joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e90
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x402ea7
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], 0
mov eax, dword [esp + 0xc]
lea ebx, [esi + 0xc]
push ebx
push eax
mov dword [esi + 4], 0x4010f0
mov dword [esi + 0x10], 0
mov dword [ebx], 0
mov byte [esi + 0x14], 0
mov byte [esi + 0x15], 0
mov byte [esi + 0x16], 0
mov byte [esi + 0x17], 0
mov dword [esi + 8], eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esi], eax
test eax, eax
je 0x402fa9
push edi
mov edi, 1
cmp dword [ebx], edi
jle 0x402f98
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea esp, [esp]
mov eax, dword [esi]
mov ecx, dword [eax + edi*4]
push 0x401578
push ecx
call ebp
test eax, eax
jne 0x402f1a
mov dword [esi + 4], 0x401140
jmp 0x402f8e
mov edx, dword [esi]
mov eax, dword [edx + edi*4]
push 0x401564
push eax
call ebp
test eax, eax
jne 0x402f31
mov byte [esi + 0x14], 1
jmp 0x402f8e
mov ecx, dword [esi]
mov edx, dword [ecx + edi*4]
push 0x401544
push edx
call ebp
test eax, eax
jne 0x402f48
mov byte [esi + 0x15], 1
jmp 0x402f8e
mov eax, dword [esi]
mov ecx, dword [eax + edi*4]
push 0x401524
push ecx
call ebp
test eax, eax
jne 0x402f5f
mov byte [esi + 0x16], 1
jmp 0x402f8e
mov edx, dword [esi]
mov eax, dword [edx + edi*4]
push 0x401504
push eax
call ebp
test eax, eax
jne 0x402f76
mov byte [esi + 0x17], 1
jmp 0x402f8e
mov ecx, dword [esi]
mov edx, dword [ecx + edi*4]
push 0x4014f0
push edx
call ebp
test eax, eax
jne 0x402f8e
mov dword [esi + 0x10], 1
inc edi
cmp edi, dword [ebx]
jl 0x402f00
pop ebp
cmp byte [esi + 0x16], 0
pop edi
jne 0x402fa9
cmp byte [esi + 0x15], 0
sete al
mov byte [esi + 0x14], al
xor eax, eax
cmp dword [esi], eax
pop esi
setne al
pop ebx
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4052f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x405301
pop dword [ebp - 0x28]
mov eax, 0x3595e636
add eax, 0xcaaa6ccb
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x6f789a0
add dword [ebp - 0x38], 0x475abbab
mov dword [ebp - 0x34], 0x362c1bb4
sub dword [ebp - 0x34], 0x3f8cf6f
mov dword [ebp - 0x30], 0xaa04e166
add dword [ebp - 0x30], 0xa24762c8
mov dword [ebp - 0x2c], 0x73c09635
sub dword [ebp - 0x2c], 0x73c09635
lea eax, [ebp - 0x38]
push eax
mov eax, 0xe260061
add eax, 0xf21acff3
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xb656cd27
sub dword [ebp - 0x38], 0x41e463d1
mov dword [ebp - 0x34], 0x60a24ab
sub dword [ebp - 0x34], 0xc49dc336
mov dword [ebp - 0x30], 0x230da945
add dword [ebp - 0x30], 0x4061c327
mov dword [ebp - 0x2c], 0x39c2bb9e
add dword [ebp - 0x2c], 0xc63d4462
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x9ef7a61
sub eax, 0x9aeaa15
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3a74e
push 0
call eax
mov ecx, 0x930c5bcc
add ecx, 0x6cf3efe0
xor edx, edx
add edx, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x28]
mov esi, 0x3dc440cf
mov dword [ebp - 0x20], 0xea96c922
mov ebx, dword [edi]
xor dword [ebp - 8], 0x9b522630
add ebx, esi
add dword [ebp - 4], 0xbf93b555
mov dword [edx], ebx
sub dword [ebp - 0x24], 0x6e5cb723
add edx, 0x96b2599f
sub edx, 0x96b2599b
add edi, 0x2f30d773
add edi, 0xd0cf2891
loop 0x405419
add eax, 0x12183
xor ebx, ebx
add ebx, eax
add eax, 0x997d9529
add eax, 0x66826adc
mov ecx, 0x1d5712f0
add ecx, 0xe2e8ed10
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4b40a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov eax, dword [esp + 0x5c]
push ebp
push esi
mov esi, ecx
push edi
push eax
lea ecx, [esp + 0x4c]
mov byte [esi + 0x18], 0
mov byte [esi + 0x19], 0
call fcn.00426f30
lea ecx, [esp + 0xd]
mov dword [esp + 0x60], 1
push ecx
lea ecx, [esp + 0x28]
call fcn.00441c50
mov edi, 0x4e5260
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [esp + 0x68]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x68]
add ecx, 0x4e5260
push eax
push ecx
push 0x4e5260
lea ecx, [esp + 0x30]
mov byte [esp + 0x6c], 2
mov byte [esp + 0x74], dl
call fcn.00402130
lea ecx, [esp + 0x24]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 3
call fcn.004273d0
lea ecx, [esp + 0x24]
mov byte [esp + 0x60], 7
call fcn.00421180
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x68], 5
call fcn.00401fa0
lea ecx, [esp + 0x10]
xor ebp, ebp
call fcn.00427700
test eax, eax
jle 0x401a60
push ebx
mov bl, byte [esp + 0x6c]
lea eax, [esp + 0x18]
push ebp
push eax
lea ecx, [esp + 0x1c]
call fcn.00427640
lea ecx, [esp + 0x12]
mov byte [esp + 0x64], 9
push ecx
lea ecx, [esp + 0x44]
call fcn.00441c50
mov edi, 0x4e525c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x6c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push edx
add ecx, 0x4e525c
mov byte [esp + 0x68], 0xa
push ecx
push 0x4e525c
lea ecx, [esp + 0x4c]
mov byte [esp + 0x78], bl
call fcn.00402130
lea eax, [esp + 0x13]
lea ecx, [esp + 0x34]
push eax
mov byte [esp + 0x68], 0xc
call fcn.00441c50
mov edi, 0x4e5258
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [esp + 0x6c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x6c]
add ecx, 0x4e5258
push eax
push ecx
push 0x4e5258
lea ecx, [esp + 0x40]
mov byte [esp + 0x70], 0xd
mov byte [esp + 0x78], dl
call fcn.00402130
lea ecx, [esp + 0x40]
push 0
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x6c], 0xe
call fcn.00426a10
fstp dword [esp + 0x1c]
lea edx, [esp + 0x34]
push 0
push edx
lea ecx, [esp + 0x20]
call fcn.00426a10
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
fstp dword [esp + 0x20]
push ecx
mov ecx, esi
mov dword [esp + 0x28], eax
call fcn.00401cf0
lea ecx, [esp + 0x34]
mov byte [esp + 0x64], 0xf
call fcn.00421180
lea ecx, [esp + 0x40]
mov byte [esp + 0x64], 0x10
call fcn.00421180
mov byte [esp + 0x64], 5
mov eax, dword [esp + 0x18]
test eax, eax
je 0x401a4d
mov edx, dword [eax]
push eax
call dword [edx + 8]
lea ecx, [esp + 0x14]
inc ebp
call fcn.00427700
cmp ebp, eax
jl 0x401940
pop ebx
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov byte [esp + 0x58], 0
test eax, eax
pop ebp
je 0x401a76
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], 0xffffffff
call fcn.00427360
mov ecx, dword [esp + 0x4c]
mov al, 1
mov dword fs:[0], ecx
add esp, 0x58
ret 4
Function at 0x40188d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4b40a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov eax, dword [esp + 0x5c]
push ebp
push esi
mov esi, ecx
push edi
push eax
lea ecx, [esp + 0x4c]
mov byte [esi + 0x18], 0
mov byte [esi + 0x19], 0
call fcn.00426f30
lea ecx, [esp + 0xd]
mov dword [esp + 0x60], 1
push ecx
lea ecx, [esp + 0x28]
call fcn.00441c50
mov edi, 0x4e5260
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [esp + 0x68]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x68]
add ecx, 0x4e5260
push eax
push ecx
push 0x4e5260
lea ecx, [esp + 0x30]
mov byte [esp + 0x6c], 2
mov byte [esp + 0x74], dl
call fcn.00402130
lea ecx, [esp + 0x24]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x68], 3
call fcn.004273d0
lea ecx, [esp + 0x24]
mov byte [esp + 0x60], 7
call fcn.00421180
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x68], 5
call fcn.00401fa0
lea ecx, [esp + 0x10]
xor ebp, ebp
call fcn.00427700
test eax, eax
jle 0x401a60
push ebx
mov bl, byte [esp + 0x6c]
lea eax, [esp + 0x18]
push ebp
push eax
lea ecx, [esp + 0x1c]
call fcn.00427640
lea ecx, [esp + 0x12]
mov byte [esp + 0x64], 9
push ecx
lea ecx, [esp + 0x44]
call fcn.00441c50
mov edi, 0x4e525c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x6c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push edx
add ecx, 0x4e525c
mov byte [esp + 0x68], 0xa
push ecx
push 0x4e525c
lea ecx, [esp + 0x4c]
mov byte [esp + 0x78], bl
call fcn.00402130
lea eax, [esp + 0x13]
lea ecx, [esp + 0x34]
push eax
mov byte [esp + 0x68], 0xc
call fcn.00441c50
mov edi, 0x4e5258
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [esp + 0x6c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x6c]
add ecx, 0x4e5258
push eax
push ecx
push 0x4e5258
lea ecx, [esp + 0x40]
mov byte [esp + 0x70], 0xd
mov byte [esp + 0x78], dl
call fcn.00402130
lea ecx, [esp + 0x40]
push 0
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x6c], 0xe
call fcn.00426a10
fstp dword [esp + 0x1c]
lea edx, [esp + 0x34]
push 0
push edx
lea ecx, [esp + 0x20]
call fcn.00426a10
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
fstp dword [esp + 0x20]
push ecx
mov ecx, esi
mov dword [esp + 0x28], eax
call fcn.00401cf0
lea ecx, [esp + 0x34]
mov byte [esp + 0x64], 0xf
call fcn.00421180
lea ecx, [esp + 0x40]
mov byte [esp + 0x64], 0x10
call fcn.00421180
mov byte [esp + 0x64], 5
mov eax, dword [esp + 0x18]
test eax, eax
je 0x401a4d
mov edx, dword [eax]
push eax
call dword [edx + 8]
lea ecx, [esp + 0x14]
inc ebp
call fcn.00427700
cmp ebp, eax
jl 0x401940
pop ebx
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov byte [esp + 0x58], 0
test eax, eax
pop ebp
je 0x401a76
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], 0xffffffff
call fcn.00427360
mov ecx, dword [esp + 0x4c]
mov al, 1
mov dword fs:[0], ecx
add esp, 0x58
ret 4
Function at 0x4035e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b4186
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea eax, [esp + 9]
mov dword [esp + 0x1c], 1
push eax
call fcn.00441c50
push 8
mov byte [esp + 0x20], 3
call fcn.00489cc9
lea ecx, [eax + 8]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
add esp, 4
mov byte [eax], 0
lea ecx, [esi + 0x8008]
lea edx, [esp + 9]
lea eax, [esp + 0xa]
push edx
push eax
mov byte [esp + 0x24], 5
call fcn.00403f50
sub esp, 0xc
lea ecx, [esp + 0x17]
mov dword [esp + 0x1c], esp
mov edi, esp
push ecx
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 6
mov byte [esi + 0x8004], 0
mov dword [esp + 0x20], edi
call fcn.00424d90
push eax
mov ecx, edi
mov byte [esp + 0x2c], 7
call fcn.00441c50
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edx
push eax
mov ecx, edi
mov byte [esp + 0x30], 9
call fcn.00404480
mov ecx, esi
mov byte [esp + 0x28], 6
call fcn.00403770
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00421180
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x18
ret 0x10

Function at 0x4035f8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b4186
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea eax, [esp + 9]
mov dword [esp + 0x1c], 1
push eax
call fcn.00441c50
push 8
mov byte [esp + 0x20], 3
call fcn.00489cc9
lea ecx, [eax + 8]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
add esp, 4
mov byte [eax], 0
lea ecx, [esi + 0x8008]
lea edx, [esp + 9]
lea eax, [esp + 0xa]
push edx
push eax
mov byte [esp + 0x24], 5
call fcn.00403f50
sub esp, 0xc
lea ecx, [esp + 0x17]
mov dword [esp + 0x1c], esp
mov edi, esp
push ecx
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 6
mov byte [esi + 0x8004], 0
mov dword [esp + 0x20], edi
call fcn.00424d90
push eax
mov ecx, edi
mov byte [esp + 0x2c], 7
call fcn.00441c50
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edx
push eax
mov ecx, edi
mov byte [esp + 0x30], 9
call fcn.00404480
mov ecx, esi
mov byte [esp + 0x28], 6
call fcn.00403770
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00421180
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x18
ret 0x10
Function at 0x4038b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b41f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov al, byte [ecx + 0x8004]
push ebx
xor ebx, ebx
push esi
cmp al, bl
push edi
mov dword [esp + 0xc], ebx
jne 0x403950
mov esi, dword [esp + 0x28]
mov eax, dword [ecx]
mov edx, dword [esp + 0x2c]
push ebp
mov edi, dword [esi]
mov esi, dword [esp + 0x28]
mov edx, dword [edx]
push eax
mov ebp, dword [esi]
lea esi, [ecx + 0xc]
push 0x7ff8
push esi
push edx
push edi
push ebp
call dword [fcn.004c7118]
mov ebp, dword [esp + 0x24]
lea eax, [esp + 0x30]
push ebx
push eax
lea ecx, [ebp + 8]
mov dword [esp + 0x24], ebx
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
call fcn.00446b10
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x1c], 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, esi
push ecx
push esi
mov ecx, ebp
call fcn.00404480
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
lea esi, [ecx + 0x8008]
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, esi
call fcn.00461100
cmp eax, dword [esi]
jne 0x4039b3
mov edi, dword [esp + 0x2c]
lea edx, [esp + 0x24]
push edx
mov ecx, edi
call fcn.00424d90
mov esi, dword [esp + 0x20]
push ebx
push eax
mov dword [esp + 0x20], 2
lea ecx, [esi + 8]
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.00446b10
mov al, byte [esp + 0x2c]
mov edx, dword [edi + 4]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2c], al
mov eax, dword [edi]
push ecx
push edx
push eax
mov ecx, esi
mov byte [esp + 0x24], 4
call fcn.00402130
jmp 0x4039ce
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x20]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [ecx]
lea ecx, [eax + 0x1c]
push edx
push esi
call fcn.00403df0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x403df0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b4308
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], ebx
lea eax, [esp + 0xf]
push ebx
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00446b10
mov edx, dword [esp + 0x34]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x28], 1
add ecx, edx
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.00404480
lea ecx, [esp + 0x14]
lea edi, [esi + 0xc]
push ecx
mov ecx, edi
mov byte [esp + 0x2c], 2
call fcn.00461100
mov esi, eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 3
call fcn.00421180
mov eax, dword [edi]
mov dword [esp + 0x28], 0xffffffff
cmp esi, eax
jne 0x403ee4
mov esi, dword [esp + 0x30]
lea edx, [esp + 0xf]
push ebx
push edx
lea ecx, [esi + 8]
mov dword [esp + 0x30], 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.00446b10
mov al, byte [esp + 0x30]
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x34]
mov byte [esp + 0x34], al
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x2c], 5
add ecx, edx
push ecx
push edx
mov ecx, esi
call fcn.00402130
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea edi, [esi + 0x1c]
lea edx, [esp + 0x38]
push ebp
push edx
mov ecx, edi
call fcn.00424d90
mov esi, dword [esp + 0x34]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov ebp, dword [edi + 4]
mov edi, dword [edi]
mov eax, ebp
mov ecx, esi
sub eax, edi
mov dword [esp + 0x2c], 6
inc eax
push eax
call fcn.00402280
mov eax, dword [esi]
mov cl, byte [esp + 0x34]
lea edx, [esp + 0x38]
mov byte [esp + 0x38], cl
push edx
push eax
push ebp
push edi
call fcn.004022d0
mov ecx, dword [esp + 0x34]
add esp, 0x10
mov dword [esi + 4], eax
mov byte [eax], bl
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x406cc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b47e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x13]
xor ebx, ebx
push eax
mov ecx, edi
mov dword [esp + 0x18], ebx
call fcn.00424d90
mov esi, dword [esp + 0x28]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov ebp, dword [edi + 4]
mov dword [esp + 0x20], ebx
mov ebx, dword [edi]
mov eax, ebp
sub eax, ebx
lea edi, [eax + 1]
cmp edi, 0xffffffff
ja 0x406d2c
test edi, edi
jbe 0x406d2c
push edi
call fcn.00407280
add esp, 4
mov dword [esi], eax
mov dword [esi + 4], eax
add eax, edi
mov dword [esi + 8], eax
jmp 0x406d39
push 0x4e5270
call fcn.004021a0
add esp, 4
mov ecx, dword [esi]
push ecx
push ebp
push ebx
call fcn.004022d0
mov dword [esi + 4], eax
add esp, 0xc
mov byte [eax], 0
mov ebp, dword [esp + 0x30]
lea edx, [esp + 0x30]
lea edi, [esi + 0xc]
push edx
mov ecx, ebp
mov dword [esp + 0x24], 1
mov dword [esp + 0x18], edi
call fcn.00424d90
push 0
push eax
lea ecx, [edi + 8]
mov byte [esp + 0x28], 2
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00446b10
mov al, byte [esp + 0x2c]
mov edx, dword [ebp + 4]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2c], al
mov eax, dword [ebp]
push ecx
push edx
push eax
mov ecx, edi
mov byte [esp + 0x2c], 4
call fcn.00402130
mov ecx, dword [ebp + 0xc]
mov eax, esi
mov dword [edi + 0xc], ecx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x407f80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b4aac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x148]
mov esi, ecx
lea eax, [esp + 0x12]
mov ecx, edi
push eax
mov dword [esp + 0x20], esi
call fcn.00424d90
xor ecx, ecx
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov ebp, dword [edi + 4]
mov eax, dword [edi]
mov dword [esp + 0x14], ebp
sub ebp, eax
mov dword [esp + 0x140], ecx
mov dword [esp + 0x18], eax
lea ebx, [ebp + 1]
cmp ebx, 0xffffffff
ja 0x408052
cmp ebx, ecx
jbe 0x408052
push ebx
call fcn.00489cc9
mov edx, dword [esp + 0x18]
lea ecx, [eax + ebx]
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x1c]
add esp, 4
cmp edx, ecx
mov dword [esi], eax
mov dword [esi + 4], eax
je 0x408011
push ebp
push ecx
push eax
call fcn.0048a210
add esp, 0xc
add eax, ebp
mov dword [esi + 4], eax
mov byte [eax], 0
mov edx, dword [edi + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0x18]
mov ecx, dword [esp + 0x138]
mov dword [esi + 0x18], edx
mov eax, dword [edi + 0x1c]
pop edi
mov dword [esi + 0x1c], eax
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x134
ret 4
lea ecx, [esp + 0x13]
mov byte [esp + 0x140], 1
push ecx
lea ecx, [esp + 0x24]
call fcn.00441c50
mov edi, 0x4e5270
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x140], 2
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, 0x4e5270
push ecx
push 0x4e5270
lea ecx, [esp + 0x28]
call fcn.00404480
lea edx, [esp + 0x20]
lea ecx, [esp + 0x2c]
push edx
mov byte [esp + 0x144], 3
call fcn.004077f0
lea eax, [esp + 0x2c]
push 0x4ce488
push eax
call fcn.0048a1cf
nop
nop
nop
nop
nop
nop
nop
Function at 0x4080c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b4b38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push esi
push edi
lea eax, [esp + 0xb]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x64], 0
call fcn.00441c50
mov edi, 0x4e5844
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [esp + 0x6c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0xa]
add ecx, 0x4e5844
push eax
push ecx
push 0x4e5844
lea ecx, [esp + 0x18]
mov byte [esp + 0x6c], 1
mov byte [esp + 0x16], dl
call fcn.00402130
mov esi, dword [esp + 0x6c]
lea ecx, [esp + 0xc]
push 0
push ecx
mov ecx, esi
mov byte [esp + 0x68], 2
call fcn.004268e0
mov dword [esp + 0x40], eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x60], 3
call fcn.00421180
lea edx, [esp + 0xb]
lea ecx, [esp + 0xc]
push edx
mov dword [esp + 0x64], 4
call fcn.00441c50
mov edi, 0x4e584c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x6c]
repne scasb al, byte es:[edi]
mov al, byte [esp + 0x6c]
push edx
not ecx
dec ecx
mov byte [esp + 0x64], 5
add ecx, 0x4e584c
mov byte [esp + 0x70], al
push ecx
push 0x4e584c
lea ecx, [esp + 0x18]
call fcn.00402130
lea eax, [esp + 0xc]
push 0
push eax
mov ecx, esi
mov byte [esp + 0x68], 6
call fcn.004268e0
mov dword [esp + 0x44], eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x60], 7
call fcn.00421180
lea ecx, [esp + 0xb]
mov dword [esp + 0x60], 8
push ecx
lea ecx, [esp + 0x1c]
call fcn.00441c50
mov byte [esp + 0x60], 9
mov edi, 0x4f01b0
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [esp + 0x6c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x6c]
add ecx, 0x4f01b0
push eax
push ecx
push 0x4f01b0
lea ecx, [esp + 0x24]
mov byte [esp + 0x78], dl
call fcn.00402130
lea ecx, [esp + 0xa]
mov byte [esp + 0x60], 0xb
push ecx
lea ecx, [esp + 0x10]
call fcn.00441c50
mov edi, 0x4e5858
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [esp + 0x6c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x6c]
add ecx, 0x4e5858
push eax
push ecx
push 0x4e5858
lea ecx, [esp + 0x18]
mov byte [esp + 0x6c], 0xc
mov byte [esp + 0x78], dl
call fcn.00402130
lea ecx, [esp + 0x18]
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0x28]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x6c], 0xd
call fcn.004265c0
lea ecx, [esp + 0x30]
push eax
push ecx
mov byte [esp + 0x68], 0xe
call fcn.00428e50
mov edx, dword [eax]
add esp, 8
mov dword [esp + 0x48], edx
mov byte [esp + 0x60], 0xd
mov ecx, dword [eax + 4]
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x24]
mov edx, dword [eax + 8]
mov dword [esp + 0x50], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x54], eax
call fcn.00421180
lea ecx, [esp + 0xc]
mov byte [esp + 0x60], 0xb
call fcn.00421180
lea ecx, [esp + 0x18]
mov byte [esp + 0x60], 8
call fcn.00421180
mov eax, dword [esp + 0x68]
mov ecx, 6
lea esi, [esp + 0x40]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x58]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x5c
ret