joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d480
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xf0
mov eax, dword [0x4e51e0]
xor eax, esp
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0xf4]
push ebx
xor ebx, ebx
cmp eax, ebx
push ebp
mov ebp, dword [esp + 0x100]
je 0x42d59c
cmp byte [eax], bl
je 0x42d59c
cmp ebp, ebx
je 0x42d59c
cmp ecx, ebx
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
jle 0x42d4fe
push edi
push ecx
push eax
lea edi, [esp + 0x14]
call fcn.00436240
add esp, 8
pop edi
xor eax, eax
mov dword [esp + 0xa5], eax
mov dword [esp + 0xa9], eax
mov dword [esp + 0xad], eax
mov word [esp + 0xb1], ax
mov byte [esp + 0xb3], al
push esi
lea eax, [esp + 0xa8]
push eax
lea esi, [esp + 0x10]
mov byte [esp + 0xac], bl
call fcn.00436300
push 0x3f
lea ecx, [esp + 0xc1]
push ebx
push ecx
mov byte [esp + 0xc8], bl
call fcn.0048ffc0
lea ecx, [esp + 0xc8]
lea eax, [esp + 0xb8]
call fcn.00436440
push 0x40
lea edx, [esp + 0xcc]
push edx
push 0x100
push ebp
call fcn.0048cbb4
add esp, 0x20
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0xec]
xor ecx, esp
call fcn.0048a8fe
add esp, 0xf0
ret
mov ecx, dword [esp + 0xf4]
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0048a8fe
add esp, 0xf0
ret

Function at 0x432c60
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x432c7d
push 0
push eax
call dword [0x4c3364]
test eax, eax
je 0x432c7d
xor eax, eax
pop esi
pop ecx
ret
lea eax, [esp + 4]
push eax
push 4
push esi
push 0x432ce0
push 0
push 0
mov dword [esp + 0x1c], 0
call fcn.0048f13d
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 4], eax
mov esi, ecx
test esi, esi
je 0x432cb5
push eax
call dword [0x4c3178]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x452940
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4bfef1
mov eax, dword fs:[0]
push eax
sub esp, 0x83c
mov eax, dword [0x4e51e0]
xor eax, esp
mov dword [esp + 0x838], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e51e0]
xor eax, esp
push eax
lea eax, [esp + 0x850]
mov dword fs:[0], eax
xor ebx, ebx
push 0x7fe
lea eax, [esp + 0x52]
push ebx
push eax
mov edi, ecx
mov word [esp + 0x58], bx
call fcn.0048ffc0
add esp, 0xc
call dword [0x4c31a0]
push eax
push str.Test_HttpChannel__d
push 0xffffffffffffffff
lea ecx, [esp + 0x58]
push 0x400
push ecx
call fcn.0048b1f2
add esp, 0x14
lea edx, [esp + 0x30]
push edx
call fcn.0045a1f0
mov dword [esp + 0x858], ebx
lea eax, [esp + 0x4c]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4529e0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x50]
push eax
lea esi, [esp + 0x1c]
call fcn.00402270
mov byte [esp + 0x858], 1
mov eax, dword [esp + 0x18]
mov ebp, 8
cmp dword [esp + 0x2c], ebp
jae 0x452a19
lea eax, [esp + 0x18]
push 0x10000000
push ebx
push ebx
push ebx
push eax
call dword [0x4c3654]
cmp eax, ebx
mov dword [esp + 0x30], eax
je 0x452a45
push 0x45a400
push eax
call dword [0x4c3650]
call fcn.00454a70
mov dword [esp + 0x48], eax
mov byte [esp + 0x858], bl
cmp dword [esp + 0x2c], ebp
jb 0x452a5f
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0048a8f9
add esp, 4
cmp dword [edi + 0x290], ebp
jb 0x452a6f
mov edx, dword [edi + 0x27c]
jmp 0x452a75
lea edx, [edi + 0x27c]
mov eax, edx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
lea esi, [eax + 2]
jmp 0x452a90
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x452a90
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x1c]
call fcn.00402270
mov edx, dword [esp + 0x864]
mov eax, dword [esp + 0x860]
push edx
push eax
mov ecx, esi
push ecx
lea edi, [esp + 0x3c]
mov byte [esp + 0x864], 2
call fcn.0045a840
cmp dword [esp + 0x2c], ebp
mov esi, eax
jb 0x452ae3
mov edx, dword [esp + 0x18]
push edx
call fcn.0048a8f9
add esp, 4
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
call fcn.0045a250
mov eax, esi
mov ecx, dword [esp + 0x850]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.0048a8fe
add esp, 0x848
ret 8
Function at 0x455f10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x4e51e0]
xor eax, esp
mov dword [esp + 0x24], eax
cmp dword [edi + 0x108], 0
push ebx
push ebp
push esi
je 0x45612f
mov eax, dword [edi]
or eax, dword [edi + 4]
je 0x45612f
mov eax, dword [edi + 0x108]
test eax, eax
je 0x455f51
push eax
push 8
push 1
push edi
call fcn.0048cb32
add esp, 0x10
cmp dword [edi + 0x80], 0
mov ebx, 8
lea ebp, [ebx + 8]
je 0x455fec
lea ecx, [edi + 0x6c]
push 0
push ecx
lea esi, [esp + 0x1c]
call fcn.0042c290
mov eax, dword [edi + 0x108]
mov ecx, dword [esp + 0x30]
add esp, 8
test eax, eax
mov dword [esp + 0x10], ecx
je 0x455fa0
push eax
push 4
lea edx, [esp + 0x18]
push 1
push edx
call fcn.0048cb32
mov ecx, dword [esp + 0x20]
add esp, 0x10
test ecx, ecx
mov ebx, 0xc
jle 0x455fd9
cmp dword [esp + 0x2c], ebp
mov edx, dword [esp + 0x18]
jae 0x455fb7
lea edx, [esp + 0x18]
mov eax, dword [edi + 0x108]
test eax, eax
je 0x455fd6
test edx, edx
je 0x455fd6
push eax
push ecx
push 1
push edx
call fcn.0048cb32
mov ecx, dword [esp + 0x20]
add esp, 0x10
lea ebx, [ecx + 0xc]
cmp dword [esp + 0x2c], ebp
jb 0x455fec
mov eax, dword [esp + 0x18]
push eax
call fcn.0048a8f9
add esp, 4
cmp dword [edi + 0x64], 0
je 0x456079
lea ecx, [edi + 0x50]
push 0
push ecx
lea esi, [esp + 0x1c]
call fcn.0042c290
mov eax, dword [edi + 0x108]
mov ecx, dword [esp + 0x30]
add esp, 8
test eax, eax
mov dword [esp + 0x10], ecx
je 0x456030
push eax
push 4
lea edx, [esp + 0x18]
push 1
push edx
call fcn.0048cb32
mov ecx, dword [esp + 0x20]
add esp, 0x10
add ebx, 4
test ecx, ecx
jle 0x456066
cmp dword [esp + 0x2c], ebp
mov edx, dword [esp + 0x18]
jae 0x456045
lea edx, [esp + 0x18]
mov eax, dword [edi + 0x108]
test eax, eax
je 0x456064
test edx, edx
je 0x456064
push eax
push ecx
push 1
push edx
call fcn.0048cb32
mov ecx, dword [esp + 0x20]
add esp, 0x10
add ebx, ecx
cmp dword [esp + 0x2c], ebp
jb 0x456079
mov eax, dword [esp + 0x18]
push eax
call fcn.0048a8f9
add esp, 4
cmp dword [edi + 0x9c], 0
je 0x45610c
lea ecx, [edi + 0x88]
push 0
push ecx
lea esi, [esp + 0x1c]
call fcn.0042c290
mov eax, dword [edi + 0x108]
mov ecx, dword [esp + 0x30]
add esp, 8
test eax, eax
mov dword [esp + 0x10], ecx
je 0x4560c3
push eax
push 4
lea edx, [esp + 0x18]
push 1
push edx
call fcn.0048cb32
mov ecx, dword [esp + 0x20]
add esp, 0x10
add ebx, 4
test ecx, ecx
jle 0x4560f9
cmp dword [esp + 0x2c], ebp
mov edx, dword [esp + 0x18]
jae 0x4560d8
lea edx, [esp + 0x18]
mov eax, dword [edi + 0x108]
test eax, eax
je 0x4560f7
test edx, edx
je 0x4560f7
push eax
push ecx
push 1
push edx
call fcn.0048cb32
mov ecx, dword [esp + 0x20]
add esp, 0x10
add ebx, ecx
cmp dword [esp + 0x2c], ebp
jb 0x45610c
mov eax, dword [esp + 0x18]
push eax
call fcn.0048a8f9
add esp, 4
mov eax, edi
mov dword [edi + 0x10], ebx
call fcn.00456400
xor eax, eax
test ebx, ebx
setg al
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0048a8fe
add esp, 0x28
ret
mov ecx, dword [esp + 0x30]
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0048a8fe
add esp, 0x28
ret
Function at 0x456400
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, eax
mov ecx, dword [esi + 0xfc]
test ecx, ecx
push edi
jne 0x456415
xor eax, eax
jmp 0x456420
mov eax, dword [esi + 0x100]
sub eax, ecx
sar eax, 5
mov edi, dword [esi + 0x10]
test edi, edi
mov dword [esp + 0x10], eax
jle 0x456587
cmp dword [esi + 0x108], 0
je 0x456587
test eax, eax
je 0x456587
mov ecx, dword [esi + 0x108]
test ecx, ecx
mov eax, edi
cdq
je 0x456482
cmp edx, 0xffffffff
jl 0x45646a
jg 0x45645d
cmp eax, 0xffffffff
jbe 0x45646a
push 0
push edx
push eax
push ecx
call fcn.0049eee3
add esp, 0x10
mov eax, dword [esi + 0x108]
push eax
push 4
lea ecx, [esp + 0x18]
push 1
push ecx
call fcn.0048cb32
add esp, 0x10
mov ecx, dword [esi + 0x108]
add edi, 4
test ecx, ecx
mov eax, edi
lea ebx, [esi + 8]
cdq
je 0x4564c6
test ebx, ebx
je 0x4564c6
cmp edx, 0xffffffff
jl 0x4564b2
jg 0x4564a5
cmp eax, 0xffffffff
jbe 0x4564b2
push 0
push edx
push eax
push ecx
call fcn.0049eee3
add esp, 0x10
mov edx, dword [esi + 0x108]
push edx
push 8
push 1
push ebx
call fcn.0048cb32
add esp, 0x10
mov ebx, dword [esi + 0xfc]
add edi, 8
cmp ebx, dword [esi + 0x100]
jbe 0x4564e0
call fcn.0048b10d
lea esp, [esp]
mov ebp, dword [esi + 0x100]
cmp dword [esi + 0xfc], ebp
jbe 0x4564f3
call fcn.0048b10d
lea eax, [esi + 0xf8]
cmp eax, eax
je 0x456502
call fcn.0048b10d
cmp ebx, ebp
je 0x456569
cmp ebx, dword [esi + 0x100]
jb 0x456513
call fcn.0048b10d
mov ecx, dword [esi + 0x108]
test ecx, ecx
mov eax, edi
cdq
je 0x456551
test ebx, ebx
je 0x456551
cmp edx, 0xffffffff
jl 0x45653d
jg 0x456530
cmp eax, 0xffffffff
jbe 0x45653d
push 0
push edx
push eax
push ecx
call fcn.0049eee3
add esp, 0x10
mov eax, dword [esi + 0x108]
push eax
push 1
push 0x20
push ebx
call fcn.0048cb32
add esp, 0x10
add edi, 0x20
cmp ebx, dword [esi + 0x100]
jb 0x456561
call fcn.0048b10d
add ebx, 0x20
jmp 0x4564e0
mov esi, dword [esi + 0x108]
test esi, esi
je 0x45657c
push esi
call fcn.0048bd53
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x456590
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x30
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
push esi
push edi
jle 0x4566fe
cmp dword [ebp + 0x108], 0
lea esi, [ebp + 0x108]
mov dword [esp + 0x44], esi
je 0x4566fe
mov eax, ebx
cdq
push 4
push edx
lea edi, [ebp + 0x14]
push eax
mov dword [esp + 0x28], edi
call fcn.004857b0
add ebx, 4
mov eax, ebx
cdq
push 8
push edx
lea edi, [ebp + 8]
push eax
call fcn.004857b0
mov edi, dword [ebp + 0x100]
lea esi, [ebp + 0xf8]
add ebx, 8
cmp dword [esi + 4], edi
jbe 0x4565fb
call fcn.0048b10d
mov ebp, dword [esi + 4]
cmp ebp, dword [esi + 8]
jbe 0x456608
call fcn.0048b10d
push edi
push esi
push ebp
push esi
lea eax, [esp + 0x24]
push eax
push esi
call fcn.00456d10
mov ecx, dword [esp + 0x1c]
xor edi, edi
cmp dword [ecx], edi
mov dword [esp + 0x14], edi
jle 0x4566ef
lea esp, [esp]
mov ebp, dword [esp + 0x44]
mov ecx, dword [ebp]
cmp ecx, edi
mov eax, ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
cdq
je 0x4566d8
cmp edx, 0xffffffff
jl 0x456672
jg 0x456666
cmp eax, 0xffffffff
jbe 0x456672
push edi
push edx
push eax
push ecx
call fcn.0049eee3
add esp, 0x10
mov edx, dword [ebp]
push edx
push 1
lea eax, [esp + 0x28]
push 0x20
push eax
call fcn.004b3eeb
add esp, 0x10
cmp eax, edi
jle 0x4566d8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
add ebx, 0x20
cmp eax, ecx
mov dword [esp + 0x38], edi
jne 0x4566b0
cmp dword [esp + 0x24], edx
jne 0x4566b0
mov dword [esp + 0x38], 3
push edx
push ecx
mov ecx, dword [esp + 0x2c]
push ecx
push eax
push str.SpliteBlocks__I64u____I64u
push 0xca
push str..TransfersTransferInfo.cpp
call fcn.004180a0
add esp, 0x1c
lea eax, [esp + 0x20]
call fcn.00456b30
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
add eax, 1
cmp eax, dword [edx]
mov dword [esp + 0x14], eax
jl 0x456630
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x30
ret 4

Function at 0x4569e0
Capabilities:
Write file on windows

Disassembly:
cmp dword [esi + 0x190], 0
jne 0x4569ee
xor eax, eax
ret 0xc
mov eax, dword [esi + 0x190]
test eax, eax
je 0x456a40
test edi, edi
je 0x456a40
mov edx, dword [esp + 8]
cmp edx, 0xffffffff
jl 0x456a1d
mov ecx, dword [esp + 4]
jg 0x456a10
cmp ecx, 0xffffffff
jbe 0x456a1d
push 0
push edx
push ecx
push eax
call fcn.0049eee3
add esp, 0x10
mov eax, dword [esi + 0x190]
mov ecx, dword [esp + 0xc]
push eax
push ecx
push 1
push edi
call fcn.0048cb32
mov edx, dword [esi + 0x190]
push edx
call fcn.0048bd53
add esp, 0x14
mov eax, 1
ret 0xc
Function at 0x457e80
Capabilities:
Create thread

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, eax
mov esi, dword [edi + 0x240]
add edi, 0x23c
cmp esi, dword [edi + 8]
mov dword [esp + 0x10], edi
jbe 0x457ea3
call fcn.0048b10d
mov ebx, esi
xor ebp, ebp
mov esi, dword [edi + 8]
cmp dword [edi + 4], esi
jbe 0x457eb4
call fcn.0048b10d
cmp edi, edi
je 0x457ebd
call fcn.0048b10d
cmp ebx, esi
je 0x457f5f
cmp ebx, dword [edi + 8]
jb 0x457ecf
call fcn.0048b10d
mov esi, dword [ebx]
mov eax, dword [esi + 0x28]
or eax, dword [esi + 0x2c]
mov edi, 1
mov dword [esi + 0xc], ebp
mov dword [esi + 0x18], edi
jne 0x457ee6
xor edi, edi
push edi
push str.StartChannel_bValid_d
push 0xca
push str..TransfersTransfersChannel.cpp
call fcn.004180a0
add esp, 0x10
cmp edi, ebp
je 0x457f45
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x457f15
push ebp
push eax
call dword [0x4c3364]
cmp eax, ebp
jne 0x457f3e
lea ecx, [esp + 0x14]
push ecx
push 4
push esi
push 0x432ce0
push ebp
push ebp
mov dword [esp + 0x2c], ebp
call fcn.0048f13d
add esp, 0x18
cmp eax, ebp
mov dword [esi + 4], eax
je 0x457f3e
push eax
call dword [0x4c3178]
mov dword [esi + 0x18], 2
mov edx, dword [esp + 0x10]
cmp ebx, dword [edx + 8]
jb 0x457f53
call fcn.0048b10d
mov edi, dword [esp + 0x10]
add ebx, 4
jmp 0x457ea7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x459dd0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4bc6ab
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x4e51e0]
xor eax, esp
mov dword [esp + 0xcc], eax
push edi
mov eax, dword [0x4e51e0]
xor eax, esp
push eax
lea eax, [esp + 0xd8]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov eax, dword [esp + 0xe8]
mov dword [esp + 0xe0], edi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ecx
mov dword [esi], vtable.tusNode__.0
push 0xc6
lea edx, [esp + 0x12]
push edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
push edx
mov dword [esi + 0xc], 1
mov dword [esi + 0x18], edi
mov word [esp + 0x18], di
call fcn.0048ffc0
push esi
lea eax, [esp + 0x1c]
push str.Channel__08x_wait_1C701C1F_7D24_4d67_B436_057DB4FD3864
push eax
lea edx, [edi + 0x64]
call fcn.0045a1d0
lea ecx, [esp + 0x24]
push ecx
push str.WaitNotifyEvent__s
push 0xca
push str..TransfersTransfersChannel.cpp
call fcn.004180a0
add esp, 0x28
lea edx, [esp + 0xc]
push edx
push edi
push 1
push edi
call dword [0x4c33f4]
push eax
mov dword [esi + 0x14], eax
call dword [0x4c3368]
mov eax, esi
mov ecx, dword [esp + 0xd8]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0xcc]
xor ecx, esp
call fcn.0048a8fe
add esp, 0xdc
ret 4
Function at 0x45b160
Capabilities:
Reference http user-agent string

Disassembly:
push 0xffffffffffffffff
push 0x4bac1b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x4e51e0]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e51e0]
xor eax, esp
push eax
lea eax, [esp + 0x438]
mov dword fs:[0], eax
push 0xc
xor edi, edi
push 0x4d2ba0
lea esi, [esp + 0x20]
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], edi
mov word [esp + 0x24], di
call fcn.00402270
push 0xb
push str.User_Agent:
mov ecx, esi
mov dword [esp + 0x448], edi
call fcn.004021a0
push 0x3a
push str.Mozilla_5.0__compatible__MSIE_8.0__Windows_NT_6.1__SSX1.0_
mov ecx, esi
call fcn.004021a0
push 2
push 0x4d2bd4
mov ecx, esi
call fcn.004021a0
push 0x17
push 0x4d2bdc
mov ecx, esi
call fcn.004021a0
mov ebp, dword [esp + 0x454]
mov esi, dword [esp + 0x44c]
cmp ebp, esi
jb 0x45b314
mov ebx, dword [esp + 0x448]
ja 0x45b229
cmp dword [esp + 0x450], ebx
jbe 0x45b314
push 0xd
push 0x4d3028
lea ecx, [esp + 0x20]
call fcn.004021a0
push 0x1fe
lea eax, [esp + 0x3a]
push edi
push eax
mov word [esp + 0x40], di
call fcn.0048ffc0
push 0xa
push 0x100
lea ecx, [esp + 0x48]
push ecx
push esi
push ebx
call fcn.0048fbb1
lea eax, [esp + 0x54]
add esp, 0x20
lea edx, [eax + 2]
jmp 0x45b270
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x45b270
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x20]
call fcn.004021a0
push 1
push 0x4d3044
lea ecx, [esp + 0x20]
call fcn.004021a0
push 0x1fe
lea eax, [esp + 0x23a]
push edi
push eax
mov word [esp + 0x240], di
call fcn.0048ffc0
mov edx, dword [esp + 0x45c]
push 0xa
push 0x100
lea ecx, [esp + 0x248]
push ecx
push ebp
push edx
call fcn.0048fbb1
lea eax, [esp + 0x254]
add esp, 0x20
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x45b2e3
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x238]
push eax
lea ecx, [esp + 0x20]
call fcn.004021a0
push 2
push 0x4d2bd4
lea ecx, [esp + 0x20]
call fcn.004021a0
push 2
push 0x4d2bd4
lea ecx, [esp + 0x20]
call fcn.004021a0
push 0x800
call fcn.00489904
mov esi, eax
mov word [esi], di
mov eax, dword [esp + 0x20]
mov edi, 8
add esp, 4
cmp dword [esp + 0x30], edi
jae 0x45b349
lea eax, [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push ecx
push eax
push 0x400
push esi
call fcn.0048b7e0
add esp, 0x10
cmp dword [esp + 0x30], edi
jb 0x45b370
mov edx, dword [esp + 0x1c]
push edx
call fcn.0048a8f9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x438]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0048a8fe
add esp, 0x430
ret 0x10
Function at 0x45df50
Capabilities:
Create thread

Disassembly:
push ecx
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.00403040
cmp dword [esi + 0x18], 8
jb 0x45df67
mov eax, dword [esi + 4]
jmp 0x45df6a
lea eax, [esi + 4]
push eax
push str.InitReport_m_strReportUrl_s
push 0xcb
push str..ReportCommon.cpp
call fcn.004180a0
mov eax, dword [esi + 0x3c]
add esp, 0x10
push eax
call dword [0x4c3368]
lea ecx, [esp]
push ecx
push 0
push esi
push 0x45e280
push 0
push 0
mov dword [esp + 0x18], 0
call fcn.0048f13d
mov edx, dword [esi + 0x3c]
add esp, 0x18
push 0xffffffffffffffff
push edx
mov dword [esi + 0x38], eax
call dword [0x4c3364]
neg eax
sbb eax, eax
add eax, 1
pop ecx
ret
Function at 0x45ff70
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4bfc7a
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4e51e0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x4d3d28
lea eax, [esi + 0x94]
push eax
mov dword [esp + 0x18], 7
call fcn.00467710
lea eax, [esi + 0x88]
mov byte [esp + 0x14], 6
call fcn.004639b0
lea eax, [esi + 0x7c]
mov byte [esp + 0x14], 5
call fcn.004638a0
lea eax, [esi + 0x70]
mov byte [esp + 0x14], 4
call fcn.00463720
lea eax, [esi + 0x64]
mov byte [esp + 0x14], 3
call fcn.004635a0
lea eax, [esi + 0x58]
mov byte [esp + 0x14], 2
call fcn.00463430
lea eax, [esi + 0x4c]
mov byte [esp + 0x14], 1
call fcn.00463330
lea eax, [esi + 0x3c]
mov byte [esp + 0x14], 0
call fcn.004631f0
cmp dword [esi + 0x34], 8
jb 0x460022
mov ecx, dword [esi + 0x20]
push ecx
call fcn.0048a8f9
add esp, 4
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], 0
mov word [esi + 0x20], 0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x467a70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4baa58
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4e51e0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
mov eax, edx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], di
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x467ab6
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x20]
call fcn.00402270
lea eax, [esp + 0x10]
push eax
push ebx
mov eax, esi
mov dword [esp + 0x48], edi
call fcn.00467d20
cmp dword [esp + 0x30], 8
jb 0x467af5
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0048a8f9
add esp, 4
mov esi, dword [esp + 0x10]
test esi, esi
mov edi, dword [ebx + 4]
je 0x467b04
cmp esi, ebx
je 0x467b09
call fcn.0048b10d
mov ebx, dword [esp + 0x14]
cmp ebx, edi
jne 0x467b26
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x467b2f
call fcn.0048b10d
cmp ebx, dword [esi + 4]
jne 0x467b39
call fcn.0048b10d
add ebx, 0x28
cmp dword [ebx], 0
jne 0x467b46
call fcn.004675c0
mov eax, dword [ebx]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4849c0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
sub esp, 0x408
mov eax, dword [0x4e51e0]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x10], ebx
mov eax, dword fs:[0x18]
mov dword [esp + 0x10], eax
mov eax, dword [0x4e9fe0]
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x20], ecx
mov eax, dword [esp + 0x41c]
mov edx, dword [0x4e9fe0]
mov dword [edx + 0x34c], eax
mov edi, dword [0x4e9fe0]
mov esi, dword [eax]
add edi, 0x30
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x4e9fe0]
mov esi, dword [eax + 4]
add edi, 0x80
mov ecx, 0xb3
rep movsd dword es:[edi], dword [esi]
call dword [0x4c3328]
mov ecx, dword [0x4e9fe0]
push 0x206
lea edx, [esp + 0x212]
push ebx
mov dword [ecx + 0x18], eax
push edx
mov word [esp + 0x218], bx
call fcn.0048ffc0
push 0x18e
lea eax, [esp + 0x8e]
push ebx
push eax
mov word [esp + 0x94], bx
call fcn.0048ffc0
add esp, 0x18
push ebx
push ebx
mov esi, 1
push esi
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], 0xc
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], esi
call dword [0x4c33f4]
push 0x40
lea edx, [esp + 0x40]
push ebx
push edx
mov edi, eax
mov dword [esp + 0x44], 0x44
call fcn.0048ffc0
add esp, 0xc
xor eax, eax
push ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x210]
push eax
push 0x104
push ebx
push str.BugReport.exe
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x7c], 0x81
mov word [esp + 0x80], si
call dword [0x4c31e8]
mov ebp, dword [0x4c3344]
call ebp
push eax
push esi
push 0x1f0fff
call dword [0x4c3120]
mov esi, eax
cmp esi, ebx
je 0x484bad
cmp edi, ebx
je 0x484bad
cmp word [esp + 0x20c], bx
je 0x484bad
call ebp
mov ecx, dword [0x4e9fe0]
push eax
push ecx
push esi
push edi
push str.BugReport__buginfo:_p:_p:_p:_lu
lea edx, [esp + 0x90]
push 0xc8
push edx
call fcn.0048fc39
add esp, 0x1c
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x3c]
push ecx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea edx, [esp + 0x9c]
push edx
lea eax, [esp + 0x230]
push eax
call dword [0x4c313c]
test eax, eax
je 0x484bad
mov ecx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x40], ebx
push 2
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ecx
call dword [0x4c31d4]
mov eax, dword [esp + 0x14]
mov esi, dword [0x4c340c]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
jmp 0x484bb3
mov esi, dword [0x4c340c]
push edi
call esi
push 0x1234
call dword [0x4c3150]
push eax
call dword [0x4c3124]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0048a8fe
add esp, 0x408
ret