joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1019af0
Capabilities:
Encode data using xor

Disassembly:
pop ss
adc ch, byte [ecx]
and byte [ebp - 0x69db8969], cl
clc
test al, 0x9c
insd dword es:[edi], dx
push esp
jecxz 0x1019a84
push cs
mov bl, 0x3d
xor esi, dword [ebp - 0x74]
or byte [edx], bh
cmpsd dword [esi], dword es:[edi]
xor ah, al
mov edi, 0xe8c1241a
pop ds
not eax
and eax, 1
xor eax, 0x84c17c83
pop edx
popfd
inc ebp
mov al, 0
xor ecx, ecx
leave
cmp dword [eax], 0xa559942
fcmovu st(0), st(0)
xchg esp, eax
shl dword [0x904d4823], 0x72
popal
or bl, dl
fcom dword [ecx + eax*8 + 0x4d482325]
nop
jb 0x1019aaf
jg 0x1019a8e
int1
xchg ebx, eax
js 0x1019a42
mov ecx, 0x9313085d
sub byte [esi], dh
push ds
cmp dword [edx], eax
cmp dword [esp + ecx*8], edx
jp 0x1019a3c
push ecx
or al, 0xba
push ecx
sbb byte [esi + edi*2], dh
adc byte [esi - 0x48], cl
int3
call 0xedc53b87
loopne 0x1019a84
fdivr qword [esi]
shl byte [ebp + 0x180c2b15], 1
pop eax
loop 0x1019a09
sub al, 0x5e
mov al, 0xc6
xchg ebx, eax
test eax, 0x5c5570ad
jo 0x1019ae5
pop esp
push ebx
test dword [edi], edx
xor eax, 0x3c77a3fe
inc ebx
ja 0x1019ad2
add ebp, eax
dec esp
pop eax
movsd dword es:[edi], dword [esi]
call 0x86200001
adc ecx, ecx
out 0x4d, eax
cwde
push edi
xchg dword [ecx], ebp
lodsb al, byte [esi]
sub dword [esi - 0x4d2368ec], ebp
adc esp, esp
xor ch, byte [ebx + 0x3c]
invalid
adc al, 0x97
fdiv qword [edx + 0x6b32e413]
cmp al, 0xc6
mov edx, 0x37aeabee
std
ja 0x1019aad
mov edi, ebx
sub ebx, dword [edx]
dec edi
add al, 0x83
stc
lodsb al, byte [esi]
jbe 0x1019a74
or esp, ecx
mov ds, ebx
invalid
ror byte [ebp - 0xfedfbb9], 0x73
inc edi
iretd
adc byte [edx], al
invalid
cmp eax, esi
jb 0x1019af6
push eax
push ebx
add eax, 0xea3e64e8
push 0x10d6146b
mov al, 0xe2
das
loop 0x1019b27
jns 0x1019b20
je 0x1019b2e
xor ecx, eax
inc dword [edx]
sar edi, 2
je 0x1019b1e
mov eax, 0x56b77e8a
leave
mov cl, 0x94
lea ecx, [ebx + 4]
push 3
jl 0x1019b33
push cs
sal dword [ebx], cl
fmul qword [ebx + ebp*2 - 0x2c72f0a5]
sub eax, 0xadfc7601
cld
lodsd eax, dword [esi]
pop ecx
loope 0x1019ac6
mov dword [0x7248874a], eax
dec edx
xchg dword [eax + 0x72], ecx
jo 0x1019adf
and al, 0x30
ja 0x1019b2e
outsb dx, byte [esi]
dec esi
sub dword [esi - 0x17c51e9], eax
sub byte [eax + 0x72ea8e43], al
out 0x5e, al
cmp esi, 0x28
add byte [ebx - 0x72], 0xea
jb 0x1019b22
pop esi
adc dword [edi + ecx - 0x53f2ae68], ebp
call dword [ecx]
add eax, 0xb032803e
stosd dword es:[edi], eax
pop edx
ja 0x1019afc
sbb dword [eax + 0x333e45a], esi
mov ah, 0x93
sal byte [ebx], 0x30
sub dword [ebp - 0x43f64712], edx
shl byte [eax], 0xd7
rcl byte [edx - 0x57], 0x3e
and al, 0x90
mov esi, 0x76b1f8e0

Function at 0x43b647
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
sub ecx, ecx
sub eax, 0x5bfdf956
call fcn.0043b694
add eax, eax
sub eax, 0xb6500cc
xor dword [ebx], edi
add ecx, 0x998edb34
push ecx
mov ecx, dword [esp]
add esp, 4
add ebx, 1
add eax, 0x45c0281
add ecx, 0x2b98d58f
sub eax, ecx
cmp ebx, esi
jne fcn.0043b647
sub eax, 0xc889d7d3
sub eax, ecx
dec eax
ret
Function at 0x4011f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40414d], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.trast
push str.bask
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401238
xor eax, eax
jmp 0x401253
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4025a0
Capabilities:
Terminate process

Disassembly:
mov ecx, 0x404240
push ecx
jmp fcn.004025ab

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00431219

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x142e71a9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x4cb1786f
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401fe0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x402013
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x402013
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x402013
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x402013
mov al, 1
ret
xor al, al
ret

Function at 0x402df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
mov edx, dword [eax + 0x3c]
add edx, eax
mov eax, dword [edi]
push dword [edx + 0x78]
call dword [eax]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x402ec2
mov ecx, dword [edi + 4]
mov esi, dword [edi]
mov edx, dword [ecx + 0x3c]
push dword [edx + ecx + 0x78]
mov ecx, edi
call dword [esi]
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x402ec2
mov eax, dword [ebp + 8]
cmp eax, 0xffff
jbe 0x402ee7
mov eax, dword [edi]
mov ecx, edi
push dword [ebx + 0x20]
call dword [eax]
mov ecx, dword [ebx + 0x18]
mov edx, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
lea ebx, [eax + ecx*4]
cmp eax, ebx
je 0x402ec2
nop dword [eax + eax]
mov eax, ebx
sub eax, edx
sar eax, 2
mov eax, eax
test eax, eax
jns 0x402e70
add eax, 1
sar eax, 1
push dword [edx + eax*4]
lea esi, [edx + eax*4]
mov ecx, edi
mov eax, dword [edi]
mov dword [ebp - 8], esi
call dword [eax]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx]
test dl, dl
je 0x402ea5
mov esi, dword [ebp + 8]
mov cl, dl
sub esi, eax
mov dl, cl
cmp cl, byte [eax]
jne 0x402ea2
mov cl, byte [esi + eax + 1]
inc eax
mov dl, cl
test cl, cl
jne 0x402e91
mov esi, dword [ebp - 8]
movzx eax, byte [eax]
movzx ecx, dl
sub ecx, eax
je 0x402ecd
test ecx, ecx
lea edx, [esi + 4]
cmovle edx, dword [ebp - 4]
cmovle ebx, esi
mov dword [ebp - 4], edx
cmp edx, ebx
jne 0x402e60
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp - 0xc]
mov ecx, edi
mov eax, dword [edi]
push dword [ebx + 0x24]
call dword [eax]
sub esi, dword [ebp - 0x10]
sar esi, 2
mov ax, word [eax + esi*2]
add ax, word [ebx + 0x10]
mov ebx, dword [ebp - 0x14]
mov ecx, edi
movzx esi, ax
mov eax, dword [edi]
push dword [ebx + 0x1c]
call dword [eax]
movzx ecx, si
sub ecx, dword [ebx + 0x10]
pop edi
pop esi
pop ebx
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret 4
Function at 0x4101b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x586ba0
push 0x50ae80
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x59e554]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
xor bl, bl
test eax, eax
je 0x41036d
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41036d
cmp byte [eax], bl
je 0x41036d
test ecx, ecx
je 0x41036d
cmp byte [ecx], bl
je 0x41036d
test edi, edi
je 0x41036d
cmp dword [ebp + 0x18], 0
je 0x41036d
push ecx
call dword [0x5481b8]
test eax, eax
je 0x41036d
push 0
push 0x40
push edi
call fcn.004103c0
add esp, 0xc
test al, al
je 0x41036d
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x41036d
mov esi, dword [edi + 0x3c]
add esi, edi
mov dword [ebp - 0x24], esi
push 0
push 0xf8
push esi
call fcn.004103c0
add esp, 0xc
test al, al
je 0x41036d
cmp dword [esi], 0x4550
jne 0x41036d
mov esi, dword [esi + 0x80]
add esi, edi
cmp esi, dword [ebp - 0x24]
je 0x410393
mov edx, dword [ebp - 0x2c]
mov edi, edx
lea ecx, [edi + 1]
nop
mov al, byte [edi]
inc edi
test al, al
jne 0x4102b0
sub edi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4102df
add eax, dword [ebp - 0x20]
push edi
push edx
push eax
call fcn.0041062e
add esp, 0xc
test eax, eax
je 0x4102df
add esi, 0x14
mov eax, dword [esi + 0xc]
test eax, eax
mov edx, dword [ebp - 0x2c]
jne 0x4102c0
cmp dword [esi + 0xc], 0
je 0x410393
mov esi, dword [esi + 0x10]
add esi, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x2c], esi
mov eax, dword [esi]
test eax, eax
je 0x41036d
cmp eax, ecx
jne 0x41038b
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 0x80
push 4
push esi
mov edi, dword [0x54835c]
call edi
test eax, eax
je 0x41036d
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
xchg dword [esi], eax
mov bl, 1
mov byte [ebp - 0x25], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x41035a
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004016a0
mov esp, ebp
pop ebp
ret
add esi, 4
jmp 0x4102f2
xor al, al
jmp 0x41036f

Function at 0x410fe0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x411013
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x411013
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x411013
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x411013
mov al, 1
ret
xor al, al
ret
Function at 0x411df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
mov edx, dword [eax + 0x3c]
add edx, eax
mov eax, dword [edi]
push dword [edx + 0x78]
call dword [eax]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411ec2
mov ecx, dword [edi + 4]
mov esi, dword [edi]
mov edx, dword [ecx + 0x3c]
push dword [edx + ecx + 0x78]
mov ecx, edi
call dword [esi]
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x411ec2
mov eax, dword [ebp + 8]
cmp eax, 0xffff
jbe 0x411ee7
mov eax, dword [edi]
mov ecx, edi
push dword [ebx + 0x20]
call dword [eax]
mov ecx, dword [ebx + 0x18]
mov edx, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
lea ebx, [eax + ecx*4]
cmp eax, ebx
je 0x411ec2
nop dword [eax + eax]
mov eax, ebx
sub eax, edx
sar eax, 2
mov eax, eax
test eax, eax
jns 0x411e70
add eax, 1
sar eax, 1
push dword [edx + eax*4]
lea esi, [edx + eax*4]
mov ecx, edi
mov eax, dword [edi]
mov dword [ebp - 8], esi
call dword [eax]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx]
test dl, dl
je 0x411ea5
mov esi, dword [ebp + 8]
mov cl, dl
sub esi, eax
mov dl, cl
cmp cl, byte [eax]
jne 0x411ea2
mov cl, byte [esi + eax + 1]
inc eax
mov dl, cl
test cl, cl
jne 0x411e91
mov esi, dword [ebp - 8]
movzx eax, byte [eax]
movzx ecx, dl
sub ecx, eax
je 0x411ecd
test ecx, ecx
lea edx, [esi + 4]
cmovle edx, dword [ebp - 4]
cmovle ebx, esi
mov dword [ebp - 4], edx
cmp edx, ebx
jne 0x411e60
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp - 0xc]
mov ecx, edi
mov eax, dword [edi]
push dword [ebx + 0x24]
call dword [eax]
sub esi, dword [ebp - 0x10]
sar esi, 2
mov ax, word [eax + esi*2]
add ax, word [ebx + 0x10]
mov ebx, dword [ebp - 0x14]
mov ecx, edi
movzx esi, ax
mov eax, dword [edi]
push dword [ebx + 0x1c]
call dword [eax]
movzx ecx, si
sub ecx, dword [ebx + 0x10]
pop edi
pop esi
pop ebx
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret 4
Function at 0x41f1b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x586ba0
push 0x50ae80
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x59e554]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
xor bl, bl
test eax, eax
je 0x41f36d
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41f36d
cmp byte [eax], bl
je 0x41f36d
test ecx, ecx
je 0x41f36d
cmp byte [ecx], bl
je 0x41f36d
test edi, edi
je 0x41f36d
cmp dword [ebp + 0x18], 0
je 0x41f36d
push ecx
call dword [0x5481b8]
test eax, eax
je 0x41f36d
push 0
push 0x40
push edi
call fcn.0041f3c0
add esp, 0xc
test al, al
je 0x41f36d
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x41f36d
mov esi, dword [edi + 0x3c]
add esi, edi
mov dword [ebp - 0x24], esi
push 0
push 0xf8
push esi
call fcn.0041f3c0
add esp, 0xc
test al, al
je 0x41f36d
cmp dword [esi], 0x4550
jne 0x41f36d
mov esi, dword [esi + 0x80]
add esi, edi
cmp esi, dword [ebp - 0x24]
je 0x41f393
mov edx, dword [ebp - 0x2c]
mov edi, edx
lea ecx, [edi + 1]
nop
mov al, byte [edi]
inc edi
test al, al
jne 0x41f2b0
sub edi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x41f2df
add eax, dword [ebp - 0x20]
push edi
push edx
push eax
call fcn.0041f62e
add esp, 0xc
test eax, eax
je 0x41f2df
add esi, 0x14
mov eax, dword [esi + 0xc]
test eax, eax
mov edx, dword [ebp - 0x2c]
jne 0x41f2c0
cmp dword [esi + 0xc], 0
je 0x41f393
mov esi, dword [esi + 0x10]
add esi, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x2c], esi
mov eax, dword [esi]
test eax, eax
je 0x41f36d
cmp eax, ecx
jne 0x41f38b
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 0x80
push 4
push esi
mov edi, dword [0x54835c]
call edi
test eax, eax
je 0x41f36d
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
xchg dword [esi], eax
mov bl, 1
mov byte [ebp - 0x25], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x41f35a
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004106a0
mov esp, ebp
pop ebp
ret
add esi, 4
jmp 0x41f2f2
xor al, al
jmp 0x41f36f
Function at 0x45dcd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53bf0e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x59e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00414ed0
mov dword [edi], eax
lea esi, [edi + 0x10]
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414ed0
mov dword [esi], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
lea eax, [edi + 0x38]
mov byte [ebp - 4], 2
push eax
call dword [0x548290]
mov dword [edi + 8], 0
mov eax, edi
mov dword [edi + 0xc], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x18], 0
mov byte [edi + 0x50], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4643e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537eb0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x59e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00414e69
mov edi, eax
add esp, 4
test edi, edi
je 0x464492
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004644aa
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46fad0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d3b6
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x59e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x30]
mov byte [edi], 0
mov dword [edi + 4], 0
mov ecx, esi
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov byte [edi + 0x2c], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414ed0
mov dword [esi], eax
lea esi, [edi + 0x54]
mov dword [edi + 0x50], 0
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414ed0
mov dword [esi], eax
mov esi, dword [0x548290]
lea eax, [edi + 0x38]
push eax
mov byte [ebp - 4], 1
call esi
lea eax, [edi + 0x14]
push eax
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x471d30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d5cc
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x59e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x38]
mov ecx, esi
mov dword [esi], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0
call fcn.00414ed0
mov dword [esi], eax
xor eax, eax
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 7
mov dword [ebp - 4], 0
mov word [edi + 0x40], ax
xor ecx, ecx
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], 7
mov word [edi + 0x58], cx
mov dword [edi + 0x80], ecx
mov dword [edi + 0x84], 7
mov word [edi + 0x70], ax
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
lea eax, [edi + 0x14]
push eax
mov byte [ebp - 4], 3
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], ecx
mov dword [edi + 0x34], ecx
mov dword [edi], ecx
mov byte [edi + 0xc], cl
mov byte [edi + 0x88], cl
mov dword [edi + 0x8c], ecx
mov dword [edi + 0x90], ecx
call dword [0x548290]
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x471e19
mov edx, esi
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x471e00
sub edx, ecx
lea ecx, [edi + 0x40]
sar edx, 1
push edx
push esi
call fcn.00416660
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x471e3e
mov edx, esi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x471e25
sub edx, ecx
lea ecx, [edi + 0x58]
sar edx, 1
push edx
push esi
call fcn.00416660
call fcn.00471890
cmp eax, 0x68
jl 0x471e7b
push 0x548a1c
call dword [0x54820c]
mov ebx, eax
test ebx, ebx
je 0x471e7b
mov esi, dword [0x5482f8]
push 0x548a38
push ebx
call esi
push 0x548a54
push ebx
mov dword [edi + 0x8c], eax
call esi
mov dword [edi + 0x90], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b5780
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540cb8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x59e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0xc]
mov dword [edi], 0x563800
mov word [edi + 4], 0
mov ecx, esi
mov byte [edi + 6], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414ed0
mov dword [esi], eax
lea eax, [edi + 0x14]
push eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
call dword [0x548290]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c8c50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5425c8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x59e554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00414e69
mov edi, eax
add esp, 4
test edi, edi
je 0x4c8cf4
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004644aa
add esp, 4
mov dword [edi + 4], eax
jmp 0x4c8cf6
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00476b90
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4c8d57
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x4c8d57
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x4c8dbe
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
je 0x4c8dbe
push 1
test cl, 4
jne 0x4c8de1
test cl, 2
je 0x4c8d9a
lea eax, [ebp - 0x14]
push eax
call fcn.00475910
add esp, 8
push eax
push 0x548dd8
jmp 0x4c8df3
lea eax, [ebp - 0x1c]
push eax
call fcn.00475910
add esp, 8
lea ecx, [ebp - 0x44]
push eax
push 0x548df0
call fcn.00473c10
push 0x58d09c
lea eax, [ebp - 0x44]
jmp 0x4c8e03
cmp byte [ebp + 0xc], 0
je 0x4c8dcd
push esi
call fcn.00516dcb
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x14]
push eax
call fcn.00475910
add esp, 8
push eax
push 0x548dc0
lea ecx, [ebp - 0x30]
call fcn.00473c10
push 0x58d09c
lea eax, [ebp - 0x30]
push eax
call fcn.00518d15
int3