joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b700
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x561751
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x640040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x18]
mov dword [esi], 0x592d54
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov dword [ebp - 4], 0
lea ecx, [esi + 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 1
lea ecx, [esi + 0x20]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 2
lea ecx, [esi + 0x24]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 3
lea ecx, [esi + 0x28]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 4
lea ecx, [esi + 0x2c]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 5
lea ecx, [esi + 0x30]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 6
lea ecx, [esi + 0x3c]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 7
lea ecx, [esi + 0x40]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 8
mov ecx, esi
mov dword [esi + 0x34], 0
call fcn.0041b950
mov edi, dword [ebp + 8]
test edi, edi
je 0x41b85b
cmp edi, esi
je 0x41b85b
lea eax, [edi + 0x1c]
push eax
lea ecx, [esi + 0x1c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__27]
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x20]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__27]
lea eax, [edi + 0x24]
push eax
lea ecx, [esi + 0x24]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__27]
lea eax, [edi + 0x28]
push eax
lea ecx, [esi + 0x28]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__27]
lea eax, [edi + 0x2c]
push eax
lea ecx, [esi + 0x2c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__27]
lea eax, [edi + 0x30]
push eax
lea ecx, [esi + 0x30]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__27]
lea eax, [edi + 0x3c]
push eax
lea ecx, [esi + 0x3c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__27]
push dword [edi + 0x34]
movzx eax, word [edi + 0x38]
mov ecx, esi
push eax
call fcn.0041c100
mov eax, dword [edi + 4]
lea ecx, [esi + 0x40]
mov dword [esi + 4], eax
lea eax, [edi + 0x40]
movups xmm0, xmmword [edi + 8]
push eax
movups xmmword [esi + 8], xmm0
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__27]
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__27]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41b880
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5617e1
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x640040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x592d54
mov dword [ebp - 4], 8
call fcn.0041b950
mov byte [ebp - 4], 7
lea ecx, [esi + 0x40]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov byte [ebp - 4], 6
lea ecx, [esi + 0x3c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov byte [ebp - 4], 5
lea ecx, [esi + 0x30]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov byte [ebp - 4], 4
lea ecx, [esi + 0x2c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov byte [ebp - 4], 3
lea ecx, [esi + 0x28]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov byte [ebp - 4], 2
lea ecx, [esi + 0x24]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov byte [ebp - 4], 1
lea ecx, [esi + 0x20]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov byte [ebp - 4], 0
lea ecx, [esi + 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43fe10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x566d80
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x640040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call dword [sym.imp.mfc140u.dll_AfxGetModuleState]
mov ecx, dword [eax + 4]
call dword [sym.imp.mfc140u.dll_CCmdTarget::BeginWaitCursor]
mov dword [ebp - 4], 0
cmp dword [esi + 0x5d4], 0
jne 0x43fed9
lea eax, [ebp - 0x21c]
mov byte [esi + 0x5d8], 1
push eax
push 0
push esi
push 0x43ffa0
push 0
push 0
mov dword [ebp - 0x21c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x5d4], eax
push 0
test eax, eax
jne 0x43feb8
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
jmp 0x43ff32
mov eax, dword [esi + 0x58c]
push 0x1f4
push 0xafc8
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x5dc], eax
jmp 0x43ff32
mov edx, dword [esi + 0x5dc]
mov byte [esi + 0x5d8], 0
test edx, edx
je 0x43ff04
mov eax, dword [esi + 0x58c]
push edx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0x5dc], 0
mov edx, 0x493e0
lea ecx, [esi + 0x5d4]
call fcn.0050eb40
test al, al
jne 0x43ff24
push 0
mov ecx, 0x641e60
call fcn.004f7060
push 0
push 5
push 0
mov ecx, esi
call dword [sym.imp.mfc140u.dll_CDocument::UpdateAllViews]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21d]
call fcn.004499f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055c86d
mov esp, ebp
pop ebp
ret
Function at 0x46de30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c475
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x640040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
push 1
lea eax, [edi + 0x188]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004f6560
mov byte [ebp - 4], 1
lea ebx, [edi + 0x1a0]
cmp dword [ebx], 0
jne 0x46df53
mov dword [edi + 0x180], 0
mov al, byte [ebp + 0xc]
mov byte [edi + 0x174], al
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x17c], eax
mov dword [edi + 0x178], 0
mov al, byte [ebp + 0x18]
mov byte [edi + 0x184], al
mov byte [edi + 0x13c], 1
mov byte [edi + 0x1a4], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 0
push edi
push 0x46e0f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx], eax
test eax, eax
jne 0x46df1f
push str.Failed_to_start_reading_tags_from_device_n
mov eax, dword [0x641a88]
add eax, 0x32c
push eax
call fcn.004ec040
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004f6620
jmp 0x46e079
xor esi, esi
mov dword [ebp - 0x38], esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop word [eax + eax]
cmp esi, 0x12c
jge 0x46dfdd
cmp byte [edi + 0x1a4], 0
jne 0x46dfdd
push 0x64
call ebx
inc esi
mov dword [ebp - 0x38], esi
jmp 0x46df30
cmp dword [0x641a88], 0
je 0x46dfe3
cmp byte [ebp + 0xc], 0
je 0x46dfe3
cmp byte [edi + 0x174], 0
jne 0x46dfe3
xorps xmm0, xmm0
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], 0
push dword [ebp + 0x14]
push 0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0051b6c0
mov byte [ebp - 4], 2
push 0x64
push 0x32
push dword [ebp - 0x30]
mov eax, dword [0x641a88]
lea ecx, [eax + 0x32c]
call fcn.004ed650
test al, al
jne 0x46dfcf
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0051ba50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004f6620
jmp 0x46e079
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0051ba50
jmp 0x46dfe3
lea ebx, [edi + 0x1a0]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004f6620
cmp dword [ebx], 0
je 0x46e009
cmp byte [edi + 0x13c], 0
je 0x46e009
mov edx, 0x124f80
mov ecx, ebx
call fcn.0050e940
mov byte [edi + 0x174], 0
mov al, byte [edi + 0x185]
jmp 0x46e07b
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055c86d
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4789a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d74d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x640040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
lea eax, [esi + 0x188]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x1c]
movlpd qword [ebp - 0x1c], xmm0
call fcn.004f6560
mov dword [ebp - 4], 0
cmp byte [esi + 0x14dc], 0
jne 0x478a1e
lea eax, [ebp - 0x14]
mov byte [esi + 0x14dc], 1
push eax
push 0
push esi
push 0x478a50
push 0
push 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x14d8], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004f6620
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055c86d
mov esp, ebp
pop ebp
ret
Function at 0x491e60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570182
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x640040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
cmp byte [0x641c87], 0
je 0x491fdb
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1c]
push eax
mov esi, dword [ebp + 0x14]
mov edx, esi
mov ecx, edi
call fcn.0051a4c0
add esp, 4
test al, al
je 0x491fce
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
push eax
call fcn.00492060
mov byte [ebp - 4], 4
mov edx, dword [0x641c88]
lea ecx, [edx + 1]
mov dword [0x641c88], ecx
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
push edx
push dword [eax]
push str._s_d__s_0x_08X_0x_04X.txt
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__31]
add esp, 0x1c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x491fc1
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 5
push esi
push dword [ebp + 0x10]
push str.0x_08X:0x_04X:
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__31]
add esp, 0x10
mov eax, dword [ebp - 0x18]
mov eax, dword [eax - 0xc]
push 0
lea ecx, [ebp - 0x24]
push ecx
add eax, eax
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push edi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
call esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax - 0xc]
push 0
lea ecx, [ebp - 0x24]
push ecx
add eax, eax
push eax
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055c86d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x497140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp byte [ebp + 8], cl
je 0x49716d
mov edi, 0x6c
mov al, byte [ecx + edx + 0x40]
mov byte [esi + ecx], al
inc ecx
cmp ecx, edi
jl 0x497157
push 0x394
lea eax, [esi + 0x6c]
jmp 0x49718c
mov edi, 0x100
mov al, byte [ecx + edx + 0xc8]
mov byte [ecx + esi], al
inc ecx
cmp ecx, edi
jl 0x497172
push 0x300
lea eax, [esi + 0x100]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea ecx, [edi - 1]
add esp, 0xc
mov eax, 1
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x4971ac
dec ecx
or ecx, 0xfffffff8
inc ecx
mov edx, edi
xorps xmm3, xmm3
sub edx, ecx
xorps xmm2, xmm2
nop word [eax + eax]
movd xmm1, dword [esi + eax]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm3, xmm1
movd xmm1, dword [esi + eax + 4]
punpcklbw xmm1, xmm0
add eax, 8
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
cmp eax, edx
jl 0x4971c0
xorps xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
xorps xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
xorps xmm2, xmm0
movd edx, xmm2
xor edx, 0xa5
cmp eax, edi
jge 0x49721d
movzx ecx, byte [esi + eax]
inc eax
xor edx, ecx
cmp eax, edi
jl 0x497212
movzx eax, byte [esi]
pop edi
pop esi
cmp edx, eax
je 0x497249
mov eax, dword [0x641a88]
push str.Invalid_linearization_table_checksum
add eax, 0x32c
push 0x3ed
push eax
call fcn.004ec2c0
add esp, 0xc
xor al, al
pop ebp
ret 0xc
mov al, 1
pop ebp
ret 0xc
Function at 0x497250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
mov eax, 0x100
push ebx
mov ebx, 0x6c
cmove ebx, eax
mov eax, 1
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
lea ecx, [ebx - 1]
and ecx, 0x8000001f
jns 0x497282
dec ecx
or ecx, 0xffffffe0
inc ecx
mov edx, ebx
xorps xmm2, xmm2
sub edx, ecx
xorps xmm1, xmm1
nop dword [eax]
movups xmm0, xmmword [eax + edi]
xorps xmm2, xmm0
movups xmm0, xmmword [edi + eax + 0x10]
add eax, 0x20
xorps xmm1, xmm0
cmp eax, edx
jl 0x497290
xorps xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 1
xorps xmm1, xmm0
movd ecx, xmm1
xor cl, 0xa5
cmp eax, ebx
jge 0x4972e8
xor cl, byte [edi + eax]
inc eax
cmp eax, ebx
jl 0x4972e0
push 0x400
push 0
push esi
mov byte [edi], cl
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
add esp, 0xc
cmp byte [ebp + 8], cl
je 0x497310
mov al, byte [ecx + edi]
mov byte [esi + ecx + 0x40], al
inc ecx
cmp ecx, ebx
jl 0x497301
jmp 0x49731f
mov al, byte [ecx + edi]
mov byte [ecx + esi + 0xc8], al
inc ecx
cmp ecx, ebx
jl 0x497310
movups xmm0, xmmword [str..mtb_file_header]
mov ecx, 4
xorps xmm3, xmm3
xorps xmm2, xmm2
movups xmmword [esi + 0xa], xmm0
mov al, byte [0x5bf894]
mov byte [esi + 0x1a], al
movups xmm0, xmmword [str.Table_1_Header]
movups xmmword [esi + 0x26], xmm0
mov eax, dword [0x5bf8a8]
mov dword [esi + 0x36], eax
movups xmm0, xmmword [str.Table_2_Header]
movups xmmword [esi + 0xae], xmm0
mov eax, dword [0x5bf8c0]
mov dword [esi + 0xbe], eax
nop dword [eax]
movd xmm1, dword [esi + ecx]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
paddd xmm3, xmm1
movd xmm1, dword [esi + ecx + 4]
punpcklbw xmm1, xmm0
add ecx, 8
punpcklwd xmm1, xmm0
paddd xmm2, xmm1
cmp ecx, 0x1c4
jl 0x497370
paddd xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
paddd xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
paddd xmm2, xmm0
movd edx, xmm2
cmp ecx, 0x1c8
jge 0x4973df
nop dword [eax]
movzx eax, byte [esi + ecx]
inc ecx
add edx, eax
cmp ecx, 0x1c8
jl 0x4973d0
mov byte [esi], dl
mov eax, edx
shr edx, 0x10
shr eax, 8
mov byte [esi + 2], dl
shr edx, 8
pop edi
mov byte [esi + 1], al
mov al, 1
mov byte [esi + 3], dl
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4a37e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x640040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0x78], 0
je 0x4a3866
cmp byte [esi + 0x8c], 0
jne 0x4a3866
cmp byte [esi + 0x79], 0
jne 0x4a3866
cmp byte [esi + 0x1c1], 0
jne 0x4a3866
cmp dword [esi + 0x1c8], 0
mov dword [ebp - 8], 0
jne 0x4a3835
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x1c8], eax
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x4a3e30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c4], eax
test eax, eax
je 0x4a3866
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055c86d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0055c86d
mov esp, ebp
pop ebp
ret

Function at 0x4a50d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571950
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x640040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
cmp byte [esi + 0x8c], 0
jne 0x4a51d9
mov dword [ebp - 4], 0
cmp byte [esi + 0x1d0], 0
je 0x4a5124
mov al, 1
jmp 0x4a51db
mov dword [ebp - 0x18], 0
cmp dword [esi + 0x1cc], 0
jne 0x4a511d
cmp dword [esi + 0x1dc], 0
jne 0x4a5151
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x1dc], eax
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push 0x4a52a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1cc], eax
test eax, eax
jne 0x4a511d
push str.Failed_to_start_Port_General_Service_Handling_Thread
push 0x3e9
mov eax, dword [0x641a88]
add eax, 0x32c
push eax
call fcn.004ec2c0
add esp, 0xc
jmp 0x4a51d9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055c86d
mov esp, ebp
pop ebp
ret

Function at 0x4a5d60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571af0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x640040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
cmp byte [esi + 0x120], 0
je 0x4a5da7
mov al, 1
jmp 0x4a5e38
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push 0x4a61b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x118], eax
test eax, eax
jne 0x4a5da0
push str.Failed_to_start_OneShotSyncDCMFromDeviceThread
push 0x3e9
mov eax, dword [0x641a88]
add eax, 0x32c
push eax
call fcn.004ec2c0
add esp, 0xc
jmp 0x4a5e36
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055c86d
mov esp, ebp
pop ebp
ret
Function at 0x4a5e60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571b20
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x640040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
cmp byte [esi + 0x121], 0
je 0x4a5ea7
mov al, 1
jmp 0x4a5f38
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push 0x4a61c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x11c], eax
test eax, eax
jne 0x4a5ea0
push str.Failed_to_start_ContinuousSyncDCMFromDeviceThread
push 0x3e9
mov eax, dword [0x641a88]
add eax, 0x32c
push eax
call fcn.004ec2c0
add esp, 0xc
jmp 0x4a5f36
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055c86d
mov esp, ebp
pop ebp
ret
Function at 0x4b0220
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572921
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x640040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x34]
mov dword [edi], 0x5c7244
call dword [sym.imp.mfc140u.dll_CWordArray::CWordArray]
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edi + 0x20], eax
lea ecx, [edi + 0x34]
mov eax, 0xfe
mov word [edi + 0x19], 0
push 0x7a
mov dword [edi + 4], 0x3e8
mov dword [edi + 0x1c], 0
mov byte [edi + 0x1b], 0
mov dword [edi + 8], 0x32
mov word [edi + 0x24], ax
mov byte [edi + 0x26], 0
mov byte [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x28], 0xffffffff
mov dword [edi + 0x10], 0x12c0
mov dword [edi + 0x14], 0x9600
mov byte [edi + 0x18], 0
push dword [edi + 0x3c]
call dword [sym.imp.mfc140u.dll_CWordArray::SetAtGrow]
lea eax, [edi + 0x48]
mov dword [edi + 0xc], 2
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b1e40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572c6d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x640040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
push 1
lea eax, [esi + 0x48]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004f6560
mov byte [ebp - 4], 1
cmp byte [0x641ca4], 0
je 0x4b1fab
mov ebx, 0xff
mov cx, word [ebp + 0xc]
cmp cx, bx
je 0x4b1f0f
cmp cx, 1
jl 0x4b1ed6
mov eax, 0xfe
cmp cx, ax
jg 0x4b1ed6
mov edx, dword [ebp + 0x10]
cmp dx, cx
jge 0x4b1f12
push 0xfe
push 1
movsx eax, dx
push eax
push str.Invalid_start_scanning_stop_address_of__d___must_be_between__d_and__d
jmp 0x4b1ee6
push 0xfe
push 1
movsx eax, cx
push eax
push str.Invalid_start_scanning_start_address_of__d___must_be_between__d_and__d
push 0x3e9
mov eax, dword [0x641a88]
add eax, 0x32c
push eax
call fcn.004ec2c0
add esp, 0x18
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004f6620
jmp 0x4b1fbe
mov edx, dword [ebp + 0x10]
lea eax, [edx - 1]
mov edi, 0xfd
cmp ax, di
ja 0x4b1ec4
mov dword [ebp - 0x20], 0
cmp cx, bx
jne 0x4b1f33
xor eax, eax
mov word [esi + 0x22], ax
jmp 0x4b1f37
mov word [esi + 0x22], cx
mov word [esi + 0x24], dx
mov al, byte [ebp + 8]
mov byte [esi + 0x26], al
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x28], eax
cmp byte [esi + 0x1b], 0
jne 0x4b1f98
mov byte [esi + 0x1b], 1
lea eax, [ebp - 0x20]
push eax
push 0
push esi
push 0x4b1620
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
mov eax, dword [0x641a88]
mov eax, dword [eax + 0x104]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4b1f98
lea eax, [ebp - 0x24]
push eax
call fcn.004044d0
mov ecx, dword [eax]
test ecx, ecx
je 0x4b1f93
mov eax, dword [ecx]
call dword [eax + 0xa4]
mov eax, dword [ebp - 0x24]
jmp 0x4b1f78
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004f6620
mov eax, 1
jmp 0x4b1fc0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004f6620
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055c86d
mov esp, ebp
pop ebp
ret 0x10