joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c170
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x668], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x1300], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x674], edi
mov dword [esi + 0x670], edi
mov dword [esi + 0x66c], edi
lea eax, [esi + 0x680]
mov ecx, 0x190
jmp 0x41c1b0
mov dword [eax - 0x658], edi
mov dword [eax], 0xfffffc18
add eax, 4
dec ecx
jne 0x41c1b0
push edi
push edi
push edi
push edi
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [esi], eax
lea eax, [esi + 4]
push eax
push edi
mov dword [esi + 0x18], edi
mov ecx, dword [0x81df74]
push ecx
push 0x41bb70
push edi
push edi
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [esi + 8], eax
pop edi
mov eax, esi
pop esi
ret

Function at 0x435f80
Capabilities:
Print debug messages

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 0x34c]
cmp eax, dword [edi + 0x350]
jne 0x435feb
push ebx
push esi
mov ecx, edi
call fcn.00435380
push 0x53582c
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov dword [edi + 0x350], 0
lea esi, [edi + 0x28c]
mov ebx, 0x1e
lea ebx, [ebx]
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 0x54]
add esi, 4
dec ebx
jne 0x435fc0
mov ecx, dword [edi + 0x354]
inc ecx
mov eax, ecx
cmp eax, 3
pop esi
mov dword [edi + 0x354], ecx
pop ebx
je 0x435feb
mov ecx, edi
pop edi
jmp fcn.00435e00
pop edi
ret
Function at 0x459f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x78
push ebx
push esi
push edi
xor edi, edi
test eax, eax
je 0x459fa2
mov edi, dword [eax]
mov ecx, dword [esp + 0x88]
mov edx, dword [ecx]
movzx ebx, byte [esp + 0x94]
mov esi, dword [ecx + 4]
xor eax, eax
mov ah, byte [esp + 0x9c]
mov dword [esp + 0xc], edx
push edi
push 1
fild dword [esp + 0x14]
mov dword [esp + 0x14], esi
mov dword [esp + 0x40], 0x42980000
mov dword [esp + 0x44], 0x3e2aaaab
mov al, byte [esp + 0x98]
fst dword [esp + 0x38]
fild dword [esp + 0x14]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x24], 0x42980000
fst dword [esp + 0x3c]
mov dword [esp + 0x28], 0x3e2aaaab
mov dword [esp + 0x30], 0x3f800000
mov dword [esp + 0x34], 0
shl eax, 8
or eax, ebx
movzx ebx, byte [esp + 0xa0]
shl eax, 8
or eax, ebx
mov ebx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
add ebx, edx
mov dword [esp + 0x14], ebx
add ecx, esi
mov dword [esp + 0x48], eax
fild dword [esp + 0x14]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x80], eax
fst dword [esp + 0x18]
mov edx, dword [esp + 0x18]
fstp dword [esp + 0x1c]
mov dword [esp + 0x64], eax
mov eax, dword [0x84a7c8]
fstp dword [esp + 0x20]
mov dword [esp + 0x78], 0x42980000
mov dword [esp + 0x7c], 0x3e2aaaab
fstp dword [esp + 0x70]
mov dword [esp + 0x84], 0
fild dword [esp + 0x14]
mov dword [esp + 0x88], 0x3f800000
mov dword [esp + 0x54], edx
mov dword [esp + 0x5c], 0x42980000
fst dword [esp + 0x74]
mov dword [esp + 0x60], 0x3e2aaaab
fstp dword [esp + 0x58]
mov dword [esp + 0x68], 0x3f800000
mov dword [esp + 0x6c], 0x3f800000
call dword [eax + 0x20]
mov ecx, dword [0x84a7c8]
push 2
push 7
call dword [ecx + 0x20]
mov edx, dword [0x84a7c8]
push 1
push 0xc
call dword [edx + 0x20]
mov eax, dword [0x84a7c8]
push 5
push 0xa
call dword [eax + 0x20]
mov ecx, dword [0x84a7c8]
push 6
push 0xb
call dword [ecx + 0x20]
mov edx, dword [0x84a7c8]
push 0
push 8
call dword [edx + 0x20]
mov eax, dword [0x84a7c8]
push 0
push 6
call dword [eax + 0x20]
mov edx, dword [0x84a7c8]
push 4
lea ecx, [esp + 0x50]
push ecx
push 4
call dword [edx + 0x30]
mov eax, dword [0x84a7c8]
add esp, 0x44
push 1
push 8
call dword [eax + 0x20]
mov ecx, dword [0x84a7c8]
push 1
push 6
call dword [ecx + 0x20]
add esp, 0x10
pop edi
pop esi
pop ebx
add esp, 0x78
ret
Function at 0x45a160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x78
push ebx
push esi
push edi
xor edi, edi
test eax, eax
je 0x45a172
mov edi, dword [eax]
mov ecx, dword [esp + 0x88]
mov edx, dword [ecx]
movzx ebx, byte [esp + 0x94]
mov esi, dword [ecx + 4]
xor eax, eax
mov ah, byte [esp + 0x9c]
mov dword [esp + 0xc], edx
push edi
push 1
fild dword [esp + 0x14]
mov dword [esp + 0x14], esi
mov dword [esp + 0x40], 0x42980000
mov dword [esp + 0x44], 0x3e2aaaab
mov al, byte [esp + 0x98]
fst dword [esp + 0x38]
fild dword [esp + 0x14]
mov dword [esp + 0x4c], 0x3f800000
mov dword [esp + 0x50], 0
mov dword [esp + 0x24], 0x42980000
fst dword [esp + 0x3c]
mov dword [esp + 0x28], 0x3e2aaaab
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
shl eax, 8
or eax, ebx
movzx ebx, byte [esp + 0xa0]
shl eax, 8
or eax, ebx
mov ebx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
add ebx, edx
mov dword [esp + 0x14], ebx
add ecx, esi
mov dword [esp + 0x48], eax
fild dword [esp + 0x14]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x80], eax
fst dword [esp + 0x18]
mov edx, dword [esp + 0x18]
fstp dword [esp + 0x1c]
mov dword [esp + 0x64], eax
mov eax, dword [0x84a7c8]
fstp dword [esp + 0x20]
mov dword [esp + 0x78], 0x42980000
mov dword [esp + 0x7c], 0x3e2aaaab
fstp dword [esp + 0x70]
mov dword [esp + 0x84], 0x3f800000
fild dword [esp + 0x14]
mov dword [esp + 0x88], 0x3f800000
mov dword [esp + 0x54], edx
mov dword [esp + 0x5c], 0x42980000
fst dword [esp + 0x74]
mov dword [esp + 0x60], 0x3e2aaaab
fstp dword [esp + 0x58]
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0x3f800000
call dword [eax + 0x20]
mov ecx, dword [0x84a7c8]
push 2
push 7
call dword [ecx + 0x20]
mov edx, dword [0x84a7c8]
push 1
push 0xc
call dword [edx + 0x20]
mov eax, dword [0x84a7c8]
push 5
push 0xa
call dword [eax + 0x20]
mov ecx, dword [0x84a7c8]
push 6
push 0xb
call dword [ecx + 0x20]
mov edx, dword [0x84a7c8]
push 0
push 8
call dword [edx + 0x20]
mov eax, dword [0x84a7c8]
push 0
push 6
call dword [eax + 0x20]
mov edx, dword [0x84a7c8]
push 4
lea ecx, [esp + 0x50]
push ecx
push 4
call dword [edx + 0x30]
mov eax, dword [0x84a7c8]
add esp, 0x44
push 1
push 8
call dword [eax + 0x20]
mov ecx, dword [0x84a7c8]
push 1
push 6
call dword [ecx + 0x20]
add esp, 0x10
pop edi
pop esi
pop ebx
add esp, 0x78
ret
Function at 0x45cf40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52aae8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0xc], ebx
call fcn.00470cd0
mov dword [ebx], 0x5387f0
push 1
mov ecx, ebx
mov dword [esp + 0x70], 0
mov dword [0x83f988], ebx
call fcn.0046f220
mov edi, dword [ebx + 0xf0]
or edi, 1
mov ecx, ebx
mov dword [ebx + 0xf0], edi
mov dword [ebx + 0xe0], 0x2bc
mov dword [ebx + 0xe4], 0x40
call fcn.0046f530
mov ecx, dword [0x84587c]
lea eax, [esp + 0x2c]
push eax
call fcn.004815a0
fld dword [eax]
mov dword [esp + 0x2c], 0
fst dword [esp + 0x48]
mov dword [esp + 0x30], 0x43c80000
mov ecx, 7
lea esi, [esp + 0x2c]
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
fstp dword [esp + 0x10]
mov ecx, 7
lea esi, [esp + 0x10]
lea edi, [esp + 0x2c]
mov dword [esp + 0x14], 0x444a8000
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x30]
push edx
mov ecx, ebx
mov dword [esp + 0x54], 0x43cd0000
call fcn.0046f2b0
push 0x7fffffeb
mov ecx, ebx
call fcn.0046fc80
mov ecx, dword [esp + 0x64]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret
Function at 0x468fc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52b3d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebp
push esi
mov ebp, ecx
push edi
mov dword [esp + 0xc], ebp
call fcn.0047f7e0
xor eax, eax
mov dword [ebp], 0x538fc8
mov dword [esp + 0x38], eax
mov dword [ebp + 0x224], eax
mov dword [ebp + 0x228], eax
mov dword [ebp + 0x22c], eax
sub esp, 0x1c
mov dword [esp + 0x30], eax
lea edi, [ebp + 0x200]
mov ecx, 7
lea esi, [esp + 0x30]
mov dword [ebp + 0x230], eax
mov dword [esp + 0x34], 0xc3020000
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0xf0]
mov eax, esp
mov dword [esp + 0x2c], esp
push 0x91
or edi, 1
push eax
mov byte [esp + 0x5c], 1
mov dword [ebp + 0xf0], edi
call fcn.004702a0
add esp, 8
mov ecx, ebp
call fcn.00467f50
push 1
mov ecx, ebp
call fcn.0046f220
lea ecx, [esp + 0x14]
mov dword [ebp + 0xe0], 0x208
mov dword [ebp + 0xe4], 0x140
push ecx
mov ecx, dword [0x84587c]
call fcn.004815a0
push eax
mov ecx, ebp
call fcn.0046f0f0
mov ecx, dword [esp + 0x30]
pop edi
mov dword [ebp + 0x104], 0x3e99999a
pop esi
mov eax, ebp
mov dword fs:[0], ecx
pop ebp
add esp, 0x30
ret

Function at 0x469110
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x52b3f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0xc], ebx
call fcn.0047f7e0
lea esi, [ebx + 0x220]
push 1
mov ecx, esi
mov dword [esp + 0x38], 0
mov dword [ebx], 0x539010
call fcn.00480740
mov eax, dword [0x841be0]
mov ecx, ebx
mov byte [esp + 0x34], 1
mov dword [eax + 0x24], esi
call fcn.0047fff0
mov ecx, ebx
mov dword [ebx + 0x28c], 0
call fcn.004682a0
push 0x437f0000
push 0x437f0000
mov dword [esp + 0x18], 0x42700000
mov dword [esp + 0x1c], 0
lea edi, [ebx + 0x200]
mov ecx, 7
lea esi, [esp + 0x18]
push 0
rep movsd dword es:[edi], dword [esi]
push 0
lea ecx, [esp + 0x20]
mov dword [ebx + 0xe0], 0x78
mov dword [ebx + 0xe4], 0x50
call fcn.00481200
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea ecx, [ebx + 0x30]
mov dword [ecx], edx
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x470cd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52ba66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esi], 0x539430
xor edi, edi
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], edi
mov dword [esp + 0x14], esi
mov word [esi + 8], di
lea ebx, [esi + 0x24]
mov ecx, ebx
mov dword [esp + 0x30], edi
call fcn.0046fc00
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
mov ebx, dword [0x841ba4]
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x10]
push eax
push ecx
push ebx
mov ecx, 0x841ba0
mov byte [esp + 0x3c], 1
mov dword [esp + 0x1c], esi
call fcn.0046fc20
push 1
mov ecx, 0x841ba0
mov ebp, eax
call fcn.004705c0
mov dword [ebx + 4], ebp
mov edx, dword [ebp + 4]
push 0x437f0000
push 0x437f0000
mov dword [edx], ebp
push 0x437f0000
mov dword [esi + 0x20], edi
push 0x437f0000
lea ecx, [esp + 0x28]
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
call fcn.00481200
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea eax, [esi + 0x30]
mov dword [eax], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov dword [esi + 0xf8], edi
mov dword [esi + 0xf0], edi
mov eax, edi
and eax, 0xfffffffd
or eax, 0x8000
mov dword [esi + 0xf0], eax
mov dword [esi + 0x4c], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], 0x3f800000
mov dword [esi + 0xfc], 0x7fffffff
mov ecx, dword [0x841b68]
mov dword [esi + 0xec], ecx
mov eax, dword [0x841b68]
mov ecx, dword [esp + 0x28]
inc eax
mov dword [0x841b68], eax
mov dword [esi + 0xe4], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0xe8], edi
pop edi
mov dword [esi + 0x40], 0xffffffff
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x4722b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x52bbc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
fld dword [esi + 0x110]
fadd dword [0x5336f0]
mov eax, dword [esi + 0x10c]
push 0x437f0000
push 0
push 0
fstp dword [esi + 0x110]
push 0x437f0000
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0
mov dword [esi + 0x10c], eax
call fcn.00481200
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x20], esp
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x4c]
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
push edx
mov word [ecx + 4], 0
call fcn.0045bf30
mov ecx, esi
call fcn.004720d0
mov ecx, dword [esp + 8]
add eax, 0x30
mov dword [eax], ecx
mov edx, dword [esp + 0xc]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov edx, dword [esp + 0x14]
mov dword [eax + 0xc], edx
fld dword [esi + 0x110]
mov eax, dword [esi + 0x10c]
fadd dword [0x5336f0]
mov dword [esi + 0x10c], eax
mov eax, dword [esp + 0x40]
cmp eax, 8
fstp dword [esi + 0x110]
jb 0x47238c
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0051647d
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 0x1c
Function at 0x473450
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x52bc21
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00470cd0
xor edi, edi
push 0x1234567
lea ecx, [esi + 0x108]
mov dword [esp + 0x38], edi
mov dword [esi], 0x5394ec
call fcn.004811f0
mov dword [esi + 0x12c], edi
mov dword [esi + 0x130], edi
mov dword [esi + 0x134], edi
push 0x108
call fcn.00516d2a
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, edi
mov byte [esp + 0x34], 2
je 0x4734c6
mov ecx, eax
call fcn.00470cd0
jmp 0x4734c8
xor eax, eax
push edi
push esi
mov ecx, eax
mov byte [esp + 0x3c], 1
mov dword [esi + 0x138], eax
call fcn.00470e20
push 0xfffffffffffffffb
mov ecx, esi
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], 0x43700000
call fcn.0046fc80
mov ecx, esi
call fcn.00472480
mov edi, dword [esi + 0xf0]
or edi, 1
lea eax, [esp + 0x10]
mov dword [esi + 0xe0], 0x280
mov dword [esi + 0xe4], 0x1e0
mov dword [esi + 0xf0], edi
mov ecx, dword [0x84587c]
push eax
call fcn.004815a0
push eax
mov ecx, esi
call fcn.0046f0f0
push 0x437f0000
push 0x437f0000
push 0x437f0000
push 0x437f0000
lea ecx, [esp + 0x20]
mov dword [esi + 0x104], 0x3d4ccccd
call fcn.00481200
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea ecx, [esi + 0x30]
mov dword [ecx], edx
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov ecx, dword [esp + 0x2c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x47ab60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52c376
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x2c], ebx
call fcn.0047f7e0
lea esi, [ebx + 0x220]
xor ebp, ebp
push 1
mov ecx, esi
mov dword [esp + 0xac], ebp
mov dword [ebx], 0x53a25c
call fcn.00480740
mov eax, dword [0x841be0]
mov dword [eax + 0x24], esi
lea ecx, [esp + 0x68]
mov dword [ebx + 0x294], ebp
push ecx
mov ecx, dword [0x84587c]
mov byte [esp + 0xac], 1
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], 0x43fa0000
call fcn.004815a0
fld dword [eax + 4]
mov edx, dword [eax]
fadd dword [0x533004]
mov ecx, 7
lea esi, [esp + 0x30]
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
fstp dword [esp + 0x14]
mov dword [esp + 0x10], edx
mov ecx, 7
lea esi, [esp + 0x10]
lea edi, [esp + 0x4c]
lea eax, [esp + 0x84]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x84587c]
push eax
call fcn.004815a0
push eax
lea ecx, [esp + 0x50]
push ecx
mov ecx, ebx
call fcn.0046f2b0
push 0x437f0000
push 0x437f0000
lea edi, [ebx + 0x200]
mov ecx, 7
lea esi, [esp + 0x38]
push ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
rep movsd dword es:[edi], dword [esi]
push ebp
lea ecx, [esp + 0x20]
mov dword [ebx + 0xe0], 0x258
mov dword [ebx + 0xe4], 0x190
call fcn.00481200
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea edx, [ebx + 0x30]
mov dword [edx], eax
mov eax, dword [esp + 0x18]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
push ebp
mov ecx, ebx
call fcn.0046f220
mov edx, dword [0x81df48]
mov eax, 0xa
mov ecx, edx
mov dword [ebx + 0x2b8], edx
mov dword [ebx + 0x290], ebp
mov dword [ebx + 0x294], ebp
cmp ecx, eax
jl 0x47acbc
mov dword [ebx + 0x2b8], eax
lea esi, [ebx + 0x298]
xor eax, eax
mov cl, byte [eax + 0x57c190]
add eax, 4
mov byte [esi], cl
inc esi
cmp eax, 0x30
jb 0x47acc4
mov ecx, dword [esp + 0xa0]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x9c
ret
Function at 0x47ad70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52c376
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x2c], ebx
call fcn.0047f7e0
lea esi, [ebx + 0x220]
xor ebp, ebp
push 1
mov ecx, esi
mov dword [esp + 0xac], ebp
mov dword [ebx], 0x53a298
call fcn.00480740
mov eax, dword [0x841be0]
mov dword [eax + 0x24], esi
lea ecx, [esp + 0x68]
mov dword [ebx + 0x294], ebp
push ecx
mov ecx, dword [0x84587c]
mov byte [esp + 0xac], 1
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], 0x43fa0000
call fcn.004815a0
fld dword [eax + 4]
mov edx, dword [eax]
fadd dword [0x533004]
mov ecx, 7
lea esi, [esp + 0x30]
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
fstp dword [esp + 0x14]
mov dword [esp + 0x10], edx
mov ecx, 7
lea esi, [esp + 0x10]
lea edi, [esp + 0x4c]
lea eax, [esp + 0x84]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x84587c]
push eax
call fcn.004815a0
push eax
lea ecx, [esp + 0x50]
push ecx
mov ecx, ebx
call fcn.0046f2b0
push 0x437f0000
push 0x437f0000
lea edi, [ebx + 0x200]
mov ecx, 7
lea esi, [esp + 0x38]
push ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
rep movsd dword es:[edi], dword [esi]
push ebp
lea ecx, [esp + 0x20]
mov dword [ebx + 0xe0], 0x258
mov dword [ebx + 0xe4], 0x190
call fcn.00481200
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea edx, [ebx + 0x30]
mov dword [edx], eax
mov eax, dword [esp + 0x18]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
push ebp
mov ecx, ebx
call fcn.0046f220
mov dword [ebx + 0x290], ebp
mov dword [ebx + 0x294], ebp
lea esi, [ebx + 0x298]
mov eax, 0x57c0e8
mov edi, 0x10
nop
mov dl, byte [eax]
mov byte [esi + 0xf], dl
mov cl, byte [eax]
add eax, 8
mov byte [esi], cl
inc esi
dec edi
jne 0x47aec0
mov ecx, dword [esp + 0xa0]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x9c
ret
Function at 0x47e400
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push esi
push edi
xor edi, edi
lea eax, [esp + 8]
push eax
push 0x104
mov dword [0x841d08], edi
mov dword [0x841d0c], edi
mov dword [0x841d10], edi
mov dword [0x841d14], edi
mov dword [0x841d18], edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
mov edx, dword [0x84a7c8]
lea ecx, [esp + 8]
push 0x5307a8
push ecx
call dword [edx + 0xd4]
lea eax, [esp + 0x10]
push eax
push 0x53a5b4
push 0x841c00
call fcn.00516fa5
push 0x5307ac
push 0x841c00
call fcn.005182a3
mov esi, eax
add esp, 0x1c
cmp esi, edi
je 0x47e501
push 2
push edi
push esi
call fcn.005181fe
push esi
call fcn.0051812e
push edi
push edi
push esi
call fcn.005181fe
push esi
push 1
push 0x3afc
push 0x841d08
call fcn.00517f80
push esi
push 1
push 0x1428
push 0x79bbf8
call fcn.00517f80
push esi
push 1
push 0x40
push 0x81de58
call fcn.00517f80
add esp, 0x4c
push esi
push 1
push 0x54
push 0x845808
call fcn.00517f80
add esp, 0x10
mov ecx, 0x57c0e8
mov eax, 0x845808
mov edx, dword [eax]
mov dword [ecx], edx
add eax, 4
add ecx, 8
cmp eax, 0x84585c
jl 0x47e4e7
push esi
call fcn.00517e46
add esp, 4
pop edi
pop esi
add esp, 0x104
ret
Function at 0x482310
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x52c8eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
mov ebx, ecx
xor ebp, ebp
push esi
push edi
mov dword [esp + 0x10], ebx
mov dword [ebx + 0x74], ebp
mov dword [ebx + 0x78], ebp
mov dword [ebx + 0x7c], ebp
mov dword [ebx + 0x80], ebp
mov dword [ebx + 0xc8], 0x280
mov dword [ebx + 0xcc], 0x1e0
mov eax, dword [0x81df7c]
mov dword [ebx + 0xc8], eax
mov ecx, dword [0x81df80]
push 0x437f0000
mov dword [ebx + 0xcc], ecx
push 0x437f0000
mov dword [0x84587c], ebx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
lea edi, [ebx + 0xa8]
mov ecx, 7
lea esi, [esp + 0x2c]
push 0x437f0000
rep movsd dword es:[edi], dword [esi]
push 0x437f0000
lea ecx, [esp + 0x24]
mov dword [esp + 0x58], ebp
mov dword [ebx + 0x94], ebp
call fcn.00481200
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea edx, [ebx + 0x84]
mov dword [edx], eax
mov eax, dword [esp + 0x1c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x20]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea edx, [esp + 0x24]
mov dword [ebx + 0xd0], ebp
push edx
mov ecx, ebx
mov dword [ebx + 0xc4], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], 0x44200000
mov dword [esp + 0x34], 0x43f00000
call fcn.004817b0
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x483110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52c9de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
xor ebx, ebx
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x6c]
mov edi, 7
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push eax
mov dword [esp + 0x68], ebx
mov word [ecx + 4], bx
call fcn.0045bf30
mov ecx, esi
call fcn.0046dae0
lea ecx, [esi + 0x14]
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
mov eax, dword [esp + 0x60]
cmp eax, 8
mov ebp, dword [esp + 0x4c]
mov byte [esp + 0x40], 3
jae 0x4831a7
lea ebp, [esp + 0x4c]
mov edi, ebp
mov eax, dword [esi + 8]
cmp eax, ebx
mov edx, dword [esp + 0x5c]
lea edi, [edi + edx*2]
jne 0x4831ad
xor eax, eax
jmp 0x4831c3
mov edi, dword [esp + 0x4c]
jmp 0x483195
mov edx, dword [esi + 0xc]
sub edx, eax
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
push eax
call fcn.00483080
cmp word [edi], 0x2f
je 0x4831d9
sub edi, 2
cmp word [edi], 0x2f
jne 0x4831d0
cmp ebp, edi
je 0x4831f9
lea ecx, [ecx]
xor eax, eax
mov ax, word [ebp]
lea ecx, [esp + 0x1c]
push eax
push 1
call fcn.00467590
add ebp, 2
cmp ebp, edi
jne 0x4831e0
push 0x2f
push 1
lea ecx, [esp + 0x24]
call fcn.00467590
xor ebp, ebp
mov eax, dword [esi + 8]
cmp eax, ebx
jne 0x483213
xor eax, eax
jmp 0x483229
mov ecx, dword [esi + 0xc]
sub ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
je 0x483285
push ebp
mov ecx, esi
call fcn.0046d210
push 0x1c
mov ebx, eax
call fcn.00515ff0
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
test edi, edi
mov byte [esp + 0x40], 4
je 0x483271
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x34], esp
push ebx
lea ecx, [esp + 0x3c]
push ecx
push eax
call fcn.00473af0
add esp, 0xc
mov ecx, edi
call fcn.00482e60
jmp 0x483273
xor eax, eax
mov edx, dword [esi + 0x18]
lea ecx, [edx + ebp*4]
inc ebp
mov byte [esp + 0x40], 3
mov dword [ecx], eax
xor ebx, ebx
jmp 0x483208
mov eax, dword [esp + 0x34]
mov edi, 8
cmp eax, edi
jb 0x48329f
mov eax, dword [esp + 0x20]
push eax
call fcn.0051647d
add esp, 4
cmp dword [esp + 0x60], edi
jb 0x4832b2
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.0051647d
add esp, 4
mov ecx, dword [esp + 0x38]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret 0x1c