joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e61a0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x630a11], 0
jne 0x4e6239
push esi
mov esi, dword [sym.imp.MSVCR90.dll_getenv]
push edi
push str.OZ_ACCESS_DELAY
call esi
mov edi, dword [sym.imp.MSVCR90.dll_atoi]
add esp, 4
test eax, eax
je 0x4e61d4
push eax
call edi
add esp, 4
mov dword [0x62c764], eax
push str.OZ_ACCESS_FREQ
call esi
add esp, 4
test eax, eax
je 0x4e61ed
push eax
call edi
add esp, 4
mov dword [0x62c768], eax
push str.OZ_AUTH_TYPE
call esi
add esp, 4
pop edi
pop esi
test eax, eax
je 0x4e622b
mov ecx, str.NTLM
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4e6222
test dl, dl
je 0x4e621e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4e6222
add eax, 2
add ecx, 2
test dl, dl
jne 0x4e6202
xor eax, eax
jmp 0x4e6227
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4e6232
mov byte [0x630a10], 1
mov byte [0x630a11], 1
ret

Function at 0x4e7830
Capabilities:
Get socket status

Disassembly:
mov ecx, dword [0x630a04]
sub esp, 0x11c
push ebx
push esi
mov esi, dword [esp + 0x128]
push edi
mov edi, dword [esp + 0x130]
mov ebx, str..._xsocket.cpp
test ecx, ecx
je 0x4e788a
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x14
jl 0x4e788a
push edi
push esi
lea eax, [esp + 0x14]
push str._ENTERING__PzExtSocket::Readable_fd_d__sec_d_
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0x78
mov dword [esp + 0x24], 0x14
call fcn.004e1a20
add esp, 0x10
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
lea edx, [esp + 0x30]
mov dword [esp + 0x34], esi
push edx
inc esi
push esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 1
call sub.WSOCK32.dll_select
mov ecx, dword [0x630a04]
test eax, eax
je 0x4e790e
cmp eax, 0xffffffff
je 0x4e794a
test ecx, ecx
je 0x4e7900
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x28
jl 0x4e7900
lea eax, [esp + 0xc]
push str._EXITING__PzExtSocket::Readable:_true
push eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0x8f
mov dword [esp + 0x1c], 0x28
call fcn.004e1a20
add esp, 8
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x11c
ret 8
test ecx, ecx
je 0x4e79c2
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0x32
jl 0x4e7986
lea ecx, [esp + 0xc]
push str.TIMEOUT:_select
push ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0x87
mov dword [esp + 0x1c], 0x32
call fcn.004e1a20
add esp, 8
jmp 0x4e7986
test ecx, ecx
je 0x4e79c2
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0xa
jl 0x4e7986
call sub.WSOCK32.dll_WSAGetLastError
push eax
lea ecx, [esp + 0x10]
push str.FAILED:_select:__d
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 0x89
mov dword [esp + 0x20], 0xa
call fcn.004e1a20
add esp, 0xc
mov ecx, dword [0x630a04]
test ecx, ecx
je 0x4e79c2
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0x28
jl 0x4e79c2
lea ecx, [esp + 0xc]
push str._EXITING__PzExtSocket::Readable:_false
push ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0x8b
mov dword [esp + 0x1c], 0x28
call fcn.004e1a20
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x11c
ret 8
Function at 0x4e79d0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov ecx, dword [0x630a04]
push esi
push edi
mov edi, dword [esp + 0x20]
test ecx, ecx
je 0x4e7a1d
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x14
jl 0x4e7a1d
push edi
lea eax, [esp + 0x10]
push str._ENTER__PzExtSocket::_SendMess_length_d_
push eax
mov dword [esp + 0x18], str..._xsocket.cpp
mov dword [esp + 0x1c], 0xae
mov dword [esp + 0x20], 0x14
call fcn.004e1a20
add esp, 0xc
push edi
call sub.WSOCK32.dll_htonl
add edi, 4
xor esi, esi
mov dword [ebx + 8], eax
test edi, edi
jle 0x4e7a75
nop
mov eax, dword [ebx]
push 0
mov ecx, edi
sub ecx, esi
push ecx
lea edx, [ebx + esi + 8]
push edx
push eax
call sub.WSOCK32.dll_send
test eax, eax
jle 0x4e7a50
add esi, eax
cmp esi, edi
jl 0x4e7a30
jmp 0x4e7a75
jge 0x4e7a5e
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x630a18], eax
jmp 0x4e7a68
mov dword [0x630a18], 0
mov dword [0x630a14], 8
or esi, 0xffffffff
add ebx, 4
push ebx
call dword [sym.imp.MSVCR90.dll__time32]
mov ecx, dword [0x630a04]
add esp, 4
test ecx, ecx
je 0x4e7ac3
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0x28
jl 0x4e7ac3
push esi
lea ecx, [esp + 0x10]
push str._EXIT__PzExtSocket::_SendMess__:_d
push ecx
mov dword [esp + 0x18], str..._xsocket.cpp
mov dword [esp + 0x1c], 0xc3
mov dword [esp + 0x20], 0x28
call fcn.004e1a20
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4e8170
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov ecx, dword [0x630a04]
sub esp, 0x14
push ebp
push esi
mov esi, eax
mov ebp, str..._xsocket.cpp
test ecx, ecx
je 0x4e81d8
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x14
jl 0x4e81d8
test ebx, ebx
je 0x4e81a0
mov eax, dword [ebx]
push eax
call sub.WSOCK32.dll_inet_ntoa
jmp 0x4e81a5
mov eax, str._NULL_
mov ecx, esi
test esi, esi
jne 0x4e81b0
mov ecx, str._null_
push eax
push ecx
lea ecx, [esp + 0x14]
push str._ENTERING__GetHostEntry_name_s__inaddr_s_
push ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], 0x1dc
mov dword [esp + 0x24], 0x14
call fcn.004e1a20
add esp, 0x10
push esi
call sub.WSOCK32.dll_inet_addr
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x4e8251
push esi
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x4e8209
test ebx, ebx
je 0x4e82cc
mov edx, dword [esi + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebx], ecx
jmp 0x4e82cc
mov dword [0x630a14], 1
call fcn.004e7790
mov ecx, dword [0x630a04]
mov dword [0x630a18], eax
test ecx, ecx
je 0x4e8330
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0xa
jl 0x4e82cc
mov ecx, dword [0x630a18]
push ecx
mov dword [esp + 0x14], 0x1ee
push str.FAILED:_gethostbyname:__d
jmp 0x4e82b3
push 2
push 4
lea eax, [esp + 0x10]
push eax
call sub.WSOCK32.dll_gethostbyaddr
mov esi, eax
test esi, esi
je 0x4e8271
test ebx, ebx
je 0x4e82cc
mov ecx, dword [esp + 8]
mov dword [ebx], ecx
jmp 0x4e82cc
mov dword [0x630a14], 2
call fcn.004e7790
mov ecx, dword [0x630a04]
mov dword [0x630a18], eax
test ecx, ecx
je 0x4e8330
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0xa
jl 0x4e82cc
mov ecx, dword [0x630a18]
push ecx
mov dword [esp + 0x14], 0x1fb
push str.FAILED:_gethostbyaddr:__d
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], 0xa
call fcn.004e1a20
add esp, 0xc
mov ecx, dword [0x630a04]
test ecx, ecx
je 0x4e8330
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x28
jl 0x4e8330
push edi
test esi, esi
je 0x4e82ef
mov eax, dword [esi]
mov edi, eax
test eax, eax
jne 0x4e82f4
mov edi, str._NULL_
test ebx, ebx
je 0x4e8302
mov eax, dword [ebx]
push eax
call sub.WSOCK32.dll_inet_ntoa
jmp 0x4e8307
mov eax, str._NULL_
push edi
push eax
lea ecx, [esp + 0x18]
push str._EXITING__GetHostEntry_inaddr_s_:__s
push ecx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], 0x1ff
mov dword [esp + 0x28], 0x28
call fcn.004e1a20
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x4e8880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dc193
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x62fda0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x34]
push 0
push edi
lea ecx, [esi + 4]
mov dword [esi], vtable.PzExtAuthClient.0
call fcn.004d8b90
mov eax, dword [esp + 0x30]
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], 0
push 0
lea ecx, [esi + 0x2c]
mov dword [esp + 0x2c], 0
mov dword [esi], vtable.PzExtAuthClient_ww.0
call fcn.004d8810
mov ecx, dword [0x630a04]
mov byte [esp + 0x28], 1
test ecx, ecx
je 0x4e8942
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0x14
jl 0x4e8942
mov ecx, dword [esp + 0x38]
test ecx, ecx
jne 0x4e890b
mov ecx, 0x5ecac2
mov eax, edi
test edi, edi
jne 0x4e8916
mov eax, 0x5ecac2
push ecx
push eax
lea ecx, [esp + 0x18]
push str._ENTER__PzExtAuthClient_ww::PzExtAuthClient_ww__hostname_s__package_s_
push ecx
mov dword [esp + 0x20], str..._xauthc.cpp
mov dword [esp + 0x24], 0xaf
mov dword [esp + 0x28], 0x14
call fcn.004e1a20
add esp, 0x10
call fcn.004ec930
mov ecx, eax
mov dword [esi + 0x28], eax
call fcn.004ebd70
push str.OZ_AUTH_TYPE
call fcn.004ea000
mov edi, eax
add esp, 4
test edi, edi
je 0x4e8972
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e8967
sub eax, edx
jne 0x4e8977
mov edi, str.NTLM
mov ecx, dword [0x630a04]
test ecx, ecx
je 0x4e89c3
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0x32
jl 0x4e89c3
mov eax, edi
test edi, edi
jne 0x4e8998
mov eax, str._null_
push eax
lea ecx, [esp + 0x14]
push str.__auth_type:__s
push ecx
mov dword [esp + 0x1c], str..._xauthc.cpp
mov dword [esp + 0x20], 0xbd
mov dword [esp + 0x24], 0x32
call fcn.004e1a20
add esp, 0xc
mov edx, dword [esi + 0x28]
mov eax, dword [edx]
mov edx, dword [eax + 0x44]
lea ecx, [esi + 0x24]
push ecx
push edi
call edx
mov ecx, dword [0x630a04]
test ecx, ecx
je 0x4e8a12
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x28
jl 0x4e8a12
lea eax, [esp + 0x10]
push str._EXIT__PzExtAuthClient_ww::PzExtAuthClient_ww
push eax
mov dword [esp + 0x18], str..._xauthc.cpp
mov dword [esp + 0x1c], 0xc1
mov dword [esp + 0x20], 0x28
call fcn.004e1a20
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0xc
Function at 0x4e9f50
Capabilities:
Get hostname

Disassembly:
mov ecx, dword [0x630a04]
sub esp, 0x10
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
test ecx, ecx
je 0x4e9f9f
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp eax, 0x14
jl 0x4e9f9f
push esi
push edi
lea eax, [esp + 0x10]
push str._ENTERING__PzGetHostName_buff_p__size_u_
push eax
mov dword [esp + 0x18], str..._xutil.cpp
mov dword [esp + 0x1c], 0x24d
mov dword [esp + 0x20], 0x14
call fcn.004e1a20
add esp, 0x10
push esi
push edi
call sub.WSOCK32.dll_gethostname
mov ecx, dword [0x630a04]
mov esi, eax
test ecx, ecx
je 0x4e9ff3
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0x28
jl 0x4e9ff3
test edi, edi
jne 0x4e9fc7
mov edi, str._null_
push esi
push edi
lea ecx, [esp + 0x10]
push str._EXITING__PzGetHostName_buff_s_:__d
push ecx
mov dword [esp + 0x18], str..._xutil.cpp
mov dword [esp + 0x1c], 0x251
mov dword [esp + 0x20], 0x28
call fcn.004e1a20
add esp, 0x10
pop edi
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x4ee430
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x5dc548
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x62fda0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x20], esi
call fcn.004f74b0
lea ecx, [esi + 0x14]
mov dword [esp + 0x80], 0
mov dword [esi], vtable.ZgeoArc.0
call fcn.004fd440
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov ebx, dword [ebp + 0x10]
mov dword [esi + 4], eax
mov ecx, dword [edi + 4]
mov dword [esi + 8], ecx
mov edx, dword [ebx]
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 4]
push ecx
push edi
mov dword [esi + 0x10], eax
call fcn.004f9950
fst qword [esp + 0x30]
add esp, 4
fstp qword [esp]
call fcn.004f9fa0
add esp, 8
test eax, eax
je 0x4ee560
mov eax, dword [edi]
cmp dword [ebx], eax
jne 0x4ee520
mov edx, dword [edi + 4]
cmp dword [ebx + 4], edx
jne 0x4ee520
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx]
cmp ecx, eax
jne 0x4ee4dd
cmp dword [ebx + 4], edx
je 0x4ee520
mov eax, dword [ebx + 4]
sub ecx, dword [edi]
sub eax, edx
push eax
push ecx
lea ecx, [esp + 0x44]
call fcn.004edd90
push eax
lea ecx, [esi + 0x14]
call fcn.00505d10
push ebx
mov ecx, edi
call fcn.005b87c0
fld qword [0x5ecc78]
fmul st(1), st(0)
faddp st(1)
call fcn.005bd3f0
mov edx, 2
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], dx
jmp 0x4ee61b
fldz
sub esp, 0x10
fst qword [esp + 8]
lea ecx, [esp + 0x4c]
fstp qword [esp]
mov dword [esi + 0x1c], 0
call fcn.004ede50
push eax
lea ecx, [esi + 0x14]
call fcn.00505d10
push 0x305
call fcn.005bbd50
mov eax, 1
add esp, 4
mov word [esi + 0x20], ax
jmp 0x4ee61b
fldz
fcomp qword [esp + 0x24]
fnstsw ax
test ah, 5
jp 0x4ee575
xor ecx, ecx
mov word [esi + 0x20], cx
jmp 0x4ee57e
mov edx, 1
mov word [esi + 0x20], dx
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
push edx
push edi
call fcn.004fcb90
fild dword [esi + 4]
add esp, 4
fsubr qword [esp + 0x3c]
fst qword [esp + 0x34]
fild dword [esi + 8]
fsubr qword [esp + 0x44]
fst qword [esp + 0x4c]
fstp qword [esp + 8]
fstp qword [esp]
call fcn.004fc960
fld qword [0x5ecc78]
add esp, 0x10
fadd st(1), st(0)
fxch st(1)
call fcn.005bd3f0
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
mov dword [esi + 0x1c], eax
fdivr qword [0x5fa9c0]
fld qword [esp + 0x24]
fmul st(1)
fxch st(1)
fmul qword [esp + 0x3c]
fldz
fcom st(2)
fnstsw ax
fxch st(2)
test ah, 0x41
jp 0x4ee5f8
fadd st(3)
jmp 0x4ee5fa
fsub st(3)
call fcn.005bd3f0
fcom st(1)
mov dword [esi + 0x14], eax
fnstsw ax
fstp st(1)
test ah, 1
jne 0x4ee611
faddp st(1)
jmp 0x4ee613
fsubrp st(1)
call fcn.005bd3f0
mov dword [esi + 0x18], eax
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ee9e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dc768
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x62fda0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004f74b0
lea edi, [esi + 0x14]
mov ecx, edi
mov dword [esp + 0x18], 0
mov dword [esi], vtable.ZgeoArc.0
call fcn.004fd440
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov dword [esi + 4], ecx
mov edx, dword [eax + 4]
mov ecx, dword [esp + 0x28]
mov dword [esi + 8], edx
mov edx, dword [ecx]
mov dword [esi + 0xc], edx
mov ecx, dword [ecx + 4]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x1c], edx
mov word [esi + 0x20], cx
mov edx, dword [esi + 0xc]
cmp edx, dword [esi + 4]
jne 0x4eea6a
mov edx, dword [esi + 0x10]
cmp edx, dword [esi + 8]
jne 0x4eea6a
or ecx, 2
mov word [esi + 0x20], cx
mov ecx, dword [esp + 0x24]
fild dword [esp + 0x2c]
mov edx, dword [ecx]
sub edx, dword [eax]
fdivr qword [0x5fa9c0]
mov ecx, dword [ecx + 4]
sub ecx, dword [eax + 4]
mov dword [esp + 0x2c], edx
fild dword [esp + 0x2c]
mov dword [esp + 0x2c], ecx
fmul st(1)
fild dword [esp + 0x2c]
fmulp st(2)
fldz
fcom st(1)
fnstsw ax
fld qword [0x5ecc78]
test ah, 0x41
jp 0x4eeaab
fadd st(2), st(0)
jmp 0x4eeaad
fsub st(2), st(0)
fxch st(2)
call fcn.005bd3f0
fcomp st(2)
mov dword [edi], eax
fnstsw ax
test ah, 0x41
jp 0x4eeac3
faddp st(1)
jmp 0x4eeac5
fsubp st(1)
call fcn.005bd3f0
mov dword [esi + 0x18], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14

Function at 0x4f18d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dc678
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x62fda0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x40]
push esi
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.004fb500
add esp, 0xc
mov edi, eax
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0xc], ecx
mov edx, dword [edi + 0x10]
lea ecx, [edi + 0x14]
mov dword [esi + 0x10], edx
mov eax, dword [edi + 0x1c]
push ecx
lea ecx, [esi + 0x14]
mov dword [esp + 0x3c], 0
mov dword [esi + 0x1c], eax
call fcn.00505d10
mov dx, word [edi + 0x20]
lea ecx, [esp + 0xc]
mov word [esi + 0x20], dx
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0xc], vtable.ZgeoArc.0
call fcn.004f74c0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
Function at 0x4f5a00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5dc930
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x62fda0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x20]
call fcn.004f74b0
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x10]
mov edi, vtable.ZgeoLine.0
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.004f74b0
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x44]
cdq
sub eax, edx
mov esi, eax
push 0
sar esi, 1
push esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 1
call fcn.004f55c0
push 1
push esi
lea ecx, [esp + 0x14]
call fcn.004f55c0
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax], edx
mov edx, dword [esp + 0x2c]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x10]
mov dword [eax + 0x1c], ecx
lea ecx, [esp + 0xc]
mov dword [eax + 0x18], edx
mov byte [esp + 0x3c], 0
mov dword [esp + 0xc], edi
call fcn.004f74c0
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x20], edi
call fcn.004f74c0
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 8
Function at 0x4f9280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dcaf1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x62fda0]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x62fda0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
mov edi, ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
call fcn.004fbc90
lea eax, [esp + 0x14]
push eax
mov ecx, edi
mov dword [esp + 0x34], 1
call fcn.004f88e0
test eax, eax
jne 0x4f92fc
mov ecx, edi
call fcn.00457680
push eax
mov ecx, edi
call fcn.00457680
push eax
mov ecx, esi
call fcn.004f4810
jmp 0x4f9306
push esi
lea ecx, [esp + 0x18]
call fcn.004fb940
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 1
mov byte [esp + 0x30], 0
call fcn.004fc5f0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005bd2c6
add esp, 0x28
ret 4

Function at 0x4faf90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5dcbb8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x62fda0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
fld qword [0x5faa68]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
fstp qword [esp + 0x1c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
jle 0x4fb022
mov esi, dword [ebp + 8]
lea eax, [edi + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
push esi
call fcn.005b87c0
fild dword [edi + 0x10]
fcom st(1)
fnstsw ax
test ah, 0x41
jnp 0x4fb057
fsubrp st(1)
fcom qword [esp + 0x1c]
fnstsw ax
test ah, 5
jp 0x4fb017
mov ecx, dword [esi]
fstp qword [esp + 0x1c]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
jmp 0x4fb019
fstp st(0)
inc ebx
add esi, 8
cmp ebx, dword [ebp + 0xc]
jl 0x4fafe1
mov eax, dword [ebp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov edx, dword [edi]
mov edx, dword [edx + 0x50]
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0xc]
fstp st(1)
mov ecx, dword [esp + 0x10]
fstp st(0)
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.004f2bd0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x44], 0
call fcn.004f9550
lea ecx, [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.004f2cc0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4fb2f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dcbf0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebp
push esi
push edi
mov eax, dword [0x62fda0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x14], edx
lea edx, [esp + 0x10]
mov dword [esp + 0x18], eax
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], ecx
inc esi
push eax
lea ecx, [esp + 0x30]
sar esi, 1
call fcn.004f5440
mov edi, dword [esp + 0x68]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x60]
push edi
push ecx
push edx
lea ecx, [esp + 0x34]
mov dword [esp + 0x64], 0
call fcn.005039a0
mov ebp, eax
sub ebp, esi
test ebp, ebp
jle 0x4fb3d7
lea eax, [edi + 8]
push eax
push edi
lea ecx, [esp + 0x44]
call fcn.004f5440
neg esi
push esi
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x44]
mov byte [esp + 0x60], 1
call fcn.004f5ce0
mov edx, dword [eax]
mov dword [edi], edx
mov eax, dword [eax + 4]
lea ecx, [esp + 0x3c]
mov dword [edi + 4], eax
mov byte [esp + 0x58], 0
call fcn.004f54b0
lea ecx, [esp + 0x28]
mov dword [esp + 0x58], 0xffffffff
call fcn.004f54b0
mov eax, ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0xc
mov eax, dword [edi + 8]
mov dword [edi], eax
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x28]
mov dword [edi + 4], eax
mov dword [esp + 0x58], 0xffffffff
call fcn.004f54b0
xor eax, eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0xc