea ecx, [esp + 0x20]
shr eax, 0x1f
add edx, eax
push edx
push esi
call fcn.0044be70
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xe
call fcn.00421180
mov ecx, dword [esp + 0x30]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x486c70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6005
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004076e0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, 0x14
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004076e0
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
add edx, 0x20
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00414ff0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x28]
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2c]
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x34]
mov dword [eax + 0x34], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x38]
mov dword [eax + 0x38], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
mov dword [eax + 0x3c], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x40]
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x44]
mov dword [eax + 0x44], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x498964
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x498ab9
push ebx
mov ebx, 0xffc03fc0
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*4]
add edi, eax
cmp eax, edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x498a94
mov esi, dword [eax + 4]
mov eax, dword [eax]
mov edx, dword [edi + 4]
mov edi, dword [edi]
mov ecx, eax
shr ecx, 2
and ecx, ebx
mov ebp, edi
shr ebp, 2
and ebp, ebx
add ecx, ebp
mov ebp, esi
shr ebp, 2
and ebp, ebx
add ecx, ebp
mov ebp, edx
shr ebp, 2
and ebp, ebx
lea ebx, [ecx + ebp - 0x7fff80]
mov ecx, eax
mov ebp, edi
and ecx, 0xff00ff
and ebp, 0xff00ff
add ecx, ebp
mov ebp, esi
and ebp, 0xff00ff
add ecx, ebp
mov ebp, edx
and ebp, 0xff00ff
shr eax, 2
lea ecx, [ecx + ebp + 0x20002]
shr ecx, 2
xor ebx, ecx
mov ecx, 0x3fc03fc0
and eax, ecx
shr edi, 2
and edi, ecx
add eax, edi
mov edi, dword [esp + 0x18]
shr esi, 2
and esi, ecx
add eax, esi
shr edx, 2
and edx, ecx
lea eax, [eax + edx + 0x800080]
and ebx, 0xff00ff
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 4
mov dword [eax], ebx
mov eax, dword [esp + 0x14]
add eax, 8
add edi, 8
cmp eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov ebx, 0xffc03fc0
jb 0x4989c7
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x4989a4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret