joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4767e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.00409da0
push eax
mov ecx, edi
call fcn.00409d90
push eax
mov ecx, esi
call fcn.00476620
mov eax, dword [ebp + 0xc]
push eax
mov ecx, esi
call fcn.00476710
pop edi
pop esi
pop ebp
ret 8

Function at 0x476840
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
mov ecx, esi
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.00476620
mov edx, dword [ebp + 0x10]
push edx
mov ecx, esi
call fcn.00476710
pop esi
pop ebp
ret 0xc

Function at 0x476890
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
cmp dword [edi + 0x804], ebx
jbe 0x4768f0
add edi, 4
lea ebx, [ebx]
mov eax, dword [edi + 0x400]
mov ecx, dword [edi]
push eax
push ecx
mov ecx, esi
call fcn.00476620
mov edx, dword [ebp + 8]
inc ebx
add edi, 4
cmp ebx, dword [edx + 0x804]
jb 0x4768d0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, esi
call fcn.00476710
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x476910
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.004033b0
push eax
mov ecx, edi
call fcn.0040fbb0
push eax
mov ecx, esi
call fcn.00476620
mov eax, dword [ebp + 0xc]
push eax
mov ecx, esi
call fcn.00476710
pop edi
pop esi
pop ebp
ret 8

Function at 0x4769a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 8], 0x6119a407
je 0x4769c0
push 0
call fcn.0040a460
add esp, 4
xor eax, eax
pop esi
pop ebp
ret 4
mov ecx, dword [ebp + 8]
call fcn.00409d90
mov edx, eax
movsx ecx, byte [edx]
mov eax, 0x1505
test ecx, ecx
je 0x4769e9
push edi
mov edi, eax
shl edi, 5
inc edx
add edi, ecx
movsx ecx, byte [edx]
add eax, edi
test ecx, ecx
jne 0x4769d7
pop edi
xor edx, edx
div dword [esi + 0xc]
pop esi
mov eax, edx
pop ebp
ret 4
Function at 0x488a00
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x739218
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
jl 0x488a69
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x488a69
mov eax, dword [ebp + 0x14]
push str.getEntropy
push eax
lea ecx, [ebp - 0x18]
call fcn.00474ef0
mov dword [ebp - 4], 0
xor bl, bl
call fcn.004216f0
mov esi, eax
test esi, esi
jne 0x488a7d
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.00474f80
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push edi
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x488a8f
mov bl, 1
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.00474f80
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d540
Capabilities:
Hash data using crc32b

Disassembly:
cmp byte [0x8a0678], 0
push edi
jne 0x48d6dd
mov al, byte [0x8a0679]
push esi
test al, al
jne 0x48d6b3
cmp dword [0x8a067c], 0
jne 0x48d6dc
push 0x100
mov byte [0x8a0679], 1
call fcn.004090a0
mov edi, eax
add esp, 4
test edi, edi
je 0x48d6dc
xor esi, esi
push ebx
lea ebx, [ebx]
push 8
push esi
call fcn.0048d280
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
add esp, 8
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x4c11db7
add ecx, ecx
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x4c11db7
add ecx, ecx
xor eax, ecx
mov edx, eax
and edx, 0x80000000
neg edx
sbb edx, edx
add eax, eax
and edx, 0x4c11db7
xor edx, eax
mov dword [edi + esi*4], edx
mov eax, edx
xor edx, edx
lea ecx, [edx + 0x1f]
test al, 1
je 0x48d660
mov ebx, 1
shl ebx, cl
or edx, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x48d653
mov dword [edi + esi*4], edx
inc esi
cmp esi, 0xff
jbe 0x48d590
cmp dword [0x8a067c], 0
pop ebx
jne 0x48d699
pop esi
mov dword [0x8a067c], edi
mov byte [0x8a0678], 1
mov byte [0x8a0679], 0
pop edi
ret
push edi
call fcn.005c4733
add esp, 4
pop esi
mov byte [0x8a0678], 1
mov byte [0x8a0679], 0
pop edi
ret
xor esi, esi
test al, al
je 0x48d6dc
lea esp, [esp]
push 2
call fcn.004213c0
inc esi
add esp, 4
cmp esi, 0xc8
ja 0x48d6dc
cmp byte [0x8a0679], 0
jne 0x48d6c0
pop esi
pop edi
ret
Function at 0x48d700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x408], eax
test edi, edi
jne 0x48d73a
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret
push esi
call fcn.0048d540
or esi, 0xffffffff
cmp dword [ebp - 0x408], 0
jne 0x48d76d
mov eax, dword [0x8a067c]
movzx edx, byte [ebx]
mov ecx, esi
and ecx, 0xff
xor ecx, edx
shr esi, 8
xor esi, dword [eax + ecx*4]
inc ebx
dec edi
jne 0x48d751
jmp 0x48d872
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0070dc20
mov ecx, dword [0x8a067c]
add esp, 0xc
lea esp, [esp]
movzx eax, byte [ebx]
inc dword [ebp + eax*4 - 0x404]
mov edx, esi
and edx, 0xff
xor edx, eax
shr esi, 8
xor esi, dword [ecx + edx*4]
inc ebx
dec edi
jne 0x48d790
mov ecx, dword [ebp - 0x404]
add ecx, dword [ebp - 0x400]
xor ebx, ebx
add ecx, dword [ebp - 0x3fc]
mov eax, 7
add ecx, dword [ebp - 0x3f8]
add ecx, dword [ebp - 0x3f4]
add ecx, dword [ebp - 0x3f0]
add ecx, dword [ebp - 0x3ec]
xor edx, edx
add edx, dword [ebp + eax*4 - 0x404]
add edi, dword [ebp + eax*4 - 0x400]
add eax, 2
cmp eax, 0x7f
jl 0x48d7e1
cmp eax, 0x80
jge 0x48d806
mov ebx, dword [ebp + eax*4 - 0x404]
inc eax
add edi, edx
add ebx, edi
xor edx, edx
xor edi, edi
mov dword [ebp - 0x40c], ebx
cmp eax, 0x100
jge 0x48d860
mov ebx, 0x100
sub ebx, eax
cmp ebx, 2
jl 0x48d848
jmp 0x48d830
add edx, dword [ebp + eax*4 - 0x404]
add edi, dword [ebp + eax*4 - 0x400]
add eax, 2
cmp eax, 0xff
jl 0x48d830
cmp eax, 0x100
jge 0x48d856
add ecx, dword [ebp + eax*4 - 0x404]
mov ebx, dword [ebp - 0x40c]
add edi, edx
add ecx, edi
mov eax, dword [ebp - 0x408]
shr ebx, 2
cmp ebx, ecx
sbb edx, edx
neg edx
mov word [eax], dx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop edi
xor ecx, ebp
not eax
pop ebx
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret
Function at 0x490b70
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov ecx, dword [0x869e50]
push esi
movzx esi, byte [ecx + 3]
shl esi, 8
push edi
movzx edi, byte [ecx + 2]
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
mov dword [edx], esi
movzx esi, byte [ecx + 7]
movzx edi, byte [ecx + 6]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 5]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 4]
shl esi, 8
or esi, edi
mov dword [edx + 4], esi
movzx esi, byte [ecx + 0xb]
movzx edi, byte [ecx + 0xa]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 9]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 8]
shl esi, 8
or esi, edi
mov dword [edx + 8], esi
movzx esi, byte [ecx + 0xf]
movzx edi, byte [ecx + 0xe]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 0xd]
movzx ecx, byte [ecx + 0xc]
shl esi, 8
or esi, edi
shl esi, 8
or esi, ecx
mov dword [edx + 0xc], esi
movzx ecx, byte [eax + 3]
movzx esi, byte [eax + 2]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 1]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x10], ecx
movzx ecx, byte [eax + 7]
movzx esi, byte [eax + 6]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 5]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 4]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x14], ecx
movzx ecx, byte [eax + 0xb]
movzx esi, byte [eax + 0xa]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 9]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 8]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x18], ecx
movzx ecx, byte [eax + 0xf]
movzx esi, byte [eax + 0xe]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0xd]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0xc]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x1c], ecx
movzx ecx, byte [eax + 0x13]
movzx esi, byte [eax + 0x12]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0x11]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0x10]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x20], ecx
movzx ecx, byte [eax + 0x17]
movzx esi, byte [eax + 0x16]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0x15]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0x14]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x24], ecx
movzx ecx, byte [eax + 0x1b]
movzx esi, byte [eax + 0x1a]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0x19]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0x18]
shl ecx, 8
or ecx, esi
mov dword [edx + 0x28], ecx
movzx ecx, byte [eax + 0x1f]
movzx esi, byte [eax + 0x1e]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 0x1d]
movzx eax, byte [eax + 0x1c]
shl ecx, 8
or ecx, esi
shl ecx, 8
or ecx, eax
pop edi
mov dword [edx + 0x2c], ecx
mov dword [edx + 0x40], 0x40
pop esi
ret
Function at 0x49ef10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7391e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
movzx eax, byte [esi + 0x24]
mov edi, dword [ebp + 0x14]
push eax
push str.readExpectedMessage
push edi
lea ecx, [ebp - 0x1c]
call fcn.00474f30
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [esi + 0x24], bl
je 0x49ef71
cmp dword [esi + 0x28], ebx
jne 0x49ef71
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.No_m_pHandler.
mov ecx, edi
call eax
mov dword [esi + 0x34], ebx
cmp dword [esi + 4], ebx
jne 0x49ef81
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 4], eax
mov ebx, dword [ebp + 0x10]
cmp dword [esi + 0x10], 0
je 0x49efab
cmp dword [esi + 4], 0
jne 0x49ef98
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 4], eax
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esi + 4]
cmp eax, ecx
jbe 0x49efab
sub eax, ecx
cmp eax, dword [esi + 0x10]
ja 0x49eff5
mov ecx, dword [ebp - 0x10]
push edi
push ebx
push esi
call fcn.0049e990
test al, al
je 0x49f027
mov ecx, ebx
call fcn.004a7160
test al, al
jne 0x49f027
cmp byte [ebp + 0xc], al
je 0x49efd0
cmp dword [esi + 0x34], 0x5d
je 0x49ef84
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.00474f80
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, ebx
call fcn.004a71c0
mov byte [ebx + 0x10], 1
cmp byte [edi + 0xad], 0
je 0x49f027
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.Too_much_time_elapsed_waiting_for_response.
mov ecx, edi
call eax
mov ecx, dword [esi + 0x10]
push ecx
push str.totalTimeoutMs
mov ecx, edi
call fcn.00474a80
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.00474f80
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a0c40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x741b80
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push ebx
push esi
push edi
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0x14]
push str.readUntilRcvWindowAdjust
push esi
lea ecx, [ebp - 0x1c]
call fcn.00474ef0
xor ebx, ebx
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0xb0], ebx
jne 0x4a0d82
mov edi, dword [ebp + 0x10]
jmp 0x4a0ca0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x78], vtable.SshReadParams.0
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x70], 1
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], 0xea60
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov word [ebp - 0x48], bx
mov dword [ebp - 0x44], ebx
call fcn.0040fe80
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x10]
mov ecx, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x6c], ebx
call fcn.004a71c0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push esi
push edi
push eax
call fcn.0049e990
mov ecx, dword [edi + 4]
cmp ecx, ebx
je 0x4a0d27
push esi
call fcn.00487de0
test al, al
jne 0x4a0da7
mov ecx, edi
call fcn.004a7130
test al, al
jne 0x4a0df2
cmp byte [ebp - 0x49], bl
jne 0x4a0e01
cmp byte [ebp - 0x4b], bl
jne 0x4a0e08
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp + 0x14]
cmp eax, 0xea60
ja 0x4a0e0f
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
mov dword [ebp - 0x78], vtable.SshReadParams.0
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
call fcn.004105c0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xb0], ebx
je 0x4a0ca0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.00474f80
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.aborted_by_user_application.
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
mov dword [ebp - 0x78], vtable.SshReadParams.0
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
call fcn.004105c0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.00474f80
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
push str.sshWindowAdjust1
mov ecx, edi
call fcn.004a7220
jmp 0x4a0db5
push str.Received_DISCONNECT
jmp 0x4a0dac
push str.Received_CHANNEL_CLOSE
jmp 0x4a0dac
mov ecx, dword [ebp - 0x10]
push esi
push edi
call fcn.00497240
push str.No_WINDOW_ADJUST_seems_to_be_coming...
jmp 0x4a0dac
Function at 0x4a3a90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7385c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0046e410
xor eax, eax
lea ecx, [esi + 0x40]
mov dword [ebp - 4], eax
mov dword [esi], vtable.SFtpFileAttr.0
mov dword [esi + 8], eax
mov word [esi + 0xc], ax
mov byte [esi + 0xe], al
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
call fcn.0046e5c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a4ec0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7420b3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x48
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
call fcn.005c46fb
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x4a4f62
mov ecx, esi
call fcn.0046e410
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 2
mov dword [esi], vtable.SFtpFileAttr.0
mov dword [esi + 8], ebx
mov word [esi + 0xc], bx
mov byte [esi + 0xe], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
call fcn.0046e5c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b3b00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x743463
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004b3570
xor ebx, ebx
lea ecx, [esi + 0x10]
mov dword [ebp - 4], ebx
call fcn.0046f550
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov dword [esi], vtable.AsyncProgressEvent.1.0
mov dword [esi + 0x10], vtable.AsyncProgressEvent.0
call fcn.0042a1e0
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x50], bl
mov dword [esi + 0x54], ebx
mov byte [esi + 0x48], 1
mov byte [esi + 0xc], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dd8c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x74677b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x40
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
call fcn.005c46fb
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x4dd950
mov ecx, esi
call fcn.0046e2e0
mov dword [esi], vtable.TreeNode.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov word [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 0xce
mov byte [esi + 0x10], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e1640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x746b21
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
lea ecx, [esi + 0x10]
mov dword [esi], vtable._ckSymSettings.0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], 0x100
call fcn.0040fe80
lea ecx, [esi + 0x30]
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
call fcn.0040fe80
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.0040fe80
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 2
call fcn.0040fe80
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], 0x80
mov byte [esi + 0x8c], bl
mov byte [esi + 0x28], 1
mov byte [esi + 0x48], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e58d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x746d70
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
test edi, edi
je 0x4e5ad3
mov ebx, dword [ebp + 0xc]
lea eax, [ebx - 1]
cmp eax, 8
ja 0x4e5ad3
mov eax, dword [ebp + 0x14]
cmp eax, 0xfa
ja 0x4e5ad3
test eax, eax
jne 0x4e592e
mov dword [ebp + 0x14], 0x1e
push 0xd9b0
mov dword [ebp - 4], 0
call fcn.005c46fb
mov esi, eax
xor eax, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0xffffffff
cmp esi, eax
je 0x4e5aba
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov eax, ebx
imul eax, eax, 0x186a0
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov edx, 4
mul edx
seto cl
mov dword [esi], edi
mov dword [ebp - 4], 2
neg ecx
or ecx, eax
push ecx
call fcn.005c46fb
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add eax, 0x22
add esp, 4
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005c46fb
add esp, 4
push 0x40004
mov dword [esi + 0x14], eax
call fcn.005c46fb
add esp, 4
mov dword [esi + 0x18], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x4e59e8
mov ecx, dword [esi + 0x10]
xor eax, eax
cmp ecx, eax
je 0x4e5a8f
mov edx, dword [esi + 0x14]
cmp edx, eax
je 0x4e5a80
cmp dword [esi + 0x18], eax
je 0x4e5a80
mov dword [esi + 0x270], ebx
imul ebx, ebx, 0x186a0
sub ebx, 0x13
mov dword [esi + 0x48], ebx
mov ebx, dword [ebp + 0x10]
mov dword [esi + 0x268], ebx
mov ebx, dword [ebp + 0x14]
mov dword [esi + 0x26c], eax
mov dword [esi + 8], 2
mov dword [esi + 4], 2
mov dword [esi + 0x264], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x20], ecx
mov dword [edi + 0x20], esi
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [esi + 0x34], 0x100
mov dword [esi + 0x38], eax
call fcn.004e5880
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp ecx, eax
je 0x4e5a8f
push ecx
call fcn.005c4733
add esp, 4
xor eax, eax
mov ecx, dword [esi + 0x14]
cmp ecx, eax
je 0x4e5aa1
push ecx
call fcn.005c4733
add esp, 4
xor eax, eax
mov ecx, dword [esi + 0x18]
cmp ecx, eax
je 0x4e5ab1
push ecx
call fcn.005c4733
add esp, 4
push esi
call fcn.005c4733
add esp, 4
mov eax, 0xfffffffd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10