joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441350
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4a7ba0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
lea ecx, [esp + 0x14]
call fcn.0045ffb0
lea eax, [esp + 8]
push 4
push eax
push 0x4c6fc8
xor ebx, ebx
push str.SoftwareCCRRFonline
push reloc.WS2_32.dll_bind
lea ecx, [esp + 0x28]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x1c], ebx
call fcn.0045fff0
mov esi, 0x4c6fc4
lea eax, [esp + 8]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4413c9
cmp cl, bl
je 0x4413c5
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4413c9
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4413a5
xor eax, eax
jmp 0x4413ce
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4413f4
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.0045ffe0
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
push ebp
push edi
push 0x4c6fc4
push 0x4c6fc8
push str.SoftwareCCRRFonline
push reloc.WS2_32.dll_bind
lea ecx, [esp + 0x2c]
call fcn.004600a0
push str.MovieEvent
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 1
push str.RFAviPlayer.exe_.SndBgmPrologue.avi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e8
push edi
call ebp
test eax, eax
je 0x441461
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push str.RFAviPlayer
push ebx
call esi
test eax, eax
je 0x441461
push 0x3e8
push edi
call ebp
test eax, eax
jne 0x441449
push 0x3e8
push edi
call ebp
xor eax, eax
push str..R3Engine.ini
mov dword [esp + 0x29], eax
lea ecx, [esp + 0x28]
push 0xc
mov dword [esp + 0x31], eax
push ecx
push 0x4c6f80
mov word [esp + 0x3d], ax
push str.AviPlayCodec
push 0x4c6f6c
mov byte [esp + 0x3c], bl
mov byte [esp + 0x47], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, str.FALSE
lea eax, [esp + 0x24]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4414ce
cmp cl, bl
je 0x4414ca
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4414ce
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4414aa
xor eax, eax
jmp 0x4414d3
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x44153f
lea eax, [esp + 0x18]
push 0x41
push eax
call fcn.0044c950
mov ecx, eax
call fcn.0044c9a0
mov esi, dword [eax]
lea ecx, [esp + 0x14]
push ebx
push ecx
mov byte [esp + 0x40], 1
call fcn.0044c950
mov ecx, eax
call fcn.0044c9a0
mov eax, dword [eax]
push ebx
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x14]
call fcn.0049da16
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], bl
call fcn.0049da16
push str..R3Engine.ini
push 0x4d11a0
push str.AviPlayCodec
push 0x4c6f6c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x7d0
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0045ffe0
mov ecx, dword [esp + 0x30]
pop edi
pop ebp
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x443e40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
xor eax, eax
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 6
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebx + 0x435f4]
push str._5__SendLoginAccept_Normal
push eax
call fcn.0044a930
push eax
call fcn.0044abc0
mov edi, dword [ebx + 0x435ec]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x1d]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x435f0]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov ax, word [ebx + 0x435e2]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [ebx + 0x435e0]
lea esi, [esp + 0x10]
mov edi, 0x1b
mov dl, byte [esi]
add dl, cl
xor dl, al
mov byte [esi], dl
inc esi
dec edi
jne 0x443ed6
call fcn.00461c20
mov ecx, eax
call fcn.00461cb0
test eax, eax
je 0x443f05
mov eax, dword [ebx + 0x435f4]
push str._5__SERVER_TYPE_TEST
mov byte [esp + 0x2e], 1
push eax
jmp 0x443f16
mov ecx, dword [ebx + 0x435f4]
push str._5__SERVER_TYPE_REGULAR
mov byte [esp + 0x2e], 0
push ecx
call fcn.0044a930
push eax
call fcn.0044abc0
mov ecx, dword [ebx + 0x43550]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0xe]
push 0x1b
push edx
push eax
push 0
mov byte [esp + 0x1e], 0x15
mov byte [esp + 0x1f], 3
call fcn.0047dd90
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x44acf0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4a80d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push 0x4c2858
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0
call fcn.00498aa2
push 0
push 0x5c
lea ecx, [esp + 0x20]
call fcn.0049deeb
mov esi, eax
cmp esi, 0xffffffff
je 0x44ad6c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 8]
push esi
push eax
lea ecx, [esp + 0x24]
call fcn.004985b0
mov eax, dword [eax]
push 0
push eax
call edi
lea ecx, [esp + 8]
call fcn.0049da16
inc esi
lea ecx, [esp + 0x1c]
push esi
push 0x5c
call fcn.0049deeb
mov esi, eax
cmp esi, 0xffffffff
jne 0x44ad38
pop edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.0049da16
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x44e8a0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 1
call fcn.0044e940
push esi
push 0
push 0x44e8e0
call fcn.004897a2
add esp, 0xc
cmp eax, 0xffffffff
jne 0x44e8cc
push 0
mov ecx, esi
call fcn.0044e940
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
Function at 0x454480
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4a82b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
mov dword [edi], 0x4ad704
mov dword [esp + 0x28], 2
call fcn.00457700
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [edi + 0x34]
mov esi, dword [edi + 0x30]
cmp esi, ebx
mov byte [esp + 0x28], 1
je 0x4544d9
mov ecx, esi
call fcn.0049da16
add esi, 4
cmp esi, ebx
jne 0x4544cb
mov eax, dword [edi + 0x30]
push ebp
push eax
call fcn.0049d780
xor ebx, ebx
lea esi, [edi + 0x1c]
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov ebp, dword [esi + 4]
mov ecx, dword [esi + 0xc]
add esp, 4
mov eax, dword [ebp]
cmp ecx, ebx
mov byte [esp + 0x2c], bl
mov dword [esp + 0x10], eax
je 0x454546
mov ecx, eax
cmp eax, ecx
jne 0x454546
cmp ebp, ebp
jne 0x454546
mov eax, dword [ebp + 4]
mov ecx, esi
push eax
call fcn.00458980
mov ecx, dword [esi + 4]
mov edx, dword [0x4e2468]
mov dword [ecx + 4], edx
mov eax, dword [esi + 4]
mov dword [esi + 0xc], ebx
mov ecx, esi
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
lea eax, [esp + 0x1c]
push eax
call fcn.004580a0
jmp 0x454570
cmp eax, ebp
je 0x454570
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
call fcn.00458ce0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.00458540
mov eax, dword [esp + 0x10]
cmp eax, ebp
jne 0x45454a
mov eax, dword [esi + 4]
push eax
call fcn.0049d780
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esp + 0x14]
xor esi, esi
call fcn.00494a4c
mov eax, dword [0x4e2464]
pop ebp
dec eax
mov dword [0x4e2464], eax
jne 0x4545a7
mov esi, dword [0x4e2468]
mov dword [0x4e2468], ebx
lea ecx, [esp + 0x10]
call fcn.00494ae8
cmp esi, ebx
je 0x4545bd
push esi
call fcn.0049d780
add esp, 4
lea ecx, [edi + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.0049da16
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x455fa0
Capabilities:
Connect to http server
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x4a8528
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
push 0
push 0
push 0
push 0
push 0x4c9650
mov dword [esp + 0x28], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [esp + 0x1c]
test eax, eax
mov dword [esi], eax
jne 0x456005
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 0xffffffff
call fcn.0049da16
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
mov eax, dword [0x4c92fc]
mov ecx, dword [esp + 0x24]
mov edx, dword [edi + 4]
and eax, 0xffff
push eax
push ecx
push str.ConnectFtp_:__s__d
push edx
call fcn.0044a930
push eax
call fcn.0044abc0
mov ecx, dword [esi]
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionA]
add esp, 0x14
lea eax, [esp + 8]
mov dword [esp + 8], 0x1388
push 4
push eax
push 2
push ecx
call edi
mov eax, dword [esi]
lea edx, [esp + 8]
push 4
push edx
push 5
push eax
call edi
mov edx, dword [esi]
lea ecx, [esp + 8]
push 4
push ecx
push 6
push edx
call edi
mov ecx, dword [esi]
lea eax, [esp + 8]
push 4
push eax
push 7
push ecx
call edi
mov eax, dword [esi]
lea edx, [esp + 8]
push 4
push edx
push 8
push eax
call edi
mov cx, word [0x4c92fc]
mov edx, dword [esp + 0x24]
mov eax, dword [esi]
push 0
push 0
push 1
push 0x4d11a0
push str.anonymous
push ecx
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ecx, dword [esp + 0x20]
test eax, eax
mov dword [ecx], eax
jne 0x4560df
mov edx, dword [esi]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 0xffffffff
call fcn.0049da16
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 0xffffffff
call fcn.0049da16
mov ecx, dword [esp + 0xc]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x45fff0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x408
lea eax, [esp]
push esi
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x460023
xor eax, eax
pop esi
add esp, 0x408
ret 0x14
mov ecx, dword [esp + 0x41c]
lea eax, [esp + 0x420]
push eax
mov eax, dword [esp + 0x41c]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x460086
push 0
lea eax, [esp + 0x10]
push 0x400
push eax
push 0
push esi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
xor eax, eax
pop esi
add esp, 0x408
ret 0x14
mov eax, 1
pop esi
add esp, 0x408
ret 0x14

Function at 0x4600a0
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push edi
lea eax, [esp + 0xc]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [esp + 0x14]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
je 0x4600f4
xor eax, eax
ret 0x10
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret 0x10
Function at 0x465e60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a8abf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x4cd448]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov edx, dword [ecx + 0xc]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 4]
push edx
push eax
push ecx
lea edx, [esp + 0x10]
push str._d_x__d_x__d
push edx
mov dword [esp + 0x28], 1
call fcn.004989ae
mov esi, dword [esp + 0x30]
add esp, 0x14
lea eax, [esp + 4]
mov ecx, esi
push eax
call fcn.0049d78b
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.0049da16
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x465ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a8b08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov eax, dword [0x4cd448]
mov dword [esp + 0x1c], 0
mov dword [esp + 8], eax
lea ecx, [esp + 0x24]
mov bl, 1
push ecx
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], bl
call fcn.0049db4f
push 0x78
lea ecx, [esp + 0xc]
call fcn.0049dedd
push eax
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [esp + 0x14]
call fcn.0049851a
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.0049db4f
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.0049da16
lea ecx, [esp + 8]
call fcn.00498a56
lea ecx, [esp + 8]
call fcn.00498b4d
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push 0xa
push eax
push ecx
mov dword [esp + 0x18], 0
call fcn.004899bf
mov edx, dword [esp + 0x30]
add esp, 0xc
mov dword [esi + 4], eax
lea ecx, [esp + 0x24]
mov eax, dword [edx - 8]
push eax
push 0x78
call fcn.0049dedd
inc eax
lea ecx, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0049851a
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 3
call fcn.0049db4f
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.0049da16
push 0x78
lea ecx, [esp + 0xc]
call fcn.0049dedd
push eax
lea ecx, [esp + 0x14]
push 0
push ecx
lea ecx, [esp + 0x14]
call fcn.0049851a
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 4
call fcn.0049db4f
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.0049da16
lea ecx, [esp + 8]
call fcn.00498a56
lea ecx, [esp + 8]
call fcn.00498b4d
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push 0xa
push edx
push eax
call fcn.004899bf
mov ecx, dword [esp + 0x30]
add esp, 0xc
mov dword [esi + 8], eax
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x24]
push eax
push 0x78
call fcn.0049dedd
inc eax
lea edx, [esp + 0x14]
push eax
push edx
lea ecx, [esp + 0x30]
call fcn.0049851a
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 5
call fcn.0049db4f
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.0049da16
mov eax, dword [esp + 8]
lea ecx, [esp + 8]
mov eax, dword [eax - 8]
push eax
push 0x78
call fcn.0049dedd
inc eax
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.0049851a
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 6
call fcn.0049db4f
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.0049da16
lea ecx, [esp + 8]
call fcn.00498a56
lea ecx, [esp + 8]
call fcn.00498b4d
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push 0xa
push edx
push eax
call fcn.004899bf
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esi + 0xc], eax
mov byte [esp + 0x1c], 0
call fcn.0049da16
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0049da16
mov ecx, dword [esp + 0x14]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x46864b
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4a8c58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [str.LauncherMessage.ini]
push esi
mov esi, ecx
push ecx
mov ecx, esp
mov dword [esp + 8], esp
push eax
call fcn.0049da84
lea ecx, [esp + 8]
push ecx
call fcn.004105d0
add esp, 8
mov ecx, eax
mov dword [esp + 0x10], 0
call fcn.004125b0
push eax
push 0
push 0x4cae5c
push str.SERVER_OPEN_PLAN
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 4]
mov byte [esi + 0x1b85], al
mov dword [esp + 0x10], 0xffffffff
call fcn.0049da16
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x46f920
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
mov ecx, dword [esi + 0x198]
push ecx
mov ecx, esi
call fcn.0046fb10
mov edx, dword [esi + 0x19c]
mov dword [esi + 0x198], eax
and eax, 0xff
mov ecx, esi
add eax, edx
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x19c], eax
shr eax, 0x18
mov byte [esp + 8], al
mov eax, dword [esi + 0x1a0]
mov edx, dword [esp + 8]
push edx
push eax
call fcn.0046fb10
mov dword [esi + 0x1a0], eax
pop esi
ret 4

Function at 0x470060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a9215
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x38]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0xc], ebx
call fcn.0049da84
mov eax, dword [esp + 0x48]
mov dword [esp + 0x30], 1
test eax, eax
jne 0x4700a4
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0x10]
call fcn.0049da84
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x30], 2
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4700db
mov esi, dword [esp + 0x38]
lea edx, [esp + 0x40]
push edx
mov ecx, esi
call fcn.0049d78b
mov dword [esp + 8], 1
jmp 0x470209
mov eax, dword [esp + 0x40]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x470104
push 0x4cb3b4
lea ecx, [esp + 0x44]
call fcn.004989c1
mov cl, byte [0x4ad8c8]
push ecx
lea ecx, [esp + 0x44]
call fcn.0049de19
push 0x4cb3b4
lea ecx, [esp + 0x10]
call fcn.004989c1
mov eax, dword [0x4cd448]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push edx
mov byte [esp + 0x34], 7
mov dword [esp + 0x14], 0x4ad884
call fcn.004768e0
mov al, byte [esp + 0x44]
mov byte [esp + 0x30], 8
test al, al
je 0x47017e
mov al, byte [esi + 4]
test al, al
je 0x470178
lea eax, [esp + 0x48]
lea ecx, [esp + 0x10]
push eax
call fcn.00476ae0
mov ebx, 2
mov dword [esp + 8], ebx
mov byte [esp + 0x30], 9
jmp 0x4701a0
lea eax, [esp + 0xc]
jmp 0x4701a0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x44]
push ecx
push edx
mov ecx, esi
call fcn.0046fcc0
mov ebx, 4
mov dword [esp + 8], ebx
mov dword [esp + 0x30], 0xa
push eax
lea ecx, [esp + 0x44]
call fcn.0049de2e
test bl, 4
mov dword [esp + 0x30], 9
je 0x4701c7
and ebx, 0xfffffffb
lea ecx, [esp + 0x44]
mov dword [esp + 8], ebx
call fcn.0049da16
test bl, 2
mov dword [esp + 0x30], 8
je 0x4701e4
and ebx, 0xfffffffd
lea ecx, [esp + 0x48]
mov dword [esp + 8], ebx
call fcn.0049da16
mov esi, dword [esp + 0x38]
lea eax, [esp + 0x40]
push eax
mov ecx, esi
call fcn.0049d78b
or ebx, 1
lea ecx, [esp + 0x10]
mov dword [esp + 8], ebx
mov byte [esp + 0x30], 2
call fcn.00476860
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call fcn.0049da16
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], 0
call fcn.0049da16
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x14
Function at 0x473350
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4a97a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov ecx, dword [ecx + 0x1c]
lea edx, [esp]
push edx
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, dword [esp]
mov dword [esp + 0x28], 0
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4733aa
lea ecx, [esp]
mov dword [esp + 0x28], 0xffffffff
call fcn.0049da16
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov eax, dword [0x4cd448]
push esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
push ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 5
mov dword [esp + 0x10], 0x4ad884
call fcn.004768e0
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x30], 6
call fcn.0046f350
mov eax, dword [eax]
mov byte [esp + 0x2c], 7
push eax
call fcn.00473910
add esp, 4
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x2c], 6
call fcn.0049da16
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.00476860
lea ecx, [esp + 4]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0049da16
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x473440
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a97f0
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
mov edi, eax
mov esi, ecx
and edi, 0xffff
test ax, ax
mov dword [esi + 0x50], edi
je 0x473569
mov ecx, dword [esi + 0x1c]
lea edx, [esp + 0x34]
push edx
mov eax, dword [ecx]
call dword [eax + 0x24]
mov eax, dword [esi + 0x20]
mov dword [esp + 0x2c], 0
cmp eax, 3
jne 0x4734aa
mov eax, dword [esp + 0x34]
push eax
call fcn.00473b90
add esp, 4
neg al
sbb eax, eax
add eax, 2
mov dword [esi + 0x20], eax
jmp 0x4734b1
mov dword [esi + 0x20], 2
cmp dword [esi + 0x20], 1
jne 0x4734c9
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x4734cc
push 0x67
mov ecx, esi
call fcn.00472b50
jmp 0x4734cc
mov dword [esi + 0x28], edi
mov eax, dword [0x4cd448]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x34]
mov byte [esp + 0x2c], 5
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x4ad884
call fcn.004768e0
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
mov byte [esp + 0x30], 6
call fcn.00473590
push eax
lea ecx, [esi + 0x2c]
mov byte [esp + 0x30], 7
call fcn.0049db4f
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 6
call fcn.0049da16
lea ecx, [esi + 0x3c]
call fcn.004708c0
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.00476860
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0049da16
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x20], 0
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4