joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441070
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d53d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x50c620]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
lea ebx, [edi + 0xc]
mov dword [esp + 0x24], ebx
test ebx, ebx
je 0x4410c5
mov eax, dword [ebx]
test eax, eax
je 0x4410c5
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x38], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x38], 1
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x44112a
mov edi, dword [ebp + 8]
mov eax, dword [esp + 0x14]
lea esp, [esp]
cmp edi, dword [esi]
jne 0x441122
push esi
lea ecx, [esp + 0x1c]
call fcn.00441de0
mov eax, dword [esp + 0x14]
add esi, 0x18
cmp esi, dword [eax + 4]
jne 0x441110
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x441143
mov eax, dword [ebx]
test eax, eax
je 0x44113d
push eax
call esi
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x18]
mov edi, eax
cmp eax, dword [esp + 0x1c]
je 0x4411f2
mov ebx, dword [esp + 0x14]
lea esi, [ebx + 0xc]
mov dword [esp + 0x14], esi
test esi, esi
je 0x44116f
mov eax, dword [esi]
test eax, eax
je 0x44116f
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x38], 2
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
cmp eax, ecx
je 0x4411b9
lea ecx, [ecx]
mov edx, dword [eax]
mov dword [esp + 0x10], edx
test edx, edx
je 0x44118e
cmp edx, dword [edi]
je 0x441197
add eax, 0x18
cmp eax, ecx
jne 0x441180
jmp 0x4411b9
test esi, esi
je 0x4411b2
mov eax, dword [esi]
test eax, eax
je 0x4411ac
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x10]
xor esi, esi
mov dword [esp + 0x14], esi
mov ecx, edx
call fcn.00425830
mov byte [esp + 0x38], 1
test esi, esi
je 0x4411d7
mov eax, dword [esi]
test eax, eax
je 0x4411cf
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x14], 0
add edi, 0x18
cmp edi, dword [esp + 0x1c]
jne 0x441157
mov ebx, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x18]
mov byte [esp + 0x38], 0
test eax, eax
je 0x44121c
push eax
call fcn.004b17b6
add esp, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x38], 0xffffffff
test ebx, ebx
je 0x441239
mov eax, dword [ebx]
test eax, eax
je 0x441231
push eax
call esi
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004b0ff2
mov esp, ebp
pop ebp
ret 4
Function at 0x4413e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d4b69
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.004029b0
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 1
lea ecx, [edi + 0x30]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x30]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 2
lea ecx, [edi + 0x48]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x48]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 3
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x441c80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4d1948
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.004029b0
mov dword [esp + 0x18], 0
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov al, byte [esi + 0x30]
mov byte [edi + 0x30], al
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x444220
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d5a0b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.004029b0
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 1
lea ecx, [edi + 0x30]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x30]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 2
lea ecx, [edi + 0x48]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x48]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 3
lea ecx, [edi + 0x60]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x60]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 4
lea ecx, [edi + 0x78]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x78]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 5
lea ecx, [edi + 0x90]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x90]
push eax
call fcn.004029b0
mov byte [esp + 0x18], 6
lea ecx, [edi + 0xb8]
movzx eax, byte [esi + 0xa8]
mov byte [edi + 0xa8], al
movzx eax, byte [esi + 0xa9]
mov byte [edi + 0xa9], al
mov eax, dword [esi + 0xb0]
mov dword [edi + 0xb0], eax
mov eax, dword [esi + 0xb4]
mov dword [edi + 0xb4], eax
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0xb8]
push eax
call fcn.004029b0
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x444b50
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4d5c55
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [edi], vtable.RC::IRefCount.0
mov dword [esp + 0x38], 0
mov dword [edi], vtable.DL::ISimpleDownloadHandler.0
mov dword [esp + 0x38], 1
mov dword [edi + 4], vtable.RC::RCRefCounted.0
mov dword [edi + 8], 0
mov byte [esp + 0x38], 2
mov dword [edi], vtable.RC::RCRefCountImpl1_class_DL::ISimpleDownloadHandler_.0
mov dword [edi + 4], vtable.RC::RCRefCountImpl1_class_DL::ISimpleDownloadHandler_.1.0
mov dword [esp + 0x38], 3
lea ecx, [edi + 0x10]
mov dword [edi], vtable.DL::RCSimpleDownloadHandler.0
mov dword [edi + 4], vtable.DL::RCSimpleDownloadHandler.1.0
call fcn.0042d670
mov byte [esp + 0x38], 4
mov dword [edi + 0x98], 0
mov byte [edi + 0x9c], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0
mov byte [esp + 0x38], 5
push 0x18
call fcn.004b1806
add esp, 4
mov dword [edi + 0xac], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [esp + 0x38], 6
lea ebx, [edi + 0xc0]
mov dword [edi + 0xb0], 0
xor eax, eax
mov dword [edi + 0xb4], 0
mov dword [edi + 0xb8], 0
mov dword [edi + 0xbc], 0
mov dword [ebx], 0
mov byte [ebx + 4], 0
mov dword [ebx + 0x1c], 7
mov dword [ebx + 0x18], 0
mov dword [esp + 0x14], ebx
mov word [ebx + 8], ax
mov byte [esp + 0x38], 8
push 0x18
mov dword [edi + 0xe0], eax
call fcn.004b1806
add esp, 4
mov dword [edi + 0xe4], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [esp + 0x38], 9
mov dword [edi + 0xe8], 0
mov dword [edi + 0xec], 0
mov byte [esp + 0x38], 0xa
mov byte [edi + 0xf0], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf8], 0
mov byte [esp + 0x38], 0xb
xor eax, eax
push eax
mov dword [esp + 0x2c], 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0
push 0x4ecf30
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00402ad0
mov byte [esp + 0x38], 0xc
mov eax, dword [ebx]
test eax, eax
je 0x444d21
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x28], 0
mov dword [ebx], 0
jne 0x444d32
xor eax, eax
jmp 0x444d40
cmp dword [esp + 0x2c], 8
lea eax, [esp + 0x18]
cmovae eax, dword [esp + 0x18]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
lea ecx, [ebx + 8]
sete al
mov byte [ebx + 4], al
lea eax, [esp + 0x18]
cmp ecx, eax
je 0x444d75
push 0xffffffffffffffff
push 0
push eax
call fcn.004029b0
mov byte [esp + 0x38], 0xb
cmp dword [esp + 0x2c], 8
jb 0x444d8d
push dword [esp + 0x18]
call fcn.004b17b6
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
mov dword [esp + 0x38], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x30
ret
Function at 0x447230
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d6168
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x50c620]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x58]
xorps xmm0, xmm0
mov esi, dword [esp + 0x54]
mov ecx, esi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x2c]
push eax
push 2
push 0xffffffffffffffff
push 0xffff8000
movlpd qword [esp + 0x3c], xmm0
call fcn.0041d230
test al, al
jne 0x44729c
mov eax, 1
jmp 0x447431
push 0x10000
call fcn.004ad321
mov ebx, eax
add esp, 4
mov dword [esp + 0x18], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x4c], 0
push 0x10000
push 0
push ebx
call fcn.004b5340
mov eax, dword [esi]
add esp, 0xc
mov dword [esp + 0x34], 0
test eax, eax
je 0x447409
test ebx, ebx
je 0x447409
cmp dword [eax], 0xffffffff
je 0x447409
push 0
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], 0
push ecx
push 0x8000
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x447409
mov esi, dword [esp + 0x18]
mov ecx, 0x8000
xor ebp, ebp
mov dword [esp + 0x20], ecx
xor ebx, ebx
add esi, ecx
jmp 0x447330
cmp byte [edi + 0x9c], 0
jne 0x4473fe
lea edx, [esp + 0x24]
mov dword [esp + 0x24], 0
push edx
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 0
push edx
push ecx
mov ecx, dword [esp + 0x34]
lea eax, [esi + ebx]
push eax
call fcn.004645a0
test al, al
je 0x4473ef
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x44739b
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x44738b
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [edi + 0x9c], 0
jne 0x4473fe
mov eax, dword [esp + 0x1c]
inc ebp
jmp 0x4473a5
add ebx, eax
cmp ebx, 0x8000
je 0x4473ba
cmp ebp, 0xf
ja 0x4473e4
mov ecx, dword [esp + 0x20]
sub ecx, eax
mov dword [esp + 0x20], ecx
jne 0x447330
mov ebx, dword [esp + 0x18]
mov edx, 0x7ffc
mov ecx, ebx
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x4473dd
add ecx, 4
add esi, 4
sub edx, 4
jae 0x4473c5
mov esi, 4
jmp 0x44741a
mov esi, 5
jmp 0x44741a
mov ebx, dword [esp + 0x18]
mov esi, 3
jmp 0x44741a
mov eax, dword [esp + 0x24]
mov esi, 3
mov ebx, dword [esp + 0x18]
jmp 0x447414
mov ebx, dword [esp + 0x18]
mov esi, 2
jmp 0x44741a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
mov dword [edi + 0xb0], eax
mov dword [esp + 0x4c], 0xffffffff
test ebx, ebx
je 0x44742f
push ebx
call fcn.004b1ec2
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004b0ff2
add esp, 0x3c
ret 0xc
Function at 0x44b5c0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x170
mov eax, dword [0x50c620]
xor eax, esp
mov dword [esp + 0x16c], eax
mov eax, dword [esp + 0x184]
push ebx
mov ebx, dword [esp + 0x17c]
push ebp
mov ebp, dword [esp + 0x188]
push esi
mov esi, dword [esp + 0x180]
push edi
mov edi, dword [esp + 0x18c]
push 0x118
mov dword [esp + 0x18], eax
lea eax, [esp + 0x60]
push 0
push eax
mov dword [esp + 0x64], 0x11c
call fcn.004b5340
add esp, 0xc
lea ecx, [esp + 0x58]
call fcn.004244b0
test al, al
je 0x44b68d
push dword [esp + 0x60]
push dword [esp + 0x60]
push 0x4eeab8
push esi
call fcn.00417410
call fcn.00424430
test al, al
mov edx, 0x40
mov ecx, 0x20
cmovne ecx, edx
push ecx
push 0x4ed1cc
push edi
call fcn.00417410
add esp, 0x1c
cmp word [esp + 0x6c], 0
jne 0x44b66a
xor ecx, ecx
jmp 0x44b680
lea ecx, [esp + 0x6c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44b671
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x70]
mov ecx, ebx
push eax
call fcn.00402ad0
push 0x40
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.004b5340
add esp, 0xc
mov dword [esp + 0x18], 0x40
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
shrd ecx, eax, 0x14
shr eax, 0x14
push eax
push ecx
push 0x4ed1cc
push dword [esp + 0x20]
call fcn.00417410
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
push 0x4ed1cc
push ebp
call fcn.00417410
mov ecx, dword [esp + 0x188]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b0ff2
add esp, 0x170
ret 0x14
Function at 0x44e410
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x4d7124
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x50c620]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x430]
mov dword fs:[0], eax
mov ebp, ecx
push 0xc
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
lea ecx, [esp + 0x1c]
push str.Iphlpapi.dll
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00402ad0
mov dword [esp + 0x438], 0
mov eax, dword [0x50fda8]
test al, 1
jne 0x44e4cc
or eax, 1
mov dword [0x50fda8], eax
mov byte [esp + 0x438], 1
mov dword [0x50fda4], 0
call fcn.00422cb0
push 0x4e2750
call fcn.004b177f
add esp, 4
mov byte [esp + 0x438], 0
lea eax, [esp + 0x18]
mov ecx, 0x50fda4
push eax
call fcn.00422e70
mov edi, eax
mov dword [esp + 0x438], 0xffffffff
cmp dword [esp + 0x2c], 8
jb 0x44e4fb
push dword [esp + 0x18]
call fcn.004b17b6
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor eax, eax
push str.GetIfTable2
push edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call esi
push str.FreeMibTable
push edi
mov ebx, eax
call esi
mov edi, eax
mov dword [esp + 0x14], edi
test ebx, ebx
je 0x44e65b
test edi, edi
je 0x44e65b
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
call ebx
mov esi, dword [esp + 0x30]
test eax, eax
jne 0x44e5ed
test esi, esi
je 0x44e5f4
xor edi, edi
cmp dword [esi], edi
jbe 0x44e5e9
xor ebx, ebx
nop
cmp dword [ebx + esi + 0x470], 0x83
je 0x44e5de
test byte [ebx + esi + 0x488], 1
je 0x44e5de
cmp dword [ebx + esi + 0x428], 6
jne 0x44e5de
lea ecx, [esp + 0x34]
call fcn.0043d7b0
mov dword [esp + 0x438], 2
lea eax, [esi + 0x42c]
add eax, ebx
lea ecx, [esp + 0x34]
push eax
call fcn.0043dbd0
lea eax, [esp + 0xac]
mov ecx, ebp
push eax
call fcn.0040cd60
mov dword [esp + 0x438], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.0043da80
mov esi, dword [esp + 0x30]
inc edi
add ebx, 0x548
cmp edi, dword [esi]
jb 0x44e570
mov edi, dword [esp + 0x14]
test esi, esi
je 0x44e5f4
push esi
call edi
mov esi, dword [ebp]
mov ecx, dword [ebp + 4]
cmp esi, ecx
je 0x44e65b
mov edx, ecx
mov byte [esp + 0x14], 0
push dword [esp + 0x14]
sub edx, esi
mov eax, 0x2aaaaaab
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
push eax
mov ecx, esi
call fcn.0043a410
mov edx, dword [ebp + 4]
mov ecx, dword [ebp]
mov byte [esp + 0x1c], 0
push dword [esp + 0x1c]
call fcn.0043a550
mov edx, eax
add esp, 0xc
sub edx, dword [ebp]
mov eax, 0x2aaaaaab
imul edx
mov ecx, ebp
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
call fcn.00439750
mov ecx, dword [esp + 0x430]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.004b0ff2
add esp, 0x428
ret
Function at 0x4517e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d7668
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x50c620]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, edx
mov dword [esp + 0xc], eax
mov edi, ecx
mov ecx, eax
mov dword [esp + 0x20], 0
sub ecx, edi
mov eax, 0x81848da9
imul ecx
xorps xmm0, xmm0
movdqu xmmword [esp + 0x10], xmm0
mov dword [esp + 0x10], 0
add edx, ecx
mov dword [esp + 0x14], 0
sar edx, 9
mov esi, edx
mov dword [esp + 0x18], 0
shr esi, 0x1f
add esi, edx
lea eax, [esi + 1]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 0
mov ecx, edi
push dword [esp + 0x40]
mov edx, dword [esp + 0x10]
push eax
push esi
call fcn.00451910
add esp, 0xc
mov dword [esp + 0x30], 0xffffffff
mov esi, dword [esp + 0x10]
test esi, esi
je 0x4518c0
cmp esi, dword [esp + 0x18]
je 0x4518b7
mov edi, edi
mov ecx, esi
call fcn.0043da80
add esi, 0x3f4
cmp esi, dword [esp + 0x18]
jne 0x4518a0
mov esi, dword [esp + 0x10]
push esi
call fcn.004b17b6
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004b0ff2
add esp, 0x28
ret
Function at 0x452880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d7900
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov dword [esp + 0x1c], edx
mov ebp, ecx
mov ebx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
mov dword [esp + 0x20], eax
test ebx, ebx
je 0x452a50
test esi, esi
je 0x452a50
cmp ebx, esi
jg 0x452981
mov ecx, edi
call fcn.00451d60
cmp ebx, eax
jg 0x452981
mov ecx, dword [edi + 0x10]
sub esp, 0x14
mov dword [esp + 0x2c], esp
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [edi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [esp + 0x54], 0
mov esi, dword [esp + 0x30]
push esi
mov dword [esp + 0x58], 0xffffffff
mov edx, ebp
lea ecx, [esp + 0x3c]
call fcn.00452680
add esp, 0x18
lea ecx, [esp + 0x24]
call fcn.004518e0
push dword [esp + 0x18]
mov ebx, dword [esp + 0x24]
mov ecx, esi
push ebp
mov edx, ebx
call fcn.00439c90
mov eax, dword [edi + 0x10]
push dword [esp + 0x20]
push ebx
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.00452f10
add esp, 0x10
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ecx, edi
call fcn.00451d60
cmp esi, eax
jg 0x452a29
mov ecx, dword [edi + 0x10]
sub esp, 0x14
mov dword [esp + 0x2c], esp
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [edi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [esp + 0x54], 1
mov ebx, dword [esp + 0x34]
push ebx
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x3c]
mov edx, dword [esp + 0x34]
call fcn.00452680
add esp, 0x18
lea ecx, [esp + 0x24]
call fcn.004518e0
push dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ecx, ebp
push ebx
call fcn.00452f10
mov eax, dword [edi + 0x10]
push dword [esp + 0x20]
push ebp
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.00439c90
add esp, 0x10
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ebx, dword [esp + 0x20]
mov ecx, ebp
mov edx, dword [esp + 0x1c]
push ebx
call fcn.00452e20
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
imul eax, esi, 0x3f4
add eax, ebp
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x452a70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4d7959
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [esp + 0x1c], eax
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x40], 1
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x50]
cmp esi, ebp
je 0x452af7
cmp edi, ebx
je 0x452af7
push esi
mov ecx, edi
call fcn.0043dd30
lea ecx, [esp + 0x54]
test al, al
je 0x452ae7
push edi
call fcn.00452e60
add edi, 0x3f4
cmp edi, ebx
jmp 0x452af5
push esi
call fcn.00452e60
add esi, 0x3f4
cmp esi, ebp
jne 0x452ac7
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [esp + 0x78]
mov dword [ecx + 0x10], eax
mov byte [esp + 0x54], 2
push ebp
mov byte [esp + 0x58], 1
mov edx, esi
lea ecx, [esp + 0x3c]
call fcn.00452680
add esp, 0x18
mov byte [esp + 0x40], 3
mov eax, dword [eax + 0x10]
mov dword [esp + 0x64], eax
mov byte [esp + 0x40], 1
mov esi, dword [esp + 0x24]
test esi, esi
je 0x452b80
cmp esi, dword [esp + 0x2c]
je 0x452b77
lea ebx, [ebx]
mov ecx, esi
call fcn.0043da80
add esi, 0x3f4
cmp esi, dword [esp + 0x2c]
jne 0x452b60
mov esi, dword [esp + 0x24]
push esi
call fcn.004b17b6
add esp, 4
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [esp + 0x78]
mov dword [ecx + 0x10], eax
mov byte [esp + 0x54], 4
push ebx
mov byte [esp + 0x58], 1
mov edx, edi
mov edi, dword [esp + 0x34]
mov ecx, edi
call fcn.00452680
add esp, 0x18
mov dword [esp + 0x14], 1
mov byte [esp + 0x40], 0
mov esi, dword [esp + 0x54]
test esi, esi
je 0x452c01
cmp esi, dword [esp + 0x5c]
je 0x452bf8
mov ecx, esi
call fcn.0043da80
add esi, 0x3f4
cmp esi, dword [esp + 0x5c]
jne 0x452be1
mov esi, dword [esp + 0x54]
push esi
call fcn.004b17b6
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret