joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8730
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4a8778
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 8], esi
call fcn.005d95d0
neg esi
sbb esi, esi
test esi, fcn.00489120
mov dword [esp + 0xc], eax
je 0x4a8778
lea eax, [esp + 8]
push eax
mov edx, 0x615a64
call fcn.004a6540
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a8780
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x64c874]
xor eax, esp
mov dword [esp + 0x194], eax
push 0x65b678
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x4a87bb
lea eax, [esp]
push eax
push 2
call sub.WS2_32.dll_WSAStartup
push eax
push 0x65b67c
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.005b88a9
add esp, 0x19c
ret

Function at 0x4aba40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5dff98
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004154d0
xor edx, edx
mov dword [esp + 0x18], edx
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
lea eax, [edi + 0x30]
push edx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edx
push eax
mov byte [ecx + 4], dl
call fcn.0040b390
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4abaf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dff98
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004154d0
test edi, edi
mov dword [esp + 0x18], 0
je 0x4abb34
add edi, 0x28
jmp 0x4abb36
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x4abb4e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4abbc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dff68
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00405390
mov dword [esi], vtable.boost::gregorian::bad_day_of_month.0
test edi, edi
mov dword [esp + 0x18], 0
je 0x4abc0a
add edi, 0x28
jmp 0x4abc0c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x4abc24
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4abd80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dff68
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00405390
mov dword [esi], vtable.boost::gregorian::bad_year.0
test edi, edi
mov dword [esp + 0x18], 0
je 0x4abdca
add edi, 0x28
jmp 0x4abdcc
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x4abde4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4abe70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dff68
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00405390
mov dword [esi], vtable.boost::gregorian::bad_month.0
test edi, edi
mov dword [esp + 0x18], 0
je 0x4abeba
add edi, 0x28
jmp 0x4abebc
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x4abed4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4ad390
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, eax
cmp edi, dword [esp + 8]
je 0x4ad416
mov ecx, dword [0x6542b0]
push ebx
mov ebx, dword [0x6542a8]
push ebp
mov ebp, dword [0x6542ac]
push esi
mov esi, dword [0x64ebc8]
mov eax, esi
shl eax, 0xb
xor eax, esi
mov edx, ecx
shr edx, 0xb
xor edx, eax
shr edx, 8
xor edx, ecx
xor edx, eax
mov esi, ebx
mov ebx, ebp
mov ebp, ecx
mov ecx, edx
mov eax, 0xd41d41d5
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x46
mov edx, ecx
sub edx, eax
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz__.___]
mov byte [edi], al
add edi, 1
cmp edi, dword [esp + 0x14]
jne 0x4ad3b4
mov dword [0x64ebc8], esi
pop esi
mov dword [0x6542ac], ebp
pop ebp
mov dword [0x6542a8], ebx
mov dword [0x6542b0], ecx
pop ebx
pop edi
ret
Function at 0x4b3de0
Capabilities:
Get file size
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5ee2ca
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x64c874]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x74]
xor ebx, ebx
mov edi, ecx
mov dword [esi], ebx
call fcn.005d95d0
mov dword [esi + 4], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], bx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
push esi
push ebx
push edi
lea ecx, [esp + 0x38]
mov dword [esp + 0x78], ebx
call fcn.004a1900
test al, al
jne 0x4b3e76
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x70], 0xffffffff
call fcn.004a1890
or eax, 0xffffffff
jmp 0x4b3fbe
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4b3ea5
call fcn.005d95d0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], edi
or edi, 0xffffffff
mov dword [esi], eax
mov dword [esp + 0x18], edi
jmp 0x4b3eb1
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov ecx, dword [esi]
neg ecx
sbb ecx, ecx
test ecx, fcn.00489120
je 0x4b3ed9
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x70], 0xffffffff
call fcn.004a1890
or eax, 0xffffffff
jmp 0x4b3fbe
cmp dword [esp + 0x18], ebx
jl 0x4b3f14
jg 0x4b3ee9
cmp edi, 0x7a1200
jbe 0x4b3f14
call fcn.00489480
mov dword [esi + 4], eax
lea eax, [esp + 0x2c]
mov ecx, 0x64
push eax
mov dword [esi], ecx
mov dword [esp + 0x70], 0xffffffff
call fcn.004a1890
mov eax, 0xfffffffe
jmp 0x4b3fbe
mov eax, edi
mov ecx, ebp
call fcn.004b7f90
mov ecx, edi
or ecx, dword [esp + 0x18]
jne 0x4b3f2f
lea edx, [esp + 0x2c]
push edx
jmp 0x4b3faf
mov eax, dword [ebp + 4]
cmp eax, ebx
je 0x4b3f3d
mov ecx, dword [ebp + 8]
sub ecx, eax
jne 0x4b3f42
call fcn.005b8b18
mov edx, dword [ebp + 4]
push esi
push 1
lea eax, [esp + 0x24]
push eax
push ebx
push ebx
lea ecx, [esp + 0x40]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edi
call fcn.004a2120
cmp eax, edi
jne 0x4b3f6a
cmp edx, dword [esp + 0x18]
je 0x4b3f83
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x70], 0xffffffff
call fcn.004a1890
mov eax, 0xfffffffd
jmp 0x4b3fbe
mov edx, dword [esi]
neg edx
sbb edx, edx
test edx, fcn.00489120
je 0x4b3faa
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x70], 0xffffffff
call fcn.004a1890
mov eax, 0xfffffffd
jmp 0x4b3fbe
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x70], 0xffffffff
call fcn.004a1890
xor eax, eax
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.005b88a9
add esp, 0x60
ret
Function at 0x4b6a00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5e67fb
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x64c874]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [esp + 0x38]
push eax
mov esi, ecx
call fcn.004b3fe0
xor eax, eax
mov dword [esp + 0xc0], eax
mov cl, byte [esp + 0xa7]
and cl, 0xf2
lea edx, [esp + 0x34]
or cl, 2
add esi, 0x9c
push edx
mov byte [esp + 0xa8], al
mov byte [esp + 0xab], cl
call fcn.004b72c0
mov eax, dword [esi + 8]
cmp dword [esi + 4], eax
mov dword [esp + 0x1c], eax
jbe 0x4b6a95
call fcn.005b8b18
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
mov dword [esp + 0x14], eax
jbe 0x4b6aa6
call fcn.005b8b18
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x18]
mov eax, 0x70
mov ecx, eax
mov ebx, eax
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push esi
mov esi, dword [esp + 0x30]
sub esp, 0x14
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], edi
call fcn.004b9b10
add esp, 0x24
lea esi, [esp + 0x34]
call fcn.004b4090
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.005b88a9
mov esp, ebp
pop ebp
ret 4
Function at 0x4bb110
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x5e2af8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, edx
mov eax, dword [esp + 0x30]
lea ebp, [esi + esi + 2]
cmp ebp, eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], esi
jge 0x4bb19c
mov ecx, dword [esp + 0x38]
mov eax, ebp
shl eax, 4
sub eax, ebp
lea eax, [ebx + eax*8]
mov dl, byte [ecx + eax]
mov ecx, dword [esp + 0x40]
cmp dl, byte [ecx + eax - 0x78]
jae 0x4bb171
sub ebp, 1
mov eax, esi
mov edx, ebp
shl edx, 4
shl eax, 4
sub edx, ebp
sub eax, esi
lea edi, [ebx + edx*8]
lea esi, [ebx + eax*8]
call fcn.0049ccf0
mov esi, ebp
lea ebp, [ebp + ebp + 2]
cmp ebp, dword [esp + 0x30]
jl 0x4bb153
mov eax, dword [esp + 0x30]
cmp ebp, eax
jne 0x4bb1bf
mov ecx, eax
mov edx, esi
shl ecx, 4
shl edx, 4
sub ecx, eax
sub edx, esi
lea edi, [ebx + ecx*8 - 0x78]
lea esi, [ebx + edx*8]
call fcn.0049ccf0
mov eax, dword [esp + 0x30]
lea esi, [eax - 1]
sub esp, 0x78
mov ecx, esp
mov dword [esp + 0x94], esp
push ecx
lea edi, [esp + 0xc4]
call fcn.00496b40
mov edx, dword [esp + 0xac]
mov ecx, dword [esp + 0xb0]
sub esp, 0x14
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0xc8]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xcc]
mov dword [eax + 8], edx
mov edx, dword [esp + 0xd0]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
mov eax, dword [esp + 0xa4]
push eax
mov ecx, esi
mov edx, ebx
call fcn.004bb390
mov esi, 0x10
add esp, 0x90
cmp dword [esp + 0x98], esi
jb 0x4bb243
mov ecx, dword [esp + 0x84]
push ecx
call fcn.0059b877
add esp, 4
xor edi, edi
cmp dword [esp + 0x7c], esi
mov ebx, 0xf
mov dword [esp + 0x98], ebx
mov dword [esp + 0x94], edi
mov byte [esp + 0x84], 0
jb 0x4bb273
mov edx, dword [esp + 0x68]
push edx
call fcn.0059b877
add esp, 4
cmp dword [esp + 0x60], esi
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x78], edi
mov byte [esp + 0x68], 0
jb 0x4bb293
mov eax, dword [esp + 0x4c]
push eax
call fcn.0059b877
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4bc8e0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5eaa98
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edx, dword [ebx + 4]
sub esp, 0x20
mov eax, fcn.00515c20
mov dword [esp + 0x30], esp
mov edi, esp
mov esi, eax
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], esi
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x50]
mov dword [eax + 8], edx
mov byte [esp + 0x3f], 0
mov dword [eax + 0xc], ecx
call fcn.004c0c40
mov eax, dword [ebx + 4]
lea edx, [eax + 0xc]
push edx
add eax, 0x24
push eax
lea eax, [esp + 0x37]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x54]
push edx
call fcn.004bf2b0
mov dword [esp + 0x9c], 0
mov edx, dword [eax]
mov edi, dword [ebx + 4]
push ecx
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, dword [eax + 0xc]
mov dword [ecx + 0xc], edx
mov edx, dword [eax + 0x10]
mov dword [ecx + 0x10], edx
mov edx, dword [eax + 0x14]
mov dword [ecx + 0x14], edx
lea esi, [ecx + 0x18]
lea ecx, [eax + 0x18]
mov dword [esp + 0x4c], esp
call fcn.00559c90
mov esi, dword [edi + 0x37c]
call fcn.004c0e50
mov dword [esp + 0x68], 0xffffffff
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4bc9d0
test al, 1
jne 0x4bc9d0
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x4bc9d0
lea ecx, [esp + 0x44]
push 2
push ecx
mov edx, ecx
push edx
call eax
add esp, 0xc
mov edi, dword [ebx + 4]
add edi, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [esp + 0xf], 0
mov byte [esp + 0x18], 1
jne 0x4bca2f
mov esi, dword [ebx + 4]
add dword [esi + 0x40], 1
add esi, 0x24
cmp byte [esp + 0x18], 0
je 0x4bca06
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [esp + 0x18], 0
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [esp + 0x18], 0
jne 0x4bca24
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x18], 1
add dword [esi + 0x1c], 0xffffffff
cmp byte [esp + 0xf], 0
je 0x4bc9e9
cmp byte [esp + 0x18], 0
movzx esi, word [esp + 0x10]
je 0x4bca42
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ax, si
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4bda00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e2a28
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x20], esi
call fcn.004be220
mov dword [esi + 4], eax
mov byte [eax + 0x21], 1
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
xor eax, eax
mov dword [esi + 8], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
push eax
push esi
lea ebx, [esp + 0x14]
call fcn.004bdb90
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x34
ret

Function at 0x4bed90
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5dfdd9
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x5c]
mov dword [esp + 0xc], 0
sub esp, 0x20
mov esi, esp
lea ecx, [esp + 0x90]
mov dword [esp + 0x74], 1
mov dword [esp + 0x30], esp
call fcn.00559c90
mov edx, dword [esp + 0x88]
push ecx
mov ecx, dword [esp + 0x90]
mov eax, esp
mov dword [eax], ecx
mov dword [esp + 0x34], esp
push ecx
mov eax, esp
mov dword [esp + 0x94], esp
push ecx
mov ecx, dword [esp + 0x90]
mov dword [eax], edx
mov edx, dword [esp + 0x8c]
mov eax, esp
mov dword [esp + 0x98], esp
push ecx
mov dword [eax], ecx
mov eax, esp
lea ecx, [esp + 0x44]
mov dword [esp + 0x9c], esp
mov dword [eax], edx
call fcn.004c0480
mov byte [esp + 0x54], 2
mov dword [edi], 0x4bec80
mov ecx, dword [eax]
mov dword [edi + 8], ecx
mov edx, dword [eax + 4]
mov dword [edi + 0xc], edx
mov ecx, dword [eax + 8]
mov dword [edi + 0x10], ecx
mov edx, dword [eax + 0xc]
lea esi, [edi + 0x18]
lea ecx, [eax + 0x10]
mov dword [edi + 0x14], edx
call fcn.00559c90
mov byte [esp + 0x54], 1
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0xc], 1
je 0x4bee96
test al, 1
jne 0x4bee8e
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x4bee8e
lea ecx, [esp + 0x2c]
push 2
push ecx
mov edx, ecx
push edx
call eax
add esp, 0xc
mov dword [esp + 0x24], 0
mov byte [esp + 0x54], 0
mov eax, dword [esp + 0x70]
test eax, eax
je 0x4beebf
test al, 1
jne 0x4beebf
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x4beebf
lea ecx, [esp + 0x78]
push 2
push ecx
mov edx, ecx
push edx
call eax
add esp, 0xc
mov eax, edi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x4c
ret
Function at 0x4bf2b0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5dfdd9
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x5c]
mov dword [esp + 0xc], 0
sub esp, 0x20
mov esi, esp
lea ecx, [esp + 0x90]
mov dword [esp + 0x74], 1
mov dword [esp + 0x30], esp
call fcn.00559c90
mov edx, dword [esp + 0x88]
push ecx
mov ecx, dword [esp + 0x90]
mov eax, esp
mov dword [eax], ecx
mov dword [esp + 0x34], esp
push ecx
mov eax, esp
mov dword [esp + 0x94], esp
push ecx
mov ecx, dword [esp + 0x90]
mov dword [eax], edx
mov edx, dword [esp + 0x8c]
mov eax, esp
mov dword [esp + 0x98], esp
push ecx
mov dword [eax], ecx
mov eax, esp
lea ecx, [esp + 0x44]
mov dword [esp + 0x9c], esp
mov dword [eax], edx
call fcn.004c0480
mov byte [esp + 0x54], 2
mov dword [edi], 0x4bf200
mov ecx, dword [eax]
mov dword [edi + 8], ecx
mov edx, dword [eax + 4]
mov dword [edi + 0xc], edx
mov ecx, dword [eax + 8]
mov dword [edi + 0x10], ecx
mov edx, dword [eax + 0xc]
lea esi, [edi + 0x18]
lea ecx, [eax + 0x10]
mov dword [edi + 0x14], edx
call fcn.00559c90
mov byte [esp + 0x54], 1
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0xc], 1
je 0x4bf3b6
test al, 1
jne 0x4bf3ae
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x4bf3ae
lea ecx, [esp + 0x2c]
push 2
push ecx
mov edx, ecx
push edx
call eax
add esp, 0xc
mov dword [esp + 0x24], 0
mov byte [esp + 0x54], 0
mov eax, dword [esp + 0x70]
test eax, eax
je 0x4bf3df
test al, 1
jne 0x4bf3df
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x4bf3df
lea ecx, [esp + 0x78]
push 2
push ecx
mov edx, ecx
push edx
call eax
add esp, 0xc
mov eax, edi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x4c
ret
Function at 0x4bf4e0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5dfdd9
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x5c]
mov dword [esp + 0xc], 0
sub esp, 0x20
mov esi, esp
lea ecx, [esp + 0x90]
mov dword [esp + 0x74], 1
mov dword [esp + 0x30], esp
call fcn.00559c90
mov edx, dword [esp + 0x88]
push ecx
mov ecx, dword [esp + 0x90]
mov eax, esp
mov dword [eax], ecx
mov dword [esp + 0x34], esp
push ecx
mov eax, esp
mov dword [esp + 0x94], esp
push ecx
mov ecx, dword [esp + 0x90]
mov dword [eax], edx
mov edx, dword [esp + 0x8c]
mov eax, esp
mov dword [esp + 0x98], esp
push ecx
mov dword [eax], ecx
mov eax, esp
lea ecx, [esp + 0x44]
mov dword [esp + 0x9c], esp
mov dword [eax], edx
call fcn.004c0480
mov byte [esp + 0x54], 2
mov dword [edi], 0x4bf400
mov ecx, dword [eax]
mov dword [edi + 8], ecx
mov edx, dword [eax + 4]
mov dword [edi + 0xc], edx
mov ecx, dword [eax + 8]
mov dword [edi + 0x10], ecx
mov edx, dword [eax + 0xc]
lea esi, [edi + 0x18]
lea ecx, [eax + 0x10]
mov dword [edi + 0x14], edx
call fcn.00559c90
mov byte [esp + 0x54], 1
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0xc], 1
je 0x4bf5e6
test al, 1
jne 0x4bf5de
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x4bf5de
lea ecx, [esp + 0x2c]
push 2
push ecx
mov edx, ecx
push edx
call eax
add esp, 0xc
mov dword [esp + 0x24], 0
mov byte [esp + 0x54], 0
mov eax, dword [esp + 0x70]
test eax, eax
je 0x4bf60f
test al, 1
jne 0x4bf60f
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x4bf60f
lea ecx, [esp + 0x78]
push 2
push ecx
mov edx, ecx
push edx
call eax
add esp, 0xc
mov eax, edi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x4c
ret