joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65229ad0
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [esp + 0xc]
imul ebp, ecx, 0x1000193
mov ecx, edi
push ebp
push ebx
push eax
call fcn.652294b0
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x65229b37
mov eax, dword [esp + 0x18]
pop edi
pop ebp
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
add esp, 8
ret 8
cmp dword [edi + 0xc], 0x15555555
je 0x65229c75
mov ecx, dword [edi + 4]
push esi
push 4
push 0xc
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebx]
mov esi, eax
mov dword [esi + 8], ecx
mov ecx, dword [edi + 0xc]
mov ebx, dword [edi + 0x24]
inc ecx
mov eax, ebx
movss xmm3, dword [edi]
shr eax, 0x1f
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x652b8c90]
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x652b8c90]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x65229c0f
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
fstp qword [esp]
call fcn.652afdef
fstp qword [esp + 0x18]
movsd xmm0, qword [esp + 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.652ae9d0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x65229bf2
cmp ebx, 0x200
jae 0x65229bf0
shl ebx, 3
cmp ebx, ecx
jae 0x65229bf2
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.6522b940
push ebp
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.652294b0
mov edx, dword [eax]
jmp 0x65229c13
mov edx, dword [esp + 0x10]
mov eax, dword [edi + 0xc]
mov ebx, dword [edx + 4]
inc eax
mov dword [edi + 0xc], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x14]
and eax, ebp
mov ebp, dword [ecx + eax*8]
cmp ebp, dword [edi + 8]
jne 0x65229c3c
mov dword [ecx + eax*8], esi
jmp 0x65229c5d
cmp ebp, edx
jne 0x65229c57
mov dword [ecx + eax*8], esi
mov eax, dword [esp + 0x1c]
mov dword [eax], esi
pop esi
pop edi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 8
ret 8
cmp dword [ecx + eax*8 + 4], ebx
jne 0x65229c61
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [esp + 0x1c]
mov dword [eax], esi
pop esi
pop edi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 8
ret 8
push str.unordered_map_set_too_long
call fcn.652ae2e8
int3
Function at 0x6522b940
Capabilities:
Hash data using fnv

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push edi
mov edi, 1
mov dword [esp + 8], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x6522ba8d
lea eax, [edx - 1]
or eax, edi
bsr ecx, eax
push esi
mov esi, dword [ebx + 8]
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0x10]
lea eax, [edi + edi]
push eax
call fcn.6522b8b0
lea eax, [edi - 1]
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x20], eax
mov ecx, dword [ebx + 8]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x6522ba6a
push ebp
nop dword [eax]
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x20]
and edi, eax
mov eax, dword [ebx + 0x14]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [esp + 0x18], eax
cmp ebx, esi
jne 0x6522b9f2
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x6522ba5b
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x6522ba25
mov eax, dword [eax]
cmp eax, ecx
je 0x6522ba1c
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov eax, dword [esp + 0x18]
mov dword [eax + 4], ecx
jmp 0x6522ba5b
cmp ebx, eax
je 0x6522ba3c
nop dword [eax]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x6522ba71
cmp ebx, eax
jne 0x6522ba30
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [esp + 0x18]
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [esp + 0x10]
mov ecx, edx
cmp edx, esi
jne 0x6522b9a0
pop ebp
pop esi
pop edi
pop ebx
pop ecx
ret 4
mov ebx, dword [ecx + 4]
mov ebp, dword [eax]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x6522ba5b
push str.invalid_hash_bucket_count
call fcn.652ae2e8
int3
Function at 0x6523fa40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov esi, dword [ebp + 4]
mov dword [esp + 0x14], ebp
cmp dword [esi + 0x78], 0
jne 0x6523fa69
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x20]
push eax
call dword [0x652b3d48]
mov ecx, dword [esi + 0x78]
lea eax, [esp + 0x14]
add esp, 4
push eax
call sym.Qt5Widgets.dll_public:_class_QList_class_QGraphicsView_____thiscall_QGraphicsScene::views_void_
mov eax, dword [esp + 0x10]
mov esi, dword [eax + 8]
mov edi, dword [eax + 0xc]
add esi, 4
add edi, 4
lea esi, [eax + esi*4]
lea edi, [eax + edi*4]
cmp esi, edi
je 0x6523fb6b
mov eax, dword [ebp]
mov ebx, dword [esi]
mov ecx, ebx
mov eax, dword [eax + 0x10]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
call sym.Qt5Widgets.dll_public:_class_QPoint___thiscall_QWidget::mapFromGlobal_class_QPoint_const__
push eax
lea eax, [esp + 0x44]
mov ecx, ebx
push eax
call sym.Qt5Widgets.dll_public:_class_QPointF___thiscall_QGraphicsView::mapToScene_class_QPoint_const__
mov ebp, eax
mov eax, dword [esp + 0x14]
mov ebx, dword [eax + 4]
lea eax, [esp + 0x18]
push eax
mov ecx, dword [ebx + 0x118]
mov dword [esp + 0x1c], ecx
mov ecx, ebx
call sym.Qt5Widgets.dll_public:_void___thiscall_QGraphicsItemPrivate::ensureSceneTransformRecursive_class_QGraphicsItem___
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 4]
mov ecx, dword [ebx + 0x10c]
shr ecx, 0x1e
test cl, 1
je 0x6523fb28
movsd xmm1, qword [ebp + 8]
movsd xmm0, qword [ebp]
subsd xmm1, qword [eax + 0xb8]
subsd xmm0, qword [eax + 0xb0]
movsd qword [esp + 0x30], xmm1
movsd qword [esp + 0x28], xmm0
jmp 0x6523fb49
lea ecx, [eax + 0x90]
push 0
lea eax, [esp + 0x54]
push eax
call dword [0x652b3a94]
push ebp
lea ecx, [esp + 0x2c]
push ecx
mov ecx, eax
call dword [0x652b2b30]
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
mov ecx, ebp
call dword [esp + 0x20]
test al, al
jne 0x6523fba1
add esi, 4
cmp esi, edi
jne 0x6523faa2
mov eax, dword [esp + 0x10]
xor bl, bl
mov eax, dword [eax]
test eax, eax
je 0x6523fb8a
cmp eax, 0xffffffff
je 0x6523fb97
mov eax, dword [esp + 0x10]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x6523fb97
push dword [esp + 0x10]
call dword [0x652b23cc]
add esp, 4
pop edi
mov al, bl
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
mov bl, 1
jmp 0x6523fb6d
Function at 0x418870
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push dword [ebp + 8]
call sub.msvcrt.dll_getenv
add esp, 0x10
mov edx, eax
mov byte [ebp - 0x104], 0
test eax, eax
je 0x4188a5
lea eax, [ebp - 0x104]
push ecx
push 0x104
push eax
push edx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
pop eax
xor eax, eax
cmp byte [ebp - 0x104], 0
je 0x4188c3
sub esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [fcn.0041e014]
add esp, 0x10
leave
ret

Function at 0x41c078
Capabilities:
Set socket configuration

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0xc], 0
setne al
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x8004667e
push dword [ebp + 8]
call sub.WS2_32.DLL_ioctlsocket
leave
ret
Function at 0x41c998
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push ebx
call sub.ADVAPI32.DLL_CryptAcquireContextA
add esp, 0xc
test eax, eax
je 0x41c9d4
sub esp, 0xc
lea eax, [ebx + 4]
push eax
push 0
push 0
push 0x8003
push dword [ebx]
call sub.ADVAPI32.DLL_CryptCreateHash
add esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x403450
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x51f584]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
cmp dword [ecx + 0x50], 0x10
lea ebx, [ecx + 0x3c]
push esi
push edi
mov edi, edx
mov dword [ebp - 0x24], eax
mov dword [ebx + 0x10], eax
jb 0x40347a
mov eax, dword [ebx]
jmp 0x40347c
mov eax, ebx
mov byte [eax], 0
call fcn.0044daf0
mov esi, eax
test esi, esi
jne 0x4034a0
mov eax, 0x13ab
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004822c9
mov esp, ebp
pop ebp
ret
mov ecx, edi
lea edi, [ebp - 0x20]
call fcn.00402fb0
push 1
push 0x34
push esi
call fcn.0044db30
add esp, 0xc
push 5
push 0x4e
push esi
call fcn.0044db30
add esp, 0xc
push 1
push 0x13
push esi
call fcn.0044db30
add esp, 0xc
push 0x12c
push 0x14
push esi
call fcn.0044db30
mov eax, dword [ebp - 0x20]
mov edi, 0x10
add esp, 0xc
cmp dword [ebp - 0xc], edi
jae 0x4034f1
lea eax, [ebp - 0x20]
push eax
push 0x2712
push esi
call fcn.0044db30
add esp, 0xc
push 0x4035b0
push 0x4e2b
push esi
call fcn.0044db30
add esp, 0xc
push ebx
push 0x2711
push esi
call fcn.0044db30
add esp, 0xc
push 1
push 0x63
push esi
call fcn.0044db30
add esp, 0xc
push esi
call fcn.0044db60
add esp, 4
test eax, eax
je 0x403545
mov dword [ebp - 0x24], 0x13ab
jmp 0x403579
lea eax, [ebp - 0x28]
push eax
push 0x200002
push esi
call fcn.0044dcc0
add esp, 0xc
test eax, eax
mov eax, dword [ebp - 0x28]
jne 0x403565
cmp eax, 0xc8
je 0x403579
sub eax, 0x194
neg eax
sbb eax, eax
and eax, 0xfffffff2
add eax, 0x13b9
mov dword [ebp - 0x24], eax
push esi
call fcn.0044dc60
add esp, 4
cmp dword [ebp - 0xc], edi
jb 0x403593
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00482674
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004822c9
mov esp, ebp
pop ebp
ret
Function at 0x403680
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
test edi, edi
je 0x4038b0
test ebx, ebx
je 0x4038b0
mov eax, dword [0x527160]
push esi
push 0x1c
push 0
push eax
call dword [0x4fa2d8]
mov esi, eax
test esi, esi
jne 0x4036c9
push str._BugReport__pMemInfo_HeapAlloc_Failed__n
call dword [0x4fa2b4]
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push 0x1c
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
push esi
mov dword [esi + 0x14], eax
push edi
mov dword [esi + 0x18], eax
call dword [0x4fa2dc]
test eax, eax
jne 0x403704
push str._BugReport__VirtualQuery_Failed__n
call dword [0x4fa2b4]
mov dword [ebp - 4], 0
jmp 0x403820
xor edi, edi
cmp dword [esi + 4], edi
jne 0x40371e
push str._BugReport__Error__AllocationBaseNULL___n
call dword [0x4fa2b4]
mov dword [ebp - 4], edi
jmp 0x403820
mov ecx, dword [esi + 4]
mov dword [ebx + 0x104], ecx
mov ecx, dword [esi + 4]
mov edx, 0x5a4d
cmp word [ecx], dx
je 0x403747
push str._BugReport__Error__IMAGE_DOS_SIGNATURE___n
call dword [0x4fa2b4]
mov dword [ebp - 4], edi
jmp 0x403820
mov eax, dword [ecx + 0x3c]
add eax, ecx
je 0x40389d
cmp dword [eax], 0x4550
jne 0x40389d
mov ecx, dword [eax + 8]
mov dword [ebx + 0x108], ecx
mov ecx, dword [esi + 0x18]
cmp ecx, 0x20000
je 0x403854
cmp ecx, 0x40000
je 0x403854
cmp ecx, 0x1000000
je 0x4037a4
push str._BugReport__unknown_memory_type__n
call dword [0x4fa2b4]
mov dword [ebx + 0x10c], 0xffffffff
mov dword [ebp - 4], edi
jmp 0x403820
mov edx, dword [0x527160]
push 0x104
push edi
push edx
mov dword [ebx + 0x10c], edi
call dword [0x4fa2d8]
mov edi, eax
test edi, edi
jne 0x4037d3
push str._BugReport__pModulePath_HeapAlloc_Failed__n
call dword [0x4fa2b4]
mov dword [ebp - 4], edi
jmp 0x403820
push 0x104
push 0
push edi
call fcn.004868c0
mov eax, dword [ebp + 8]
add esp, 0xc
push 0x104
push edi
push eax
call dword [0x4fa2d4]
push eax
call dword [0x4fa37c]
test eax, eax
jne 0x403838
push str._BugReport__GetMappedFileName_Failed__n
call dword [0x4fa2b4]
mov dword [ebp - 4], 0
mov edx, dword [0x527160]
push edi
push 0
push edx
call dword [0x4fa2d0]
mov eax, dword [0x527160]
push esi
push 0
push eax
call dword [0x4fa2d0]
mov eax, dword [ebp - 4]
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push edi
call dword [0x4fa398]
push eax
push 0x40
push ebx
call fcn.004830e6
add esp, 0xc
mov dword [ebp - 4], 1
jmp 0x403810
mov dword [ebx + 0x10c], 1
mov ecx, dword [eax + 0x78]
cmp ecx, edi
je 0x40388d
cmp dword [eax + 0x7c], edi
je 0x40388d
mov eax, dword [esi + 4]
add ecx, eax
cmp ecx, edi
je 0x403820
mov ecx, dword [ecx + 0xc]
add ecx, eax
push ecx
push 0x40
push ebx
call fcn.004830e6
add esp, 0xc
mov dword [ebp - 4], 1
jmp 0x403820
push str._BugReport__Error__Module_No_Export___n
call dword [0x4fa2b4]
mov dword [ebp - 4], edi
jmp 0x403820
push str._BugReport__Error__IMAGE_NT_SIGNATURE___n
call dword [0x4fa2b4]
mov dword [ebp - 4], edi
jmp 0x403820
push str._BugReport___ERROR_INVALID_PARAMETER___n
call dword [0x4fa2b4]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x408730
Capabilities:
Parse pe header

Disassembly:
test eax, eax
je 0x408749
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408749
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
je 0x40874c
xor eax, eax
ret
add eax, 0x18
ret
Function at 0x40ed50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
je 0x40ed73
push edi
movzx edi, byte [edx]
mov eax, dword [esi]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x50ca80]
inc edx
dec ecx
mov dword [esi], eax
jne 0x40ed55
pop edi
ret
Function at 0x412f40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eaac8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51f584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ebx + 8]
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
lea ecx, [esi + 4]
mov dword [esi], vtable.tpsp::TASKITEM.0
call fcn.004be630
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x38], edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413f50
Capabilities:
Hash data with md5
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
mov eax, dword [0x51f584]
xor eax, esp
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov dword [esp + 0x10], eax
jb 0x413f80
mov eax, dword [eax]
push 0x50ec30
push eax
call fcn.00484408
add esp, 8
test eax, eax
je 0x413fb7
push 0xc8
call dword [0x4fa294]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.004822c9
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x527168]
movzx eax, si
push edi
push eax
push ecx
mov dword [esp + 0x20], 0
call dword [0x4fa0fc]
mov esi, eax
test esi, esi
je 0x41410b
mov edx, dword [0x527168]
push esi
push edx
call dword [0x4fa104]
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x41410b
mov eax, dword [0x527168]
push esi
push eax
call dword [0x4fa114]
push ebx
mov edi, eax
call dword [0x4fa130]
mov ebx, eax
test ebx, ebx
je 0x414100
mov ecx, dword [esp + 0x10]
push 0x50e55c
call fcn.00402a40
push eax
call fcn.00484408
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
je 0x414100
push edi
mov dword [esp + 0x18], 1
call fcn.00483145
add esp, 4
push edi
mov esi, eax
push ebx
push esi
mov dword [esp + 0x24], esi
call fcn.00486940
add esp, 0xc
push edi
mov ecx, esi
call fcn.004110b0
xor eax, eax
mov dword [esp + 0x79], eax
mov dword [esp + 0x7d], eax
mov dword [esp + 0x81], eax
mov dword [esp + 0x85], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], eax
push esi
mov eax, edi
lea ecx, [esp + 0x24]
mov byte [esp + 0x7c], 0
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
call fcn.00423480
add esp, 4
lea esi, [esp + 0x20]
lea ebx, [esp + 0x78]
call fcn.00423540
call fcn.004249f0
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
push ecx
push edi
push 1
push ebx
call fcn.004845ce
push ebx
mov esi, eax
call fcn.00483528
add esp, 0x14
cmp esi, edi
je 0x4140f3
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x10]
push edx
call fcn.004848f9
add esp, 4
mov eax, dword [esp + 0x1c]
push eax
call dword [0x4fa100]
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004822c9
mov esp, ebp
pop ebp
ret
Function at 0x418df0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f09cb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51f584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x4fa294]
mov esi, 3
push 0x68
call fcn.004826d0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x418e44
mov ecx, dword [ebp + 0x10]
push ecx
push eax
call fcn.00432800
jmp 0x418e46
xor eax, eax
test eax, eax
setne cl
mov dword [ebp - 4], 0xffffffff
test cl, cl
jne 0x418e75
push 0x64
call edi
mov edx, esi
dec esi
test edx, edx
jne 0x418e20
lea eax, [edx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push eax
call fcn.00444c70
push 0
push 0
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call fcn.0048518e
mov esi, eax
mov eax, dword [ebp + 0xc]
add esp, 0x18
test eax, eax
jne 0x418ece
test esi, esi
je 0x418eb7
push esi
call dword [0x4fa274]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [0x4fa288]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push eax
push esi
call dword [0x4fa108]
test eax, eax
jne 0x418f03
lea ecx, [ebp - 0x10]
push ecx
push esi
mov dword [ebp - 0x10], eax
call dword [0x4fa12c]
push esi
call dword [0x4fa274]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [0x4fa274]
mov eax, 0x5b4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x419770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f09cb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51f584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x30
call fcn.004826d0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4197bb
mov ecx, dword [ebp + 8]
push ecx
push eax
call fcn.00438c30
mov edi, eax
jmp 0x4197bd
xor edi, edi
push edi
mov dword [ebp - 4], 0xffffffff
call fcn.00444c70
push 0
push 0
push eax
push 0x417ab0
push 0
push 0
call fcn.0048518e
mov edi, dword [edi + 0x20]
add esp, 0x18
mov esi, eax
test edi, edi
jne 0x419822
test esi, esi
je 0x419809
push esi
call dword [0x4fa274]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call dword [0x4fa288]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
push esi
call dword [0x4fa108]
test eax, eax
jne 0x419859
lea edx, [ebp + 8]
push edx
push esi
mov dword [ebp + 8], eax
call dword [0x4fa12c]
push esi
call dword [0x4fa274]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push esi
call dword [0x4fa274]
mov eax, 0x5b4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x419880
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f09cb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51f584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x30
call fcn.004826d0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4198cb
mov ecx, dword [ebp + 8]
push ecx
push eax
call fcn.00439d20
mov esi, eax
jmp 0x4198cd
xor esi, esi
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.00444c70
push 0
push 0
push eax
push 0x418640
push 0
push 0
call fcn.0048518e
mov edi, eax
mov eax, dword [esi + 0x18]
add esp, 0x18
push eax
push edi
call dword [0x4fa108]
cmp dword [esi + 0x18], 0
jne 0x41993c
test edi, edi
je 0x419923
push edi
call dword [0x4fa274]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call dword [0x4fa288]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
test eax, eax
jne 0x41996b
lea edx, [ebp + 8]
push edx
push edi
mov dword [ebp + 8], eax
call dword [0x4fa12c]
push edi
call dword [0x4fa274]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
call dword [0x4fa274]
mov eax, 0x5b4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x419990
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f114e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x51f584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x28
call fcn.004826d0
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x419a15
mov byte [ebp - 4], 1
lea ecx, [esi + 4]
mov dword [esi], vtable.tpsp::OPDELETE.0
call fcn.004be630
mov edx, dword [ebp + 8]
mov byte [ebp - 4], 2
mov eax, 0x5206e0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, dword [0x5272e4]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0x3e8
mov dword [esi + 0x18], eax
mov byte [esi + 0x1c], bl
mov ecx, esi
mov dword [esi + 0x24], ebx
call fcn.0043d000
jmp 0x419a17
xor esi, esi
push ebx
push ebx
push esi
push 0x4188f0
push ebx
push ebx
call fcn.0048518e
add esp, 0x18
cmp eax, ebx
je 0x419a49
push eax
call dword [0x4fa274]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [0x4fa288]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4