joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6674f500
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x66788158
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push esi
push edi
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x94]
push 0x1878bff9
mov esi, 1
push 0xe771fe20
push 0x6f66fe42
lea ecx, [esp + 0xa0]
mov dword [esp + 0x74], esi
call dword [eax]
push eax
lea ecx, [esp + 0xa4]
call fcn.667308e2
lea ecx, [esp + 0x20]
mov edi, eax
mov dword [esp + 8], esi
call fcn.66750250
lea ecx, [esp + 8]
mov byte [esp + 0x68], 2
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x66796210
call fcn.6672d78b
lea ecx, [esp + 0x38]
mov byte [esp + 0x68], 3
call fcn.66750260
mov dword [esp + 0x30], 0x667960d8
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 4
call fcn.6672d7aa
lea edx, [esp + 0xc]
lea ecx, [esp + 0x30]
push edx
mov dword [esp + 0x10], eax
call fcn.6672e165
lea ecx, [esp + 0x30]
call fcn.6672e184
mov esi, eax
mov ecx, edi
shl esi, cl
lea ecx, [esp + 0x30]
mov byte [esp + 0x68], 3
call fcn.6672e157
lea ecx, [esp + 0x50]
call fcn.66750260
mov dword [esp + 0x48], 0x667960d8
lea ecx, [esp + 0x74]
mov byte [esp + 0x68], 5
call fcn.6672d7aa
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x4c]
call fcn.6672e165
lea ecx, [esp + 0x48]
call fcn.6672e184
not esi
lea ecx, [esp + 0x48]
and esi, eax
mov byte [esp + 0x68], 3
call fcn.6672e157
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x70]
lea ecx, [esi + 8]
call fcn.66750250
lea ecx, [esp + 0x14]
mov byte [esp + 0x68], 6
push ecx
mov ecx, esi
mov dword [esi], 0x66796210
call fcn.6672d78b
mov edi, 0x667960d4
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x20]
call fcn.6672d784
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], edi
call fcn.6672d784
lea ecx, [esp + 0x94]
mov dword [esp + 0x8c], edi
call fcn.6672d784
mov ecx, dword [esp + 0x60]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x64
ret 0x34

Function at 0x6674f690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66788190
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x5c]
push 0x1878bff9
push 0xe771fe20
push 0x6f66fe42
lea ecx, [esp + 0x68]
mov dword [esp + 0x3c], 1
call dword [eax]
push eax
lea ecx, [esp + 0x6c]
call fcn.667308e2
lea ecx, [esp + 0x18]
mov edi, eax
call fcn.66750260
mov dword [esp + 0x10], 0x667960d8
mov edx, dword [esp + 0x44]
push 0x1878bff9
push 0xe771fe20
push 0x6f66fe42
lea ecx, [esp + 0x50]
mov byte [esp + 0x3c], 2
call dword [edx]
push eax
lea ecx, [esp + 0x54]
call fcn.667308e2
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
call fcn.6672e165
lea ecx, [esp + 0x10]
call fcn.6672e184
mov esi, eax
mov ecx, edi
shl esi, cl
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0x667960d8
call fcn.6672e3b2
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x38]
mov dword [esi + 8], 0x66796214
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 3
push ecx
mov ecx, esi
mov dword [esi], 0x66796210
call fcn.6672d78b
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x34
Function at 0x6674f790
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x667881d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x5c]
push 0x1878bff9
push 0xe771fe20
push 0x6f66fe42
lea ecx, [esp + 0x68]
mov dword [esp + 0x3c], 1
call dword [eax]
push eax
lea ecx, [esp + 0x6c]
call fcn.667308e2
mov edi, eax
mov dword [esp + 0x14], 0x667960f8
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 2
call fcn.667502a0
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 3
call fcn.667502b0
mov dword [esp + 0x10], 0x667960e8
mov edx, dword [esp + 0x44]
push 0x1878bff9
push 0xe771fe20
push 0x6f66fe42
lea ecx, [esp + 0x50]
mov byte [esp + 0x3c], 4
call dword [edx]
push eax
lea ecx, [esp + 0x54]
call fcn.667308e2
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
call fcn.66722fe3
lea ecx, [esp + 0x10]
call fcn.6672e127
mov esi, eax
mov ecx, edi
shr esi, cl
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.6672e10e
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x38]
mov dword [esi + 8], 0x66796214
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 5
push ecx
mov ecx, esi
mov dword [esi], 0x66796210
call fcn.6672d78b
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x34

Function at 0x6674fa60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66788270
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x5c]
push 0x1878bff9
push 0xe771fe20
push 0x6f66fe42
lea ecx, [esp + 0x68]
mov dword [esp + 0x3c], 1
call dword [eax]
push eax
lea ecx, [esp + 0x6c]
call fcn.667308e2
mov edi, eax
mov dword [esp + 0x14], 0x667960f8
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 2
call fcn.667502a0
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 3
call fcn.667502b0
mov dword [esp + 0x10], 0x667960e8
mov edx, dword [esp + 0x44]
push 0x1878bff9
push 0xe771fe20
push 0x6f66fe42
lea ecx, [esp + 0x50]
mov byte [esp + 0x3c], 4
call dword [edx]
push eax
lea ecx, [esp + 0x54]
call fcn.667308e2
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
call fcn.66722fe3
lea ecx, [esp + 0x10]
call fcn.6672e127
mov esi, eax
lea ecx, [esp + 0x10]
imul esi, edi
mov byte [esp + 0x30], 1
call fcn.6672e10e
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x38]
mov dword [esi + 8], 0x66796214
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 5
push ecx
mov ecx, esi
mov dword [esi], 0x66796210
call fcn.6672d78b
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x34
Function at 0x6674fd70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66788308
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x7c]
push 0x1878bff9
push 0xe771fe20
push 0x6f66fe42
lea ecx, [esp + 0x88]
mov dword [esp + 0x5c], 1
call dword [eax]
push eax
lea ecx, [esp + 0x8c]
call fcn.667308e2
lea ecx, [esp + 0x38]
mov dword [esp + 0x10], eax
call fcn.66750260
mov edi, 0x667960d8
mov dword [esp + 0x30], edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x50], 2
call fcn.66750260
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x5c]
mov byte [esp + 0x50], 3
call fcn.6672d7aa
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], eax
push ecx
lea ecx, [esp + 0x34]
call fcn.6672e165
lea edx, [esp + 0x10]
lea ecx, [esp + 0x18]
push edx
call fcn.6672e165
mov eax, dword [esp + 0x38]
push 0xc337eae3
push 0x3c3eab3a
push 0xb429ab58
lea ecx, [esp + 0x44]
call dword [eax]
mov edx, dword [esp + 0x20]
push 0xc337eae3
push 0x3c3eab3a
push 0xb429ab58
lea ecx, [esp + 0x2c]
mov esi, eax
call dword [edx]
cmp esi, eax
lea ecx, [esp + 0x20]
setne bl
mov dword [esp + 0x18], edi
call fcn.6672e3b2
lea ecx, [esp + 0x30]
mov byte [esp + 0x50], 1
call fcn.6672e157
mov esi, dword [esp + 0x58]
xor eax, eax
test bl, bl
lea edi, [esi + 8]
sete al
mov ecx, edi
mov dword [esp + 0x14], eax
call fcn.66750250
mov ebx, dword [edi]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x14]
mov byte [esp + 0x54], 4
mov dword [esi], 0x66796210
call fcn.6672ec7f
push eax
mov ecx, edi
call dword [ebx + 4]
mov eax, esi
pop edi
mov ecx, dword [esp + 0x44]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 0x34

Function at 0x6674fec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66788350
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov dword [esp + 8], 0
mov eax, dword [esp + 0x58]
push 0x1878bff9
push 0xe771fe20
push 0x6f66fe42
lea ecx, [esp + 0x64]
mov dword [esp + 0x38], 1
call dword [eax]
push eax
lea ecx, [esp + 0x68]
call fcn.667308e2
mov esi, eax
mov dword [esp + 0x10], 0x667960f8
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call fcn.667502a0
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c], 3
call fcn.667502b0
mov dword [esp + 0xc], 0x667960e8
mov edx, dword [esp + 0x40]
push 0x1878bff9
push 0xe771fe20
push 0x6f66fe42
lea ecx, [esp + 0x4c]
mov byte [esp + 0x38], 4
call dword [edx]
push eax
lea ecx, [esp + 0x50]
call fcn.667308e2
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x10]
call fcn.66722fe3
lea ecx, [esp + 0xc]
call fcn.6672e127
cmp eax, esi
mov byte [esp + 0x2c], 1
setb cl
mov byte [esp + 8], cl
lea ecx, [esp + 0xc]
call fcn.6672e10e
mov edx, dword [esp + 8]
mov esi, dword [esp + 0x34]
and edx, 0xff
mov dword [esp + 8], edx
mov dword [esi + 8], 0x66796214
lea eax, [esp + 8]
mov ecx, esi
push eax
mov byte [esp + 0x30], 5
mov dword [esi], 0x66796210
call fcn.6672d78b
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x34
Function at 0x66750890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66788508
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 8], edi
lea ecx, [esp + 0x1c]
mov dword [esp + 8], 0xffff
call fcn.66750250
lea eax, [esp + 8]
lea ecx, [esp + 0x14]
push eax
mov dword [esp + 0x68], edi
mov dword [esp + 0x18], 0x66796210
call fcn.6672d78b
mov edx, dword [esp + 0x1c]
push 0x1878bff9
push 0xe771fe20
push 0x6f66fe42
lea ecx, [esp + 0x28]
mov dword [esp + 0x70], 1
call dword [edx]
push eax
lea ecx, [esp + 0x2c]
call fcn.667308e2
mov edi, eax
lea eax, [esp + 0x44]
push eax
mov ecx, esi
call fcn.66750610
mov esi, eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x64], 2
call fcn.66750260
mov dword [esp + 0x2c], 0x667960d8
mov edx, dword [esi + 8]
lea ecx, [esi + 8]
push 0x1878bff9
push 0xe771fe20
push 0x6f66fe42
mov byte [esp + 0x70], 3
call dword [edx]
push eax
lea ecx, [esi + 0x14]
call fcn.667308e2
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
call fcn.6672e165
lea ecx, [esp + 0x2c]
call fcn.6672e184
and eax, edi
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x64], 2
call fcn.6672e157
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x6c]
lea ecx, [esi + 8]
call fcn.66750250
lea ecx, [esp + 0x10]
mov byte [esp + 0x64], 4
push ecx
mov ecx, esi
mov dword [esi], 0x66796210
call fcn.6672d78b
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret 4

Function at 0x66750a00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x66788548
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0x19
mov dword [esp + 0x30], 0x66796214
lea eax, [esp + 8]
lea ecx, [esp + 0x3c]
push eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x2c], 0x66796210
call fcn.6672ec7f
push eax
lea ecx, [esp + 0x34]
call dword [0x66796218]
mov edx, dword [esp + 0x30]
push 0x1878bff9
push 0xe771fe20
push 0x6f66fe42
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], 1
call dword [edx]
mov ecx, eax
mov dword [esp + 0x14], 0x667960f8
not ecx
xor ecx, eax
and ecx, 0x6e60ca67
xor ecx, eax
xor ecx, 0xc5ef7e84
mov esi, ecx
not esi
xor esi, ecx
and esi, 0x3bec014c
xor esi, ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 2
call fcn.667502a0
lea ecx, [esp + 0x24]
mov byte [esp + 0x48], 3
call fcn.667502b0
mov dword [esp + 0x10], 0x667960e8
mov eax, dword [edi + 8]
lea ecx, [edi + 8]
push 0x1878bff9
push 0xe771fe20
push 0x6f66fe42
mov byte [esp + 0x54], 4
call dword [eax]
push eax
lea ecx, [edi + 0x14]
call fcn.667308e2
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], eax
push ecx
lea ecx, [esp + 0x14]
call fcn.66722fe3
lea ecx, [esp + 0x10]
call fcn.6672e127
mov edi, eax
mov ecx, esi
shr edi, cl
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 1
call fcn.6672e10e
mov ecx, dword [esp + 0x40]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x44
ret
Function at 0x66751060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66788599
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov cl, byte [esp + 0x3c]
mov al, byte [esp + 0x3c]
xor ebx, ebx
mov byte [esi + 1], cl
mov ecx, esi
mov dword [esp + 0x20], ebx
mov byte [esi], al
mov byte [esi + 8], bl
call fcn.667527f0
mov dl, byte [esp + 0x28]
lea ecx, [esi + 0x10]
mov byte [esp + 0x20], 1
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov eax, dword [0x66794218]
lea edx, [esp + 0x28]
push eax
push ebx
push edx
call fcn.66715025
mov eax, dword [esp + 0x38]
lea ebp, [esi + 0x20]
mov edi, ebp
mov byte [esp + 0x20], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x14], edi
lea ecx, [edi + 8]
call fcn.667520a0
lea ecx, [esp + 0x38]
mov byte [esp + 0x20], 3
push ecx
mov ecx, edi
mov dword [edi], 0x6679608c
call fcn.66729837
mov al, byte [esp + 0x3c]
mov edi, dword [esp + 0x3c]
lea edx, [esi + 0x48]
or ecx, 0xffffffff
mov byte [esp + 0x20], 4
mov byte [edx], al
xor eax, eax
mov dword [edx + 4], ebx
mov dword [edx + 8], ebx
mov dword [edx + 0xc], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x40]
push ecx
mov ecx, edx
call fcn.66715495
lea ecx, [ebp + 8]
mov dword [esi + 0x58], ebx
push 0x1ca3c1b
push 0xfec37dc2
mov edx, dword [ecx]
push 0x76d47da0
mov byte [esp + 0x2c], 5
call dword [edx]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [ebp + 0x24]
call fcn.6672a20e
push eax
call fcn.6676763f
mov eax, dword [esp + 0x30]
add esp, 4
cmp eax, ebx
je 0x6675118b
mov cl, byte [eax - 1]
cmp cl, bl
je 0x66751181
cmp cl, 0xff
je 0x66751181
dec cl
mov byte [eax - 1], cl
jmp 0x6675118b
dec eax
push eax
call fcn.667661a3
add esp, 4
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x18
Function at 0x66751f00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66788713
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x28]
mov dl, byte [esp + 0x2c]
lea ecx, [esi + 4]
xor ebx, ebx
mov dword [esi], eax
mov dword [esp + 0x20], ebx
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov eax, dword [0x66794218]
lea edx, [esp + 0x2c]
push eax
push ebx
push edx
call fcn.66715025
lea ebp, [esi + 0x14]
mov dword [esp + 0x28], ebp
lea edi, [ebp + 8]
mov dword [esp + 0x14], edi
mov dword [edi], method.streambuf.virtual_28
lea ecx, [edi + 4]
mov byte [esp + 0x20], 2
call fcn.66735723
mov dword [edi], 0x667958b4
mov eax, dword [esp + 0x3c]
mov edx, dword [edi]
xor eax, 0x8597b5b9
mov byte [esp + 0x20], 3
mov ecx, eax
mov dword [ebp], 0x667957d0
not ecx
xor ecx, eax
and ecx, 0x6e60ca67
xor ecx, eax
xor ecx, 0x558ccb2b
push ecx
mov ecx, edi
call dword [edx + 4]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], 0xffffffff
cmp ecx, ebx
mov dword [esi + 0x40], ebx
je 0x66751fd7
mov al, byte [ecx - 1]
cmp al, bl
je 0x66751fcd
cmp al, 0xff
je 0x66751fcd
dec al
mov byte [ecx - 1], al
jmp 0x66751fd7
dec ecx
push ecx
call fcn.667661a3
add esp, 4
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x18

Function at 0x66753fb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x66788860
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
lea edi, [ecx + 8]
mov dword [ecx], 0x66796ab0
mov dword [esp + 0x14], edi
xor ebp, ebp
lea ebx, [edi + 4]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], ebx
mov eax, dword [ebx + 8]
lea esi, [ebx + 4]
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.66708530
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.66708540
mov eax, dword [esi + 4]
push eax
call fcn.667661a3
add esp, 4
mov dword [esi + 4], ebp
mov dword [esi + 0xc], ebp
lea ecx, [esp + 0x10]
xor esi, esi
call fcn.66772db2
mov eax, dword [0x667bd65c]
dec eax
mov dword [0x667bd65c], eax
jne 0x66754043
mov esi, dword [0x667bd658]
mov dword [0x667bd658], ebp
lea ecx, [esp + 0x10]
call fcn.66772e4e
cmp esi, ebp
je 0x66754059
push esi
call fcn.667661a3
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [ebx], method.streambuf.virtual_28
mov dword [edi], method.streambuf.virtual_28
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x66755630
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x66788a90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
lea edi, [ecx + 8]
mov dword [ecx], 0x66796b00
mov dword [esp + 0x14], edi
xor ebp, ebp
lea ebx, [edi + 4]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], ebx
mov eax, dword [ebx + 8]
lea esi, [ebx + 4]
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.66708530
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.66708610
mov eax, dword [esi + 4]
push eax
call fcn.667661a3
add esp, 4
mov dword [esi + 4], ebp
mov dword [esi + 0xc], ebp
lea ecx, [esp + 0x10]
xor esi, esi
call fcn.66772db2
mov eax, dword [0x667bd664]
dec eax
mov dword [0x667bd664], eax
jne 0x667556c3
mov esi, dword [0x667bd660]
mov dword [0x667bd660], ebp
lea ecx, [esp + 0x10]
call fcn.66772e4e
cmp esi, ebp
je 0x667556d9
push esi
call fcn.667661a3
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [ebx], method.streambuf.virtual_28
mov dword [edi], method.streambuf.virtual_28
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x66755a40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x66788b30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
lea edi, [ecx + 8]
mov dword [ecx], 0x66796ac4
mov dword [esp + 0x14], edi
xor ebp, ebp
lea ebx, [edi + 4]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], ebx
mov eax, dword [ebx + 8]
lea esi, [ebx + 4]
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.66708530
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.66708610
mov eax, dword [esi + 4]
push eax
call fcn.667661a3
add esp, 4
mov dword [esi + 4], ebp
mov dword [esi + 0xc], ebp
lea ecx, [esp + 0x10]
xor esi, esi
call fcn.66772db2
mov eax, dword [0x667bd664]
dec eax
mov dword [0x667bd664], eax
jne 0x66755ad3
mov esi, dword [0x667bd660]
mov dword [0x667bd660], ebp
lea ecx, [esp + 0x10]
call fcn.66772e4e
cmp esi, ebp
je 0x66755ae9
push esi
call fcn.667661a3
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [ebx], method.streambuf.virtual_28
mov dword [edi], method.streambuf.virtual_28
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x66755d70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x66788b90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
lea edi, [ecx + 8]
mov dword [ecx], 0x66796ae4
mov dword [esp + 0x14], edi
xor ebp, ebp
lea ebx, [edi + 4]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], ebx
mov eax, dword [ebx + 8]
lea esi, [ebx + 4]
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.66708530
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.66708610
mov eax, dword [esi + 4]
push eax
call fcn.667661a3
add esp, 4
mov dword [esi + 4], ebp
mov dword [esi + 0xc], ebp
lea ecx, [esp + 0x10]
xor esi, esi
call fcn.66772db2
mov eax, dword [0x667bd664]
dec eax
mov dword [0x667bd664], eax
jne 0x66755e03
mov esi, dword [0x667bd660]
mov dword [0x667bd660], ebp
lea ecx, [esp + 0x10]
call fcn.66772e4e
cmp esi, ebp
je 0x66755e19
push esi
call fcn.667661a3
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [ebx], method.streambuf.virtual_28
mov dword [edi], method.streambuf.virtual_28
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x66757140
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x66788ce0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x1c], ebp
mov dword [ebp], method.streambuf.virtual_28
lea esi, [ebp + 4]
xor ebx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], esi
mov dword [esi], method.streambuf.virtual_28
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x13]
push 0x18
mov byte [esp + 0x30], 1
mov byte [esi + 4], al
mov byte [esi + 5], cl
mov byte [esi + 0xc], bl
call fcn.66766ab2
mov edi, eax
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], edi
mov dword [edi + 4], ebx
mov dword [edi + 0x14], 1
call fcn.66772db2
cmp dword [0x667bd660], ebx
jne 0x667571d2
mov dword [0x667bd660], edi
mov dword [edi], ebx
mov edx, dword [0x667bd660]
mov dword [esp + 0x14], ebx
mov dword [edx + 8], ebx
mov edx, dword [0x667bd664]
lea ecx, [esp + 0x18]
inc edx
mov dword [0x667bd664], edx
call fcn.66772e4e
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x667571f9
push eax
call fcn.667661a3
add esp, 4
mov edi, dword [0x667bd660]
push 0x18
call fcn.66766ab2
mov dword [eax + 4], edi
mov dword [eax + 0x14], ebx
mov ecx, dword [esp + 0x28]
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [eax], eax
mov eax, dword [esi + 8]
add esp, 4
mov dword [eax + 8], eax
mov dword [esi], 0x66796af4
pop edi
mov dword [ebp], 0x66796ae8
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x66757240
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x66788d00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x1c], ebp
mov dword [ebp], method.streambuf.virtual_28
lea esi, [ebp + 4]
xor ebx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], esi
mov dword [esi], method.streambuf.virtual_28
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x13]
push 0x14
mov byte [esp + 0x30], 1
mov byte [esi + 4], al
mov byte [esi + 5], cl
mov byte [esi + 0xc], bl
call fcn.66766ab2
mov edi, eax
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], edi
mov dword [edi + 4], ebx
mov dword [edi + 0x10], 1
call fcn.66772db2
cmp dword [0x667bd658], ebx
jne 0x667572d2
mov dword [0x667bd658], edi
mov dword [edi], ebx
mov edx, dword [0x667bd658]
mov dword [esp + 0x14], ebx
mov dword [edx + 8], ebx
mov edx, dword [0x667bd65c]
lea ecx, [esp + 0x18]
inc edx
mov dword [0x667bd65c], edx
call fcn.66772e4e
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x667572f9
push eax
call fcn.667661a3
add esp, 4
mov edi, dword [0x667bd658]
push 0x14
call fcn.66766ab2
mov dword [eax + 4], edi
mov dword [eax + 0x10], ebx
mov ecx, dword [esp + 0x28]
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [eax], eax
mov eax, dword [esi + 8]
add esp, 4
mov dword [eax + 8], eax
mov dword [esi], 0x667962e0
pop edi
mov dword [ebp], 0x667961cc
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret