joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a380
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffffffffff
push 0x4f68ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov ecx, dword [esp + 0x1c]
mov eax, 0xaaaaaaab
mul ecx
push ebp
push esi
push edi
mov edi, edx
mov eax, ecx
xor edx, edx
mov ecx, 3
mov esi, dword [esp + 0x24]
div ecx
shr edi, 1
mov ecx, dword [0x532934]
mov dword [esp + 0xc], 0
mov dword [esp + 0x28], ecx
mov ebp, edx
xor edx, edx
test ebp, ebp
setle dl
dec edx
and edx, 4
lea eax, [edx + edi*4]
inc eax
lea ecx, [esp + 0x28]
push eax
mov dword [esp + 0x1c], 1
call fcn.004dacac
test eax, eax
je 0x46a4e9
test edi, edi
jle 0x46a463
push ebx
mov ecx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
xor edx, edx
mov dl, byte [esi]
add esi, 3
shr edx, 2
add eax, 4
mov dl, byte [edx + ecx]
mov byte [eax - 4], dl
mov cl, byte [esi - 3]
mov ebx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and ecx, 3
xor edx, edx
mov dl, byte [esi - 2]
shl ecx, 4
shr edx, 4
add ebx, ecx
mov cl, byte [edx + ebx]
mov byte [eax - 3], cl
mov dl, byte [esi - 2]
mov ebx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
xor ecx, ecx
mov cl, byte [esi - 1]
and edx, 0xf
shr ecx, 6
add ebx, ecx
mov dl, byte [ebx + edx*4]
mov byte [eax - 2], dl
mov cl, byte [esi - 1]
mov edx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and ecx, 0x3f
dec edi
mov cl, byte [ecx + edx]
mov byte [eax - 1], cl
jne 0x46a3f9
pop ebx
test ebp, ebp
je 0x46a4e6
dec ebp
je 0x46a4b5
dec ebp
jne 0x46a4e6
mov ecx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
xor edx, edx
mov dl, byte [esi]
shr edx, 2
mov dl, byte [edx + ecx]
mov byte [eax], dl
mov cl, byte [esi]
mov edi, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and ecx, 3
xor edx, edx
mov dl, byte [esi + 1]
shl ecx, 4
shr edx, 4
add edi, ecx
mov cl, byte [edx + edi]
mov byte [eax + 1], cl
mov dl, byte [esi + 1]
mov ecx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and edx, 0xf
mov dl, byte [ecx + edx*4]
mov byte [eax + 3], 0x3d
mov byte [eax + 2], dl
jmp 0x46a4e3
mov edx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
xor ecx, ecx
mov cl, byte [esi]
shr ecx, 2
mov cl, byte [ecx + edx]
mov byte [eax], cl
mov dl, byte [esi]
mov ecx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and edx, 3
shl edx, 4
mov dl, byte [edx + ecx]
mov cl, 0x3d
mov byte [eax + 1], dl
mov byte [eax + 2], cl
mov byte [eax + 3], cl
add eax, 4
mov byte [eax], 0
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
call fcn.004dacfb
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call fcn.004da5f1
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.004da87c
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x46a530
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
push edi
je 0x46a726
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
je 0x46a726
test ecx, ecx
jle 0x46a731
xor edi, edi
mov ebp, ecx
mov eax, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push esi
call fcn.004c59a0
sub ebp, eax
add esp, 8
add edi, eax
add esi, eax
test ebp, ebp
mov dword [esp + 0x10], edi
jle 0x46a5ce
mov ecx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push ecx
push esi
call fcn.004c4b80
mov ebx, eax
add esp, 8
xor edi, edi
test ebx, ebx
jle 0x46a5c2
movsx edx, byte [edi + esi]
push edx
call fcn.004c4b4c
add esp, 4
test eax, eax
jne 0x46a5b1
cmp byte [edi + esi], 0x3d
je 0x46a5b8
inc edi
cmp edi, ebx
jl 0x46a59a
jmp 0x46a5c2
cmp byte [ebx + esi], 0
jne 0x46a71c
mov edi, dword [esp + 0x10]
sub ebp, ebx
add esi, ebx
test ebp, ebp
jg 0x46a565
mov eax, edi
and eax, 0x80000003
jns 0x46a5dc
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 1
jne 0x46a5eb
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
test eax, eax
je 0x46a5f4
lea ecx, [eax - 1]
jmp 0x46a5f6
xor ecx, ecx
mov eax, edi
mov ebx, dword [esp + 0x24]
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [ecx + eax*2]
add eax, ecx
mov ecx, ebx
mov dword [esp + 0x18], eax
add eax, 4
push eax
call fcn.004645c0
xor esi, esi
cmp edi, esi
jle 0x46a710
mov eax, dword [esp + 0x14]
mov edi, dword [ebx + 4]
xor ebp, ebp
cmp eax, esi
mov dword [esp + 0x10], esi
jle 0x46a710
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov bl, byte [edx + eax]
movsx ecx, bl
push ecx
call fcn.004c4b4c
add esp, 4
test eax, eax
jne 0x46a6fb
cmp bl, 0x41
jl 0x46a668
cmp bl, 0x5a
jg 0x46a668
sub bl, 0x41
mov al, bl
jmp 0x46a69a
cmp bl, 0x61
jl 0x46a679
cmp bl, 0x7a
jg 0x46a679
sub bl, 0x47
mov al, bl
jmp 0x46a69a
cmp bl, 0x30
jl 0x46a68a
cmp bl, 0x39
jg 0x46a68a
add bl, 4
mov al, bl
jmp 0x46a69a
cmp bl, 0x2b
jne 0x46a693
mov al, 0x3e
jmp 0x46a69a
cmp bl, 0x2f
jne 0x46a717
mov al, 0x3f
mov ecx, ebp
inc ebp
cmp ecx, 3
ja case.default.0x46a6a2
jmp dword [ecx*4 + 0x46a740]
shl al, 2
mov byte [edi + esi], al
jmp case.default.0x46a6a2
mov bl, byte [edi + esi]
mov dl, al
shr dl, 4
and dl, 3
or bl, dl
shl al, 4
mov byte [edi + esi], bl
mov byte [edi + esi + 1], al
jmp case.default.0x46a6a2
mov dl, byte [edi + esi + 1]
mov cl, al
shr cl, 2
and cl, 0xf
or dl, cl
shl al, 6
mov byte [edi + esi + 1], dl
mov byte [edi + esi + 2], al
jmp case.default.0x46a6a2
mov cl, byte [edi + esi + 2]
and al, 0x3f
or cl, al
mov byte [edi + esi + 2], cl
cmp ebp, 4
jne 0x46a6fb
xor ebp, ebp
add esi, 3
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x46a638
mov edx, dword [esp + 0x18]
push edx
jmp 0x46a728
cmp bl, 0x3d
je 0x46a710
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0
mov ecx, dword [esp + 0x28]
call fcn.00464590
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x46a8d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f695f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
test ebp, ebp
mov dword [esp + 0xc], 0
jne 0x46a91d
mov esi, dword [esp + 0x20]
push 0x536ec0
mov ecx, esi
call fcn.004da8ea
mov eax, esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov edi, dword [esp + 0x28]
test edi, edi
jne 0x46a949
mov esi, dword [esp + 0x20]
push 0x536ec0
mov ecx, esi
call fcn.004da8ea
mov eax, esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push edi
push ebp
call fcn.004c3420
mov edx, eax
add esp, 8
test edx, edx
jne 0x46a979
mov esi, dword [esp + 0x20]
push ebp
mov ecx, esi
call fcn.004da8ea
mov eax, esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov eax, dword [0x532934]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], 1
test eax, eax
je 0x46a99e
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jmp 0x46a9a0
xor ecx, ecx
sub ecx, ebp
add ecx, edx
mov esi, ecx
push esi
push ebp
lea ecx, [esi + 1]
push ecx
lea ecx, [esp + 0x30]
call fcn.004dacac
push eax
call fcn.004c59e0
add esp, 0xc
lea ecx, [esp + 0x24]
push esi
call fcn.004dacfb
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
mov ecx, esi
call fcn.004da5f1
lea ecx, [esp + 0x24]
mov dword [esp + 0xc], 1
mov byte [esp + 0x18], 0
call fcn.004da87c
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x46ab40
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
push 2
push 0
push 0x3f
mov esi, ecx
push 2
call fcn.004ecf06
test eax, eax
jne 0x46ab58
pop esi
pop ecx
ret
mov ecx, dword [esi + 4]
lea eax, [esp + 4]
push 4
push eax
push 4
push 0xffff
push ecx
mov dword [esp + 0x18], 1
call sub.wsock32.dll_setsockopt
cmp eax, 0xffffffff
je 0x46abb2
push 0
push 0x84dc
mov ecx, esi
call fcn.004eca42
test eax, eax
je 0x46abb2
mov eax, dword [esi + 4]
lea edx, [esp + 4]
push 4
push edx
push 0x20
push 0xffff
push eax
call sub.wsock32.dll_setsockopt
cmp eax, 0xffffffff
je 0x46abb2
mov eax, 1
pop esi
pop ecx
ret
push edi
call sub.wsock32.dll_WSAGetLastError
mov edx, dword [esi]
mov ecx, esi
mov edi, eax
call dword [edx + 0x10]
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x46ae20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4f6a2a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x18]
mov dword [esi], method.CScrollView.virtual_240
call fcn.00464470
xor ebx, ebx
xor eax, eax
mov dword [esi + 0x38], 0x50354c
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 0x11
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], 0xa
xor ecx, ecx
mov dword [esi + 0x30], eax
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x34], ecx
lea edi, [esi + 0x54]
mov byte [esp + 0x1c], 1
mov dword [esp + 0x10], edi
lea ecx, [edi + 0xc]
call fcn.00464470
lea ecx, [edi + 0x28]
mov byte [esp + 0x1c], 2
call fcn.00464470
push 0x428
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.004c3bb1
push 0x428
mov dword [edi + 8], eax
call fcn.004c3bb1
add esp, 8
mov dword [edi + 0x24], eax
lea ecx, [esi + 0xb0]
mov byte [esp + 0x1c], 3
call fcn.0048d250
mov ecx, esi
mov byte [esp + 0x1c], 4
mov dword [esi], 0x503598
call fcn.0046b020
mov ecx, esi
call fcn.0046b050
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x46bc50
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4f6c21
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
mov dword [esp + 0x20], esi
mov dword [esi], method.CScrollView.virtual_240
call fcn.004736e0
xor ebx, ebx
add esp, 4
mov dword [esi + 8], ebx
mov dword [esi + 4], 1
lea ebp, [esi + 0x10]
mov dword [esi + 0xc], 0x4ffcd8
mov dword [esp + 0x28], ebx
mov dword [ebp], method.CScrollView.virtual_240
mov eax, dword [0x532934]
mov dword [esi + 0x1c], eax
mov ecx, dword [0x532934]
mov dword [esi + 0x30], ecx
lea ecx, [esi + 0x38]
mov byte [esp + 0x28], 2
call fcn.00478ce0
lea ecx, [esi + 0x48]
mov byte [esp + 0x28], 3
call fcn.0048e580
mov edx, dword [0x532934]
mov dword [esi + 0x64], edx
mov eax, dword [0x532934]
mov dword [esi + 0x68], eax
mov ecx, dword [0x532934]
mov dword [esi + 0x6c], ecx
mov edx, dword [0x532934]
mov dword [esi + 0x8c], edx
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x13]
push 0x18
mov byte [esp + 0x2c], 8
mov byte [esi + 0x90], al
mov byte [esi + 0x91], cl
mov byte [esi + 0x98], bl
call fcn.004dae15
mov edi, eax
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], edi
mov dword [edi + 4], ebx
mov dword [edi + 0x14], 1
call fcn.004d043e
cmp dword [0x537428], ebx
jne 0x46bd52
mov dword [0x537428], edi
mov dword [edi], ebx
mov edx, dword [0x537428]
mov dword [esp + 0x14], ebx
mov dword [edx + 8], ebx
mov edx, dword [0x537424]
lea ecx, [esp + 0x18]
inc edx
mov dword [0x537424], edx
call fcn.004d04da
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x46bd79
push eax
call fcn.004dae3e
add esp, 4
mov edi, dword [0x537428]
push 0x18
call fcn.004dae15
mov dword [eax + 4], edi
mov dword [eax + 0x14], ebx
mov dword [esi + 0x94], eax
mov dword [esi + 0x9c], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x94]
add esp, 4
mov dword [eax + 8], eax
mov eax, esi
mov dword [esi], 0x5035dc
neg eax
sbb eax, eax
mov dword [esi + 0xc], 0x5035cc
and eax, ebp
mov dword [ebp], 0x5035c8
mov dword [esi + 0x54], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x40], eax
mov eax, 1
mov ecx, esi
mov byte [esp + 0x28], 9
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x18], ebx
call fcn.0046c0f0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x46bf20
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4f6ca1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
mov dword [edi], 0x5035dc
mov dword [edi + 0xc], 0x5035cc
mov dword [edi + 0x10], 0x5035c8
mov dword [esp + 0x2c], 9
call fcn.0046c0f0
mov eax, dword [edi + 0x94]
mov ecx, dword [edi + 0x9c]
lea esi, [edi + 0x90]
mov ebp, eax
mov eax, dword [eax]
xor ebx, ebx
cmp ecx, ebx
mov byte [esp + 0x2c], 8
mov dword [esp + 0x10], eax
je 0x46bfdd
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.004033a0
mov ecx, eax
mov eax, dword [esp + 0x10]
cmp eax, dword [ecx]
setne cl
cmp cl, bl
jne 0x46bfdd
mov ecx, dword [esi + 4]
cmp ebp, ecx
jne 0x46bfdd
mov edx, dword [ecx + 4]
mov ecx, esi
push edx
call fcn.004723f0
mov eax, dword [esi + 4]
mov ecx, dword [0x537428]
lea edx, [esp + 0x1c]
mov dword [eax + 4], ecx
mov eax, dword [esi + 4]
mov dword [esi + 0xc], ebx
push edx
mov dword [eax], eax
mov eax, dword [esi + 4]
mov ecx, esi
mov dword [eax + 8], eax
call fcn.004033a0
jmp 0x46c005
cmp eax, ebp
je 0x46c005
lea eax, [esp + 0x18]
push ebx
push eax
lea ecx, [esp + 0x18]
call fcn.00472510
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.00471640
cmp dword [esp + 0x10], ebp
jne 0x46bfe1
mov eax, dword [esi + 4]
push eax
call fcn.004dae3e
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esp + 0x10]
xor esi, esi
call fcn.004d043e
mov eax, dword [0x537424]
dec eax
mov dword [0x537424], eax
jne 0x46c03b
mov esi, dword [0x537428]
mov dword [0x537428], ebx
lea ecx, [esp + 0x10]
call fcn.004d04da
cmp esi, ebx
je 0x46c051
push esi
call fcn.004dae3e
add esp, 4
lea ecx, [edi + 0x8c]
mov byte [esp + 0x2c], 7
call fcn.004da87c
lea ecx, [edi + 0x6c]
mov byte [esp + 0x2c], 6
call fcn.004da87c
lea ecx, [edi + 0x68]
mov byte [esp + 0x2c], 5
call fcn.004da87c
lea ecx, [edi + 0x64]
mov byte [esp + 0x2c], 4
call fcn.004da87c
lea ecx, [edi + 0x48]
mov byte [esp + 0x2c], 3
call fcn.0048e5b0
lea ecx, [edi + 0x38]
mov byte [esp + 0x2c], 2
call fcn.00478d20
lea ecx, [edi + 0x30]
mov byte [esp + 0x2c], 1
call fcn.004da87c
lea ecx, [edi + 0x1c]
mov byte [esp + 0x2c], bl
call fcn.004da87c
push edi
mov dword [esp + 0x30], 0xffffffff
mov dword [edi], method.CScrollView.virtual_240
call fcn.00473a00
mov ecx, dword [esp + 0x28]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x46e670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f70e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
mov dword [esp + 0x1c], esi
mov dword [esi], method.CScrollView.virtual_240
call fcn.004736e0
xor ebx, ebx
add esp, 4
mov dword [esi + 8], ebx
mov dword [esi + 4], 1
lea ebp, [esi + 0x10]
mov dword [esi + 0xc], 0x4ffcd8
mov dword [esp + 0x24], ebx
mov dword [ebp], method.CScrollView.virtual_240
mov dword [esi + 0x14], 0x4ffcd4
mov eax, dword [0x532934]
mov dword [esi + 0x18], eax
mov ecx, dword [0x532934]
mov dword [esi + 0x1c], ecx
mov edx, dword [0x532934]
mov dword [esi + 0x20], edx
mov eax, dword [0x532934]
mov dword [esi + 0x48], eax
mov ecx, dword [0x532934]
mov dword [esi + 0x4c], ecx
lea ecx, [esi + 0x5c]
mov byte [esp + 0x24], 5
call fcn.00478ce0
lea ecx, [esi + 0x6c]
mov byte [esp + 0x24], 6
call fcn.0046b720
mov edx, dword [0x532934]
mov dword [esi + 0xb0], edx
lea ecx, [esi + 0xb8]
mov byte [esp + 0x24], 8
call fcn.0048e580
mov cl, byte [esp + 0x2c]
mov al, byte [esp + 0x2c]
lea edi, [esi + 0xc4]
push 1
push ebx
mov byte [esp + 0x2c], 9
mov byte [edi + 1], cl
mov ecx, edi
mov byte [edi], al
mov byte [edi + 8], bl
call fcn.00472ee0
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], eax
call fcn.004d043e
cmp dword [0x537430], ebx
jne 0x46e77c
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], ebx
mov dword [0x537430], eax
mov dword [eax], ebx
mov edx, dword [0x537430]
mov dword [edx + 8], ebx
mov edx, dword [0x53742c]
lea ecx, [esp + 0x14]
inc edx
mov dword [0x53742c], edx
call fcn.004d04da
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x46e7a3
push eax
call fcn.004dae3e
add esp, 4
mov eax, dword [0x537430]
push ebx
push eax
mov ecx, edi
call fcn.00472ee0
mov dword [edi + 4], eax
mov dword [edi + 0xc], ebx
mov dword [eax], eax
mov edi, dword [edi + 4]
mov edx, dword [esp + 0x2c]
mov eax, esi
mov dword [edi + 8], edi
mov ecx, dword [0x532934]
neg eax
mov dword [esi + 0xe8], ecx
lea ecx, [esi + 0x14]
sbb eax, eax
mov dword [esi], 0x503600
and eax, ebp
mov dword [esi + 0xc], 0x5035f0
mov dword [ebp], 0x5035ec
mov dword [ecx], 0x5035e8
mov dword [esi + 0xa0], edx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0x24], 0x186a0
mov dword [esi + 0x28], 0x989680
mov dword [esi + 0x2c], 0x5f5e100
mov dword [esi + 0x30], 0xf4240
mov dword [esi + 0x34], 0x1d4c0
mov dword [esi + 0x64], eax
mov eax, esi
mov dword [esi + 0x98], ebx
neg eax
sbb eax, eax
and eax, ecx
mov dword [esi + 0x74], eax
mov dword [esi + 0x58], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xd8], 0x7530
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0xec], eax
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x44], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x473b40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f7798
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x74
push esi
push edi
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push 1
push 0x537438
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], eax
call fcn.004ba961
lea eax, [esp + 9]
lea ecx, [esp + 0xa]
push eax
push ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x8c], 0
call fcn.00473cc0
lea edx, [esp + 0xb]
lea ecx, [esp + 0x40]
push edx
mov byte [esp + 0x88], 1
call fcn.0040e430
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x5c]
mov byte [esp + 0x88], 2
mov dword [esp + 0x58], eax
call fcn.00474c60
lea edx, [esp + 0x54]
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, 0x537458
mov byte [esp + 0x8c], 3
call fcn.004755c0
lea ecx, [esp + 0x20]
lea edx, [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.004292e0
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x58]
mov byte [esp + 0x84], 2
call fcn.00473f00
lea ecx, [esp + 0x40]
mov byte [esp + 0x84], 4
call fcn.0041b670
lea ecx, [esp + 0x30]
mov byte [esp + 0x84], 0
call fcn.00473d70
mov eax, dword [esi + 0x30]
push eax
push 0
call dword [sym.imp.user32.dll_KillTimer]
lea ecx, [esp + 0xc]
push ecx
mov ecx, 0x537458
call fcn.00475df0
mov edi, eax
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, 0x537458
call fcn.00475800
mov esi, dword [eax]
cmp esi, edi
mov dword [esp + 0x10], esi
je 0x473c7e
lea ecx, [esp + 0x10]
call fcn.00475e80
cmp dword [esp + 0x10], edi
jne 0x473c6f
push edi
lea ecx, [esp + 0x20]
push esi
push ecx
mov ecx, 0x537458
call fcn.00474b10
lea ecx, [esp + 0x24]
mov dword [esp + 0x84], 0xffffffff
call fcn.004ba99d
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x80
ret
Function at 0x4770e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f7a50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], 0x5037b0
mov dword [esi + 0xc], 0x5037ac
mov eax, dword [esi + 0x180]
mov dword [esp + 0x2c], 5
push eax
mov dword [esp + 0x14], eax
call fcn.004dae3e
xor ebx, ebx
add esp, 4
lea ecx, [esi + 0x164]
mov dword [esi + 0x180], ebx
mov dword [esi + 0x184], ebx
mov dword [esi + 0x188], ebx
call fcn.004644e0
lea ecx, [esi + 0x14c]
mov byte [esp + 0x2c], 4
call fcn.004644e0
mov ebp, dword [esi + 0x13c]
lea edi, [esi + 0x138]
mov byte [esp + 0x2c], 3
mov eax, dword [ebp]
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x477199
lea eax, [esp + 0x18]
push ebx
push eax
lea ecx, [esp + 0x18]
call fcn.0041b6f0
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, edi
call fcn.0041b700
cmp dword [esp + 0x10], ebp
jne 0x477175
mov eax, dword [edi + 4]
push eax
call fcn.004dae3e
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
lea edi, [esi + 0xa0]
add esp, 4
mov dword [esp + 0x20], edi
lea ebp, [edi + 0x50]
mov byte [esp + 0x2c], 8
lea eax, [ebp + 8]
mov dword [ebp], vtable.CCriticalSection.0
push eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
mov ecx, ebp
call fcn.004bb357
mov eax, dword [edi + 0x4c]
lea ebp, [edi + 0x20]
cmp eax, ebx
mov byte [esp + 0x2c], 7
je 0x4771f0
mov ecx, ebp
call fcn.00478fe0
cmp dword [ebp + 0x2c], ebx
jne 0x4771e4
lea ecx, [edi + 0x10]
mov byte [esp + 0x2c], 6
call fcn.004dbabb
mov ecx, edi
mov byte [esp + 0x2c], 2
call fcn.004da87c
lea ebp, [esi + 0x28]
mov dword [esp + 0x20], ebp
lea edi, [ebp + 0x50]
mov byte [esp + 0x2c], 0xb
lea ecx, [edi + 8]
mov dword [edi], vtable.CCriticalSection.0
push ecx
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
mov ecx, edi
call fcn.004bb357
mov eax, dword [ebp + 0x4c]
lea edi, [ebp + 0x20]
cmp eax, ebx
mov byte [esp + 0x2c], 0xa
je 0x47724a
mov ecx, edi
call fcn.00478fe0
cmp dword [edi + 0x2c], ebx
jne 0x47723e
lea ecx, [ebp + 0x10]
mov byte [esp + 0x2c], 9
call fcn.004dbabb
mov ecx, ebp
mov byte [esp + 0x2c], 1
call fcn.004da87c
mov ecx, esi
lea eax, [esi + 0xc]
neg ecx
sbb ecx, ecx
mov byte [esp + 0x2c], bl
and ecx, eax
mov dword [ecx], fcn.00476bd0
call fcn.00476700
push esi
mov dword [esp + 0x30], 0xffffffff
mov dword [esi], method.CScrollView.virtual_240
call fcn.00473a00
mov ecx, dword [esp + 0x28]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret