joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae20f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1039d668
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov dword [esp + 0x1c], ecx
mov edi, dword [esp + 0x74]
xor esi, esi
mov byte [esp + 0x17], 0
mov dword [esp + 0x18], esi
cmp edi, esi
jne 0x4ae28f
push 0x19
push 0x10471b28
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], esi
mov byte [esp + 0x2c], 0
call fcn.0040517f
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x70], esi
call fcn.004c07cf
push 0x104f2130
lea ecx, [esp + 0x40]
push ecx
call fcn.00776cc8
mov eax, dword [edi + 0x14]
mov ebp, dword [esp + 0x78]
mov ecx, edi
cmp ebp, eax
ja 0x4ae2a6
push 0xffffffffffffffff
push ebp
call fcn.00404daf
jmp 0x4ae2b1
mov edx, ebp
push esi
sub edx, eax
push edx
call fcn.0040845f
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x1c]
push ebx
push 1
lea eax, [esp + 0x1f]
push eax
call fcn.004ae01f
add dword [esp + 0x18], eax
cmp byte [esp + 0x17], 0
je 0x4ae2f5
cmp esi, dword [edi + 0x14]
jbe 0x4ae2db
call fcn.00776e71
cmp dword [edi + 0x18], 0x10
jb 0x4ae2e6
mov eax, dword [edi + 4]
jmp 0x4ae2e9
lea eax, [edi + 4]
mov cl, byte [esp + 0x17]
mov byte [eax + esi], cl
inc esi
cmp esi, ebp
jbe 0x4ae2b5
mov eax, dword [edi + 0x14]
mov ecx, edi
cmp esi, eax
ja 0x4ae308
push 0xffffffffffffffff
push esi
call fcn.00404daf
jmp 0x4ae312
push 0
sub esi, eax
push esi
call fcn.0040845f
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 0xc
Function at 0x4ae32f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1039d668
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov dword [esp + 0x1c], ecx
mov edi, dword [esp + 0x74]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
cmp edi, ebx
jne 0x4ae3ad
push 0x24
push 0x10471b44
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
call fcn.0040517f
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x70], ebx
call fcn.004c07cf
push 0x104f2130
lea ecx, [esp + 0x40]
push ecx
call fcn.00776cc8
mov eax, dword [edi + 0x14]
mov ebp, dword [esp + 0x78]
mov ecx, edi
cmp ebp, eax
ja 0x4ae3c4
push 0xffffffffffffffff
push ebp
call fcn.00407d6f
jmp 0x4ae3cf
mov edx, ebp
push ebx
sub edx, eax
push edx
call fcn.00412c1f
xor esi, esi
cmp ebp, ebx
jbe 0x4ae424
mov ebx, dword [esp + 0x7c]
lea ebx, [ebx]
mov ecx, dword [esp + 0x1c]
push ebx
push 2
lea eax, [esp + 0x1c]
push eax
call fcn.004ae01f
add dword [esp + 0x18], eax
cmp word [esp + 0x14], 0
je 0x4ae422
cmp esi, dword [edi + 0x14]
jbe 0x4ae406
call fcn.00776e71
cmp dword [edi + 0x18], 8
jb 0x4ae411
mov eax, dword [edi + 4]
jmp 0x4ae414
lea eax, [edi + 4]
mov cx, word [esp + 0x14]
mov word [eax + esi*2], cx
inc esi
cmp esi, ebp
jb 0x4ae3df
xor ebx, ebx
mov eax, dword [edi + 0x14]
mov ecx, edi
cmp esi, eax
ja 0x4ae437
push 0xffffffffffffffff
push esi
call fcn.00407d6f
jmp 0x4ae440
push ebx
sub esi, eax
push esi
call fcn.00412c1f
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 0xc
Function at 0x4ae73f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1039d668
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov dword [esp + 0x1c], ecx
mov edi, dword [esp + 0x74]
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
cmp edi, esi
jne 0x4ae7be
push 0x19
push 0x10471b28
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], esi
mov byte [esp + 0x2c], 0
call fcn.0040517f
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x70], esi
call fcn.004c07cf
push 0x104f2130
lea ecx, [esp + 0x40]
push ecx
call fcn.00776cc8
mov eax, dword [edi + 0x14]
mov ebp, dword [esp + 0x78]
mov ecx, edi
cmp ebp, eax
ja 0x4ae7d5
push 0xffffffffffffffff
push ebp
call fcn.00407d6f
jmp 0x4ae7e0
mov edx, ebp
push esi
sub edx, eax
push edx
call fcn.00412c1f
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x1c]
push ebx
push 2
lea eax, [esp + 0x1c]
push eax
call fcn.004ae01f
add dword [esp + 0x18], eax
cmp word [esp + 0x14], 0
je 0x4ae827
cmp esi, dword [edi + 0x14]
jbe 0x4ae80b
call fcn.00776e71
cmp dword [edi + 0x18], 8
jb 0x4ae816
mov eax, dword [edi + 4]
jmp 0x4ae819
lea eax, [edi + 4]
mov cx, word [esp + 0x14]
mov word [eax + esi*2], cx
inc esi
cmp esi, ebp
jbe 0x4ae7e4
mov eax, dword [edi + 0x14]
mov ecx, edi
cmp esi, eax
ja 0x4ae83a
push 0xffffffffffffffff
push esi
call fcn.00407d6f
jmp 0x4ae844
push 0
sub esi, eax
push esi
call fcn.00412c1f
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 0xc

Function at 0x4aff5f
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x103b2738
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.0040826f
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4affbf
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.0042aaaf
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.0040826f
cmp dword [esp + 0x28], 8
jb 0x4b000c
mov eax, dword [esp + 0x14]
push eax
call fcn.00776c58
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x4b898f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1039e050
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x105623f8]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
mov edi, dword [esp + 0x74]
mov ebp, dword [esp + 0x78]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
push 1
xor esi, esi
push esi
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x64]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x30], 0x21
call fcn.0042a88f
cmp eax, 0xffffffff
jne 0x4b8a31
cmp dword [esp + 0x70], 8
jb 0x4b8a2a
mov edx, dword [esp + 0x5c]
push edx
call fcn.00776c58
add esp, 4
xor al, al
jmp 0x4b8b6d
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], esi
mov word [esp + 0x2c], ax
mov ecx, edi
mov byte [esp + 0x50], 1
xor bl, bl
call fcn.0057791f
mov eax, dword [esp + 0x6c]
test eax, eax
jbe 0x4b8ad2
cmp esi, eax
jbe 0x4b8a67
call fcn.00776e71
mov eax, dword [esp + 0x6c]
cmp dword [esp + 0x70], 8
mov ecx, dword [esp + 0x5c]
jae 0x4b8a76
lea ecx, [esp + 0x5c]
cmp word [ecx + esi*2], 0x21
jne 0x4b8a81
mov bl, 1
jmp 0x4b8acd
test bl, bl
je 0x4b8aa3
cmp esi, eax
jbe 0x4b8a8e
call fcn.00776e71
cmp dword [esp + 0x70], 8
mov eax, dword [esp + 0x5c]
jae 0x4b8a9d
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x28]
jmp 0x4b8abd
cmp esi, eax
jbe 0x4b8aac
call fcn.00776e71
cmp dword [esp + 0x70], 8
mov eax, dword [esp + 0x5c]
jae 0x4b8abb
lea eax, [esp + 0x5c]
mov ecx, edi
movzx eax, word [eax + esi*2]
push eax
push 1
call fcn.00412c1f
mov eax, dword [esp + 0x6c]
inc esi
cmp esi, eax
jb 0x4b8a67
cmp dword [edi + 0x14], 0
je 0x4b8b27
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
push ecx
push ebp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
xor edx, edx
push 0xffffffffffffffff
push edx
lea eax, [esp + 0x60]
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
push eax
mov word [ecx + 4], dx
call fcn.0040826f
call fcn.004b80af
add esp, 0x30
test al, al
je 0x4b8b27
mov bl, 1
jmp 0x4b8b29
xor bl, bl
mov esi, 8
cmp dword [esp + 0x40], esi
jb 0x4b8b41
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00776c58
add esp, 4
xor edx, edx
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], dx
cmp dword [esp + 0x70], esi
jb 0x4b8b6b
mov eax, dword [esp + 0x5c]
push eax
call fcn.00776c58
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00777267
add esp, 0x40
ret
Function at 0x4bcb1f
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
mov eax, dword [0x105623f8]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x60]
xor ecx, ecx
push esi
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x68]
push ecx
push eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.004bc97f
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004bca3f
mov ecx, dword [esp + 0x70]
add esp, 0x14
pop esi
xor ecx, esp
call fcn.00777267
add esp, 0x5c
ret

Function at 0x4bd4cf
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x1039e3b8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x105623f8]
xor eax, esp
mov dword [esp + 0x70], eax
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x7c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x8c]
xor eax, eax
mov dword [esp + 8], eax
cmp dword [esp + 0xa8], 0x10
mov dword [esp + 0x84], eax
mov byte [esp + 0xc], al
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x58], 0x67452301
mov dword [esp + 0x5c], 0xefcdab89
mov dword [esp + 0x60], 0x98badcfe
mov dword [esp + 0x64], 0x10325476
jae 0x4bd556
lea eax, [esp + 0x94]
mov ecx, dword [esp + 0xa4]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.004bd24f
lea ecx, [esp + 0xc]
call fcn.004bd2ff
push esi
lea ecx, [esp + 0x10]
call fcn.004bd41f
cmp dword [esp + 0xa8], 0x10
jb 0x4bd595
mov edx, dword [esp + 0x94]
push edx
call fcn.00776c58
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00777267
add esp, 0x80
ret
Function at 0x4cf82f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
push esi
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4cf83f
sub eax, esi
movzx edx, ax
xor eax, eax
mov word [esp + 8], ax
movzx eax, dx
add eax, ecx
cmp eax, ecx
je 0x4cf88a
push edi
lea ecx, [ecx]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0xc]
shr esi, 0xe
and esi, 1
add edi, edi
or esi, edi
movsx di, byte [eax - 1]
dec eax
and esi, 0x7fff
xor si, di
mov word [esp + 0xc], si
cmp eax, ecx
jne 0x4cf85f
pop edi
mov eax, dword [esp + 8]
mov ecx, eax
shr ecx, 0xe
and ecx, 1
add eax, eax
or ecx, eax
and ecx, 0x7fff
xor ecx, edx
xor ecx, 0xce4b
mov word [esp + 8], cx
movzx eax, byte [esp + 9]
movzx ecx, cl
shl eax, 8
or eax, ecx
pop esi
ret

Function at 0x4cf8bf
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
push esi
lea esi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4cf8cf
sub eax, esi
sar eax, 1
movzx edx, ax
xor eax, eax
mov word [esp + 8], ax
movzx eax, dx
lea eax, [ecx + eax*2]
cmp eax, ecx
je 0x4cf91b
push edi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0xc]
shr esi, 0xe
and esi, 1
add edi, edi
or esi, edi
sub eax, 2
and esi, 0x7fff
xor si, word [eax]
mov word [esp + 0xc], si
cmp eax, ecx
jne 0x4cf8f3
pop edi
mov eax, dword [esp + 8]
mov ecx, eax
shr ecx, 0xe
and ecx, 1
add eax, eax
or ecx, eax
and ecx, 0x7fff
xor ecx, edx
xor ecx, 0xce4b
mov word [esp + 8], cx
movzx eax, byte [esp + 9]
movzx ecx, cl
shl eax, 8
or eax, ecx
pop esi
ret
Function at 0x4cf9ff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1039fb8e
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
mov edi, dword [esp + 0xac]
mov ecx, dword [edi + 0x14]
xor esi, esi
cmp ecx, esi
jne 0x4cfa81
push 0x19
push 0x10472564
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], esi
mov byte [esp + 0x20], 0
call fcn.0040517f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0xa8], esi
call fcn.004c07cf
push 0x104f2130
lea ecx, [esp + 0x50]
push ecx
call fcn.00776cc8
mov ebx, 8
lea ebp, [edi + 4]
cmp dword [edi + 0x18], ebx
jb 0x4cfa93
mov eax, dword [ebp]
jmp 0x4cfa95
mov eax, ebp
cmp word [eax], 0x27
je 0x4cfaaa
dec ecx
push ecx
mov ecx, edi
call fcn.0046330f
cmp word [eax], 0x27
jne 0x4cfae0
push 0x10472540
lea ecx, [esp + 0x18]
call fcn.004053ef
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x50]
mov dword [esp + 0xa8], 1
call fcn.004c07cf
push 0x104f2130
lea eax, [esp + 0x50]
push eax
call fcn.00776cc8
mov eax, dword [edi + 0x14]
test eax, eax
jbe 0x4cfb9c
cmp esi, eax
jbe 0x4cfaf4
call fcn.00776e71
cmp dword [edi + 0x18], ebx
jb 0x4cfafe
mov eax, dword [ebp]
jmp 0x4cfb00
mov eax, ebp
cmp word [eax + esi*2], 0x3a
je 0x4cfbb6
cmp esi, dword [edi + 0x14]
jbe 0x4cfb15
call fcn.00776e71
cmp dword [edi + 0x18], ebx
jb 0x4cfb1f
mov eax, dword [ebp]
jmp 0x4cfb21
mov eax, ebp
cmp word [eax + esi*2], 0x5c
je 0x4cfbb6
cmp esi, dword [edi + 0x14]
jbe 0x4cfb36
call fcn.00776e71
cmp dword [edi + 0x18], ebx
jb 0x4cfb40
mov eax, dword [ebp]
jmp 0x4cfb42
mov eax, ebp
cmp word [eax + esi*2], 0x2a
je 0x4cfbb6
cmp esi, dword [edi + 0x14]
jbe 0x4cfb53
call fcn.00776e71
cmp dword [edi + 0x18], ebx
jb 0x4cfb5d
mov eax, dword [ebp]
jmp 0x4cfb5f
mov eax, ebp
cmp word [eax + esi*2], 0x3f
je 0x4cfbb6
push esi
mov ecx, edi
call fcn.0046330f
cmp word [eax], 0x2f
je 0x4cfbb6
push esi
mov ecx, edi
call fcn.0046330f
cmp word [eax], 0x5b
je 0x4cfbb6
push esi
mov ecx, edi
call fcn.0046330f
cmp word [eax], 0x5d
je 0x4cfbb6
mov eax, dword [edi + 0x14]
inc esi
cmp esi, eax
jb 0x4cfaf4
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret
push 0x23
push 0x10472540
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], 0
mov byte [esp + 0x3c], 0
call fcn.0040517f
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x78]
mov dword [esp + 0xa8], 2
call fcn.004c07cf
push 0x104f2130
lea edx, [esp + 0x78]
push edx
call fcn.00776cc8
int3
Function at 0x4d5c3f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103a03f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x30], 0
call fcn.004d6b1f
add esp, 4
cmp byte [edi + 0xc], 0
je 0x4d5c8d
mov ecx, dword [edi + 8]
inc ecx
mov dword [esp + 0x14], ecx
jmp 0x4d5c95
mov dword [esp + 0x14], 1
lea edx, [esp + 0x14]
lea ebp, [edi + 4]
push edx
mov ecx, ebp
call fcn.00605adf
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x18]
lea ebx, [edi + 0x54]
push ecx
mov ecx, ebx
call fcn.004d44ef
mov esi, dword [esp + 0x14]
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx]
mov dword [esp + 0x20], edx
test esi, esi
je 0x4d5ccd
cmp esi, eax
je 0x4d5cd2
call fcn.00776e71
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x20]
je 0x4d5d16
test esi, esi
jne 0x4d5d12
call fcn.00776e71
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esi + 0x18]
jne 0x4d5cf3
call fcn.00776e71
cmp dword [esp + 0x4c], 8
mov edx, dword [esp + 0x18]
mov esi, dword [edx + 0x28]
jb 0x4d5d0e
mov eax, dword [esp + 0x38]
push eax
call fcn.00776c58
add esp, 4
mov eax, esi
jmp 0x4d5d87
mov esi, dword [esi]
jmp 0x4d5ce5
mov ecx, ebp
call fcn.004d594f
lea esi, [edi + 0x34]
mov ecx, esi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x34]
push ecx
push eax
mov ecx, edi
call fcn.004d45ff
mov edx, dword [esi + 0x10]
sub edx, dword [esi + 0xc]
lea eax, [esp + 0x14]
sar edx, 2
push eax
mov ecx, ebp
mov dword [esp + 0x18], edx
call fcn.006a4b1f
mov edi, dword [esi + 0x10]
sub edi, dword [esi + 0xc]
lea ecx, [esp + 0x34]
push ecx
mov ecx, ebx
sar edi, 2
call fcn.004d515f
dec edi
mov dword [eax], edi
mov edi, dword [esi + 0x10]
sub edi, dword [esi + 0xc]
sar edi, 2
dec edi
cmp dword [esp + 0x4c], 8
jb 0x4d5d85
mov edx, dword [esp + 0x38]
push edx
call fcn.00776c58
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x1c
Function at 0x4d5faf
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103a03f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x30], 0
call fcn.004d6b1f
add esp, 4
cmp byte [esi + 0xc], 0
je 0x4d5ffd
mov ecx, dword [esi + 8]
inc ecx
mov dword [esp + 0x14], ecx
jmp 0x4d6005
mov dword [esp + 0x14], 1
lea edx, [esp + 0x14]
lea ebp, [esi + 4]
push edx
mov ecx, ebp
call fcn.00605adf
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x18]
lea ebx, [esi + 0x3c]
push ecx
mov ecx, ebx
call fcn.004d44ef
mov edi, dword [esp + 0x14]
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx]
mov dword [esp + 0x20], edx
test edi, edi
je 0x4d603d
cmp edi, eax
je 0x4d6042
call fcn.00776e71
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x20]
je 0x4d6086
test edi, edi
jne 0x4d6082
call fcn.00776e71
mov ecx, dword [esp + 0x18]
cmp ecx, dword [edi + 0x18]
jne 0x4d6063
call fcn.00776e71
cmp dword [esp + 0x4c], 8
mov edx, dword [esp + 0x18]
mov esi, dword [edx + 0x28]
jb 0x4d607e
mov eax, dword [esp + 0x38]
push eax
call fcn.00776c58
add esp, 4
mov eax, esi
jmp 0x4d6101
mov edi, dword [edi]
jmp 0x4d6055
mov ecx, ebp
call fcn.004d59bf
add esi, 0x1c
mov ecx, esi
call fcn.0058411f
mov edi, dword [eax]
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x3c]
add edi, 4
push ecx
mov ecx, edi
call fcn.0040826f
mov byte [edi + 0x1c], 1
mov edx, dword [esi + 0x10]
sub edx, dword [esi + 0xc]
lea eax, [esp + 0x14]
sar edx, 2
push eax
mov ecx, ebp
mov dword [esp + 0x18], edx
call fcn.006a4b1f
mov edi, dword [esi + 0x10]
sub edi, dword [esi + 0xc]
lea ecx, [esp + 0x34]
push ecx
mov ecx, ebx
sar edi, 2
call fcn.004d515f
dec edi
mov dword [eax], edi
mov edi, dword [esi + 0x10]
sub edi, dword [esi + 0xc]
sar edi, 2
dec edi
cmp dword [esp + 0x4c], 8
jb 0x4d60ff
mov edx, dword [esp + 0x38]
push edx
call fcn.00776c58
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x1c
Function at 0x4d64df
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1039fdd8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
mov dword [esp + 0xc], 0
push 1
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 0x2e
call fcn.004d009f
cmp eax, 0xffffffff
je 0x4d6541
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x2c]
call fcn.00407d6f
mov esi, dword [esp + 0x38]
test esi, esi
jbe 0x4d6575
dec esi
cmp esi, dword [esp + 0x38]
jbe 0x4d6555
call fcn.00776e71
cmp dword [esp + 0x3c], 8
mov eax, dword [esp + 0x28]
jae 0x4d6564
lea eax, [esp + 0x28]
movzx ecx, word [eax + esi*2]
push ecx
call fcn.0077a84e
add esp, 4
test eax, eax
jne 0x4d6545
cmp esi, dword [esp + 0x38]
jae 0x4d6588
push 0xffffffffffffffff
inc esi
push esi
lea ecx, [esp + 0x2c]
call fcn.00407d6f
xor edx, edx
push 0xffffffffffffffff
push edx
lea eax, [esp + 0x2c]
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], 0
push eax
mov ecx, edi
mov word [edi + 4], dx
call fcn.0040826f
cmp dword [esp + 0x3c], 8
jb 0x4d65bf
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00776c58
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4d777f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103a06b3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x10472804
push esi
mov dword [esp + 0x18], 1
call fcn.00766aa9
add esp, 4
cmp dword [esi + 0x30], 0x10
jb 0x4d77d0
mov eax, dword [esi + 0x1c]
push eax
call fcn.00776c58
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov dword [esi], 0x1046aed0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x4df1ff
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103a0ab8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x105623f8]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.006407bf
add esi, 0x50
mov ecx, esi
mov dword [esp + 0x44], 0
call fcn.004d7cff
mov ecx, eax
call fcn.004dee7f
mov ecx, esi
call fcn.004d7cff
lea ecx, [eax + 0x10]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 0xc]
call fcn.004d7acf
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.0064549f
mov ecx, esi
call fcn.004d7cff
lea ecx, [eax + 0x10]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 0x14]
call fcn.004d7acf
lea edx, [esp + 0xc]
push edx
mov ecx, eax
call fcn.0064549f
mov ecx, esi
call fcn.004d7cff
lea ecx, [eax + 0x10]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 0x1c]
call fcn.004d7acf
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.0064549f
mov ecx, esi
call fcn.004d7cff
lea ecx, [eax + 0x10]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 0x24]
call fcn.004d7acf
lea edx, [esp + 0xc]
push edx
mov ecx, eax
call fcn.0064549f
mov ecx, esi
call fcn.004d7cff
lea ecx, [eax + 0x10]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 0x2c]
call fcn.004d7acf
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.0064549f
mov ecx, esi
call fcn.004d7cff
mov edx, dword [eax + 0x20]
sub edx, dword [eax + 0x1c]
lea eax, [esp + 8]
sar edx, 2
push eax
mov ecx, esi
mov dword [esp + 0xc], edx
call fcn.004d7cff
mov ecx, eax
call fcn.00605adf
lea ecx, [esp + 0xc]
mov dword [esp + 0x44], 0xffffffff
call fcn.0063e47f
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00777267
add esp, 0x40
ret