joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4626d0
Capabilities:
Connect socket

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
push 0x10
call dword [eax + 0x28]
mov ecx, dword [esi + 0x10]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x46270c
mov edx, dword [0x8fdf5c]
mov esi, dword [edx]
push 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [0x8fdf5c]
push eax
call dword [esi + 0x30]
pop esi
ret 4
xor eax, eax
pop esi
ret 4

Function at 0x462b11
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x10
call dword [edx + 0x28]
push eax
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x462b59
mov ecx, dword [0x8fdf5c]
mov esi, dword [ecx]
push 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [0x8fdf5c]
push eax
call dword [esi + 0x30]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x463000
Capabilities:
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x73a518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov byte [esi + 4], bl
mov dword [esi + 8], ebx
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
mov dword [esp + 0x14], ebx
mov dword [esi], vtable.CBWinNetGate.0
jne 0x4630d4
push edi
mov edi, 1
cmp dword [esp + 0x24], edi
mov eax, 2
jne 0x463066
cmp dword [esp + 0x20], eax
mov edx, eax
jne 0x46305f
mov eax, edi
mov ecx, 6
jmp 0x46307f
mov ecx, 0x11
jmp 0x46307f
cmp dword [esp + 0x20], eax
mov edx, 6
jne 0x46307a
mov eax, edi
mov ecx, 0x4e8
jmp 0x46307f
mov ecx, 0x3e8
push edi
push ebx
push ebx
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_WSASocketA]
push 4
lea ecx, [esp + 0x24]
push ecx
push 0x20
push 0xffff
mov dword [esp + 0x30], edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push eax
mov dword [esi + 0x10], eax
call edi
mov eax, dword [esi + 0x10]
push 4
lea edx, [esp + 0x24]
push edx
push 4
push 0xffff
push eax
call edi
mov edx, dword [esi + 0x10]
push 4
lea ecx, [esp + 0x24]
push ecx
push 8
push 0xffff
push edx
call edi
pop edi
jmp 0x4630d7
mov dword [esi + 0x10], eax
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 0x14], eax
mov ecx, dword [0x8fdf5c]
mov eax, dword [ecx]
push esi
call dword [eax + 0x18]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xc], eax
mov byte [esi + 4], bl
mov dword [esi + 0x18], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x4634c0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x73a4d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.004616e0
lea eax, [esi + 0x34c]
push eax
xor edi, edi
push 2
mov dword [esp + 0x24], edi
mov dword [esi], vtable.CBWinNetShell.0
mov dword [esi + 0x6dc], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, esi
call fcn.00461aa0
push 0x14
call fcn.0040fa60
add esp, 4
cmp eax, edi
je 0x46352f
mov dword [eax + 4], edi
mov dword [eax], vtable.CBSList_struct_TBDNSRequest__.0
mov dword [eax + 0xc], edi
mov dword [eax + 8], edi
mov dword [eax + 0x10], edi
jmp 0x463531
xor eax, eax
push 0x14
mov dword [esi + 0x6e0], eax
call fcn.0040fa60
add esp, 4
cmp eax, edi
je 0x46355d
mov dword [eax + 4], edi
mov dword [eax], vtable.CBSList_struct_TBDNSRequest__.0
mov dword [eax + 0xc], edi
mov dword [eax + 8], edi
mov dword [eax + 0x10], 0x4619c0
jmp 0x46355f
xor eax, eax
push edi
push bind
push edi
push edi
mov dword [esi + 0x6e4], eax
mov dword [esi + 0x70c], edi
call fcn.0041be70
add esp, 0x10
lea ecx, [esi + 0x6f4]
push ecx
mov dword [esi + 0x6e8], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea edx, [esi + 0x6f0]
push edx
push edi
push esi
push 0x461910
push 0x1000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.WS2_32.dll_WSASocketA]
push edi
push edi
push edi
push 0x11
push 2
push 2
mov dword [esi + 0x6ec], eax
call ebx
cmp eax, 0xffffffff
mov ebp, dword [sym.imp.WS2_32.dll_closesocket]
je 0x4635d4
or dword [esi + 0x348], 2
push eax
call ebp
push edi
push edi
push edi
push 0x3e8
push 2
push 6
call ebx
cmp eax, 0xffffffff
je 0x4635f1
or dword [esi + 0x348], 4
push eax
call ebp
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4634d8
Capabilities:
Create thread
Create udp socket
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x73a4d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.004616e0
lea eax, [esi + 0x34c]
push eax
xor edi, edi
push 2
mov dword [esp + 0x24], edi
mov dword [esi], vtable.CBWinNetShell.0
mov dword [esi + 0x6dc], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, esi
call fcn.00461aa0
push 0x14
call fcn.0040fa60
add esp, 4
cmp eax, edi
je 0x46352f
mov dword [eax + 4], edi
mov dword [eax], vtable.CBSList_struct_TBDNSRequest__.0
mov dword [eax + 0xc], edi
mov dword [eax + 8], edi
mov dword [eax + 0x10], edi
jmp 0x463531
xor eax, eax
push 0x14
mov dword [esi + 0x6e0], eax
call fcn.0040fa60
add esp, 4
cmp eax, edi
je 0x46355d
mov dword [eax + 4], edi
mov dword [eax], vtable.CBSList_struct_TBDNSRequest__.0
mov dword [eax + 0xc], edi
mov dword [eax + 8], edi
mov dword [eax + 0x10], 0x4619c0
jmp 0x46355f
xor eax, eax
push edi
push bind
push edi
push edi
mov dword [esi + 0x6e4], eax
mov dword [esi + 0x70c], edi
call fcn.0041be70
add esp, 0x10
lea ecx, [esi + 0x6f4]
push ecx
mov dword [esi + 0x6e8], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea edx, [esi + 0x6f0]
push edx
push edi
push esi
push 0x461910
push 0x1000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.WS2_32.dll_WSASocketA]
push edi
push edi
push edi
push 0x11
push 2
push 2
mov dword [esi + 0x6ec], eax
call ebx
cmp eax, 0xffffffff
mov ebp, dword [sym.imp.WS2_32.dll_closesocket]
je 0x4635d4
or dword [esi + 0x348], 2
push eax
call ebp
push edi
push edi
push edi
push 0x3e8
push 2
push 6
call ebx
cmp eax, 0xffffffff
je 0x4635f1
or dword [esi + 0x348], 4
push eax
call ebp
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x495ec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73c536
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
push edi
push 0x20944
mov esi, ecx
call fcn.0040fa60
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov dword [esp + 0x34], 0
je 0x495f04
push 1
mov ecx, eax
call fcn.0048a8d0
jmp 0x495f06
xor eax, eax
mov dword [esi + 0xbc], eax
mov ecx, dword [0x914218]
mov edx, dword [ecx + 0x374]
mov ecx, dword [edx + 0x20]
add edx, 0x20
mov dword [esp + 0xc], ecx
mov ecx, dword [edx + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [edx + 8]
mov dword [esp + 0x14], ecx
mov edx, dword [edx + 0xc]
push 0
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20], edx
mov edx, dword [eax]
or edi, 0xffffffff
push esi
mov ecx, eax
mov dword [esp + 0x40], edi
call dword [edx + 0xc]
mov eax, dword [esi + 0xbc]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x78]
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0xbc]
mov edx, dword [ecx]
push eax
call dword [edx + 0x12c]
push 0x268
call fcn.0040fa60
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov dword [esp + 0x34], 1
je 0x495f95
push 1
mov ecx, eax
call fcn.004bfda0
jmp 0x495f97
xor eax, eax
mov ecx, dword [esi + 0xbc]
mov dword [ecx + 0x254], eax
mov ecx, dword [esi + 0x2c]
lea edx, [ecx - 0x103]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x30]
add ecx, 0xfffffffe
mov dword [esp + 0x24], ecx
mov dword [esp + 0x34], edi
lea edi, [edx - 0x99]
push 0x10
add edx, 0xc
lea ecx, [esp + 0x20]
push ecx
mov dword [esi + 0x9c], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], edx
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx + 0xc]
sub esp, 8
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, dword [esi + 0xbc]
mov eax, dword [esp + 0x44]
mov edx, dword [ecx]
mov dword [esp + 0x10], esp
push eax
call dword [edx + 0x22c]
mov ecx, dword [esi + 0xbc]
mov edx, dword [ecx]
push 0
call dword [edx + 0x178]
mov ecx, dword [0x912e94]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, dword [esp + 0x2c]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x30
ret 8
Function at 0x4e4670
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x73fa52
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], ebx
cmp dword [esp + 0x30], ebx
mov dword [esp + 0xc], esi
je 0x4e46b9
mov dword [esi + 4], 0x7ad320
mov dword [esi + method.CBRTTIObject.virtual_0], vtable.CBRTTIObject.0
mov dword [esp + 0x28], ebx
mov dword [esp + 8], 1
push ebx
mov ecx, esi
call fcn.00420620
mov eax, dword [esi + 4]
mov dword [esi], vtable.CSquadBtn.2.0
mov dword [esi + 8], vtable.CSquadBtn.1.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 4], vtable.CSquadBtn.0
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
lea ecx, [eax - 0x15c]
mov dword [eax + esi], ecx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
lea eax, [esi + 0x13c]
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
add eax, 8
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
add eax, 8
push 0xf8
mov dword [esp + 0x2c], 1
mov word [esi + 0x124], bx
mov dword [esi + 0x130], ebx
mov dword [esi + 0x128], 0xffffffff
mov dword [esi + 0x138], ebx
mov dword [esi + 0x12c], ebx
mov byte [esi + 0x154], bl
mov dword [esi + 0x158], ebx
mov dword [esp + 0x14], 6
mov dword [esp + 0x18], 0x52
mov dword [esp + 0x1c], 0x2d
mov dword [esp + 0x20], 0x58
call fcn.0040fa60
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
mov byte [esp + 0x28], 2
je 0x4e478b
push 1
mov ecx, eax
call fcn.004e2e20
jmp 0x4e478d
xor eax, eax
push 0x11
lea ecx, [esp + 0x14]
push ecx
mov dword [esi + 0x134], eax
mov edx, dword [eax]
push esi
mov ecx, eax
mov byte [esp + 0x34], 1
call dword [edx + 0xc]
mov edx, dword [esi + 0x134]
push ebx
push str.Images_Screens_PlayWnd_Castle_interface_Army_pbar_full.rle
mov ecx, esi
mov dword [edx + 0x40], 0x64
call fcn.00430200
mov ecx, dword [esi + 0x134]
push ebx
mov dword [ecx + 0xbc], eax
push str.Images_Screens_PlayWnd_Castle_interface_Army_pbar_empty.rle
mov ecx, esi
call fcn.00430200
mov edx, dword [esi + 0x134]
mov ecx, dword [esp + 0x20]
mov dword [edx + 0xc0], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x4fb270
Capabilities:
Decompress data using quicklz

Disassembly:
push ecx
push edi
push 0x4259e0
push 0
push str.images_kingdom_colors.bmp
call fcn.0043d020
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4fb324
mov eax, dword [edi + 0x20]
xor edx, edx
cmp dword [eax + 8], edx
jbe 0x4fb300
push esi
mov esi, 0x905c60
mov ecx, dword [edi + 0x20]
movzx eax, byte [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
imul eax, edx
mov ecx, dword [eax + ecx]
mov al, ch
shr al, 2
mov dword [esp + 8], ecx
shr cl, 3
movzx ax, al
movzx cx, cl
add edx, 1
add esi, 3
shl eax, 5
or eax, ecx
mov ecx, dword [esp + 8]
shr ecx, 0x10
shr cl, 3
movzx cx, cl
and eax, 0x7ff
shl ecx, 0xb
or eax, ecx
mov word [esi - 3], ax
mov byte [esi - 1], 0
mov eax, dword [edi + 0x20]
cmp edx, dword [eax + 8]
jb 0x4fb2a0
cmp edx, 0x100
pop esi
jae 0x4fb31b
mov ecx, 0x100
lea eax, [edx + edx*2 + 0x905c62]
sub ecx, edx
mov edi, edi
mov byte [eax], 1
add eax, 3
sub ecx, 1
jne 0x4fb310
push edi
call fcn.0043a1a0
add esp, 4
pop edi
pop ecx
ret

Function at 0x4fb277
Capabilities:
Decompress data using quicklz

Disassembly:
push ecx
push edi
push 0x4259e0
push 0
push str.images_kingdom_colors.bmp
call fcn.0043d020
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4fb324
mov eax, dword [edi + 0x20]
xor edx, edx
cmp dword [eax + 8], edx
jbe 0x4fb300
push esi
mov esi, 0x905c60
mov ecx, dword [edi + 0x20]
movzx eax, byte [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
imul eax, edx
mov ecx, dword [eax + ecx]
mov al, ch
shr al, 2
mov dword [esp + 8], ecx
shr cl, 3
movzx ax, al
movzx cx, cl
add edx, 1
add esi, 3
shl eax, 5
or eax, ecx
mov ecx, dword [esp + 8]
shr ecx, 0x10
shr cl, 3
movzx cx, cl
and eax, 0x7ff
shl ecx, 0xb
or eax, ecx
mov word [esi - 3], ax
mov byte [esi - 1], 0
mov eax, dword [edi + 0x20]
cmp edx, dword [eax + 8]
jb 0x4fb2a0
cmp edx, 0x100
pop esi
jae 0x4fb31b
mov ecx, 0x100
lea eax, [edx + edx*2 + 0x905c62]
sub ecx, edx
mov edi, edi
mov byte [eax], 1
add eax, 3
sub ecx, 1
jne 0x4fb310
push edi
call fcn.0043a1a0
add esp, 4
pop edi
pop ecx
ret
Function at 0x4fea10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x740860
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
sub eax, 2
push esi
sub ecx, 2
mov dword [esp + 0x3c], eax
push edi
mov edx, 1
lea eax, [esp + 0x34]
mov dword [esp + 0x3c], ecx
push eax
lea ecx, [esp + 0x58]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
call fcn.00432f00
mov esi, dword [ebx + 4]
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x2c], esi
call dword [edx + 0x24]
mov edi, dword [ebx + 0x10]
mov eax, dword [edi]
mov ecx, edi
mov dword [esp + 0x4c], 0
mov dword [esp + 0x30], edi
call dword [eax + 0x24]
mov eax, dword [esp + 0x58]
cmp eax, dword [esp + 0x60]
mov edx, eax
mov byte [esp + 0x4c], 1
mov dword [esp + 0x18], edx
jg 0x4febfc
push ebp
lea ecx, [ecx]
mov ecx, dword [ebx + 4]
mov esi, dword [esp + 0x58]
mov eax, dword [ecx]
push edx
push esi
call dword [eax + 0x44]
mov edi, eax
mov eax, dword [ebx + 0x3ea8]
mov ecx, dword [ebx + 0x10]
mov ebp, dword [ecx]
cdq
sub eax, edx
sar eax, 1
add eax, dword [esp + 0x1c]
mov dword [esp + 0x20], edi
push eax
mov eax, dword [ebx + 0x3ea4]
cdq
sub eax, edx
sar eax, 1
add eax, esi
push eax
call dword [ebp + 0x44]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x60]
cmp esi, eax
jg 0x4febde
sub eax, esi
add eax, 1
mov dword [esp + 0x24], eax
mov al, byte [edi]
test al, al
mov byte [esp + 0x28], al
je 0x4febc3
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x14]
sub edi, eax
mov byte [esp + 0x13], 0x20
mov dword [esp + 0x2c], eax
mov ebp, 0x85fe11
sub edi, 2
lea ebx, [ebx]
mov dword [esp + 0x18], edi
or esi, 0xffffffff
jmp 0x4feb30
mov edx, dword [esp + 0x18]
mov al, byte [edx]
mov ecx, dword [esp + 0x28]
push eax
push ecx
mov ecx, ebx
call fcn.004fb000
test eax, eax
jne 0x4feb54
mov al, byte [esi + ebp]
cmp byte [esp + 0x13], al
jbe 0x4feb54
mov byte [esp + 0x13], al
add dword [esp + 0x18], 1
add esi, 1
cmp esi, 1
jle 0x4feb30
add edi, dword [esp + 0x2c]
add ebp, 3
cmp ebp, 0x85fe17
jle 0x4feb20
cmp byte [esp + 0x13], 0x20
jae 0x4febc3
movzx eax, word [ebx + 0x3e48]
mov edx, dword [esp + 0x14]
movzx edx, word [edx]
mov ecx, eax
shl ecx, 0x10
or ecx, eax
mov eax, edx
shl eax, 0x10
or eax, edx
movzx edx, byte [esp + 0x13]
and eax, 0x7e0f81f
and ecx, 0x7e0f81f
sub eax, ecx
imul eax, edx
mov edx, dword [esp + 0x14]
shl ecx, 5
add eax, ecx
shr eax, 5
and eax, 0x7e0f81f
mov ecx, eax
shr ecx, 0x10
or ecx, eax
mov word [edx], cx
mov edi, dword [esp + 0x20]
add dword [esp + 0x14], 2
add edi, 1
sub dword [esp + 0x24], 1
mov dword [esp + 0x20], edi
jne 0x4feaf3
mov edx, dword [esp + 0x1c]
add edx, 1
cmp edx, dword [esp + 0x64]
mov dword [esp + 0x1c], edx
jle 0x4feaa0
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
pop ebp
mov eax, dword [edi]
mov ecx, edi
mov byte [esp + 0x4c], 0
call dword [eax + 0x28]
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x4c], 0xffffffff
call dword [edx + 0x28]
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 0x10
Function at 0x4fee50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x740860
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
sub eax, 2
push esi
sub ecx, 2
mov dword [esp + 0x3c], eax
push edi
mov edx, 1
lea eax, [esp + 0x34]
mov dword [esp + 0x3c], ecx
push eax
lea ecx, [esp + 0x58]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
call fcn.00432f00
mov esi, dword [ebx + 4]
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x2c], esi
call dword [edx + 0x24]
mov edi, dword [ebx + 0x10]
mov eax, dword [edi]
mov ecx, edi
mov dword [esp + 0x4c], 0
mov dword [esp + 0x30], edi
call dword [eax + 0x24]
mov eax, dword [esp + 0x58]
cmp eax, dword [esp + 0x60]
mov edx, eax
mov byte [esp + 0x4c], 1
mov dword [esp + 0x18], edx
jg 0x4ff03c
push ebp
lea ecx, [ecx]
mov ecx, dword [ebx + 4]
mov esi, dword [esp + 0x58]
mov eax, dword [ecx]
push edx
push esi
call dword [eax + 0x44]
mov edi, eax
mov eax, dword [ebx + 0x3ea8]
mov ecx, dword [ebx + 0x10]
mov ebp, dword [ecx]
cdq
sub eax, edx
sar eax, 1
add eax, dword [esp + 0x1c]
mov dword [esp + 0x20], edi
push eax
mov eax, dword [ebx + 0x3ea4]
cdq
sub eax, edx
sar eax, 1
add eax, esi
push eax
call dword [ebp + 0x44]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x60]
cmp esi, eax
jg 0x4ff01e
sub eax, esi
add eax, 1
mov dword [esp + 0x24], eax
mov al, byte [edi]
test al, al
mov byte [esp + 0x28], al
je 0x4ff003
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x14]
sub edi, eax
mov byte [esp + 0x13], 0x20
mov dword [esp + 0x2c], eax
mov ebp, 0x85fe31
sub edi, 2
lea ebx, [ebx]
mov dword [esp + 0x18], edi
or esi, 0xffffffff
jmp 0x4fef70
mov edx, dword [esp + 0x18]
mov al, byte [edx]
mov ecx, dword [esp + 0x28]
push eax
push ecx
mov ecx, ebx
call fcn.004fb160
test eax, eax
jne 0x4fef94
mov al, byte [esi + ebp]
cmp byte [esp + 0x13], al
jbe 0x4fef94
mov byte [esp + 0x13], al
add dword [esp + 0x18], 1
add esi, 1
cmp esi, 1
jle 0x4fef70
add edi, dword [esp + 0x2c]
add ebp, 3
cmp ebp, 0x85fe37
jle 0x4fef60
cmp byte [esp + 0x13], 0x20
jae 0x4ff003
movzx eax, word [ebx + 0x3e48]
mov edx, dword [esp + 0x14]
movzx edx, word [edx]
mov ecx, eax
shl ecx, 0x10
or ecx, eax
mov eax, edx
shl eax, 0x10
or eax, edx
movzx edx, byte [esp + 0x13]
and eax, 0x7e0f81f
and ecx, 0x7e0f81f
sub eax, ecx
imul eax, edx
mov edx, dword [esp + 0x14]
shl ecx, 5
add eax, ecx
shr eax, 5
and eax, 0x7e0f81f
mov ecx, eax
shr ecx, 0x10
or ecx, eax
mov word [edx], cx
mov edi, dword [esp + 0x20]
add dword [esp + 0x14], 2
add edi, 1
sub dword [esp + 0x24], 1
mov dword [esp + 0x20], edi
jne 0x4fef33
mov edx, dword [esp + 0x1c]
add edx, 1
cmp edx, dword [esp + 0x64]
mov dword [esp + 0x1c], edx
jle 0x4feee0
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
pop ebp
mov eax, dword [edi]
mov ecx, edi
mov byte [esp + 0x4c], 0
call dword [eax + 0x28]
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x4c], 0xffffffff
call dword [edx + 0x28]
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 0x10
Function at 0x52051d
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x74218f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
cmp dword [esp + 0x30], 0
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
je 0x52054f
mov dword [esi + 4], 0x7f038c
mov dword [esi + 0xb8], vtable.CBRTTIObject.0
mov dword [esp + 0x14], 0
mov dword [esp + 4], 1
push 0
mov ecx, esi
call fcn.00431810
mov eax, dword [esi + 4]
mov dword [esi], vtable.CViewSkills.2.0
mov dword [esi + 8], vtable.CViewSkills.1.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 4], vtable.CViewSkills.0
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
mov edx, dword [esp + 0x30]
lea ecx, [eax - 0xb4]
mov dword [eax + esi], ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [esi + 0xa0], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x9c], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x98], edx
mov edx, dword [esp + 0x24]
mov dword [esi + 0xb0], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xac], eax
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], edx
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x1c
Function at 0x5514a6
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x7442e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x10]
mov dword [esp + 8], esi
call fcn.00412d40
xor edi, edi
lea ecx, [esi + 0x18]
mov dword [esp + 0x14], edi
call fcn.00412d40
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov byte [esp + 0x14], 1
mov dword [esi], edi
call fcn.0040d640
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x4c]
mov ecx, dword [esp + 0xc]
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x552290
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x744384
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [esp + 0x14], ebx
mov dword [esi], vtable.CAction.0
call fcn.00412d40
lea ecx, [esi + 0x18]
mov byte [esp + 0x14], 1
call fcn.00412d40
lea ecx, [esi + 0x20]
mov byte [esp + 0x14], 2
call fcn.00412d40
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x5c], vtable.CBSList_class_CMapObj__.0
mov dword [esi + 0x68], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
mov byte [esp + 0x14], 4
mov word [esi + 0x12], bx
call fcn.0040d640
mov edx, dword [eax]
push 0x11
mov ecx, eax
call dword [edx + 0x44]
test eax, eax
setne al
mov byte [esi + 0x14], al
call fcn.0040d640
mov edx, dword [eax]
push 0x12
mov ecx, eax
call dword [edx + 0x44]
test eax, eax
setne al
mov byte [esi + 0x16], al
call fcn.0040d640
mov edx, dword [eax]
push 0x10
mov ecx, eax
call dword [edx + 0x44]
mov ecx, dword [esp + 0xc]
test eax, eax
setne al
mov byte [esi + 0x15], al
mov byte [esi + 0x17], bl
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov word [esi + 0x28], bx
mov word [esi + 0x2a], bx
mov byte [esi + 0x2c], bl
mov byte [esi + 0x2d], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov byte [esi + 0x58], bl
mov word [esi + 0x5a], bx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret