joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007f907
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push str.OPENSSL_CONF
call dword [sym.imp.MSVCRT.dll_getenv]
test eax, eax
pop ecx
je 0x1007f923
push eax
call fcn.1004aef7
pop ecx
jmp 0x1007f97e
call fcn.10085042
push eax
call sub.MSVCRT.dll_strlen
mov ebx, str.openssl.cnf
mov esi, eax
push ebx
inc esi
call sub.MSVCRT.dll_strlen
add esi, eax
push 0x230
inc esi
push str..cryptoconfconf_mod.c
push esi
call fcn.10042bdc
mov edi, eax
add esp, 0x14
test edi, edi
je 0x1007f97e
push esi
call fcn.10085042
push eax
push edi
call fcn.1004afbb
push esi
push 0x100af434
push edi
call fcn.1004aff7
push esi
push ebx
push edi
call fcn.1004aff7
add esp, 0x24
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x425070
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x520720
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [ebx + 0x288]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ecx
call fcn.004f57a0
mov ecx, dword [ebp + 8]
xor esi, esi
push 0xffffffffffffffff
push esi
call fcn.004ecdd0
mov dword [esp + 0x2c], 0x533ea4
mov dword [esp + 0x30], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], esi
mov edi, dword [ebx + 0x10c8]
mov dword [esp + 0x48], esi
cmp edi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 0x40e86a00
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0xc0e86a00
mov dword [esp + 0x18], edi
jle 0x42516f
jmp 0x4250fb
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 0x10c4]
mov ebx, dword [eax + esi*4]
mov ecx, ebx
call fcn.00498b90
fld qword [eax + 0x10]
fcomp qword [esp + 0x1c]
fnstsw ax
test ah, 1
jne 0x425127
mov ecx, ebx
call fcn.00498b90
fld qword [eax + 0x10]
fstp qword [esp + 0x1c]
mov ecx, ebx
call fcn.00498b90
fld qword [eax]
fcomp qword [esp + 0x24]
fnstsw ax
test ah, 0x41
je 0x425148
mov ecx, ebx
call fcn.00498b90
fld qword [eax]
fstp qword [esp + 0x24]
mov eax, dword [esp + 0x34]
push 0xffffffffffffffff
mov dword [esp + 0x18], eax
inc eax
push eax
lea ecx, [esp + 0x34]
call fcn.004ecdd0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x14]
inc esi
cmp esi, edi
mov dword [ecx + edx*4], ebx
jl 0x4250f7
xor esi, esi
fld qword [esp + 0x1c]
fsub qword [esp + 0x24]
mov ecx, dword [esp + 0xc]
fstp qword [esp + 0x1c]
call fcn.004fbe90
inc eax
xor ebx, ebx
test edi, edi
mov dword [esp + 0x14], eax
jle 0x425227
mov eax, dword [esp + 0x30]
push 0
mov ecx, dword [eax + ebx*4]
add ecx, 0x1d0
mov edx, dword [ecx]
call dword [edx + 0x30]
test eax, eax
je 0x4251b3
lea esi, [eax - 0x1d0]
jmp 0x4251b5
xor esi, esi
mov eax, dword [esi + 0x25c]
test eax, eax
je 0x4251cb
mov ecx, dword [esp + 0x14]
add eax, ecx
mov dword [esi + 0x25c], eax
mov ecx, dword [esp + 0xc]
push esi
call fcn.004f8730
mov edx, dword [ebp + 8]
push 0xffffffffffffffff
mov ecx, edx
mov edi, dword [edx + 8]
lea eax, [edi + 1]
push eax
call fcn.004ecdd0
mov ecx, dword [ebp + 8]
push 0
push 0
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, esi
mov dword [edx + edi*4], esi
mov edx, dword [esp + 0x28]
mov eax, dword [esi]
push edx
mov dword [esi + 0x1e0], 1
mov dword [esi + 0x258], 0x186a0
call dword [eax + 0xc]
mov eax, dword [esp + 0x18]
inc ebx
cmp ebx, eax
jl 0x425193
mov dword [esp + 0x2c], 0x533ea4
mov eax, dword [esp + 0x30]
mov dword [esp + 0x48], 1
test eax, eax
je 0x425248
push eax
call fcn.0051aee4
add esp, 4
mov ecx, dword [esp + 0x40]
pop edi
fld qword [esp + 0x18]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x434ca0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5222b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [edi + 8]
mov ecx, dword [ebp + 0xc]
sub esp, 0x38
mov esi, esp
mov dword [esp + 0x44], esp
mov dword [esp + 0x50], 0
mov dword [esi], eax
mov dword [esi + 4], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edx
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x24]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov edx, dword [ebp + 0x28]
mov eax, dword [ebp + 0x2c]
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
mov ecx, dword [ebp + 0x30]
lea eax, [ebp + 0x38]
mov dword [esi + 0x28], ecx
mov edx, dword [ebp + 0x34]
push eax
lea ecx, [esi + 0x30]
mov dword [esi + 0x2c], edx
call fcn.0051b01c
mov ecx, dword [ebp + 0x3c]
push ebx
mov dword [esi + 0x34], ecx
mov ecx, edi
call fcn.00436180
lea ecx, [ebp + 0x38]
mov dword [esp + 0x18], 0xffffffff
call fcn.0051af0e
mov ecx, dword [esp + 0x10]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x38
Function at 0x43a6b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x522888
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov eax, dword [esi + 0x2b4]
test eax, eax
je 0x43a704
mov dword [esi + 0x2b4], 0
mov eax, 1
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x58]
call fcn.00487f90
mov eax, dword [esi + 0x2a8]
xor edx, edx
test eax, eax
mov dword [esp + 0x10], eax
jle 0x43a871
mov esi, dword [esi + 0x2a4]
mov ecx, dword [esi]
lea eax, [ecx + 0x1b8]
fld qword [ecx + 0x1c8]
mov edi, eax
fmul qword [0x531170]
mov ebx, dword [edi]
mov dword [esp + 0x18], ebx
mov ebx, dword [edi + 4]
mov dword [esp + 0x1c], ebx
mov ebx, dword [edi + 8]
fsubr qword [esp + 0x18]
mov edi, dword [edi + 0xc]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edi
mov edi, eax
fstp qword [esp + 0x58]
mov ebx, dword [edi]
fld qword [ecx + 0x1c8]
fmul qword [0x531170]
mov dword [esp + 0x28], ebx
mov ebx, dword [edi + 4]
mov dword [esp + 0x2c], ebx
mov ebx, dword [edi + 8]
fadd qword [esp + 0x28]
mov edi, dword [edi + 0xc]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], edi
mov edi, eax
fstp qword [esp + 0x68]
mov ebx, dword [edi]
fld qword [ecx + 0x1d0]
fmul qword [0x531170]
mov dword [esp + 0x38], ebx
mov ebx, dword [edi + 4]
mov dword [esp + 0x3c], ebx
mov ebx, dword [edi + 8]
mov dword [esp + 0x40], ebx
mov edi, dword [edi + 0xc]
mov dword [esp + 0x44], edi
fsubr qword [esp + 0x40]
fstp qword [esp + 0x60]
mov edi, dword [eax]
fld qword [ecx + 0x1d0]
fmul qword [0x531170]
mov dword [esp + 0x48], edi
mov edi, dword [eax + 4]
mov dword [esp + 0x4c], edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], eax
fadd qword [esp + 0x50]
fstp qword [esp + 0x70]
fld qword [ebp + 8]
fcomp qword [esp + 0x68]
fnstsw ax
test ah, 0x41
je 0x43a829
fld qword [ebp + 8]
fcomp qword [esp + 0x58]
fnstsw ax
test ah, 1
jne 0x43a829
fld qword [ebp + 0x10]
fcomp qword [esp + 0x70]
fnstsw ax
test ah, 0x41
je 0x43a829
fld qword [ebp + 0x10]
fcomp qword [esp + 0x60]
fnstsw ax
test ah, 1
je 0x43a83a
mov eax, dword [esp + 0x10]
inc edx
add esi, 4
cmp edx, eax
jge 0x43a871
jmp 0x43a727
mov edx, dword [esp + 0x14]
mov dword [esp + 0x80], 0xffffffff
mov dword [edx + 0x2b4], ecx
lea ecx, [esp + 0x58]
call fcn.00519440
mov eax, 1
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x58]
mov dword [esp + 0x80], 0xffffffff
call fcn.00519440
mov ecx, dword [esp + 0x78]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x456db8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x524728
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov ecx, dword [esi + 0x34]
add ecx, 0x288
call fcn.004f90c0
fld qword [0x5315c8]
fsub qword [eax + 0x28]
mov ecx, dword [esi + 0x34]
add ecx, 0x288
fdivr qword [0x5315c8]
fmul qword [esp + 0x20]
fstp qword [esp + 0x20]
call fcn.004f90c0
fld qword [0x5315c8]
fsub qword [eax + 0x30]
push 1
fdivr qword [0x5315c8]
fmul qword [esp + 0x2c]
fstp qword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
call fcn.004740b0
add esp, 0xc
lea ecx, [esp + 4]
push eax
call fcn.0051b01c
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push edx
push 1
push eax
push ecx
mov dword [esp + 0x28], 0
call fcn.004740b0
mov edx, dword [eax]
add esp, 0xc
lea eax, [esp + 0x10]
push edx
push str.Horizontal:__s__Vertical_:__s
push 0x559060
push eax
call fcn.0043e2f0
add esp, 0x14
fld qword [esp + 0x20]
fmul qword [esp + 0x20]
fld qword [esp + 0x28]
fmul qword [esp + 0x28]
mov esi, dword [eax]
push 1
sub esp, 8
mov byte [esp + 0x24], 1
faddp st(1)
fsqrt
fstp qword [esp]
call fcn.004740b0
mov ecx, dword [eax]
add esp, 0xc
lea edx, [esp + 8]
push ecx
push str.Length_:__s
push 0x557ddc
push edx
call fcn.0043e2f0
mov eax, dword [eax]
push 0
push 0
push 0
mov byte [esp + 0x34], 2
push esi
push 0
push eax
call fcn.0043e3d0
add esp, 0x28
lea ecx, [esp + 8]
mov byte [esp + 0x18], 1
call fcn.0051af0e
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 0
call fcn.0051af0e
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.0051af0e
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10

Function at 0x4631d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x525383
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x53138c
lea ebx, [esi + 4]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x18], edi
call fcn.0051b9d6
mov dword [ebx], 0x53889c
lea ebx, [esi + 0x18]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.0051b9d6
mov ecx, dword [esp + 0x10]
mov eax, 0x538888
mov dword [ebx], 0x53889c
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x54], edi
mov dword [esi], 0x538874
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x468f90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x525958
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebp
push esi
mov ebp, 0x538f98
xor esi, esi
push edi
mov edi, ecx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov eax, dword [edi + 0xc8]
push esi
push esi
push 0x110a
push eax
mov byte [esp + 0x50], 1
nop
call fcn.0061e179
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
push edx
push eax
mov ecx, edi
call fcn.00468a00
lea ecx, [esp + 0xc]
call fcn.0051af14
mov byte [esp + 0x40], 2
call fcn.00410760
mov eax, dword [eax + 0x64]
cmp eax, esi
je 0x46902a
cmp eax, 2
jne 0x46905e
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
lea edx, [esp + 0x14]
push 0x5597a4
push edx
call fcn.0051af38
mov eax, dword [esp + 0x1c]
add esp, 0x10
mov ecx, edi
push eax
push 0x510
call fcn.0051afce
mov ecx, eax
call fcn.0051af32
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 1
call fcn.0051af0e
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x14]
mov byte [esp + 0x40], 3
cmp eax, esi
je 0x469086
push eax
call fcn.0051aee4
add esp, 4
mov dword [esp + 0x10], 0x53138c
mov dword [esp + 0x24], ebp
mov eax, dword [esp + 0x28]
pop edi
cmp eax, esi
pop esi
mov dword [esp + 0x38], 4
pop ebp
je 0x4690ae
push eax
call fcn.0051aee4
add esp, 4
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x476090
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x478877
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov ecx, 0x559d88
push 0x20
sub ecx, eax
pop esi
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x478886
pop esi
ret

Function at 0x478891
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov ecx, 0x559d88
push 0x20
sub ecx, eax
pop esi
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x4788a0
pop esi
ret

Function at 0x47ba60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x526ad9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
push 0xa
push edi
mov dword [esp + 0x24], edi
mov dword [esi], 0x531cd8
call fcn.004ecdd0
lea ebx, [esi + 0x14]
mov dword [esp + 0x1c], 1
mov ecx, ebx
call fcn.0051af80
mov dword [ebx], 0x531584
lea ecx, [esi + 0x2c]
mov byte [esp + 0x1c], 2
call fcn.0051af14
lea ecx, [esi + 0x30]
mov dword [esp + 0x10], ecx
mov dword [ecx + 4], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 8], edi
push 0xa
push edi
mov byte [esp + 0x24], 4
mov dword [ecx], 0x539d14
call fcn.004ecdd0
lea ebx, [esi + 0x44]
mov byte [esp + 0x1c], 5
mov ecx, ebx
call fcn.0051af80
mov dword [ebx], 0x531584
mov dword [esi + 0x28], edi
lea edi, [esi + 0x58]
mov ecx, 0x28
or eax, 0xffffffff
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x47bb30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x526b29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0x44]
mov dword [esp + 0x18], 3
mov dword [ecx], 0x531584
call fcn.0051af86
lea edi, [esi + 0x30]
mov dword [esp + 0xc], edi
mov dword [edi], 0x533fe4
mov eax, dword [edi + 4]
mov byte [esp + 0x18], 4
test eax, eax
je 0x47bb88
push eax
call fcn.0051aee4
add esp, 4
lea ecx, [esi + 0x2c]
mov dword [edi], 0x53138c
mov byte [esp + 0x18], 1
call fcn.0051af0e
lea ecx, [esi + 0x14]
mov byte [esp + 0x18], 0
mov dword [ecx], 0x531584
call fcn.0051af86
mov dword [esi], 0x5315ac
mov eax, dword [esi + 4]
mov dword [esp + 0x18], 5
test eax, eax
je 0x47bbcc
push eax
call fcn.0051aee4
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword [esi], 0x53138c
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4811e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52712c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c8
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x70]
mov ebp, dword [esi + 0x38]
call fcn.00485090
lea ecx, [esp + 0xe8]
mov dword [esp + 0x1e0], 0
call fcn.00485090
fld qword [esi + 0x18]
fld qword [esi + 0x10]
fpatan
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
push eax
mov bl, 1
push ecx
lea ecx, [esp + 0x78]
mov byte [esp + 0x1e8], bl
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0x3ff00000
fstp qword [esp + 0x1c]
call fcn.00485410
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x34]
push edx
push eax
push ecx
lea ecx, [esp + 0xf4]
call fcn.00485480
lea edx, [esp + 0xe8]
lea eax, [esp + 0x70]
push edx
lea ecx, [esp + 0x164]
push eax
push ecx
call fcn.00485530
add esp, 0xc
push eax
lea ecx, [esp + 0x74]
mov byte [esp + 0x1e4], 2
call fcn.004853c0
lea ecx, [esp + 0x160]
mov byte [esp + 0x1e0], bl
call fcn.00519440
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
push 0
push edx
mov edx, dword [esi]
push eax
push ecx
push edx
lea ecx, [esp + 0x100]
call fcn.004854d0
lea eax, [esp + 0xe8]
lea ecx, [esp + 0x70]
push eax
lea edx, [esp + 0x164]
push ecx
push edx
call fcn.00485530
add esp, 0xc
push eax
lea ecx, [esp + 0x74]
mov byte [esp + 0x1e4], 3
call fcn.004853c0
mov byte [esp + 0x1e0], bl
lea ecx, [esp + 0x160]
call fcn.00519440
cmp byte [ebp], 0
je 0x481426
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x14]
push eax
push ecx
push ebp
mov ecx, 0x55e588
call fcn.00480650
test eax, eax
je 0x4813cb
mov ecx, dword [esp + 0x14]
xor ebx, ebx
test ecx, ecx
jle 0x4813cb
mov edi, eax
mov edx, edi
mov eax, dword [edx]
test al, 6
mov ecx, dword [edx + 4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov edx, dword [edx + 8]
mov dword [esp + 0x28], edx
jne 0x48138f
push 3
nop
call fcn.0061e908
lea eax, [esp + 0x28]
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0x78]
call fcn.00485af0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push edx
push eax
nop
call fcn.0061e911
cmp dword [esp + 0x20], 4
jne 0x4813bf
nop
call fcn.0061e91a
mov eax, dword [esp + 0x14]
inc ebx
add edi, 0xc
cmp ebx, eax
jl 0x48136d
fld qword [esp + 0x4c]
fmul qword [esi + 0x28]
lea ecx, [esp + 0x58]
mov dword [esp + 0x68], 0
push ecx
lea ecx, [esp + 0x74]
fadd qword [esi + 0x30]
mov dword [esp + 0x70], 0
fst qword [esp + 0x30]
fmul qword [esi + 0x18]
fld qword [esp + 0x30]
fmul qword [esi + 0x10]
fstp qword [esp + 0x5c]
fstp qword [esp + 0x64]
call fcn.00485240
push ebp
call fcn.00480270
add esp, 4
test al, al
je 0x481419
inc ebp
jmp 0x48141c
add ebp, 2
cmp byte [ebp], 0
jne 0x481348
lea ecx, [esp + 0xe8]
mov byte [esp + 0x1e0], 0
call fcn.00519440
lea ecx, [esp + 0x70]
mov dword [esp + 0x1e0], 0xffffffff
call fcn.00519440
mov ecx, dword [esp + 0x1d8]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x482380
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x527279
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 8]
call fcn.0051af14
lea ecx, [esi + 0xc]
mov dword [esp + 0x14], 0
call fcn.0051af14
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 1
call fcn.0051af14
lea ecx, [esi + 0x14]
mov byte [esp + 0x14], 2
call fcn.0051af14
lea ecx, [esi + 0x18]
mov byte [esp + 0x14], 3
call fcn.0051af14
lea ecx, [esi + 0x1c]
mov byte [esp + 0x14], 4
call fcn.0051af14
lea ecx, [esi + 0x20]
mov byte [esp + 0x14], 5
call fcn.0051af14
lea ecx, [esi + 0x24]
mov byte [esp + 0x14], 6
call fcn.0051af14
lea edi, [esi + 0x28]
mov byte [esp + 0x14], 7
mov ecx, edi
call fcn.0051af14
lea ecx, [esi + 0x2c]
mov byte [esp + 0x14], 8
call fcn.0051af14
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 9
call fcn.0051af14
push 0x55a1d8
mov ecx, edi
mov byte [esp + 0x18], 0xa
mov dword [esi], 5
mov dword [esi + 4], 0
call fcn.0051afb6
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x482460
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5272fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x30]
mov dword [esp + 0x10], 9
call fcn.0051af0e
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 8
call fcn.0051af0e
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 7
call fcn.0051af0e
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 6
call fcn.0051af0e
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 5
call fcn.0051af0e
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 4
call fcn.0051af0e
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 3
call fcn.0051af0e
lea ecx, [esi + 0x14]
mov byte [esp + 0x10], 2
call fcn.0051af0e
lea ecx, [esi + 0x10]
mov byte [esp + 0x10], 1
call fcn.0051af0e
lea ecx, [esi + 0xc]
mov byte [esp + 0x10], 0
call fcn.0051af0e
lea ecx, [esi + 8]
mov dword [esp + 0x10], 0xffffffff
call fcn.0051af0e
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x48f960
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x527cd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x53138c
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [esp + 0x14], ebx
call fcn.0051af14
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x14], 0x53a6d8
mov dword [esi + 0x18], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi], 0x53a690
mov byte [esi + 0x2c], bl
mov dword [esi + 0x28], ebx
mov byte [esi + 4], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x30], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x492270
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x527f03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.004c5420
mov dword [esp + 0x14], 0x53a858
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call fcn.004c5420
mov dword [esp + 0x10], 0x53a84c
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call fcn.004c5420
mov dword [esp + 0xc], 0x53a840
mov eax, dword [ebp + 8]
mov byte [esp + 0x28], 2
mov edi, dword [eax + 0x30]
dec edi
mov dword [esp + 0x18], edi
js 0x4923e8
jmp 0x4922ed
mov edi, dword [esp + 0x18]
push 0x1d0
call fcn.0051af44
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x28], 3
je 0x492312
mov ecx, eax
call fcn.00498980
mov esi, eax
jmp 0x492314
xor esi, esi
mov ecx, dword [ebp + 8]
mov byte [esp + 0x28], 2
mov edx, dword [ecx + 0x2c]
mov ecx, esi
mov eax, dword [edx + edi*4]
push eax
call fcn.00498fc0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x48]
test ecx, ecx
je 0x49233c
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x10]
mov eax, dword [ebp + 0x10]
push 0xffffffffffffffff
mov edi, dword [eax + 0x30]
lea ebx, [eax + 0x28]
lea ecx, [edi + 1]
push ecx
mov ecx, ebx
call fcn.004ecdd0
mov edx, dword [ebx + 4]
mov ecx, esi
mov dword [edx + edi*4], esi
call fcn.0040a180
mov ecx, eax
mov dword [esp + 0x1c], eax
call fcn.0049c880
mov edi, eax
mov ebx, edi
mov esi, dword [edi + 0x38]
fld qword [esi]
fcomp qword [edi]
fnstsw ax
test ah, 1
je 0x49237e
mov edi, esi
fld qword [esi]
fcomp qword [ebx]
fnstsw ax
test ah, 0x41
jne 0x49238b
mov ebx, esi
mov ecx, dword [esp + 0x1c]
mov esi, dword [esi + 0x38]
call fcn.0049c880
cmp esi, eax
jne 0x492371
mov esi, dword [ebp + 0x10]
lea ecx, [esp + 0x14]
lea eax, [esi + 0x40]
push eax
push ecx
push edi
push ebx
call fcn.004a34c0
lea edx, [esi + 0x80]
lea eax, [esp + 0x20]
push edx
push eax
push ebx
push edi
call fcn.004a34c0
add esp, 0x20
add esi, 0xc0
lea ecx, [esp + 0xc]
push esi
push ecx
mov ecx, dword [esp + 0x24]
call fcn.004a36f0
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x18], eax
jns 0x4922e9
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [eax], edx
lea ecx, [eax + 8]
add eax, 0x28
push ecx
push eax
call fcn.00504c40
add esp, 8
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
mov dword [esp + 0xc], 0x53a840
call fcn.004c5450
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
mov dword [esp + 0x10], 0x53a84c
call fcn.004c5450
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x14], 0x53a858
call fcn.004c5450
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc