joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65c0e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x681008
mov eax, dword [edi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], ebp
je 0x4af8e7
mov ecx, dword [eax + 0x10]
dec ecx
mov dword [eax + 0x10], ecx
mov esi, dword [edi + 0x30]
cmp dword [esi + 0x10], ebp
jg 0x4af8e7
cmp esi, ebp
je 0x4af8e7
mov ecx, esi
call fcn.004ced80
push esi
call fcn.004fec60
add esp, 4
mov dword [edi], method.CSyncObject.virtual_20
mov eax, dword [edi + 0x2c]
mov dword [esp + 0x1c], 1
cmp eax, ebp
je 0x4af958
mov ecx, dword [eax + 0x14]
dec ecx
mov dword [eax + 0x14], ecx
mov esi, dword [edi + 0x2c]
cmp dword [esi + 0x14], ebp
jg 0x4af958
cmp esi, ebp
mov dword [esp + 0x10], esi
je 0x4af958
mov eax, dword [esi + 4]
mov byte [esp + 0x1c], 2
test eax, eax
jle 0x4af938
push 0
push ebp
mov ecx, esi
call fcn.0049c440
mov ecx, eax
call fcn.0049c420
mov eax, dword [esi + 4]
inc ebp
cmp ebp, eax
jl 0x4af91f
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.0049a0c0
mov ecx, esi
mov byte [esp + 0x1c], 1
call fcn.0049a0b0
push esi
call fcn.004fec60
add esp, 4
test edi, edi
je 0x4af961
lea esi, [edi + 4]
jmp 0x4af963
xor esi, esi
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x10]
mov dword [esp + 0x1c], 6
test eax, eax
je 0x4af990
mov edx, dword [eax + 0x6c]
dec edx
mov dword [eax + 0x6c], edx
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 0x6c]
test ecx, ecx
jg 0x4af990
push eax
call fcn.004fec60
add esp, 4
mov eax, dword [esi + 0xc]
mov byte [esp + 0x1c], 5
test eax, eax
je 0x4af9b6
mov edx, dword [eax + 0x34]
dec edx
mov dword [eax + 0x34], edx
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x34]
test ecx, ecx
jg 0x4af9b6
push eax
call fcn.004fec60
add esp, 4
mov eax, dword [esi + 8]
mov byte [esp + 0x1c], 4
test eax, eax
je 0x4af9de
mov ecx, dword [eax + 0x18]
dec ecx
mov dword [eax + 0x18], ecx
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0x18]
test eax, eax
jg 0x4af9de
test ecx, ecx
je 0x4af9de
push 1
call fcn.0049f730
mov eax, dword [esi + 4]
mov byte [esp + 0x1c], 3
test eax, eax
je 0x4afa06
mov ecx, dword [eax + 0x1c]
dec ecx
mov dword [eax + 0x1c], ecx
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x1c]
test eax, eax
jg 0x4afa06
test ecx, ecx
je 0x4afa06
push 1
call fcn.0049f750
mov eax, dword [esi]
mov dword [esp + 0x1c], 0xffffffff
test eax, eax
je 0x4afa38
mov ecx, dword [eax + 0x14]
dec ecx
mov dword [eax + 0x14], ecx
mov esi, dword [esi]
mov eax, dword [esi + 0x14]
test eax, eax
jg 0x4afa38
test esi, esi
je 0x4afa38
mov ecx, esi
call fcn.004bc260
push esi
call fcn.004fec60
add esp, 4
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4b8a90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65cd98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [ecx + 8]
push ebp
push esi
lea esi, [ecx + 8]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0xc], eax
lea edx, [esp + 8]
push edi
lea eax, [esp + 0x34]
mov dword [esi], ecx
push edx
push eax
mov ecx, esi
call fcn.004b9550
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], 0
test eax, eax
jne 0x4b8b03
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0xffffffff
call fcn.00498970
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4b8b10
add eax, 0xc
jmp 0x4b8b15
mov eax, 0x73d670
push eax
call fcn.00466a15
add esp, 4
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov ebp, eax
push ecx
push edx
mov ecx, esi
call fcn.004b9550
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 1
call fcn.00498be0
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.00498970
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4b8b7d
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0xffffffff
call fcn.00498970
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4b8b8a
add eax, 0xc
jmp 0x4b8b8f
mov eax, 0x73d670
push ebx
push eax
call fcn.00466a15
add esp, 4
mov edi, eax
lea eax, [esp + 0x18]
mov ecx, esi
push eax
mov dword [esp + 0x20], 0x6ecb80
mov dword [esp + 0x24], 3
call fcn.004b9590
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 2
push ecx
mov ecx, eax
call fcn.00498cb0
test al, al
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 0
sete bl
call fcn.00498970
test bl, bl
pop ebx
je 0x4b8c0d
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x34]
mov dword [esi], edx
mov dword [esp + 0x28], 0xffffffff
call fcn.00498970
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
push eax
push edi
push ebp
push ecx
mov ecx, esi
call fcn.004b95d0
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x34]
mov edi, eax
mov dword [esi], edx
mov dword [esp + 0x28], 0xffffffff
call fcn.00498970
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x4bf980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65d558
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [esp + 0x38]
lea ecx, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
mov dword [esp + 0x30], ebx
call fcn.004e4e30
add esp, 8
mov edx, dword [esp + 0x30]
mov byte [esp + 0x28], 1
cmp edx, ebx
je 0x4bfb39
cmp dword [esp + 0xc], ebx
je 0x4bfb39
mov edi, 0x6ecc8c
mov eax, edi
mov dword [esp + 0x10], edi
test eax, eax
je 0x4bf9ed
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4bf9f1
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x10]
push ecx
mov ecx, edx
call fcn.00497990
mov edx, eax
cmp edx, ebx
je 0x4bfb39
mov eax, str.Font
mov dword [esp + 0x10], str.Font
test eax, eax
je 0x4bfa2a
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4bfa2e
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x10]
push ecx
mov ecx, edx
call fcn.00497990
cmp eax, ebx
je 0x4bfb39
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x4bfa5a
lea edx, [ecx + 0xc]
mov dword [esp + 0x10], edx
mov ecx, dword [ecx + 4]
mov dword [esp + 0x14], ecx
jmp 0x4bfa62
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
lea edx, [esp + 0x10]
mov ecx, eax
push edx
call fcn.00497990
mov esi, eax
cmp esi, ebx
je 0x4bfb39
mov edi, str.Type
mov eax, edi
mov dword [esp + 0x10], edi
test eax, eax
je 0x4bfa97
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4bfa9b
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x10]
lea edx, [esp + 0x30]
push ecx
push edx
mov ecx, esi
call fcn.00497790
mov edx, eax
mov eax, str.Font
mov byte [esp + 0x28], 2
test eax, eax
mov dword [esp + 0x18], str.Font
je 0x4bfad6
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x4bfada
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x18]
push ecx
mov ecx, edx
call fcn.00498cb0
lea ecx, [esp + 0x30]
mov bl, al
mov byte [esp + 0x28], 1
call fcn.00498970
test bl, bl
je 0x4bfb39
mov ecx, dword [esp + 0x34]
push esi
call fcn.004b6580
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x28], 0
call fcn.00498970
lea ecx, [esp + 0x38]
mov dword [esp + 0x28], 0xffffffff
call fcn.00498970
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.00498970
lea ecx, [esp + 0x38]
mov dword [esp + 0x28], 0xffffffff
call fcn.00498970
mov ecx, dword [esp + 0x20]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x4c0300
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x65d630
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
cmp esi, ebp
push edi
jne 0x4c0339
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
mov edi, 0x6ecb38
mov eax, edi
mov dword [esp + 0x1c], edi
test eax, eax
je 0x4c0358
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x20], ecx
jmp 0x4c035c
mov dword [esp + 0x20], ebp
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.00497790
mov dword [esp + 0x2c], ebp
mov dword [esp + 0xc], ebp
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.00498be0
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 3
call fcn.00498970
mov dword [esp + 0x34], ebp
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
push eax
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 4
call fcn.004be230
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.00498a90
mov eax, dword [esp + 0x3c]
push eax
push esi
call fcn.004bf980
add esp, 0xc
lea ecx, [esp + 0x34]
mov esi, eax
mov byte [esp + 0x2c], 3
call fcn.00498970
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00498970
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x24
ret
Function at 0x4c0410
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x65d648
push eax
mov dword fs:[0], esp
mov edx, dword [ecx]
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push edi
cmp edx, esi
je 0x4c05a5
mov edi, 0x6e28dc
or ebx, 0xffffffff
mov eax, edi
mov dword [esp + 0x10], edi
test eax, eax
je 0x4c0458
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x4c045c
mov dword [esp + 0x14], esi
mov edi, 0x6ed330
mov ecx, edi
mov dword [esp + 0x18], edi
test ecx, ecx
je 0x4c047a
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x4c047e
mov dword [esp + 0x1c], esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push ecx
push eax
mov ecx, edx
call fcn.00497830
mov edi, 0x6ed32c
mov dword [esp + 0x30], esi
mov ecx, edi
mov dword [esp + 0x20], edi
test ecx, ecx
je 0x4c04b6
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], ecx
jmp 0x4c04ba
mov dword [esp + 0x24], esi
lea edx, [esp + 0x20]
lea ecx, [esp + 0xc]
push edx
call fcn.00498cb0
test al, al
je 0x4c04f0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], ebx
call fcn.00498970
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov edi, 0x6e0b2c
mov eax, edi
mov dword [esp + 0x20], edi
test eax, eax
je 0x4c050e
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], ecx
jmp 0x4c0512
mov dword [esp + 0x24], esi
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x10]
call fcn.00498cb0
test al, al
je 0x4c0548
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], ebx
call fcn.00498970
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov edi, 0x6e1c84
mov edx, edi
mov dword [esp + 0x20], edi
test edx, edx
je 0x4c0566
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], ecx
jmp 0x4c056a
mov dword [esp + 0x24], esi
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
call fcn.00498cb0
test al, al
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0xc]
je 0x4c05a0
call fcn.00498970
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
call fcn.00498970
mov ecx, dword [esp + 0x28]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4c26c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65d7af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
xor esi, esi
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], esi
call fcn.004c3d90
push 0x28
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 1
call fcn.004c3ea0
mov ebx, dword [esp + 0x44]
mov eax, dword [ebx]
cmp eax, esi
je 0x4c270c
mov edi, dword [eax + 4]
jmp 0x4c270e
xor edi, edi
cmp edi, esi
jle 0x4c279c
push ebp
mov ebp, 2
mov eax, dword [ebx]
test eax, eax
je 0x4c2756
mov al, byte [eax + esi + 0xc]
cmp al, 0x29
mov byte [esp + 0x48], al
je 0x4c277d
cmp al, 0x5c
je 0x4c277d
cmp al, 0x28
je 0x4c277d
cmp al, 0xa
jne 0x4c275d
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
mov dword [esp + 0x18], 0x6ed3d8
mov dword [esp + 0x1c], ebp
call fcn.004c3f00
jmp 0x4c2796
mov byte [esp + 0x48], 0
jmp 0x4c2788
cmp al, 0xd
jne 0x4c2788
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x6ed3d4
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], ebp
call fcn.004c3f00
jmp 0x4c2796
push 0x5c
lea ecx, [esp + 0x28]
call fcn.004c3ea0
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x24]
push edx
call fcn.004c3ea0
inc esi
cmp esi, edi
jl 0x4c271c
pop ebp
push 0x29
lea ecx, [esp + 0x24]
call fcn.004c3ea0
mov esi, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push esi
call fcn.004c3ed0
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.004c3db0
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x4c2cf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65d8b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
lea eax, [esp + 0x10]
push edi
mov esi, ecx
push eax
call fcn.004c2840
mov edi, 0x6ecc80
xor edx, edx
mov ecx, edi
mov dword [esp + 0x38], edx
test ecx, ecx
mov dword [esp + 0x18], edi
je 0x4c2d3c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x4c2d40
mov dword [esp + 0x1c], edx
mov edi, 0x6ece44
mov eax, edi
mov dword [esp + 0x20], edi
test eax, eax
je 0x4c2d5f
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], ecx
jmp 0x4c2d63
mov dword [esp + 0x24], edx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esi + 8]
lea eax, [esp + 0x14]
push edx
push eax
call fcn.00497830
mov ebx, 1
push 0xffffffffffffffff
push 0x6ecc80
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], bl
call fcn.00498990
mov eax, dword [esp + 0x40]
mov byte [esp + 0x38], 2
test eax, eax
je 0x4c2dae
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x10]
call fcn.00498be0
lea edx, [esp + 0xc]
lea ecx, [esp + 0x10]
push edx
call fcn.00498cf0
test al, al
jne 0x4c2dfe
mov edi, 0x6ece44
mov eax, edi
mov dword [esp + 0x28], edi
test eax, eax
je 0x4c2ddf
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x2c], ecx
jmp 0x4c2de7
mov dword [esp + 0x2c], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [esi + 8]
push edx
call fcn.00497c60
mov eax, dword [esi]
mov dword [eax + 0x5c], ebx
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], bl
call fcn.00498970
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
call fcn.00498970
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.00498970
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 4
Function at 0x4c3520
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65d977
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
xor ebx, ebx
push ebp
push esi
mov dword [esp + 0x10], ebx
mov ebp, 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x24], ebp
mov edx, dword [ecx + 8]
mov byte [esp + 0x24], 2
cmp edx, ebx
jne 0x4c3570
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.004a2080
mov dword [esp + 0x10], ebp
jmp 0x4c35ed
push edi
mov edi, 0x6ed3f4
mov ecx, edi
mov dword [esp + 0x18], edi
test ecx, ecx
je 0x4c3590
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x4c3594
mov dword [esp + 0x1c], ebx
lea eax, [esp + 0x18]
mov ecx, edx
push eax
call fcn.00497990
cmp eax, ebx
pop edi
jne 0x4c35b7
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004a2080
jmp 0x4c35e9
mov ecx, dword [esp + 0x30]
cmp ecx, ebx
je 0x4c35cf
lea edx, [ecx + 0xc]
mov dword [esp + 0x14], edx
mov ecx, dword [ecx + 4]
mov dword [esp + 0x18], ecx
jmp 0x4c35d7
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x14]
push ebx
push edx
push esi
mov ecx, eax
call fcn.004977e0
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call fcn.00498970
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.00498970
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x4d1740
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x65e163
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
xor ebx, ebx
push 0x20
mov dword [esp + 0x1c], ebx
mov dword [esi], 0x68661c
mov dword [esi + 4], edi
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call fcn.00492990
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0x18], 1
je 0x4d1799
push edi
mov ecx, eax
call fcn.004d0120
jmp 0x4d179b
xor eax, eax
mov ecx, esi
mov byte [esp + 0x18], bl
mov dword [esi + 0x2c], eax
call fcn.0049d1e0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4d17e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x65e18e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
xor ebx, ebx
push 0x24
mov dword [esp + 0x1c], ebx
mov dword [esi], 0x68661c
mov dword [esi + 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], 1
call fcn.00492990
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, ebx
mov byte [esp + 0x18], 1
je 0x4d1839
mov ecx, eax
call fcn.004c4430
jmp 0x4d183b
xor eax, eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ebx
push ebx
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push ecx
mov ecx, eax
mov byte [esp + 0x2c], bl
mov dword [esi + 4], eax
call fcn.004c4470
push 0x20
call fcn.00492990
add esp, 4
mov dword [esp + 0x28], eax
cmp eax, ebx
mov byte [esp + 0x18], 2
je 0x4d187e
mov edx, dword [esi + 4]
mov ecx, eax
push edx
call fcn.004d0120
jmp 0x4d1880
xor eax, eax
mov ecx, esi
mov byte [esp + 0x18], bl
mov dword [esi + 0x2c], eax
call fcn.0049d1e0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x4d6700
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x65e1eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 0x74]
mov ecx, edi
call fcn.00498370
mov eax, dword [esp + 0x2c]
push 0
push 0
push 0
push eax
mov ecx, edi
mov dword [esp + 0x34], 0
call fcn.00498390
mov ecx, dword [esi + 0x78]
mov edx, dword [edi]
push ecx
push edx
lea ecx, [esi + 0x8c]
call fcn.004c4060
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov dword [esi], eax
mov dword [esi + 8], ebx
mov dword [esi + 4], ebp
mov edi, dword [ecx + 0xc]
lea edx, [esp + 0x14]
mov ecx, edi
push edx
mov dword [esp + 0x18], str.BitsPerCoordinate
mov dword [esp + 0x1c], 0x11
call fcn.00497890
mov dword [esi + 0xc], eax
lea eax, [esp + 0x14]
push eax
mov ecx, edi
mov dword [esp + 0x18], str.BitsPerComponent
mov dword [esp + 0x1c], 0x10
call fcn.00497890
lea ecx, [esp + 0x14]
mov dword [esi + 0x10], eax
push ecx
mov ecx, edi
mov dword [esp + 0x18], str.BitsPerFlag
mov dword [esp + 0x1c], 0xb
call fcn.00497890
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x14], eax
test ecx, ecx
je 0x4d68df
mov edx, dword [esi + 0x10]
test edx, edx
je 0x4d68df
test eax, eax
je 0x4d68df
test ebx, ebx
mov eax, 1
jne 0x4d67fa
mov eax, dword [ebp + 8]
cmp ecx, 0x20
mov dword [esi + 0x18], eax
jne 0x4d6807
or eax, 0xffffffff
jmp 0x4d680f
mov eax, 1
shl eax, cl
dec eax
mov dword [esi + 0x1c], eax
mov eax, 1
mov ecx, edx
mov dword [esp + 0x14], str.Decode
shl eax, cl
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], 6
push ecx
mov ecx, edi
dec eax
mov dword [esi + 0x20], eax
call fcn.004979c0
mov edi, eax
test edi, edi
je 0x4d68df
mov edx, dword [esi + 0x18]
mov ecx, dword [edi + 0x10]
lea eax, [edx + edx + 4]
cmp ecx, eax
jne 0x4d68df
push 0
mov ecx, edi
call fcn.004972e0
fstp dword [esi + 0x24]
push 1
mov ecx, edi
call fcn.004972e0
fstp dword [esi + 0x28]
push 2
mov ecx, edi
call fcn.004972e0
fstp dword [esi + 0x2c]
push 3
mov ecx, edi
call fcn.004972e0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x30], 0
fstp dword [esi + 0x30]
test eax, eax
jbe 0x4d68cc
mov ebp, 5
lea ebx, [esi + 0x54]
lea ecx, [ebp - 1]
push ecx
mov ecx, edi
call fcn.004972e0
fstp dword [ebx - 0x20]
push ebp
mov ecx, edi
call fcn.004972e0
mov eax, dword [esp + 0x30]
add ebp, 2
fstp dword [ebx]
mov ecx, dword [esi + 0x18]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x30], eax
jb 0x4d689e
mov edx, dword [esp + 0x2c]
push 0
push 0
push 0
push edx
lea ecx, [esi + 0x74]
call fcn.00498390
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
Function at 0x4dbb20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65e40a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x686874]
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 0x1c], eax
mov ecx, dword [0x686874]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 1
mov dword [esi + 0x1d4], edi
lea ecx, [esi + 0x1d8]
push 4
mov dword [esp + 0x18], edi
call fcn.0049a090
mov dword [esi + 0x224], edi
push 4
lea ecx, [esi + 0x24c]
mov byte [esp + 0x18], 2
call fcn.0049a090
mov edx, dword [0x686870]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x1d0], edi
mov dword [esi + 0x1f0], edx
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret