joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a49b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x78], ebp
je 0x4a4b6d
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x4a4ae6
mov ecx, dword [esi + 0x94]
sub ecx, eax
mov eax, dword [esp + 0x14]
sar ecx, 4
cmp eax, ecx
jae 0x4a4ae6
xor ebx, ebx
mov edx, dword [esi + 0x90]
mov eax, dword [esp + 0x10]
add eax, edx
mov ecx, dword [eax + 4]
cmp ecx, ebp
je 0x4a4acd
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
cmp ebx, edx
jae 0x4a4acd
mov eax, ecx
mov ecx, esi
mov edi, dword [eax + ebx*4]
push edi
call fcn.004a5c20
mov ebp, eax
test ebp, ebp
je 0x4a4ac5
push ebp
mov ecx, esi
call fcn.004a7010
test eax, eax
je 0x4a4ac5
mov edx, dword [esi + 0x74]
cmp edi, edx
je 0x4a4ac5
mov eax, dword [esp + 0x10]
xor ecx, ecx
test ebx, ebx
sete cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x90]
add eax, ecx
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x4a4a86
xor eax, eax
jmp 0x4a4a8e
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
dec eax
xor ecx, ecx
cmp ebx, eax
lea eax, [edi + 1]
sete cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, edx
sete cl
dec edi
mov dword [esp + 0x30], ecx
xor eax, eax
cmp edi, edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x18]
sete al
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x3c], eax
call fcn.004a79b0
inc ebx
xor ebp, ebp
jmp 0x4a4a17
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ecx
add eax, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x4a49f0
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
call fcn.004a5f30
test eax, eax
pop ebx
je 0x4a4b6d
mov ecx, dword [esi + 0x74]
push ecx
mov ecx, esi
call fcn.004a5c20
mov edi, eax
cmp edi, ebp
je 0x4a4b6d
push edi
mov ecx, esi
call fcn.004a7010
test eax, eax
je 0x4a4b6d
mov eax, 1
lea edx, [esi + 0x1f8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
call fcn.004a6170
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
call fcn.004a61e0
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push eax
call fcn.004a79b0
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
Function at 0x4ad4e0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x551261
push eax
mov dword fs:[0], esp
sub esp, 0xec
push edi
mov edi, ecx
mov eax, dword [edi + 0x5c]
test eax, eax
jne 0x4ad51d
xor eax, eax
pop edi
mov ecx, dword [esp + 0xec]
mov dword fs:[0], ecx
add esp, 0xf8
ret
push esi
push 0x400
lea ecx, [esp + 0xc]
call fcn.0054573a
push 0
push 0x1000
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x10c], 0
call fcn.00544a82
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 1
push ecx
mov ecx, dword [edi + 0x5c]
call fcn.004a64a0
lea ecx, [esp + 8]
call fcn.005459e5
lea ecx, [esp + 0x30]
call fcn.00544be6
mov edx, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x10]
call dword [edx + 0x28]
push 0
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x84]
call fcn.00544a82
lea ecx, [esp + 0x74]
lea esi, [edi + 0x60]
push ecx
mov ecx, esi
mov byte [esp + 0x100], 2
call fcn.004a6910
lea ecx, [esp + 0x74]
call fcn.00544be6
lea ecx, [esp + 8]
call fcn.005459e6
mov eax, dword [edi + 0x5c]
lea edx, [esp + 0xb8]
push edx
push 0x3c
mov eax, dword [eax + 0xc8]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, esi
call fcn.004a4140
mov edx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [edx + 0xdc]
mov dword [esi + 0xdc], eax
call fcn.004a6440
mov ecx, esi
call fcn.004a6f50
mov eax, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [eax + 0xe0]
mov dword [esi + 0xe0], eax
call fcn.004a6440
mov ecx, esi
call fcn.004a6f50
mov ecx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov eax, dword [ecx + 0xe4]
mov ecx, esi
mov dword [esi + 0xe4], eax
call fcn.004a6440
mov ecx, esi
call fcn.004a6f50
mov ecx, dword [edi + 0x5c]
call fcn.004a3920
push eax
mov ecx, esi
call fcn.004a3930
mov ecx, dword [edi + 0x5c]
call fcn.004a3ee0
push eax
mov ecx, esi
call fcn.004a3e80
mov ecx, dword [edi + 0x5c]
call fcn.004a4000
push eax
mov ecx, esi
call fcn.004a3fb0
mov ecx, dword [edi + 0x5c]
push 0
call fcn.004a3200
push eax
mov ecx, esi
call fcn.004a3210
mov edx, dword [edi + 0x7c]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x74]
mov byte [esp + 0xfc], 1
call fcn.00544b5e
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 0
call fcn.00544b5e
lea ecx, [esp + 8]
mov dword [esp + 0xfc], 0xffffffff
call fcn.005457ff
mov ecx, dword [esp + 0xf4]
pop esi
mov eax, 1
pop edi
mov dword fs:[0], ecx
add esp, 0xf8
ret
Function at 0x4aec00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x551487
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CMenu.virtual_0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.0053b7cd
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.0053b7cd
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], method.CMenu.virtual_0
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.004af720
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x4af770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x551560
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.00547d3b
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x4af7a3
xor al, al
jmp 0x4af8cf
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x4af7c5
xor al, al
jmp 0x4af8cf
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x4af7d8
xor al, al
jmp 0x4af8cf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x4af7ec
xor al, al
jmp 0x4af8cf
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.0053b892
test eax, eax
jne 0x4af820
xor al, al
jmp 0x4af8cf
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x9beae4
mov dword [esp + 0x20], ebp
call fcn.00547d3b
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.00544737
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.0054478e
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x4af8b4
mov ax, word [ebx]
test ax, ax
je 0x4af8a6
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.004af8f0
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x4af88a
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.0054478e
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x4afe30
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.00545e23
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x4afe76
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.004d1e40
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0xabebc4
push ecx
call fcn.004d3950
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x4b58c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x4b590c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x4b590c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x4b58f6
push eax
call ebp
test ax, ax
jl 0x4b5904
inc esi
add edi, 4
cmp esi, 6
jb 0x4b58e8
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.004b55c0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4b7fe0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x4b8040
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x4b8040
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x4b8040
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x4b8040
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x4b8050
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x4be520
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x551d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.004be8f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0
call fcn.004be8f0
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x3c], 1
call fcn.004be960
lea ecx, [esp + 0x10]
call fcn.004bd300
cmp eax, 1
jae 0x4be5c8
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
push 0
call ebx
mov edi, eax
test edi, edi
je 0x4be633
lea ecx, [edi + 1]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4be633
push esi
push edi
call ebx
push esi
lea ecx, [esp + 0x14]
call fcn.004be960
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x10]
call fcn.004bd300
cmp eax, 1
jb 0x4be633
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.004be3c0
test eax, eax
je 0x4be633
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.004be6a0
mov edi, dword [esp + 0x44]
xor esi, esi
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x24]
call fcn.004be9c0
push edi
lea ecx, [esp + 0x24]
call fcn.004be9e0
push esi
lea ecx, [esp + 0x24]
call fcn.004bea80
push str..tmp
lea ecx, [esp + 0x24]
call fcn.004be9e0
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
call fcn.004be3a0
test eax, eax
je 0x4be669
inc esi
cmp esi, 0x7a0a1f00
jb 0x4be5ea
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.004be910
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.004be910
xor eax, eax
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x20]
push eax
call fcn.004be9c0
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.004be910
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.004be910
mov eax, 1
jmp 0x4be654
Function at 0x4bee10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x551dd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.004be8f0
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x28], 0
call fcn.004be960
push 0
mov ecx, esi
call fcn.004bed90
mov ebx, dword [esp + 0x2c]
cmp ebx, 1
jb 0x4bef48
lea ecx, [esp + 0xc]
call fcn.004bd300
cmp eax, 1
jae 0x4bee97
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.004be910
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
mov eax, dword [esp + 0x34]
lea edi, [esi + 0xc]
test eax, eax
jne 0x4beee4
push 0
lea ecx, [esp + 0x10]
call fcn.004bed10
push eax
push edi
mov ecx, 0xb187cc
call fcn.004be520
test eax, eax
jne 0x4beeec
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.004be910
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
push eax
mov ecx, edi
call fcn.004be960
push edi
mov ecx, 0xb187cc
call fcn.004be480
push 0
push 2
push 2
push 0
push 3
push 0xc0000000
mov ecx, edi
call fcn.004bed00
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x4bef48
push 0
push ebx
push 0
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x4bef48
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 8], eax
jne 0x4bef78
push 1
mov ecx, esi
call fcn.004bed90
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.004be910
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
lea ecx, [esp + 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esp + 0x24], 0xffffffff
call fcn.004be910
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc

Function at 0x4bf8a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x110]
call fcn.004be960
pop edi
add esp, 0x104
ret 4
Function at 0x4c3780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
cmp di, 0x76d
jb 0x4c38d5
cmp di, 0x801
ja 0x4c38d5
mov ebx, dword [esp + 0x28]
cmp bx, 1
jb 0x4c38d5
cmp bx, 0xc
ja 0x4c38d5
mov al, byte [esp + 0x30]
test al, al
je 0x4c37d4
push edi
call fcn.004c3d10
add esp, 4
cmp ax, bx
je 0x4c37d4
mov byte [esp + 0x30], 0
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x13]
lea ecx, [esp + 0x14]
mov word [esi], di
mov edi, dword [esp + 0x38]
push eax
lea edx, [esp + 0x1c]
mov word [edi], bx
mov ebx, dword [esp + 0x30]
push ecx
lea eax, [esp + 0x24]
mov word [ebp], bx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ebx
push ecx
push edx
call fcn.004c38e0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x30]
push ebx
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
call fcn.004c3700
add esp, 0x34
mov ebx, eax
xor eax, eax
inc eax
cmp eax, 0x64
mov dword [esp + 0x34], eax
jg 0x4c38d5
test ebx, ebx
jne 0x4c3869
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x30]
cmp al, cl
je 0x4c38cb
test al, al
je 0x4c385c
push 0xffffffffffffffe1
jmp 0x4c385e
push 0x1f
push ebp
push edi
push esi
call fcn.004c36b0
add esp, 0x10
neg ebx
push ebx
push ebp
push edi
push esi
call fcn.004c36b0
lea edx, [esp + 0x23]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
mov ax, word [ebp]
lea edx, [esp + 0x34]
push ecx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ecx
push edx
call fcn.004c38e0
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
push edx
call fcn.004c3700
mov ebx, eax
mov eax, dword [esp + 0x78]
add esp, 0x44
jmp 0x4c3836
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
Function at 0x4c4f60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5520c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push 0xb2ad48
lea ecx, [esp + 4]
call fcn.0053d85f
push 0xacb180
lea ecx, [esp + 8]
mov dword [esp + 0x40], 0
call fcn.0053d85f
push 0xacb17c
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 1
call fcn.0053d85f
push 0xacb178
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 2
call fcn.0053d85f
push 0xacb174
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 3
call fcn.0053d85f
push 0xacb170
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 4
call fcn.0053d85f
push 0xacb16c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 5
call fcn.0053d85f
push 0xacb168
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 6
call fcn.0053d85f
push 0xacb164
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 7
call fcn.0053d85f
push 0xacb160
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], 8
call fcn.0053d85f
push 0xacb15c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x40], 9
call fcn.0053d85f
push 0xacb158
lea ecx, [esp + 0x30]
mov byte [esp + 0x40], 0xa
call fcn.0053d85f
push 0xacb154
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 0xb
call fcn.0053d85f
mov eax, dword [esp + 0x44]
mov byte [esp + 0x3c], 0xc
cmp eax, 1
jge 0x4c5090
cmp eax, 0xc
jle 0x4c5090
mov ecx, dword [esp + 0x48]
push 0xb2ad48
call fcn.0053d97a
jmp 0x4c509e
mov ecx, dword [esp + 0x48]
lea eax, [esp + eax*4]
push eax
call fcn.0053d92a
lea ecx, [esp + 0x30]
mov byte [esp + 0x3c], 0xb
call fcn.0053d7f1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3c], 0xa
call fcn.0053d7f1
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 9
call fcn.0053d7f1
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 8
call fcn.0053d7f1
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 7
call fcn.0053d7f1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 6
call fcn.0053d7f1
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 5
call fcn.0053d7f1
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 4
call fcn.0053d7f1
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 3
call fcn.0053d7f1
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 2
call fcn.0053d7f1
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 1
call fcn.0053d7f1
lea ecx, [esp + 4]
mov byte [esp + 0x3c], 0
call fcn.0053d7f1
lea ecx, [esp]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0053d7f1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x4e1160
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x4e1193
push esi
call fcn.004e6060
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4e118c
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4e1219
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4e1202
mov eax, dword [esi + 8]
test eax, eax
je 0x4e11b7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4e11fe
cmp eax, 2
je 0x4e1202
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4e11aa
cmp eax, 3
je 0x4e11dd
cmp eax, 1
jne 0x4e11aa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4e11aa
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4e11aa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004e1250
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4e1239
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.004e1250
add esp, 4
pop esi
ret

Function at 0x511af0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x511afb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x511bfe
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x9c5930]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x9c5930]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x9c5930]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x9c5930]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x9c5930]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x9c5930]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x9c5930]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x9c5930]
xor eax, edx
inc ecx
dec edi
jne 0x511b16
pop edi
test esi, esi
je 0x511c20
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x9c5930]
xor eax, edx
inc ecx
dec esi
jne 0x511c02
pop esi
pop ebx
not eax
ret