joyce8/EMBER2024-capa huggingface dataset:
Function at 0x531346
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + 4]
test al, al
push esi
mov esi, ecx
je 0x531375
mov eax, dword [esi + 0x78]
push 1
lea ecx, [esi + 0x4c]
push str.UnGrab
push eax
call fcn.0051f130
mov ecx, dword [esi + eax*4 + 0x110]
push ecx
call fcn.0051cc00
add esp, 0xc
mov byte [esi + 0x108], 0
mov esi, dword [esi + 0x5c]
test esi, esi
je 0x531381
lea ecx, [esi - 4]
jmp 0x531383
xor ecx, ecx
mov eax, 0x83acc0
pop esi
lea esp, [esp]
mov edx, dword [ecx + 0x18]
mov dword [eax - 8], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax - 4], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x5313a8
add ecx, 0xfffffffc
jmp 0x5313aa
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 4], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x5313c1
add ecx, 0xfffffffc
jmp 0x5313c3
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax + 8], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0xc], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x5313db
add ecx, 0xfffffffc
jmp 0x5313dd
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x10], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0x14], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x5313f5
add ecx, 0xfffffffc
jmp 0x5313f7
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x18], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0x1c], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x53140f
add ecx, 0xfffffffc
jmp 0x531411
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x20], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0x24], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x531429
add ecx, 0xfffffffc
jmp 0x53142b
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x28], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0x2c], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x531443
add ecx, 0xfffffffc
jmp 0x531445
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x30], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0x34], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x53145d
add ecx, 0xfffffffc
jmp 0x53145f
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x38], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0x3c], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x531477
add ecx, 0xfffffffc
jmp 0x531479
xor ecx, ecx
add eax, 0x48
cmp eax, 0x83ad98
jl 0x531390
ret 4
Function at 0x531650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x776c98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 0xabadcafe
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push fcn.0051a7a0
push 0x4fe4f0
push 0x100
push 0x20
lea eax, [esi + 0xc]
xor ebx, ebx
push eax
mov dword [esp + 0x30], ebx
mov dword [esi], 0x79b9ec
call fcn.0075c18d
mov dword [esi + 0x200c], 0x79a9e8
mov dword [esi + 0x2014], ebx
mov dword [esi + 0x2018], ebx
mov dword [esi + 0x2010], ebx
mov dword [esi + 0x201c], ebx
lea eax, [esi + 0x14]
mov ebp, 0x40
jmp 0x5316d0
mov edx, dword [esi + 0x2018]
lea ecx, [eax - 8]
test ecx, ecx
je 0x53172d
cmp edx, ebx
je 0x5316fb
mov ecx, dword [edx + 4]
cmp ecx, ebx
mov dword [eax - 4], ecx
je 0x5316f1
lea edi, [eax - 8]
mov dword [ecx + 8], edi
lea ecx, [eax - 8]
mov dword [eax], edx
mov dword [edx + 4], ecx
jmp 0x531719
mov ecx, dword [esi + 0x2014]
cmp ecx, ebx
mov dword [eax - 4], ecx
je 0x53170e
lea edi, [eax - 8]
mov dword [ecx + 8], edi
lea ecx, [eax - 8]
mov dword [eax], ebx
mov dword [esi + 0x2014], ecx
cmp dword [esi + 0x2018], edx
jne 0x531727
mov dword [esi + 0x2018], ecx
inc dword [esi + 0x2010]
mov edi, dword [esi + 0x2018]
lea ecx, [eax + 0x18]
cmp ecx, ebx
je 0x531780
cmp edi, ebx
je 0x531753
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x1c], edx
je 0x53174b
mov dword [edx + 8], ecx
mov dword [eax + 0x20], edi
mov dword [edi + 4], ecx
jmp 0x53176c
mov edx, dword [esi + 0x2014]
cmp edx, ebx
mov dword [eax + 0x1c], edx
je 0x531763
mov dword [edx + 8], ecx
mov dword [eax + 0x20], ebx
mov dword [esi + 0x2014], ecx
cmp dword [esi + 0x2018], edi
jne 0x53177a
mov dword [esi + 0x2018], ecx
inc dword [esi + 0x2010]
mov edi, dword [esi + 0x2018]
lea ecx, [eax + 0x38]
cmp ecx, ebx
je 0x5317d3
cmp edi, ebx
je 0x5317a6
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x3c], edx
je 0x53179e
mov dword [edx + 8], ecx
mov dword [eax + 0x40], edi
mov dword [edi + 4], ecx
jmp 0x5317bf
mov edx, dword [esi + 0x2014]
cmp edx, ebx
mov dword [eax + 0x3c], edx
je 0x5317b6
mov dword [edx + 8], ecx
mov dword [eax + 0x40], ebx
mov dword [esi + 0x2014], ecx
cmp dword [esi + 0x2018], edi
jne 0x5317cd
mov dword [esi + 0x2018], ecx
inc dword [esi + 0x2010]
mov edi, dword [esi + 0x2018]
lea ecx, [eax + 0x58]
cmp ecx, ebx
je 0x531826
cmp edi, ebx
je 0x5317f9
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x5c], edx
je 0x5317f1
mov dword [edx + 8], ecx
mov dword [eax + 0x60], edi
mov dword [edi + 4], ecx
jmp 0x531812
mov edx, dword [esi + 0x2014]
cmp edx, ebx
mov dword [eax + 0x5c], edx
je 0x531809
mov dword [edx + 8], ecx
mov dword [eax + 0x60], ebx
mov dword [esi + 0x2014], ecx
cmp dword [esi + 0x2018], edi
jne 0x531820
mov dword [esi + 0x2018], ecx
inc dword [esi + 0x2010]
add eax, 0x80
dec ebp
jne 0x5316d0
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x535e00
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x777384
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor edx, edx
push ebx
push esi
mov esi, ecx
mov dword [esi + 0x14], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], edx
mov word [esi + 0x1a], dx
mov word [esi + 0x18], dx
mov dword [esi + 0x24], edx
mov dword [esi + 0x20], edx
mov dword [esi + 0x1c], edx
mov byte [esi + 0x28], dl
mov byte [esi + 0x29], dl
mov eax, 0x79b878
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 0xe4], edx
mov dword [esi + 0xe8], edx
mov dword [esi + 0xe0], edx
mov dword [esi + 0xdc], eax
mov dword [esp + 0x18], edx
mov dword [esi + 0xf4], edx
mov dword [esi + 0xf8], edx
mov dword [esi + 0xf0], edx
mov dword [esi + 0xec], eax
mov dword [esi + 0x104], edx
mov dword [esi + 0x108], edx
mov dword [esi + 0x100], edx
mov dword [esi + 0xfc], eax
mov dword [esi + 0x110], edx
mov dword [esi + 0x4114], 0x79a9e8
mov dword [esi + 0x411c], edx
mov dword [esi + 0x4120], edx
mov dword [esi + 0x4118], edx
mov dword [esi + 0x412c], edx
mov dword [esi + 0x4130], edx
mov dword [esi + 0x4128], edx
mov dword [esi + 0x4124], eax
lea ebx, [esi + 0x4134]
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
mov dword [ebx + 4], edx
mov dword [ebx], eax
mov byte [ebx + 0x10], dl
mov al, 1
mov byte [esi], al
mov byte [esi + 1], al
mov byte [esi + 3], al
mov byte [esi + 4], al
xor eax, eax
mov byte [esi + 0x5250], dl
mov dword [esi + 0xd4], edx
mov dword [esi + 8], edx
mov dword [esi + 0x30], edx
mov dword [esi + 0x2c], edx
mov dword [esi + 0xd0], edx
mov byte [esi + 2], dl
mov byte [esi + 0x5251], dl
mov ecx, 0x13
lea edi, [esi + 0x84]
rep stosd dword es:[edi], eax
mov dword [esi + 0x4148], edx
mov ecx, 0x400
lea edi, [esi + 0x414c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x514c], edx
mov ecx, 0x40
lea edi, [esi + 0x5150]
rep stosd dword es:[edi], eax
mov ecx, ebx
mov byte [esp + 0x18], 5
call fcn.00535660
mov eax, esi
pop edi
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x53a660
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x776fe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 0x2c], ecx
mov ecx, 0x3f800000
mov dword [esp + 4], esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], 1
mov byte [esi + 0x22], al
mov byte [esi + 0x23], al
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], ecx
mov byte [esi + 0x44], 1
mov byte [esi + 0x45], al
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [esi + 0x4c], eax
mov al, byte [esp + 0x28]
push ecx
mov dword [esi], 0x79b604
mov dword [esi + 0x48], ecx
mov byte [esi + 0x50], al
mov dword [esi + 0x54], 0xffffffff
mov dword [esi + 0x58], edx
call fcn.00539990
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x22], al
add esp, 4
mov byte [esi + 0x45], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18

Function at 0x53a67e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x776fe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 0x2c], ecx
mov ecx, 0x3f800000
mov dword [esp + 4], esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], 1
mov byte [esi + 0x22], al
mov byte [esi + 0x23], al
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], ecx
mov byte [esi + 0x44], 1
mov byte [esi + 0x45], al
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [esi + 0x4c], eax
mov al, byte [esp + 0x28]
push ecx
mov dword [esi], 0x79b604
mov dword [esi + 0x48], ecx
mov byte [esi + 0x50], al
mov dword [esi + 0x54], 0xffffffff
mov dword [esi + 0x58], edx
call fcn.00539990
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x22], al
add esp, 4
mov byte [esi + 0x45], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x53aa9c
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x777426
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
or eax, 0xffffffff
push esi
mov esi, ecx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea eax, [esi + 0x48]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], 0x40
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esp + 8], esi
mov dword [eax], eax
mov dword [eax + 4], eax
lea ecx, [esi + 0x50]
mov dword [esp + 0x14], ebx
call fcn.0040c950
lea ecx, [esi + 0x940]
mov byte [esp + 0x14], 1
call fcn.0040c950
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x123c], ebx
mov byte [esi + 0x1240], bl
mov byte [esi + 0x1241], bl
mov byte [esi + 0x1242], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x53e3a0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x776c98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 0xabadcafe
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push fcn.00534790
push 0x4fe560
push 0x40
push 0x18
lea eax, [esi + 0xc]
xor ebx, ebx
push eax
mov dword [esp + 0x30], ebx
mov dword [esi], 0x79bf50
call fcn.0075c18d
mov dword [esi + 0x60c], 0x79a9e8
mov dword [esi + 0x614], ebx
mov dword [esi + 0x618], ebx
mov dword [esi + 0x610], ebx
mov dword [esi + 0x61c], ebx
lea eax, [esi + 0x14]
mov ebp, 0x10
jmp 0x53e420
mov edx, dword [esi + 0x618]
lea ecx, [eax - 8]
test ecx, ecx
je 0x53e47d
cmp edx, ebx
je 0x53e44b
mov ecx, dword [edx + 4]
cmp ecx, ebx
mov dword [eax - 4], ecx
je 0x53e441
lea edi, [eax - 8]
mov dword [ecx + 8], edi
lea ecx, [eax - 8]
mov dword [eax], edx
mov dword [edx + 4], ecx
jmp 0x53e469
mov ecx, dword [esi + 0x614]
cmp ecx, ebx
mov dword [eax - 4], ecx
je 0x53e45e
lea edi, [eax - 8]
mov dword [ecx + 8], edi
lea ecx, [eax - 8]
mov dword [eax], ebx
mov dword [esi + 0x614], ecx
cmp dword [esi + 0x618], edx
jne 0x53e477
mov dword [esi + 0x618], ecx
inc dword [esi + 0x610]
mov edi, dword [esi + 0x618]
lea ecx, [eax + 0x10]
cmp ecx, ebx
je 0x53e4d0
cmp edi, ebx
je 0x53e4a3
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x14], edx
je 0x53e49b
mov dword [edx + 8], ecx
mov dword [eax + 0x18], edi
mov dword [edi + 4], ecx
jmp 0x53e4bc
mov edx, dword [esi + 0x614]
cmp edx, ebx
mov dword [eax + 0x14], edx
je 0x53e4b3
mov dword [edx + 8], ecx
mov dword [eax + 0x18], ebx
mov dword [esi + 0x614], ecx
cmp dword [esi + 0x618], edi
jne 0x53e4ca
mov dword [esi + 0x618], ecx
inc dword [esi + 0x610]
mov edi, dword [esi + 0x618]
lea ecx, [eax + 0x28]
cmp ecx, ebx
je 0x53e523
cmp edi, ebx
je 0x53e4f6
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x2c], edx
je 0x53e4ee
mov dword [edx + 8], ecx
mov dword [eax + 0x30], edi
mov dword [edi + 4], ecx
jmp 0x53e50f
mov edx, dword [esi + 0x614]
cmp edx, ebx
mov dword [eax + 0x2c], edx
je 0x53e506
mov dword [edx + 8], ecx
mov dword [eax + 0x30], ebx
mov dword [esi + 0x614], ecx
cmp dword [esi + 0x618], edi
jne 0x53e51d
mov dword [esi + 0x618], ecx
inc dword [esi + 0x610]
mov edi, dword [esi + 0x618]
lea ecx, [eax + 0x40]
cmp ecx, ebx
je 0x53e576
cmp edi, ebx
je 0x53e549
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x44], edx
je 0x53e541
mov dword [edx + 8], ecx
mov dword [eax + 0x48], edi
mov dword [edi + 4], ecx
jmp 0x53e562
mov edx, dword [esi + 0x614]
cmp edx, ebx
mov dword [eax + 0x44], edx
je 0x53e559
mov dword [edx + 8], ecx
mov dword [eax + 0x48], ebx
mov dword [esi + 0x614], ecx
cmp dword [esi + 0x618], edi
jne 0x53e570
mov dword [esi + 0x618], ecx
inc dword [esi + 0x610]
add eax, 0x60
dec ebp
jne 0x53e420
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x53e5a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x776c98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 0xabadcafe
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push fcn.00534e00
push fcn.00511a00
push 0x20
push 0x34
lea eax, [esi + 0xc]
xor ebx, ebx
push eax
mov dword [esp + 0x30], ebx
mov dword [esi], 0x79bf54
call fcn.0075c18d
mov dword [esi + 0x68c], 0x79a9e8
mov dword [esi + 0x694], ebx
mov dword [esi + 0x698], ebx
mov dword [esi + 0x690], ebx
mov dword [esi + 0x69c], ebx
lea eax, [esi + 0x14]
mov ebp, 8
jmp 0x53e620
mov edx, dword [esi + 0x698]
lea ecx, [eax - 8]
test ecx, ecx
je 0x53e67d
cmp edx, ebx
je 0x53e64b
mov ecx, dword [edx + 4]
cmp ecx, ebx
mov dword [eax - 4], ecx
je 0x53e641
lea edi, [eax - 8]
mov dword [ecx + 8], edi
lea ecx, [eax - 8]
mov dword [eax], edx
mov dword [edx + 4], ecx
jmp 0x53e669
mov ecx, dword [esi + 0x694]
cmp ecx, ebx
mov dword [eax - 4], ecx
je 0x53e65e
lea edi, [eax - 8]
mov dword [ecx + 8], edi
lea ecx, [eax - 8]
mov dword [eax], ebx
mov dword [esi + 0x694], ecx
cmp dword [esi + 0x698], edx
jne 0x53e677
mov dword [esi + 0x698], ecx
inc dword [esi + 0x690]
mov edi, dword [esi + 0x698]
lea ecx, [eax + 0x2c]
cmp ecx, ebx
je 0x53e6d0
cmp edi, ebx
je 0x53e6a3
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x30], edx
je 0x53e69b
mov dword [edx + 8], ecx
mov dword [eax + 0x34], edi
mov dword [edi + 4], ecx
jmp 0x53e6bc
mov edx, dword [esi + 0x694]
cmp edx, ebx
mov dword [eax + 0x30], edx
je 0x53e6b3
mov dword [edx + 8], ecx
mov dword [eax + 0x34], ebx
mov dword [esi + 0x694], ecx
cmp dword [esi + 0x698], edi
jne 0x53e6ca
mov dword [esi + 0x698], ecx
inc dword [esi + 0x690]
mov edi, dword [esi + 0x698]
lea ecx, [eax + 0x60]
cmp ecx, ebx
je 0x53e723
cmp edi, ebx
je 0x53e6f6
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x64], edx
je 0x53e6ee
mov dword [edx + 8], ecx
mov dword [eax + 0x68], edi
mov dword [edi + 4], ecx
jmp 0x53e70f
mov edx, dword [esi + 0x694]
cmp edx, ebx
mov dword [eax + 0x64], edx
je 0x53e706
mov dword [edx + 8], ecx
mov dword [eax + 0x68], ebx
mov dword [esi + 0x694], ecx
cmp dword [esi + 0x698], edi
jne 0x53e71d
mov dword [esi + 0x698], ecx
inc dword [esi + 0x690]
mov edi, dword [esi + 0x698]
lea ecx, [eax + 0x94]
cmp ecx, ebx
je 0x53e785
cmp edi, ebx
je 0x53e752
mov edx, dword [edi + 4]
cmp edx, ebx
mov dword [eax + 0x98], edx
je 0x53e747
mov dword [edx + 8], ecx
mov dword [eax + 0x9c], edi
mov dword [edi + 4], ecx
jmp 0x53e771
mov edx, dword [esi + 0x694]
cmp edx, ebx
mov dword [eax + 0x98], edx
je 0x53e765
mov dword [edx + 8], ecx
mov dword [eax + 0x9c], ebx
mov dword [esi + 0x694], ecx
cmp dword [esi + 0x698], edi
jne 0x53e77f
mov dword [esi + 0x698], ecx
inc dword [esi + 0x690]
add eax, 0xd0
dec ebp
jne 0x53e620
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x543260
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x7776eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
lea eax, [esi + 4]
mov dword [esi], 0x79b948
push edi
mov dword [esp + 0x10], esi
mov dword [eax], eax
mov dword [eax + 4], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
xor ebx, ebx
push 0x30
mov dword [esp + 0x20], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov byte [esi + 0x2c], bl
mov byte [esi + 0x2d], bl
mov byte [esi + 0x2e], bl
mov byte [esi + 0x2f], bl
mov byte [esi + 0x30], 1
mov byte [esi + 0x31], 1
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x50], 0x43f00000
mov dword [esi + 0x54], 0x42c80000
mov dword [esi + 0x60], ebx
call fcn.005752a0
add esp, 4
cmp eax, ebx
je 0x54330d
mov ecx, 0x3f800000
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov word [eax + 0x2c], bx
mov word [eax + 0x2e], 1
jmp 0x54330f
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x10], eax
mov dword [eax + 0x24], 0x3e99999a
mov eax, dword [esi + 0x10]
mov word [eax + 0x2e], bx
mov edi, dword [esi + 0x14]
push ecx
call fcn.00504ff0
add esp, 4
cmp edi, ebx
mov ebp, eax
je 0x54334f
push edi
call fcn.0052cba0
add esp, 4
cmp eax, ebx
je 0x54334f
push ebp
mov ecx, eax
call fcn.00517c10
cmp eax, ebx
jne 0x543366
mov eax, dword [0x8384c4]
cmp eax, ebx
je 0x543364
mov ecx, dword [eax + 8]
push edi
push ebp
call fcn.0052c220
jmp 0x543366
xor eax, eax
lea edx, [esi + 0x4c]
push edx
lea ecx, [esi + 0x48]
push ecx
push eax
mov dword [esi + 0x1c], eax
call fcn.0051d3c0
mov ecx, dword [esi + 0x1c]
lea edx, [esi + 0x5c]
push edx
lea eax, [esi + 0x58]
push eax
push ecx
call fcn.0051d2b0
add esp, 0x18
push ebx
mov ecx, esi
call fcn.0052e8d0
mov edx, dword [esi + 0x1c]
push edx
mov dword [esi + 0x28], eax
call fcn.0050c5a0
lea eax, [esi + 0x44]
push eax
lea eax, [esi + 0x40]
push eax
mov eax, dword [esi + 0x1c]
push eax
call fcn.0051d2b0
mov ecx, dword [0x8384c4]
mov eax, dword [esi + 0x1c]
add esp, 0x10
cmp ecx, ebx
je 0x5433d1
cmp eax, ebx
je 0x5433d1
mov edx, dword [eax + 0x10]
mov eax, dword [esi + 0x14]
push edx
push eax
call fcn.0052caf0
mov ecx, dword [esp + 0x34]
mov ebp, dword [esp + 0x24]
push ecx
push ebp
call fcn.00495380
mov edx, dword [esp + 0x40]
push edx
mov dword [esi + 0x20], eax
call fcn.00504ff0
add esp, 0xc
cmp ebp, ebx
mov edi, eax
je 0x54340f
push ebp
call fcn.0052cba0
add esp, 4
cmp eax, ebx
je 0x54340f
push edi
mov ecx, eax
call fcn.00517c10
cmp eax, ebx
jne 0x543422
mov eax, dword [0x8384c4]
cmp eax, ebx
je 0x543427
mov ecx, dword [eax + 8]
push ebp
push edi
call fcn.0052c220
mov dword [esi + 0x24], eax
jmp 0x54342a
mov dword [esi + 0x24], ebx
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x5434d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7776eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
lea eax, [esi + 4]
mov dword [esi], 0x795cbc
push edi
mov dword [esp + 0x10], esi
mov dword [eax], eax
mov dword [eax + 4], eax
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
mov cl, byte [esp + 0x38]
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esi + 0x20], eax
mov eax, 1
push edx
mov dword [esp + 0x20], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], 0x41200000
mov dword [esi + 0x28], eax
mov byte [esi + 0x2c], cl
mov byte [esi + 0x2d], al
mov byte [esi + 0x2e], al
mov byte [esi + 0x2f], al
mov byte [esi + 0x30], bl
mov dword [esi + 0x34], 0xfffffff7
call fcn.00504ff0
add esp, 4
cmp edi, ebx
mov ebp, eax
je 0x543570
push edi
call fcn.0052cba0
add esp, 4
cmp eax, ebx
je 0x543570
push ebp
mov ecx, eax
call fcn.00517c10
cmp eax, ebx
jne 0x543587
mov eax, dword [0x8384c4]
cmp eax, ebx
je 0x543585
mov ecx, dword [eax + 8]
push edi
push ebp
call fcn.0052c220
jmp 0x543587
xor eax, eax
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x2c]
push eax
call fcn.00504ff0
add esp, 4
cmp edi, ebx
mov ebp, eax
je 0x5435b9
push edi
call fcn.0052cba0
add esp, 4
cmp eax, ebx
je 0x5435b9
push ebp
mov ecx, eax
call fcn.00517c10
cmp eax, ebx
jne 0x5435d0
mov eax, dword [0x8384c4]
cmp eax, ebx
je 0x5435ce
mov ecx, dword [eax + 8]
push edi
push ebp
call fcn.0052c220
jmp 0x5435d0
xor eax, eax
mov ecx, dword [esp + 0x30]
mov edi, dword [esi + 0x1c]
push ecx
mov dword [esi + 0x14], eax
call fcn.00504ff0
add esp, 4
cmp edi, ebx
mov ebp, eax
je 0x543602
push edi
call fcn.0052cba0
add esp, 4
cmp eax, ebx
je 0x543602
push ebp
mov ecx, eax
call fcn.00517c10
cmp eax, ebx
jne 0x543615
mov eax, dword [0x8384c4]
cmp eax, ebx
je 0x54361a
mov ecx, dword [eax + 8]
push edi
push ebp
call fcn.0052c220
mov dword [esi + 0x18], eax
jmp 0x54361d
mov dword [esi + 0x18], ebx
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x551fa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7779a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.00551a50
mov eax, dword [esi + 4]
push 0x43f00000
push str.option_
push str.BUTTON_MASTER
push str.LOCK_MASTER
push str.OPTION_MASTER
xor ebx, ebx
push eax
lea ecx, [esi + 0x4c]
mov dword [esp + 0x2c], ebx
mov dword [esi], 0x7974d4
call fcn.00543720
mov eax, dword [esi + 4]
push str.ICON_TITLE
push eax
mov byte [esp + 0x1c], 1
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x148], ebx
call fcn.00495360
mov dword [esi + 0x134], eax
mov eax, dword [esi + 4]
push 0x783fe5
push eax
call fcn.00495360
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x138], eax
add esp, 0x10
mov byte [esi + 0x2c], bl
mov byte [esi + 0x14c], bl
mov dword [esi + 0x30], 9
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4