joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e84a0
Capabilities:
Access peb ldr_data

Disassembly:
sub ecx, 4
jmp method.CryptoPP::StreamTransformationFilter.virtual_0
push 0xffffffffffffffff
push 0x569dc0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edx, dword [esi + 0x50]
xor al, al
mov ecx, dword [esi + 0x4c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
mov dword [esp + 0x1c], 0
call fcn.00443e80
mov edx, dword [esi + 0x30]
xor al, al
mov ecx, dword [esi + 0x2c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
mov dword [esp + 0x20], 1
call fcn.00443e80
mov ecx, dword [esi + 0xc]
add esp, 8
mov dword [esp + 0x18], 0xffffffff
test ecx, ecx
je 0x4e8515
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [esp + 0x20], 1
je 0x4e8525
push esi
call fcn.00443e80
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4ecaf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x56a4d8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x40]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x14], eax
mov byte [esp + 0xc], 0
push 1
lea eax, [esp + 0x10]
mov dword [esp + 0x3c], 3
push eax
lea eax, [esp + 0x2c]
push 0x5938f0
push eax
call fcn.0043ae90
add esp, 0x10
mov edx, dword [edi]
mov ecx, edi
push eax
push dword [esp + 0x48]
mov byte [esp + 0x40], 4
push esi
call dword [edx + 0x18]
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x38], 3
test ecx, ecx
je 0x4ecb86
mov eax, dword [ecx]
push 1
call dword [eax]
mov edx, dword [esp + 0x20]
xor al, al
mov ecx, dword [esp + 0x1c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
mov dword [esp + 0x3c], 0xffffffff
call fcn.00443e80
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 0x10

Function at 0x4edc00
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
xor eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, esi
shr edi, 2
test edi, edi
je 0x4edc46
mov esi, ebp
mov dword [esp + 0x10], edi
mov edx, ecx
sub esi, ecx
jmp 0x4edc30
mov eax, dword [esi + edx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or ebx, eax
dec edi
jne 0x4edc30
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
shl eax, 2
sub esi, eax
jne 0x4edc5a
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
pop ecx
ret
add ebp, eax
add ecx, eax
mov edx, ebx
mov eax, ebx
shr edx, 0x18
shr eax, 0x10
or dl, al
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
test esi, esi
je 0x4edc8e
sub ebp, ecx
lea esp, [esp]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
dec esi
jne 0x4edc80
pop edi
xor eax, eax
test dl, dl
pop esi
pop ebp
sete al
pop ebx
pop ecx
ret
Function at 0x4edee0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, edx
xor ebp, ebp
shr esi, 2
push edi
mov edi, dword [esp + 0x20]
test esi, esi
je 0x4edfa0
cmp esi, 8
jb 0x4edf79
lea eax, [edi - 4]
lea eax, [eax + esi*4]
lea ecx, [ebx - 4]
lea ecx, [ecx + esi*4]
cmp ebx, eax
ja 0x4edf1b
cmp ecx, edi
jae 0x4edf79
mov eax, esi
mov ecx, esi
and eax, 7
mov edx, edi
sub ecx, eax
sub edx, ebx
mov dword [esp + 0x10], edx
lea eax, [ebx + 0x10]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x14], ecx
mov ecx, edi
mov edi, dword [esp + 0x10]
lea ecx, [ecx]
movdqu xmm0, xmmword [ecx]
add ebp, 8
lea ecx, [ecx + 0x20]
lea eax, [eax + 0x20]
movdqu xmm1, xmmword [eax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x30], xmm1
movdqu xmm1, xmmword [edi + eax - 0x20]
movdqu xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x20], xmm1
cmp ebp, dword [esp + 0x14]
jb 0x4edf40
mov edi, dword [esp + 0x20]
cmp ebp, esi
jae 0x4edfa0
mov edx, edi
lea ecx, [ebx + ebp*4]
sub esi, ebp
sub edx, ebx
add ebp, esi
jmp 0x4edf90
mov eax, dword [ecx + edx]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
dec esi
jne 0x4edf90
mov edx, dword [esp + 0x24]
shl ebp, 2
sub edx, ebp
je 0x4ee02c
add ebx, ebp
add edi, ebp
xor ecx, ecx
test edx, edx
je 0x4ee02c
cmp edx, 0x20
jb 0x4ee011
lea eax, [edi - 1]
lea esi, [ebx - 1]
add eax, edx
add esi, edx
cmp ebx, eax
ja 0x4edfcc
cmp esi, edi
jae 0x4ee011
mov eax, edx
mov esi, edx
and eax, 0x1f
mov ebp, edi
sub esi, eax
mov eax, ebx
sub ebp, ebx
jmp 0x4edfe0
movdqu xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movdqu xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x20], xmm1
movdqu xmm1, xmmword [edi + ecx + 0x10]
add ecx, 0x20
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x10], xmm1
cmp ecx, esi
jb 0x4edfe0
cmp ecx, edx
jae 0x4ee02c
sub edi, ebx
lea eax, [ecx + ebx]
sub edx, ecx
lea esp, [esp]
mov cl, byte [eax + edi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
dec edx
jne 0x4ee020
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4f0420
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56bc30
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5bf500]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0x10
push str.BER_decode_error
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.004027f0
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.0051fa9a
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 1
lea eax, [esp + 0x10]
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [esp + 0x3c], 1
mov byte [ecx], 0
call fcn.00402660
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.CryptoPP::InvalidArgument.0
jb 0x4f04d6
push dword [esp + 0xc]
call fcn.00443e80
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::BERDecodeErr.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0051ece9
add esp, 0x2c
ret
Function at 0x4f1960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x56ab00
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x5bf500]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, dword [esp + 0x88]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x50]
push dword [esp + 0x10]
lea ecx, [esp + 0x20]
push esi
call fcn.004f0500
mov bl, byte [esp + 0x10]
lea ecx, [esp + 0x44]
push 0
mov dword [esp + 0x84], 0
call fcn.004fbdf0
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x44], vtable.CryptoPP::DERGeneralEncoder.0
mov dword [esp + 0x48], vtable.CryptoPP::DERGeneralEncoder.1.0
mov dword [esp + 0x6c], eax
mov byte [esp + 0x70], 0
mov byte [esp + 0x71], bl
cmp byte [esp + 0x35], 0
mov byte [esp + 0x80], 1
je 0x4f1a56
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
push 1
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push 0x5bf004
push eax
lea eax, [esp + 0x50]
push eax
mov eax, dword [esp + 0x2c]
call dword [eax + 0x7c]
cmp byte [esp + 0x35], 0
mov byte [esp + 0x34], 1
je 0x4f1a87
mov eax, dword [esp + 0x3c]
or eax, dword [esp + 0x40]
je 0x4f1aa4
call fcn.004f10e0
cmp byte [esp + 0x35], 0
je 0x4f1a56
mov eax, dword [esp + 0x3c]
or eax, dword [esp + 0x40]
jmp 0x4f1a71
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0xc]
push 1
push eax
call fcn.004ec460
cmp eax, 2
jne 0x4f1a73
cmp word [esp + 0xc], 0
je 0x4f1a2a
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004f1960
add esp, 8
jmp 0x4f1a45
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0xc]
push 1
push eax
call fcn.004ebf00
cmp eax, 2
jne 0x4f1a40
cmp word [esp + 0xc], 0
jne 0x4f1a40
lea ecx, [esp + 0x44]
call fcn.004f1c80
lea ecx, [esp + 0x44]
mov byte [esp + 0x80], 0
call fcn.004f06a0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x80], 0xffffffff
call fcn.004f05f0
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0051ece9
add esp, 0x78
ret
Function at 0x4f3380
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x56ad20
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x5bf500]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x78]
lea ecx, [esi + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x3c]
mov ecx, eax
mov dword [esp + 0x20], ecx
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
jne 0x4f346c
push 0x37
push str.HMAC:_can_only_be_used_with_a_block_based_hash_function
lea ecx, [esp + 0x54]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], eax
mov byte [esp + 0x54], al
call fcn.004027f0
lea ecx, [esp + 0x24]
mov dword [esp + 0x70], ebp
call fcn.0051fa9a
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0x54]
mov byte [esp + 0x78], 1
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x30], vtable.CryptoPP::Exception.0
mov dword [esp + 0x3c], 1
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebp
mov byte [esp + 0x40], 0
call fcn.00402660
push 0x5bc084
lea eax, [esp + 0x28]
mov byte [esp + 0x74], 0
push eax
mov dword [esp + 0x2c], vtable.CryptoPP::InvalidArgument.0
call fcn.00524e20
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x3c]
mov edi, eax
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x3c]
mov ebx, eax
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x20]
mov edi, eax
mov ecx, ebx
mov eax, dword [ebx]
add edi, edi
call dword [eax + 0x1c]
add eax, edi
lea ecx, [esi + 8]
push eax
call fcn.004eda00
mov ebx, dword [esp + 0x1c]
cmp ebx, ebp
ja 0x4f34b5
push ebx
push dword [esp + 0x18]
push dword [esi + 0x10]
call fcn.005256b0
add esp, 0xc
jmp 0x4f34d6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x3c]
mov ecx, eax
push ebx
push dword [esp + 0x18]
mov eax, dword [ecx]
push dword [esi + 0x10]
call dword [eax + 0x2c]
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ebx, eax
mov ecx, ebp
sub ecx, ebx
push ecx
mov ecx, dword [esi + 0x10]
add ecx, ebx
push 0
push ecx
call fcn.00525d00
xor ebp, ebp
add esp, 0xc
cmp dword [esp + 0x18], ebp
jbe 0x4f3520
mov eax, dword [esi]
mov ecx, esi
mov ebx, dword [esi + 0x10]
call dword [eax + 0x3c]
mov edi, dword [esi + 0x10]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x20]
lea ecx, [eax + edi]
mov al, byte [ebx + ebp]
xor al, 0x5c
mov byte [ecx + ebp], al
mov eax, dword [esi + 0x10]
xor byte [eax + ebp], 0x36
inc ebp
cmp ebp, dword [esp + 0x18]
jb 0x4f34f3
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0051ece9
add esp, 0x60
ret 0xc
Function at 0x4f4720
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56bc30
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5bf500]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0x32
push str.Integer:_no_integer_satisfies_the_given_parameters
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.004027f0
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.0051fa9a
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 6
lea eax, [esp + 0x10]
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [esp + 0x3c], 1
mov byte [ecx], 0
call fcn.00402660
cmp dword [esp + 0x20], 0x10
jb 0x4f47d0
push dword [esp + 0xc]
call fcn.00443e80
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::Integer::RandomNumberNotFound.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0051ece9
add esp, 0x2c
ret

Function at 0x4f4a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56b718
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push dword [esp + 0x2c]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.004f45b0
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x24], 0
call fcn.004f1e70
mov esi, dword [esp + 0x28]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.004f45b0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4f4ad8
push eax
call fcn.00443e80
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret
Function at 0x4f5a80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56b178
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5bf500]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 8]
push 0x30
push eax
call fcn.004f0580
mov dword [esp + 8], vtable.CryptoPP::DERSequenceEncoder.0
mov dword [esp + 0xc], vtable.CryptoPP::DERSequenceEncoder.1.0
push 2
lea eax, [esp + 0xc]
mov dword [esp + 0x48], 0
push 0
push eax
call fcn.004f01b0
mov eax, dword [esi - 0x2c]
lea ecx, [esi - 0x2c]
add esp, 0xc
lea edx, [esp + 8]
push edx
call dword [eax + 8]
mov eax, dword [esi - 0x18]
lea ecx, [esi - 0x18]
lea edx, [esp + 8]
push edx
call dword [eax + 8]
mov eax, dword [esi + 0x34]
lea ecx, [esi + 0x34]
lea edx, [esp + 8]
push edx
call dword [eax + 8]
mov eax, dword [esi + 0x48]
lea ecx, [esi + 0x48]
lea edx, [esp + 8]
push edx
call dword [eax + 8]
mov eax, dword [esi + 0x5c]
lea ecx, [esi + 0x5c]
lea edx, [esp + 8]
push edx
call dword [eax + 8]
mov eax, dword [esi + 0x70]
lea ecx, [esi + 0x70]
lea edx, [esp + 8]
push edx
call dword [eax + 8]
mov eax, dword [esi + 0x84]
lea ecx, [esi + 0x84]
lea edx, [esp + 8]
push edx
call dword [eax + 8]
mov eax, dword [esi + 0x98]
lea ecx, [esi + 0x98]
lea edx, [esp + 8]
push edx
call dword [eax + 8]
lea ecx, [esp + 8]
call fcn.004f1c80
lea ecx, [esp + 8]
mov dword [esp + 0x44], 0xffffffff
call fcn.004f06a0
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0051ece9
add esp, 0x40
ret 4

Function at 0x4f5ba0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56b178
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5bf500]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 8]
push 0x30
push eax
call fcn.004f0580
mov dword [esp + 8], vtable.CryptoPP::DERSequenceEncoder.0
mov dword [esp + 0xc], vtable.CryptoPP::DERSequenceEncoder.1.0
mov eax, dword [esi + 8]
lea ecx, [esi + 8]
lea edx, [esp + 8]
mov dword [esp + 0x44], 0
push edx
call dword [eax + 8]
mov eax, dword [esi + 0x1c]
lea ecx, [esi + 0x1c]
lea edx, [esp + 8]
push edx
call dword [eax + 8]
lea ecx, [esp + 8]
call fcn.004f1c80
lea ecx, [esp + 8]
mov dword [esp + 0x44], 0xffffffff
call fcn.004f06a0
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0051ece9
add esp, 0x40
ret 4
Function at 0x4f6eb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x56b3d8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00503230
push eax
lea ecx, [esi + 0x34]
mov dword [esp + 0x30], 0
call fcn.004fe4f0
mov edx, dword [esp + 0x18]
mov ebx, eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
mov dword [esp + 0x2c], 0xffffffff
mov ecx, edx
rep stosd dword es:[edi], eax
lea eax, [edx*4]
push esi
cmp eax, 0x10
jb 0x4f6f29
call fcn.004edb70
jmp 0x4f6f2e
call fcn.00443e80
mov eax, ebx
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4

Function at 0x4f8170
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56b718
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
call fcn.004f81f0
mov esi, dword [esp + 0x2c]
push 0x348
push eax
push esi
mov dword [esp + 0x30], 0
call fcn.004f4a60
mov eax, dword [esp + 0x1c]
add esp, 0x10
test eax, eax
je 0x4f81d2
push eax
call fcn.00443e80
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret

Function at 0x4f81f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56b718
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
call fcn.004f8120
mov esi, dword [esp + 0x2c]
push 2
push eax
push esi
mov dword [esp + 0x30], 0
call fcn.004f4a60
mov eax, dword [esp + 0x1c]
add esp, 0x10
test eax, eax
je 0x4f824f
push eax
call fcn.00443e80
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret

Function at 0x4f8270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56b718
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
call fcn.004f83f0
mov esi, dword [esp + 0x2c]
push 1
push eax
push esi
mov dword [esp + 0x30], 0
call fcn.004f4a60
mov eax, dword [esp + 0x1c]
add esp, 0x10
test eax, eax
je 0x4f82cf
push eax
call fcn.00443e80
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret
Function at 0x4f82f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56b718
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
call fcn.004f8270
mov esi, dword [esp + 0x2c]
push 1
push eax
push esi
mov dword [esp + 0x30], 0
call fcn.004f4a60
mov eax, dword [esp + 0x1c]
add esp, 0x10
test eax, eax
je 0x4f834f
push eax
call fcn.00443e80
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret

Function at 0x4f8370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56b718
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
call fcn.004f82f0
mov esi, dword [esp + 0x2c]
push 1
push eax
push esi
mov dword [esp + 0x30], 0
call fcn.004f4a60
mov eax, dword [esp + 0x1c]
add esp, 0x10
test eax, eax
je 0x4f83cf
push eax
call fcn.00443e80
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret

Function at 0x4f83f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56b718
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
call fcn.004f8170
mov esi, dword [esp + 0x2c]
push 0x1bb8d
push eax
push esi
mov dword [esp + 0x30], 0
call fcn.004f4a60
mov eax, dword [esp + 0x1c]
add esp, 0x10
test eax, eax
je 0x4f8452
push eax
call fcn.00443e80
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret

Function at 0x4f8ab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56b8d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
push esi
call fcn.004fde60
lea eax, [esi + 0x14]
mov dword [esp + 0x18], 0
push eax
lea ecx, [edi + 0x14]
call fcn.004fde60
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
movzx eax, byte [esi + 0x34]
mov byte [edi + 0x34], al
movzx eax, byte [esi + 0x35]
mov byte [edi + 0x35], al
movzx eax, byte [esi + 0x36]
mov byte [edi + 0x36], al
movzx eax, byte [esi + 0x37]
mov byte [edi + 0x37], al
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4f8ea0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x56c2e1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 0
call fcn.004fde60
push dword [esp + 0x3c]
mov ecx, eax
mov dword [esp + 0x34], 1
call fcn.004feca0
mov esi, dword [esp + 0x38]
mov ecx, esi
push eax
call fcn.004fde60
mov edx, dword [esp + 0x1c]
xor eax, eax
mov ebx, dword [esp + 0x20]
mov ecx, edx
mov edi, ebx
mov dword [esp + 0x10], 1
rep stosd dword es:[edi], eax
lea ecx, [edx*4]
mov byte [esp + 0x30], 0
push ebx
cmp ecx, 0x10
jb 0x4f8f28
call fcn.004edb70
jmp 0x4f8f2d
call fcn.00443e80
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8