joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66c5db
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x78]
xor ebx, ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esp + 0x6c], 4
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov eax, dword [esp + 0x74]
mov byte [esp + 0x6c], 6
mov dword [esi], 0x6b2424
mov dword [esi + 4], 0x6b2508
mov dword [esi + 0x54], eax
cmp byte [esp + 0x80], bl
jne 0x42f4e5
push ebx
push 0x70b090
push 0x70a870
push ebx
push eax
call fcn.00617543
add esp, 0x14
test eax, eax
je 0x42f4e5
push 0x87
push 0x6b21b8
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00417c40
lea ecx, [esp + 0x1c]
push ecx
push 1
lea ecx, [esp + 0x40]
mov byte [esp + 0x74], 7
call fcn.004182c0
push 0x6d67bc
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], 0x68cbf8
call fcn.00611ced
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x6b2120
call fcn.004302e0
add esp, 8
push eax
mov ecx, esi
mov byte [esp + 0x70], 8
call fcn.0042ebe0
mov byte [esp + 0x6c], 6
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x42f51e
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x64
ret 0x10

Function at 0x42fd80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x66bd99
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esp + 0x18], 2
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov cl, byte [esp + 0x28]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
mov byte [esp + 0x18], 4
mov byte [esi + 0x28], cl
push 0xffffffffffffffff
lea ecx, [esi + 0x34]
mov dword [esi], 0x6b251c
mov dword [esi + 4], 0x6b25dc
mov dword [esi + 0x24], eax
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00418140
mov eax, dword [esp + 0x34]
push 0xffffffffffffffff
lea ecx, [esi + 0x50]
mov byte [esp + 0x1c], 5
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00418140
mov eax, dword [esp + 0x2c]
cmp eax, ebx
mov byte [esp + 0x18], 6
jge 0x42fe35
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x42fe50
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esp + 0x24]
mov dword [esi + 0xc], ecx
jmp 0x42fe57
mov edx, dword [esp + 0x24]
mov dword [esi + 0xc], edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 0x18
Function at 0x4302e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66c2a1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x6b20f8
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x30]
push eax
push ecx
lea edi, [esp + 0x18]
mov dword [esp + 0x2c], 1
call fcn.00430380
push eax
mov ecx, esi
call fcn.0042e3d0
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x430362
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x4388e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x66c550
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x705e7c]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push 1
mov dword [esp + 0x20], eax
mov dword [esp + 8], eax
push 0x7096f8
lea eax, [esp + 0xc]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x10], edx
mov edx, dword [ecx]
mov edx, dword [edx + 0x7c]
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x6929b4
mov dword [esp + 0x20], 0x6929a4
call edx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.006117ae
mov esp, ebp
pop ebp
ret 8
Function at 0x43f950
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x43f960
movzx edx, byte [esi + 0x6a6120]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov ebx, edx
shl ebx, 0x19
xor ecx, ebx
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ecx, ebx
lea ebx, [edx + edx]
xor eax, ebx
xor eax, edx
or eax, ecx
xor edx, edx
xor ebx, ebx
or edx, ecx
or eax, ebx
mov dword [esi*8 + 0x7526e0], edx
mov dword [esi*8 + 0x7526e4], eax
inc esi
cmp esi, 0x100
jl 0x43f960
mov dword [0x752ee8], edi
mov dword [0x752eec], edi
mov dword [0x752ee0], edi
mov dword [0x752ee4], edi
pop edi
pop esi
mov byte [0x752f00], 1
pop ebx
ret

Function at 0x43f9e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
lea ecx, [ecx]
movzx eax, byte [eax + 0x6a6220]
mov ebp, eax
shr ebp, 7
mov dword [esp + 0x1c], ebp
imul ebp, ebp, 0x1b000000
mov ecx, eax
shr ecx, 6
mov esi, ecx
and ecx, 1
mov dword [esp + 0x10], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
xor ecx, eax
shl ecx, 0x19
xor ecx, ebp
and esi, 2
mov dword [esp + 0x14], esi
mov edi, eax
shr edi, 5
mov edx, edi
mov esi, edi
and edi, 1
mov ebp, edi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and esi, 2
mov ebp, esi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x10]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x14]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and edx, 4
mov ebp, edx
imul ebp, ebp, 0x1b000000
xor ecx, ebp
lea ebp, [ebx*4]
xor ebp, eax
shl ebp, 8
mov ebx, edi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, esi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x14]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, edx
imul ebx, ebx, 0x11b00
xor ebp, ebx
or ecx, ebp
mov ebp, edi
imul edi, edi, 0x11b
imul ebp, ebp, 0x11b0000
lea ebx, [eax*8]
xor ebx, eax
shl ebx, 0x10
xor ebx, ebp
mov ebp, esi
imul ebp, ebp, 0x11b0000
xor ebx, ebp
mov ebp, edx
imul ebp, ebp, 0x11b0000
xor ebx, ebp
or ecx, ebx
mov ebx, dword [esp + 0x1c]
imul ebx, ebx, 0x11b
lea ebp, [eax*4]
xor ebp, eax
add ebp, ebp
xor ebp, ebx
xor ebp, edi
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebp, esi
xor ebp, edx
xor ebp, eax
or eax, ecx
or ebp, ecx
xor edx, edx
or edx, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
or ebp, ecx
mov dword [eax*8 + 0x751ed8], edx
mov dword [eax*8 + 0x751edc], ebp
inc eax
cmp eax, 0x100
mov dword [esp + 0x18], eax
jl 0x43f9f0
pop edi
pop esi
pop ebp
mov byte [0x752f01], 1
pop ebx
add esp, 0x10
ret
Function at 0x441110
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, dword [ebp + 8]
movdqa xmm0, xmmword [eax]
sub esp, 8
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
movdqa xmm1, xmmword [edi]
lea edx, [esi - 1]
pxor xmm0, xmm1
movdqa xmmword [eax], xmm0
cmp edx, 1
jbe 0x441177
add edx, 0xfffffffe
shr edx, 1
lea ecx, [edi + 0x10]
inc edx
jmp 0x441150
movdqa xmm1, xmmword [ecx]
movdqa xmm0, xmmword [eax]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
movdqa xmm1, xmmword [ecx + 0x10]
add ecx, 0x20
sub edx, 1
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
jne 0x441150
movdqa xmm0, xmmword [eax]
shl esi, 4
movdqa xmm1, xmmword [esi + edi - 0x10]
lea ecx, [esi + edi]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
movdqa xmm1, xmmword [ecx]
pop edi
aesenclast xmm0, xmm1
movdqa xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4411b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push ecx
mov eax, dword [ebp + 8]
movdqa xmm1, xmmword [eax]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
movdqa xmm0, xmmword [edi]
pxor xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
pxor xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
pxor xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
pxor xmm1, xmm0
movdqa xmmword [esi], xmm1
cmp ebx, 1
jbe 0x441256
add edi, 0x10
dec ebx
lea esp, [esp]
movdqa xmm0, xmmword [edi]
movdqa xmm1, xmmword [eax]
aesenc xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
aesenc xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
aesenc xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
add edi, 0x10
sub ebx, 1
aesenc xmm1, xmm0
movdqa xmmword [esi], xmm1
jne 0x441210
mov ebx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
movdqa xmm1, xmmword [eax]
shl ebx, 4
movdqa xmm0, xmmword [ebx + edi]
aesenclast xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
aesenclast xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
aesenclast xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
pop edi
aesenclast xmm1, xmm0
movdqa xmmword [esi], xmm1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f350
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jbe 0x44f36e
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
call fcn.00453e50
add esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x14]
jae 0x44f3bb
mov edx, dword [ebp - 4]
imul edx, edx, 0x1000193
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax]
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x44f390
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x49e9b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65ccc6
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x705e7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0044b4f0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00461f80
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x10]
fld1
fstp dword [eax + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 0xf
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0049f140
push 1
mov eax, dword [0x6e04f0]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0049f080
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4a3210
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65cddb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x705e7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
fld dword [ecx + 0x10]
fstp dword [eax + 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp + 8]
add edx, 0x18
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.004a32d0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0x30
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004a33d0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4d7f80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push str.LoadLocaleData___LoadItemList__s__Error
push 0x68197c
call fcn.00614709
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d7fa8
xor al, al
jmp 0x4d7fd3
mov eax, dword [ebp - 4]
push eax
push 0xc8
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x2628
push ecx
call fcn.00615c23
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.006144ad
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4d7fe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2624], 0
jne 0x4d7ff7
jmp 0x4d8070
push 0x68198c
call dword [0x673730]
add esp, 4
push eax
push 0x681990
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x2624]
push edx
call fcn.0058feb0
add esp, 0xc
push 0x6819a8
push 0x6819ac
call fcn.00614709
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d8047
push 0x6819bc
call fcn.00584ec0
add esp, 4
jmp 0x4d8070
mov eax, dword [ebp - 4]
push eax
push 0xc8
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x2628
push ecx
call fcn.0061661c
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.006144ad
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4da0f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65ec16
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x705e7c]
xor eax, ebp
mov dword [ebp - 0x28], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
lea eax, [ebp - 0x48]
push eax
push 3
mov ecx, dword [ebp - 0x64]
call fcn.00563f10
movzx ecx, al
test ecx, ecx
jne 0x4da138
mov al, 1
jmp 0x4da286
movzx esi, word [ebp - 0x47]
mov ecx, dword [ebp - 0x64]
call fcn.00563e20
cmp esi, eax
jle 0x4da14f
mov al, 1
jmp 0x4da286
lea edx, [ebp - 0x24]
push edx
push 7
mov ecx, dword [ebp - 0x64]
call fcn.00563f20
movzx eax, al
test eax, eax
jne 0x4da16b
xor al, al
jmp 0x4da286
movzx ecx, word [ebp - 0x23]
sub ecx, 7
mov word [ebp - 0x14], cx
mov edx, dword [ebp - 0x21]
mov dword [ebp - 0x1c], edx
movzx eax, word [ebp - 0x14]
push eax
call fcn.0061013d
add esp, 4
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
movzx eax, word [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x64]
call fcn.00563f20
movzx ecx, al
test ecx, ecx
jne 0x4da1c3
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
push eax
call fcn.00614389
add esp, 4
xor al, al
jmp 0x4da286
mov ecx, 0x710644
call fcn.00418260
push eax
call fcn.005851d0
add esp, 4
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004ff1b0
add esp, 4
push eax
lea ecx, [ebp - 0x44]
call fcn.00417d70
mov dword [ebp - 4], 0
push 0x681e0c
lea ecx, [ebp - 0x44]
call fcn.00418260
push eax
call fcn.00614709
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4da23b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
push eax
call fcn.00614389
add esp, 4
mov byte [ebp - 0x55], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.005d0540
mov al, byte [ebp - 0x55]
jmp 0x4da286
mov ecx, dword [ebp - 0x10]
push ecx
push 1
movzx edx, word [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.0061661c
add esp, 0x10
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.006144ad
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x5c]
push eax
call fcn.00614389
add esp, 4
mov byte [ebp - 0x5d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.005d0540
mov al, byte [ebp - 0x5d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.006117ae
mov esp, ebp
pop ebp
ret
Function at 0x4da790
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 4]
push eax
push 1
call dword [0x673038]
mov ecx, dword [ebp - 4]
push ecx
call dword [0x67303c]
push 0x600
call dword [0x673064]
push 0x602
call dword [0x67305c]
mov edx, dword [ebp + 8]
push edx
push 0
call dword [0x673040]
movzx eax, al
test eax, eax
jne 0x4da7e8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 2
xor al, al
jmp 0x4da8fa
push 0xde4
call dword [0x673044]
cmp eax, 0x40
je 0x4da808
mov edx, dword [ebp + 0xc]
mov dword [edx], 3
xor al, al
jmp 0x4da8fa
push 0xde5
call dword [0x673044]
cmp eax, 0x80
je 0x4da82a
mov eax, dword [ebp + 0xc]
mov dword [eax], 4
xor al, al
jmp 0x4da8fa
lea ecx, [ebp - 4]
push ecx
push 1
call dword [0x673048]
call dword [0x673060]
push 0x681e40
mov edx, dword [ebp + 8]
push edx
call fcn.00614709
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4da85f
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
push 2
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.00615ed5
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call fcn.00615ddd
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x3a0], eax
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.00615ed5
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x3a0]
push ecx
call fcn.0061013d
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov dword [edx + 0x3a8], eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x3a0]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x3a8]
push edx
call fcn.00615c23
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.006144ad
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.0058a4a0
add esp, 4
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3a4], eax
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x4e3900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x18
call fcn.004e4810
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x18
call fcn.00494e50
mov ecx, eax
call fcn.00453ca0
movzx ecx, al
test ecx, ecx
je 0x4e3942
jmp 0x4e3a78
lea ecx, [ebp - 8]
call fcn.004d0550
add eax, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x1c]
call fcn.004e2fc0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e3a01
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00448fb0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00448f60
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00448a30
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00446020
mov edx, dword [ebp + 8]
add edx, 0x28
push edx
mov ecx, dword [ebp - 0x10]
call fcn.0044fde0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00455560
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00455500
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x1c]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00447c90
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x1e]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00447cc0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00447d80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x28]
mov eax, dword [ecx + 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x1c], edx
mov dword [ecx + 0x20], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [edx + 0x80], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [edx + 0x68], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [edx + 0x6c], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x70], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x1c]
mov word [edx + 0x78], cx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x1e]
mov byte [edx + 0x7a], cl
mov esp, ebp
pop ebp
ret 4
Function at 0x50a1e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6602e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x705e7c]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0x3f8]
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [0x70df68]
call fcn.00522e90
test eax, eax
je 0x50a2fb
mov edx, dword [edi + 0x3fc]
mov ecx, dword [esp + 0xc]
push edx
call fcn.00523af0
mov esi, dword [eax + 0x2c]
sub esi, dword [eax + 0x28]
lea ecx, [eax + 0x1c]
mov eax, 0x88888889
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x50a2fb
push 0
call fcn.00509b30
add eax, 4
cmp dword [eax + 0x18], 0x10
jb 0x50a278
mov edx, dword [eax + 4]
jmp 0x50a27b
lea edx, [eax + 4]
mov eax, edx
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x50a295
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00417c40
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x3c], 0
call fcn.004f7c20
mov eax, dword [esp + 0x18]
add esp, 4
cmp dword [esp + 0x28], 0x10
jae 0x50a2cd
lea eax, [esp + 0x14]
fld dword [esp + 0x48]
mov edx, dword [esp + 0x40]
push ecx
fstp dword [esp]
push edx
push eax
mov eax, dword [esp + 0x50]
push eax
mov ecx, edi
call fcn.005afbbf
cmp dword [esp + 0x28], 0x10
jb 0x50a2fb
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00611358
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.006117ae
add esp, 0x30
ret 0xc