joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d6600
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [esp + 4]
test al, al
mov byte [ecx + 0x19], al
je 0x4d661a
mov eax, dword [ecx + 4]
push 5
push eax
call dword [sym.imp.user32.dll_ShowWindow]
ret 4
mov ecx, dword [ecx + 4]
push 0
push ecx
call dword [sym.imp.user32.dll_ShowWindow]
ret 4

Function at 0x4d8ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5910e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], 0x5ac300
mov dword [esi + 4], 0x5ac2fc
mov dword [esi + 8], 0x5ac2f8
mov dword [esi + 0x50], 0x5ac2f4
mov eax, dword [esi + 0x68]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x24], 3
je 0x4d8b26
push eax
call fcn.004796fd
add esp, 4
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov eax, dword [esi + 0x58]
cmp eax, ebx
je 0x4d8b3f
push eax
call fcn.004796fd
add esp, 4
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov eax, dword [esi + 0x30]
cmp eax, ebx
je 0x4d8b58
push eax
call fcn.004796fd
add esp, 4
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
lea edi, [esi + 0x20]
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.004d8030
mov eax, dword [edi + 4]
push eax
call fcn.004796fd
add esp, 4
lea ecx, [esi + 0xc]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.004b8e40
mov dword [esi + 8], 0x5ac2e8
mov dword [0x5f4988], ebx
mov ecx, esi
mov dword [esi + 4], 0x5ac2e4
mov dword [esp + 0x24], 0xffffffff
call fcn.004c5e20
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x4d9350
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov eax, dword [0x627c2c]
push esi
push 0
push 0
push 0
push 0
mov esi, ecx
mov edx, dword [esi + 0x1060]
push eax
lea ecx, [esi + 0x814]
push ecx
push 0
push edx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [esi + 0x1034]
jl 0x4d939d
mov eax, dword [esp + 8]
push 0
push 4
push 0x15
push eax
call sub.imm32.dll_ImmNotifyIME
mov dword [0x627c34], 0
pop esi
ret 4
mov ecx, dword [esp + 8]
push 0x800
add esi, 0x14
push esi
push 8
push ecx
call sub.imm32.dll_ImmGetCompositionStringW
shr eax, 1
mov dword [0x627c34], eax
pop esi
ret 4

Function at 0x4d93c0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x400
push esi
push 0x400
lea eax, [esp + 8]
push eax
push 0x10
push ecx
call sub.imm32.dll_ImmGetCompositionStringW
mov esi, eax
xor ecx, ecx
test esi, esi
jle 0x4d93f8
mov dl, byte [esp + ecx + 4]
cmp dl, 1
je 0x4d93f8
cmp dl, 3
je 0x4d93f8
inc ecx
cmp ecx, esi
jl 0x4d93e5
cmp ecx, esi
mov edx, ecx
jge 0x4d9423
mov al, byte [esp + ecx + 4]
cmp byte [esp + edx + 4], al
jne 0x4d940d
inc edx
cmp edx, esi
jl 0x4d9402
mov dword [0x627c28], ecx
mov dword [0x627c24], edx
pop esi
add esp, 0x400
ret 4
mov dword [0x627c28], ecx
mov dword [0x627c24], edx
pop esi
add esp, 0x400
ret 4
Function at 0x4d94b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x1064]
xor ebx, ebx
cmp eax, 0xe0080404
mov dword [edi + 0x106c], ebx
mov dword [edi + 0x1068], ebx
je 0x4d94eb
cmp eax, 0xe0090404
je 0x4d94eb
cmp eax, 0xe00e0804
jne 0x4d96b2
push 0x3ff
lea ecx, [ebp - 0x410]
push ecx
push eax
call sub.imm32.dll_ImmGetIMEFileNameA
test eax, eax
je 0x4d96b2
cmp dword [edi + 0x1024], ebx
jne 0x4d95b1
mov esi, dword [sym.imp.kernel32.dll_CompareStringA]
push 0xffffffffffffffff
push str.TINTLGNT.IME
push 0xffffffffffffffff
lea edx, [ebp - 0x410]
push edx
push 1
push 0x409
call esi
cmp eax, 2
je 0x4d95b1
push 0xffffffffffffffff
push str.CINTLGNT.IME
push 0xffffffffffffffff
lea eax, [ebp - 0x410]
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x4d95b1
push 0xffffffffffffffff
push str.MSTCIPHA.IME
push 0xffffffffffffffff
lea ecx, [ebp - 0x410]
push ecx
push 1
push 0x409
call esi
cmp eax, 2
je 0x4d95b1
push 0xffffffffffffffff
push str.PINTLGNT.IME
push 0xffffffffffffffff
lea edx, [ebp - 0x410]
push edx
push 1
push 0x409
call esi
cmp eax, 2
je 0x4d95b1
push 0xffffffffffffffff
push str.MSSCIPYA.IME
push 0xffffffffffffffff
lea eax, [ebp - 0x410]
push eax
push 1
push 0x409
call esi
cmp eax, 2
jne 0x4d96b2
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x410]
push edx
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
mov ax, word [edi + 0x1064]
mov word [ebp - 4], ax
je 0x4d96b2
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0047b4d0
mov ecx, dword [ebp - 0xc]
mov ebx, esp
push ebx
push esi
push ecx
lea edx, [ebp - 0x410]
push edx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4d96b2
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0x5a83d4
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4d96b2
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 8]
xor edx, edx
mov dh, al
and eax, 0xffff0000
or edx, eax
shl edx, 8
mov eax, edx
mov edx, dword [edi + 0x1024]
test edx, edx
mov edx, dword [ebp - 4]
jne 0x4d969e
cmp dx, 0x404
jne 0x4d9682
cmp eax, 0x4020000
je 0x4d969e
cmp eax, 0x4030000
je 0x4d969e
cmp eax, 0x4040000
je 0x4d969e
cmp eax, 0x5000000
je 0x4d969e
cmp eax, 0x5010000
je 0x4d969e
cmp eax, 0x5020000
je 0x4d969e
cmp eax, 0x6000000
je 0x4d969e
lea esp, [ebp - 0x41c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dx, 0x804
jne 0x4d96b2
cmp eax, 0x4010000
je 0x4d969e
cmp eax, 0x4020000
je 0x4d969e
cmp eax, 0x5030000
jne 0x4d96b2
movzx edx, dx
or edx, eax
mov dword [edi + 0x1068], edx
mov eax, dword [ecx + 0xc]
mov dword [edi + 0x106c], eax
lea esp, [ebp - 0x41c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d96c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ecx + 0x1064]
sub esp, 0x114
cmp eax, 0xe00e0804
je 0x4d97f1
cmp eax, 0xe0090404
je 0x4d97f1
mov eax, dword [ecx + 0x1068]
test eax, eax
je 0x4d97f1
mov ecx, eax
push ebx
and ecx, 0xffff
xor bl, bl
cmp ecx, 0x404
jne 0x4d97fa
push ebp
push esi
push edi
mov ecx, 0xa
mov esi, str.softwaremicrosoftwindowscurrentversion_
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
and eax, 0xffff0000
movsw word es:[edi], word [esi]
mov ebp, eax
cmp ebp, 0x5010000
movsb byte es:[edi], byte [esi]
mov eax, str.MSTCIPH
jae 0x4d9736
mov eax, str.TINTLGNT
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d9738
lea edi, [esp + 0x20]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d9746
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x10]
push edx
push 0x20019
mov ecx, eax
push 0
lea eax, [esp + 0x2c]
push eax
and ecx, 3
push SysReAllocString
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d97e4
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push str.Keyboard_Mapping
push ecx
mov dword [esp + 0x30], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x4d97d9
cmp ebp, 0x5000000
mov al, byte [esp + 0x14]
ja 0x4d97bf
cmp al, 0x22
je 0x4d97d7
cmp al, 0x23
je 0x4d97d7
cmp ebp, 0x5010000
je 0x4d97cf
cmp ebp, 0x5020000
jne 0x4d97d9
cmp al, 0x22
jb 0x4d97d9
cmp al, 0x24
ja 0x4d97d9
mov bl, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x114
ret
mov al, 1
add esp, 0x114
ret
mov al, bl
pop ebx
add esp, 0x114
ret
Function at 0x4d98d0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov di, word [esi + 0x1064]
movzx ecx, di
mov eax, ecx
and eax, 0x3ff
sub eax, 4
mov edx, 0x5e1850
je 0x4d992a
sub eax, 0xd
je 0x4d9917
dec eax
je 0x4d9904
mov dword [esi + 0x1074], edx
jmp 0x4d996b
mov byte [esi + 0x1071], 0
mov dword [esi + 0x1074], 0x5e1862
jmp 0x4d996b
mov byte [esi + 0x1071], 1
mov dword [esi + 0x1074], 0x5e1868
jmp 0x4d996b
mov eax, ecx
shr eax, 0xa
dec eax
mov byte [esi + 0x1071], 1
je 0x4d9961
dec eax
je 0x4d9944
mov dword [esi + 0x1074], edx
jmp 0x4d996b
mov eax, dword [esi + 0x1068]
test eax, eax
sete al
mov byte [esi + 0x1071], al
mov dword [esi + 0x1074], 0x5e1856
jmp 0x4d996b
mov dword [esi + 0x1074], 0x5e185c
cmp dword [esi + 0x1074], edx
jne 0x4d99ab
push 0xa
lea edx, [esp + 0x1c]
push edx
push 3
push ecx
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
movsx ax, byte [esp + 0x18]
mov ecx, dword [esi + 0x1074]
mov word [ecx], ax
movsx dx, byte [esp + 0x19]
push edx
call fcn.005575e2
mov ecx, dword [esi + 0x1074]
add esp, 4
mov word [ecx + 2], ax
mov edx, dword [esi + 0x1064]
push edx
call sub.imm32.dll_ImmIsIME
test eax, eax
mov eax, dword [esp + 0x28]
push eax
setne bl
call sub.imm32.dll_ImmGetContext
mov ebp, eax
test ebp, ebp
je 0x4d9a2c
and edi, 0x3ff
cmp edi, 4
jne 0x4d99fa
test bl, bl
je 0x4d9a0f
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push ebp
call sub.imm32.dll_ImmGetConversionStatus
mov eax, dword [esp + 0x10]
and al, 1
neg al
sbb eax, eax
add eax, 2
jmp 0x4d9a11
test bl, bl
je 0x4d9a0f
push ebp
call sub.imm32.dll_ImmGetOpenStatus
test eax, eax
je 0x4d9a0f
mov eax, 1
jmp 0x4d9a11
xor eax, eax
mov ecx, dword [esp + 0x28]
push ebp
push ecx
mov dword [esi + 0x1078], eax
call sub.imm32.dll_ImmReleaseContext
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
pop edi
mov dword [esi + 0x1078], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4

Function at 0x4d9b50
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0x800
push esi
push 0x800
lea eax, [esp + 8]
push eax
mov esi, ecx
mov ecx, dword [esp + 0x810]
push 0x800
push ecx
call sub.imm32.dll_ImmGetCompositionStringW
shr eax, 1
test eax, eax
jle 0x4d9b88
push eax
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.004d9a60
pop esi
add esp, 0x800
ret 4
Function at 0x4da0db
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x59118b
push eax
mov dword fs:[0], esp
sub esp, 0x81c
push esi
mov esi, ecx
mov al, byte [esi + 0x107d]
test al, al
je 0x4da1c4
push 0
call dword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
je 0x4da1c4
push ebp
push edi
push 1
call dword [sym.imp.user32.dll_GetClipboardData]
mov edi, eax
push edi
call dword [sym.imp.kernel32.dll_GlobalLock]
mov ecx, eax
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
lea ebp, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4da130
sub ecx, ebp
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00404250
push edi
mov dword [esp + 0x834], 0
call dword [sym.imp.kernel32.dll_GlobalUnlock]
call dword [sym.imp.user32.dll_CloseClipboard]
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4da16b
cmp dword [esp + 0x24], 0x10
jmp 0x4da1b3
mov ecx, dword [esp + 0x24]
mov edi, 0x10
cmp ecx, edi
mov ecx, dword [esp + 0x10]
jae 0x4da180
lea ecx, [esp + 0x10]
push 0x400
lea edx, [esp + 0x2c]
push edx
push eax
mov eax, dword [esi + 0x1060]
push ecx
push 0
push eax
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.004d9a60
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
cmp dword [esp + 0x24], edi
jb 0x4da1c2
mov eax, dword [esp + 0x10]
push eax
call fcn.004796fd
add esp, 4
pop edi
pop ebp
mov ecx, dword [esp + 0x820]
pop esi
mov dword fs:[0], ecx
add esp, 0x828
ret
Function at 0x4dab00
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x591230
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, ecx
lea ebp, [esi + 4]
xor ebx, ebx
mov dword [esi], 0x5ac3f8
push edi
mov dword [esp + 0x10], esi
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov dword [esp + 0x124], ebx
mov dword [esi + 0x1044], ebx
mov dword [esi + 0x1048], ebx
mov dword [esi + 0x104c], ebx
lea edi, [esi + 0x1050]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
push ebx
push ebx
mov ecx, edi
mov byte [esp + 0x12c], 2
mov dword [esi + 0x102c], ebx
call fcn.004c7130
mov dword [0x627c2c], ebx
mov dword [0x627c30], ebx
mov dword [0x627c34], ebx
mov dword [0x627c28], ebx
mov dword [0x627c24], ebx
push 0x20
mov ecx, ebp
mov dword [esi + 0x1038], 1
mov dword [esi + 0x103c], ebx
mov dword [esi + 0x1030], ebx
call fcn.004da6b0
push 0x8000
mov ecx, edi
call fcn.004da780
push 0x105
lea eax, [esp + 0x18]
push eax
mov byte [esi + 0x107c], bl
mov byte [esi + 0x107d], bl
mov byte [esi + 0x107e], bl
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4dac81
lea edi, [esp + 0x14]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4dabf0
mov ecx, dword [str.imm32.dll]
mov edx, dword [0x5ac45c]
mov ax, word [0x5ac460]
mov dword [edi], ecx
mov cl, byte [0x5ac462]
mov dword [edi + 4], edx
lea edx, [esp + 0x14]
mov word [edi + 8], ax
push edx
mov byte [edi + 0xa], cl
call dword [sym.imp.kernel32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 0x1084], eax
je 0x4dac81
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.ImmLockIMC
push eax
call edi
mov dword [esi + 0x1014], eax
mov eax, dword [esi + 0x1084]
push str.ImmUnlockIMC
push eax
call edi
mov ecx, dword [esi + 0x1084]
push str.ImmLockIMCC
push ecx
mov dword [esi + 0x1018], eax
call edi
mov edx, dword [esi + 0x1084]
push str.ImmUnlockIMCC
push edx
mov dword [esi + 0x101c], eax
call edi
mov dword [esi + 0x1020], eax
mov ecx, dword [esp + 0x11c]
pop edi
mov dword [esi + 0x1080], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x118
ret

Function at 0x4dacb0
Capabilities:
Get keyboard layout

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
push 0
mov dword [esi + 0x102c], edi
call dword [sym.imp.user32.dll_GetKeyboardLayout]
push eax
push edi
mov ecx, esi
call fcn.004da9e0
pop edi
pop esi
ret 4

Function at 0x4db5e0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
mov esi, ecx
mov al, byte [esi + 4]
test al, al
je 0x4db5f9
call sub.ws2_32.dll_WSACleanup
mov byte [esi + 4], 0
lea eax, [esp + 4]
push eax
push 0x101
mov byte [esi + 4], 0
call sub.ws2_32.dll_WSAStartup
test eax, eax
je 0x4db61a
xor al, al
pop esi
add esp, 0x190
ret
mov al, 1
mov byte [esi + 4], al
pop esi
add esp, 0x190
ret
Function at 0x4f4cc0
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4f4cd0
sub eax, edx
mov edx, eax
mov eax, 0x1505
mov ecx, 0
je 0x4f4cff
push edi
jmp 0x4f4cf0
movsx edi, byte [ecx + esi]
imul eax, eax, 0x21
add eax, edi
inc ecx
cmp ecx, edx
jb 0x4f4cf0
pop edi
pop esi
ret
Function at 0x514aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x593d18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push 0x10
push str.objectscriptname
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00404250
mov eax, dword [esp + 0x34]
add eax, 4
push eax
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x30], 0
call fcn.004d1aa0
mov ebx, eax
mov eax, dword [esp + 0x1c]
neg ebx
sbb bl, bl
inc bl
cmp eax, 0x10
jb 0x514b1a
mov edx, dword [esp + 8]
push edx
call fcn.004796fd
add esp, 4
mov ecx, dword [esp + 0x20]
xor eax, eax
test bl, bl
sete al
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x51e120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x594260
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x5af238
mov dword [esp + 0xc], esi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
lea ebp, [esi + 0x84]
mov ecx, ebp
mov byte [esp + 0x18], 7
call fcn.004f4da0
mov dword [ebp + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
lea ebp, [esi + 0xb8]
mov ecx, ebp
mov byte [esp + 0x18], 0xa
call fcn.004f4da0
mov dword [ebp + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], edi
lea ebp, [esi + 0xc8]
mov ecx, ebp
mov byte [esp + 0x18], 0xb
call fcn.00474e60
mov dword [ebp + 4], eax
mov ecx, dword [esp + 0x10]
mov byte [eax + 0x11], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], edi
mov eax, 0xff
mov word [esi + 0xb2], ax
mov word [esi + 0xb0], ax
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x51e137
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x594260
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x5af238
mov dword [esp + 0xc], esi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
lea ebp, [esi + 0x84]
mov ecx, ebp
mov byte [esp + 0x18], 7
call fcn.004f4da0
mov dword [ebp + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
lea ebp, [esi + 0xb8]
mov ecx, ebp
mov byte [esp + 0x18], 0xa
call fcn.004f4da0
mov dword [ebp + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], edi
lea ebp, [esi + 0xc8]
mov ecx, ebp
mov byte [esp + 0x18], 0xb
call fcn.00474e60
mov dword [ebp + 4], eax
mov ecx, dword [esp + 0x10]
mov byte [eax + 0x11], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], edi
mov eax, 0xff
mov word [esi + 0xb2], ax
mov word [esi + 0xb0], ax
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x51e840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5942e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
mov eax, 0xf
push ebx
xor ebx, ebx
mov dword [esp + 4], ecx
mov ecx, 0x599e5c
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0xc], bl
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov dword [esp + 0x24], ecx
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x7c]
lea eax, [esp + 8]
push eax
push ecx
mov dword [esp + 0x74], ebx
call fcn.004edc90
add esp, 8
test al, al
jne 0x51e8ca
lea ecx, [esp + 8]
call fcn.0051b0c0
pop ebx
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
add esp, 0x6c
ret 0xc
push edi
mov edi, dword [esp + 0x78]
mov ecx, 0x62b2f4
mov dword [edi + 4], 5
call fcn.0051d1d0
cmp dword [esp + 0x44], 0x10
mov ecx, dword [esp + 0x30]
mov dword [edi + 0x24], eax
jae 0x51e8f2
lea ecx, [esp + 0x30]
push ebp
push esi
push ecx
mov ecx, eax
call fcn.00532fd0
mov esi, dword [esp + 0x84]
fld dword [esi + 0x24]
mov edx, dword [esi + 4]
fadd dword [esi + 8]
mov eax, dword [esi]
push ecx
mov ecx, dword [edi + 0x24]
fstp dword [esp]
push edx
push eax
call fcn.004bf540
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
push ecx
mov ecx, dword [edi + 0x24]
push edx
push eax
call fcn.004bf4f0
mov ecx, dword [edi + 0x24]
call fcn.00532a20
mov ecx, dword [edi + 0x24]
call fcn.00532ab0
mov ecx, dword [edi + 0x24]
call fcn.004bf8b0
xor ebp, ebp
lea ebx, [ebx]
mov al, byte [esi + ebp + 0x10]
cmp al, bl
je 0x51e965
movzx ecx, al
push ecx
mov ecx, dword [edi + 0x24]
push ebp
call fcn.004bf600
inc ebp
cmp ebp, 8
jl 0x51e950
mov eax, dword [esp + 0x6c]
pop esi
cmp eax, 0x10
mov eax, dword [esp + 0x54]
pop ebp
jae 0x51e97e
lea eax, [esp + 0x50]
mov ecx, dword [esp + 8]
push eax
push edi
call fcn.0051dc60
lea ecx, [esp + 0xc]
call fcn.0051b0c0
mov ecx, dword [esp + 0x68]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x6c
ret 0xc