joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f970
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x1002f990
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x1002f9b0
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x1002faa0
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x1002fab0
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x1002fad0
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x1002fae0
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x1002fb00
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x1002fb10
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x1002fb20
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x1002fb30
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x1002fed0
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x1002fef0
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x403620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49c588
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov al, byte [esp + 0x24]
mov byte [esp + 0x24], al
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
push 1
lea edx, [esp + 0x28]
push edx
push ecx
push eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x28], edi
call fcn.00403530
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.004032b0
mov edi, dword [esp + 0x34]
add eax, 0x10
add esp, 0x18
mov dword [edi], eax
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4036b6
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x409e70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x409e89
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x409e9d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x409ebe
cmp esi, eax
jae 0x409e97
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x409eb0
cmp esi, eax
jae 0x409e97
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x40fe60
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c0
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x118], bl
mov ecx, 0x3f
lea edi, [esp + 0x119]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x218], bl
mov ecx, 0x3f
lea edi, [esp + 0x219]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x18], bl
mov ecx, 0x3f
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0x6c]
sub eax, ebx
je 0x41005c
dec eax
je 0x40ff27
dec eax
jne 0x41005c
lea eax, [esp + 0x14]
push eax
push 1
push ebx
push str.SOFTWARERealNetworksGames_scrabbledownloadedition1
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41005c
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x31c]
push edx
push ebx
push ebx
push str.LicenseKey
push eax
mov dword [esp + 0x28], 0xb4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
add eax, 2
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0xff
lea ecx, [esp + 0x1c]
push ecx
push str.LOCK
call esi
test eax, eax
je 0x40ffa9
lea edx, [esp + 0x18]
push str.LOCKED
push edx
call fcn.0046b8d8
add esp, 8
test eax, eax
je 0x40ffa9
lea eax, [esp + 0x18]
push str.BETA
push eax
call fcn.0046b8d8
add esp, 8
test eax, eax
jne 0x40ff79
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0xff
lea ecx, [esp + 0x11c]
push ecx
push str.USERNAME
call esi
test eax, eax
je 0x40ffa9
push 0xff
lea edx, [esp + 0x21c]
push edx
push str.USERKEY
call esi
test eax, eax
jne 0x40ffb6
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x118]
push str.DEFAULT
push eax
call fcn.0046b8d8
add esp, 8
test eax, eax
jne 0x410019
mov ecx, 0x10
mov esi, str.Program_is_using_the_default_key__no_username_or_key_is_available.
lea edi, [esp + 0x3d0]
rep movsd dword es:[edi], dword [esi]
push 0x40
push str.Information
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x3d8]
push ecx
push ebx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp + 0x2c]
cmp ecx, ebx
je 0x41004f
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov dword [ebp + 0x2c], ebx
mov eax, 2
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x11c]
push ecx
lea edx, [esp + 0x3d8]
push str.Program_is_registered_to__s___s_.
push edx
call fcn.00468e67
mov ecx, dword [ebp + 0x2c]
add esp, 0x10
cmp ecx, ebx
je 0x41004f
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [ebp + 0x2c], ebx
mov eax, 2
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49ceae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esi + 4], vtable.IEventReceiver.0
push edi
mov dword [esp + 0x10], esi
mov dword [esi], vtable.CGameSplash.1.0
mov dword [esi + 4], vtable.CGameSplash.0
call fcn.0048a7ff
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x30], eax
xor ebx, ebx
mov dword [esp + 0x1c], ebx
call fcn.0048a7ff
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x34], eax
mov byte [esp + 0x1c], 1
lea edi, [esi + 0x68]
call fcn.0048a7ff
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x1c], 2
call fcn.0048a7ff
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x70], eax
mov byte [esp + 0x1c], 3
call fcn.0048a7ff
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x74], eax
mov byte [esp + 0x1c], 4
call fcn.0048a7ff
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x78], eax
mov byte [esp + 0x1c], 5
call fcn.0048a7ff
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x8c], eax
mov byte [esp + 0x1c], 6
call fcn.0048a7ff
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x94], eax
mov byte [esp + 0x1c], 7
mov dword [esi + 0x10], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov eax, 0x4a3870
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x20], ebx
lea ebp, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x410be0
sub eax, ebp
push eax
push 0x4a3870
mov ecx, edi
call fcn.00401f30
mov ecx, dword [esp + 0x14]
pop edi
mov dword [esi + 0x2c], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x410c11
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ecx
push esi
mov esi, ecx
mov al, byte [esi + 0x90]
test al, al
jne 0x410ce3
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x410ce3
push ebx
push ebp
push edi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
jne 0x410c4e
call dword [sym.imp.USER32.dll_CloseClipboard]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
jne 0x410c6e
call dword [sym.imp.USER32.dll_CloseClipboard]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
jne 0x410c81
call dword [sym.imp.USER32.dll_CloseClipboard]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x410c92
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esi + 0x7c]
cmp eax, 2
jne 0x410cae
lea ebp, [esi + 0x70]
push edi
mov ecx, ebp
call fcn.00402010
mov ecx, dword [ebp]
push ecx
mov ecx, dword [esi + 0x58]
jmp 0x410cc5
cmp eax, 3
jne 0x410cce
lea ebp, [esi + 0x74]
push edi
mov ecx, ebp
call fcn.00402010
mov edx, dword [ebp]
mov ecx, dword [esi + 0x5c]
push edx
call fcn.00404550
mov ebp, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
call dword [sym.imp.USER32.dll_CloseClipboard]
push ebp
call esi
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
Function at 0x411cc0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x49d0e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
push 0x74
mov esi, ecx
call fcn.0048a73b
add esp, 4
mov dword [esp + 8], eax
xor edi, edi
cmp eax, edi
mov dword [esp + 0x14], edi
je 0x411cfd
push 2
mov ecx, eax
call fcn.0043b390
jmp 0x411cff
xor eax, eax
mov dword [0x4c6d28], eax
mov ecx, eax
mov dword [esp + 0x14], 0xffffffff
mov dword [esi + 0x110], eax
call fcn.0043a450
test eax, eax
jne 0x411d3a
mov ecx, dword [esi + 0x110]
cmp ecx, edi
je 0x411d33
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x110], edi
push 0xffffffffffffffff
call fcn.004697fa
cmp dword [esi + 0xd0], edi
mov ecx, dword [esi + 0x1c]
push ebx
mov ebx, dword [esi + 0x11c]
push ebp
mov ebp, dword [esi + 0x120]
je 0x411db7
push edi
push 0x10
push ebp
push ebx
push ecx
mov ecx, dword [esi + 0x110]
call fcn.0043a9f0
mov edi, eax
test edi, edi
jge 0x411ddb
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x110]
push 0
push 0x18
push ebp
push ebx
push edx
call fcn.0043a9f0
mov edi, eax
test edi, edi
jge 0x411ddb
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x110]
push 0
push 0x20
push ebp
push ebx
push eax
call fcn.0043a9f0
mov edi, eax
test edi, edi
jge 0x411ddb
mov ecx, dword [esi + 0x1c]
push 0
push 8
push ebp
push ebx
push ecx
mov ecx, dword [esi + 0x110]
call fcn.0043a9f0
jmp 0x411dd1
mov edx, dword [esi + 0x128]
mov eax, dword [esi + 0x124]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x110]
call fcn.0043a5a0
mov edi, eax
test edi, edi
jl 0x411e7c
mov ecx, dword [esi + 0x110]
push 0
call fcn.00439ec0
mov edx, dword [esi + 0x110]
mov ecx, dword [edx + 0x18]
push 0
call fcn.00432db0
mov ecx, dword [esi + 0x110]
push 0
push 1
push 1
call fcn.0043af00
mov eax, dword [esi + 0x110]
mov ecx, dword [eax + 0x18]
push 0
call fcn.00432db0
mov ecx, dword [esi + 0x110]
push 0
push 1
push 1
call fcn.0043af00
push 0xc38
call fcn.0048a73b
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x1c], 1
je 0x411e50
mov ecx, eax
call fcn.00433350
jmp 0x411e52
xor eax, eax
mov dword [0x4c6d2c], eax
mov esi, dword [esi + 0x110]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
push 1
push ecx
push edx
push esi
mov ecx, eax
mov dword [esp + 0x2c], 0xffffffff
call fcn.004333e0
call fcn.004304f0
mov ecx, dword [esp + 0x14]
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4157b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49d378
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.0048a7ff
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov edx, dword [esi + 0x10]
mov edi, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
add edi, edx
mov edx, dword [esi + 0x14]
lea ebx, [ecx + edx + 1]
mov cl, byte [esi + 0x2d]
test cl, cl
mov dword [esp + 0x18], 0
je 0x41581a
add eax, 0xfffffff0
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
jmp 0x41597d
mov al, byte [esi + 0x2c]
test al, al
je 0x41582b
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x415833
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
call dword [edx + 4]
push ebp
mov ecx, esi
call fcn.004156e0
mov ecx, dword [esi + 0x20]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esi + 0x24]
call fcn.00405040
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 0x18]
push 3
push 0x190
push 0x10
push 0
push str.Tahoma
call fcn.004321c0
mov edx, dword [esi + 4]
mov ecx, dword [edx + 0x18]
call fcn.00432120
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x18]
call fcn.00432290
mov ecx, dword [esi + 4]
mov ebp, dword [ecx + 0x18]
mov ecx, dword [esi + 8]
add edi, 0x52
call fcn.0040ad90
push eax
push 0
lea edx, [ebx + 0x1e]
push edx
push edi
mov ecx, ebp
call fcn.004322d0
mov ecx, dword [esi + 8]
call fcn.00409fe0
push eax
lea eax, [esp + 0x14]
push 0x4a3b68
push eax
call fcn.00405170
mov edx, dword [esp + 0x1c]
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 0x18]
add esp, 0xc
push edx
push 0
lea eax, [ebx + 0x2d]
push eax
push edi
call fcn.004322d0
mov ecx, dword [esi + 8]
cmp dword [ecx + 0x3ec], 1
jne 0x4158ec
call fcn.00409fe0
push eax
push 0x4a3b68
lea ecx, [esp + 0x18]
push ecx
jmp 0x415902
fld qword [ecx + 0x740]
call fcn.00469428
push eax
push 0x4a3b68
lea edx, [esp + 0x18]
push edx
call fcn.00405170
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax + 0x18]
add esp, 0xc
push edx
push 0
lea eax, [ebx + 0x3c]
push eax
push edi
call fcn.004322d0
mov ecx, dword [esi + 8]
call fcn.00409fd0
push eax
lea ecx, [esp + 0x14]
push 0x4a3b68
push ecx
call fcn.00405170
mov ebp, dword [esp + 0x1c]
mov edx, dword [esi + 4]
mov ecx, dword [edx + 0x18]
add esp, 0xc
push ebp
push 0
add ebx, 0x4b
push ebx
push edi
call fcn.004322d0
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x18]
call fcn.00432170
mov ecx, dword [esi + 0x28]
call fcn.00405040
lea eax, [ebp - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop ebp
test edx, edx
jg 0x415989
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x417a30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49d5a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword [esp + 0x38]
push ebx
push esi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov esi, ecx
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.004019d0
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
mov ecx, esi
mov dword [esp + 0x40], ebx
call fcn.00417720
mov esi, dword [eax]
cmp dword [esp + 0x28], 0x10
jb 0x417a9e
mov eax, dword [esp + 0x14]
push eax
call fcn.0048a76b
add esp, 4
mov ecx, dword [esp + 0x30]
lea eax, [esi + 0x24]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4

Function at 0x41f540
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49db5b
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0041f080
mov eax, dword [esp + 0x30]
push 0x14
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00469e60
mov cl, byte [esp + 0x18]
add esp, 0xc
test cl, cl
lea eax, [esp + 0xc]
je 0x41f592
cmp byte [eax], 0x30
jne 0x41f58a
mov byte [eax], 0x20
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x41f582
push 0x10
call fcn.0048a73b
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
mov dword [esp + 0x28], 0
je 0x41f5c1
mov edx, dword [esp + 0x34]
push edx
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call fcn.004187f0
mov edi, eax
jmp 0x41f5c3
xor edi, edi
push 0x68
mov dword [esp + 0x2c], 0xffffffff
call fcn.0048a73b
add esp, 4
test eax, eax
je 0x41f5e4
mov ecx, eax
call fcn.004188a0
mov esi, eax
jmp 0x41f5e6
xor esi, esi
push edi
mov ecx, esi
call fcn.00419470
push 1
mov ecx, esi
call fcn.004191e0
mov ecx, dword [ebx + 0x30]
push 0
push 1
push esi
call fcn.0041ee20
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8