joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418010
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x4c3049]
mov dl, byte [0x4c3044]
and al, dl
mov edx, dword [0x4c3038]
or al, 0x29
sub esp, 0xc
mov byte [0x4c3044], al
mov eax, dword [0x4c303c]
mov ecx, eax
push esi
shl ecx, 4
and edx, ecx
xor ecx, ecx
mov cl, byte [0x4c3045]
mov dword [0x4c3038], edx
mov edx, dword [0x4c3034]
push 0x4c7d28
and edx, 8
xor esi, esi
imul edx, ecx
or eax, edx
mov dword [0x4c303c], eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea edx, [esp + 4]
push edx
push 0x20019
push esi
push str.CLSIDEC529B00_1A1F_11D1_BAD9_00609744111AInprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x418090
xor eax, eax
pop esi
add esp, 0xc
ret 4
mov al, byte [0x4c3049]
mov cl, byte [0x4c3048]
xor cl, al
mov eax, dword [esp + 0x14]
mov byte [0x4c3048], cl
mov cl, byte [0x4c3043]
or cl, 8
lea edx, [esp + 0xc]
shr cl, 3
and ecx, 0xff
push edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 8]
fild dword [esp + 0xc]
push eax
push 0
push 0
push str.ThreadingModel
fdivr qword [0x4c69c0]
push ecx
mov dword [esp + 0x24], 0x104
fadd qword [0x4c3050]
fstp qword [0x4c69b0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4180fe
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi

Function at 0x42f550
Capabilities:
Encode data using xor

Disassembly:
add bl, ch
pop ds
push 0x546b38
lea ecx, [ebp - 0x10]
call fcn.004301bd
push esi
lea edx, [ebp - 0x10]
push 0x546b58
push edx
call fcn.0043086d
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push 0x546b78
push ecx
call fcn.0043005d
add esp, 0xc
mov byte [ebp - 4], 1
mov ecx, dword [eax]
mov esi, dword [ebp - 0x10]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x42f57d
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x42f50d
int3
push ss
pop eax
xor byte [edi - 0x2b52ac28], bl
pop ebx
vmwrite edx, dword [esi + 0x3a]
jp 0x42f551
cmp ecx, edx
mov gs, word [eax]
xchg edi, eax
popal
and ecx, ebp
jge 0x42f4ee
push ss
push ds
ret 0x8a5f
jl 0x42f569
cmp byte [ebx - 0x4decec18], dh
sar esi, cl
or byte [eax], 0xbc
imul esp, dword [ecx], 0xffffffb2
jnp 0x42f606
mov bh, 0x38
fist word [edi + 0x7d7ddf79]
sbb al, 0x18
test dword [ebp + 0x3b3a4766], 0xd4dfdac8
lea esp, [esi + 0x47]
cmp bh, byte [ebx]
enter 0xffffffffffffdfda, 0xffffffffffffffd4
dec dword [ecx]
inc edx
ja 0x42f67e
test eax, 0x3bf285dd
into
invalid
or eax, 0x5743bcc4
pop esi
cmp al, 0xa0
mov ah, 0x8e
or dword [ebx + 0x72], ebp
dec ebx
and bh, bl
xor edi, dword [ebx]
ret
Function at 0x441df5
Capabilities:
Encode data using xor

Disassembly:
invalid
out 0x5e, al
inc edi
movsd dword es:[edi], dword [esi]
inc esi
clc
test al, 0x72
dec esp
jle 0x441de8
dec esp
push 0x8fa4b81d
ja 0x441e2b
adc dh, byte [esi + 0x5d6826b3]
invalid
sub eax, dword [ecx + 0x44]
jno 0x441df9
or al, dh
and esp, dword [esi - 0x1a]
dec esp
xchg edx, eax
xchg edi, eax
dec edx
je 0x441da9
push edx
ja 0x441d6e
cmp bl, dl
imul edx, dword [edi - 0x40066ed], 0x1207b6bd
pop es
fcom dword [eax + edi*4 - 0x3fbba3c8]
sal byte [edi], 0x12
jg 0x441dcf
invalid
sal byte [edi], 0x12
jg 0x441dcf
aad 0x3d
jmp 0x4f9e35ff
cmp eax, 0x5a17ffe9
dec edi
sal byte [edi + 0x2d], 1
fisub word [eax]
invalid
xchg esi, eax
or byte [ebp + 0x6c7b4919], dl
push edi
sub al, 0x98
inc ecx
cdq
mov bh, 0x5e
cmp eax, 0xf575c343
pop edi
scasd eax, dword es:[edi]
cmp byte [0xda36a7c8], bl
push edx
popal
sbb ch, byte [ebx - 0x79]
enter 0x594e, 0x4d
inc esi
sbb esi, edx
rcr dword [esi], 0x57
movsb byte es:[edi], byte [esi]
imul esi, dword [edi], 0xe9134f0b
cmp al, 0x84
cmp dl, ah
jb 0x441e8f
xor al, 0x7d
pop ds
fidivr word [edi - 0x60f86b2a]
mov esp, 0xef385a03
inc ebx
pop ds
sub ch, byte [esi]
cmp byte [ecx], ah
sub eax, 0x1f4142c4
push esi
jne 0x441e17
cmp byte [ebp + 0x5a], bl
inc esp
lds ebx, [ebx]
xlatb
sbb byte [ebp + 0x26f69de0], 0x93
sbb dword [ebp + 0x18], ebp
outsb dx, byte [esi]
xchg edi, eax
insd dword es:[edi], dx
sbb byte [esi - 0x69], ch
inc ebp
invalid
aaa
pop ss
push edi
push 0x66
mov dword [0xeb8973ea], eax
pop edi
mov esi, 0x7534041f
add esi, dword [ebx - 0x6f97ed44]
sahf
je 0x441e79
dec esi
invalid
Function at 0x458e35
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
pop edi
cmc
push edi
ret
or esi, dword [0x60916d14]
inc esi
test eax, 0x292b1622
jecxz 0x458cdd
mov dl, 0x37
mov ebp, 0x181d128
invalid
pushal
js 0x458d0e
cmp dword [esp + edx*8 - 0x5d], ebx
or al, 0x63
push esp
inc ebp
jbe 0x458d66
jnp 0x458d9c
cli
mov bl, byte [ebx]
adc al, 0x53
push ebx
push ebx
int 0xe4
mov al, ah
lodsd eax, dword [esi]
sbb eax, 0x8e4928fb
pop edi
dec ecx
mov ds, word [edi - 0x2d]
arpl word [edx - 0x71743c47], si
call 0x2b81352c
shl dword [ebx - 0x4e], cl
mov ecx, 0xe88e8bc3
mov bh, 0xa7
cmp ebp, dword [ebx]
push edx
jecxz 0x458ddb
loop 0x458d15
and esi, dword [edx]
fstp qword [esi + 0x2d]
into
jb 0x458db1
ret
jp 0x458d69
cmp al, 0x84
pop ebx
jo 0x458ddb
imul edi, esi, 0x45b18bd2
mov cl, 0x45
push edi
dec ecx
pop esp
invalid
invalid
imul ecx, dword [esi + 0x50], 0xf7db6f1a
pcmpgtw mm7, qword [eax]
aaa
jecxz 0x458d48
imul ebp, dword [edx + eax*8 + 0x4e920c7c], 0x68b51a1f
invalid
mov ah, byte [ebx]
sub ebx, dword [eax]
int1
aam 0x36
push edx
jae 0x458da2
sbb al, 0x79
test eax, 0x40f988a
or ah, byte [edi + ebx*4]
jns 0x458d91
mov bl, byte [eax + 0x240a040f]
lahf
mov dword [0x2be76287], eax
invalid
push es
mov ah, 0x48
test eax, 0x52b4ce9
jp 0x458e10
or dword [ebx + ebx], esi
sub al, 0xcb
cwde
jnp 0x458e7c
xchg dword [ecx], esi
jns 0x458df4
sbb dword [ebx - 0x22], 0x74
mov ebx, 0x82b2696
sub ecx, dword es:[eax]
invalid
into
call 0x6e81f345
push 0xba8a795b
inc esi
xor dword [eax], ecx
push dword [ecx - 0x1a]
jg 0x458de6
push ebx
adc eax, 0x74462c5f
jecxz 0x458e1b
invalid
in eax, 0x1c
and eax, 0xe295041c
jl 0x458e74
sbb al, 0x25
sbb al, 4
xchg ebp, eax
loop 0x458eb9
test eax, 0x2f00b915
test eax, 0x2f00b915
aam 0x6e
lodsb al, byte [esi]
inc edi
and al, 0x58
xor byte [eax - 0x4d], bh
outsb dx, byte [esi]
dec esi
xor dword [ebp + 0x6f], ecx
test al, 0x7e
and byte [esi], dh
jle 0x458e51
mov ah, 0xd1
pop ss
dec ebp
pop eax
and eax, 0xbf794c0e
dec esp
jns 0x458e21
out dx, eax
out 0xef, al
jo 0x458df1
push esi
jo 0x458e5f
wait
pop ebp
invalid
pop esi
in al, 0xb4
xlatb
popfd
std
cmp bh, dh
cmp dword [ebp + ebp*2 + 0x79], 0xf1e46fe2
xchg esp, eax
test dword [ecx - 0x1d869284], 0x94f1e46f
sbb esp, dword [ebp + 0x74babaff]
retf
sub ch, byte [ecx - 0xf]
xchg esi, eax
mov bh, 0xe2
pop ds
jg 0x458ecd
jno 0x458ecf
jns 0x458f24
stc
mov byte [0x733e5858], al
sti
sub byte [eax - 0x5d], 0x76
in eax, 0x71
sub dl, byte [esi]
mov dword [0x2a71e576], eax
push ss
mov ah, 3
adc al, 0x80
or byte [ecx + 0x41], bl
mov ebp, 0x1f360fc2
mov bh, 0xa1
dec edx
mov ch, 0x7c
mov bl, 0x55
div byte gs:[ecx + 0xb]
les edx, [esp + edx - 0x5c]
push cs
add ah, byte [ecx + 0x51]
push 4
xchg ecx, eax
lahf
lcall 0x9838, 0x38dcc062
xchg ebx, eax
in eax, 0xa9
sbb al, 0x52
add edi, ebx
pushfd
adc ah, byte [edx - 0x42]
adc eax, 0xfef68f0c
or al, 0x8f
idiv dh
invalid
ja 0x458f0c
push ss
pop es
int 0xa7
lcall 0x4a92, 0xd6d1fc5
cmpsd dword [esi], dword es:[edi]
ljmp 0x42f6
push ebp
jnp 0x458f0b
les edi, [ecx - 0x7f]
mov byte [ecx - 0x5882f371], cl
cmp esp, dword [ebx + 0x23]
iretd
Function at 0x46f62d
Capabilities:
Encode data using xor

Disassembly:
sub dword [ebp + 0x26], esp
in al, dx
fbld tbyte [eax + 0x76]
xlatb
outsd dx, dword [si]
out 0xd8, al
mov ecx, 0x143e562b
mov edx, 0xdbc589a6
push cs
stosd dword es:[edi], eax
cmp eax, 0x15dcf6dc
loopne 0x46f5ce
xor bh, dh
call 0x8f404900
push ds
lea esp, [edx - 0x2b0425c3]
mov eax, 0x3064247a
or al, 0x68
wait
sbb eax, 0x8102c04c
fisttp dword [eax + 0x1fcd61f9]
sub al, 0xb4
invalid

Function at 0x48223c
Capabilities:
Encode data using xor

Disassembly:
out dx, al
aaa
fist dword [eax - 0x4d183acd]
pop edi
imul esp
sti
xor dword [ebx - 2], eax
or eax, 0x3ef90080
sub al, 0x51
mov esp, 0x5f927772
xchg edx, eax
pop edi
js 0x482262
adc dword [esi + 0x18], ebx
popfd
sbb eax, 0xffffffce
fmul st(6)
cmp al, 0x88
and al, 0x70
inc esp
lodsb al, byte [esi]
in eax, dx
and ebx, edi
xor eax, 0x47005088
or dword [esi + 0x62c56a1c], 0xffffffed
rcl dword [ebx + 0x453eb070], cl
push eax
sbb ebp, dword cs:[eax]
dec esi
cmp al, ah
std
jge 0x48225e
stosd dword es:[edi], eax
sbb al, 0x1d
faddp st(0)
and byte [ebx], bh
or eax, 0x96682cdc
adc eax, 0x87008451
sbb dl, byte [eax]
fnstcw word [ebx - 0x33]
jns fcn.00482222
or dword [eax + 0x1d], ecx
in eax, dx
jge 0x48231f
pop ebx
in al, dx
je 0x482255
shr byte [edx + 0x366d0453], 0xa7
invalid

Function at 0x4b10bb
Capabilities:
Encode data using xor

Disassembly:
shl dword [ecx - 0x12], 1
inc ebp
invalid
js 0x4b105b
xchg ebp, eax
adc ebx, edx
invalid

Function at 0x4b5e2d
Capabilities:
Encode data using xor

Disassembly:
dec edi
arpl word [ecx + 0x37], ax
adc al, 0x34
invalid
jmp 0x4b5de5
or byte [edx + esi*4 + 0x12e57848], al
mov cl, 0xed
aam 0x5b
pop ebx
stosb byte es:[edi], al
or eax, 0x46e474e3
jp 0x4b5e37
push 0xffffffffffffff95
adc al, 0xe
jp 0x4b5e83
je 0x4b5e7c
les esp, [edi - 0x7f442adc]
and dl, byte [ebx + 0x17]
mov ebx, 0x17532280
mov ecx, eax
ret
jecxz 0x4b5e15
loop 0x4b5e9f
test ecx, edi
or byte [ecx + 0x7b], al
xchg esp, eax
neg ebx
fcmovbe st(0), st(1)
sub eax, 0x5d8634f5
clc
ja 0x4b5e4c
dec edx
hlt
invalid

Function at 0x4bb67a
Capabilities:
Terminate process

Disassembly:
adc al, 0x30
dec esp
add al, ch
inc ebx
add byte [eax], al
add byte [ecx + 0x59], bl
push 0x4c3020
push 0x4c301c
call fcn.004bb6c6
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x4bb6a2
call fcn.004bb6bd
pop edi
ret
push dword [esp + 8]
mov dword [0x4c7dd0], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4bc17d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33c8
cmp edx, dword [eax]
je 0x4bc19f
add eax, 8
inc ecx
cmp eax, 0x4c3458
jl 0x4bc190
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33c8]
jne 0x4bc2cd
mov eax, dword [0x4c7d8c]
cmp eax, 1
je 0x4bc2a7
test eax, eax
jne 0x4bc1d0
cmp dword [0x4c32f4], 1
je 0x4bc2a7
cmp edx, 0xfc
je 0x4bc2cd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bc207
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bcb60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bcff0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bc24a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bcff0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c170c
push edi
call fcn.004beec0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bcb60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bcb70
lea eax, [ebp - 0xa0]
push 0x4c16ec
push eax
call fcn.004bcb70
push dword [esi + 0x4c33cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bcb70
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bee34
add esp, 0x2c
pop edi
jmp 0x4bc2cd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33cc]
push 0
push eax
push dword [esi]
call fcn.004bcff0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x457020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x522900
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
mov dword [esp + 0x20], 0x530160
mov word [esp + 0x24], 0xffff
mov word [esp + 0x26], 0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x3c], 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x54aa50
call fcn.004f58e0
mov ecx, dword [0x5540a8]
call fcn.004fa1d0
push 6
push 0x54ab78
lea ecx, [esp + 0x14]
call fcn.004f58e0
xor bl, bl
mov byte [esp + 0x3c], 1
mov byte [esp + 0x10], bl
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push 5
call fcn.004f5c80
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.004f5850
mov ecx, dword [0x5540a8]
call fcn.004fa410
inc bl
cmp bl, 8
mov byte [esp + 0x10], bl
jbe 0x457097
mov ecx, dword [0x5540a8]
lea eax, [esp + 0x20]
push eax
call fcn.004fa550
cmp ax, 0xffff
je 0x457276
lea ecx, [esp + 8]
call fcn.004f5840
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 2
call fcn.004f5840
push 7
push 0x54ab70
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 3
mov byte [esp + 0x30], 0x50
mov byte [esp + 0x31], 0x51
mov byte [esp + 0x32], 0x52
mov byte [esp + 0x33], 0x53
mov byte [esp + 0x34], 0x54
mov byte [esp + 0x35], 0x55
mov byte [esp + 0x36], 0x56
mov byte [esp + 0x37], 0x59
mov byte [esp + 0x38], 0x5a
call fcn.004f5de0
movsx ecx, word [esp + 0x24]
mov dl, byte [esp + ecx + 0x28]
lea ecx, [esp + 8]
push edx
push 4
call fcn.004f5c80
lea eax, [esp + 8]
push eax
call fcn.00473820
add esp, 4
push 0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x4c], 4
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x54ab50
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x4c], 3
call fcn.004f91a0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0
call fcn.004f5870
lea ecx, [esp + 0x18]
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x4c], 5
call fcn.004f5850
mov byte [esp + 0x48], 3
call fcn.00473d20
add esp, 0xc
mov bl, al
push 0x4b0
call esi
push 0
push 1
push ecx
test bl, bl
mov ecx, esp
jne 0x457210
mov dword [esp + 0x28], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x4c], 6
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54ab48
jmp 0x457233
mov dword [esp + 0x28], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x4c], 7
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54ab40
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x4c], 3
call fcn.004f91a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 2
call fcn.004f5980
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 1
call fcn.004f5980
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 0
call fcn.004f5980
jmp 0x45705e
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 0
call fcn.004f5980
mov ecx, dword [esp + 0x34]
pop esi
xor ax, ax
mov dword fs:[0], ecx
pop ebx
add esp, 0x38
ret
Function at 0x480cc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x525ad0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebx
push esi
mov esi, ecx
push 0
push 0
push 1
mov ecx, 0x554070
call fcn.004f3520
push 0x7d0
mov ecx, 0x554070
call fcn.004ee4f0
push 0x40140000
push 0
push 0x37
push 0xc8
mov ecx, 0x554070
call fcn.004f0c90
push 3
push 0xc
push 0xc
push 0xc
mov ecx, 0x554070
call fcn.004ee6e0
push 8
push 0
push 0x40c45800
push 0
mov ecx, 0x554070
call fcn.004f03b0
lea ecx, [esp + 0x20]
call fcn.0050a720
lea ecx, [esp + 0x30]
mov dword [esp + 0x80], 0
call fcn.004f70e0
lea ecx, [esp + 0x18]
mov byte [esp + 0x80], 1
call fcn.004f5840
push 5
push 0x54bc40
lea ecx, [esp + 0x18]
mov byte [esp + 0x88], 2
call fcn.004f58e0
push 0
lea ecx, [esp + 0x10]
mov byte [esp + 0x84], 3
call fcn.004f5870
push 8
push 0x54bc34
lea ecx, [esp + 0x10]
mov byte [esp + 0x88], 4
call fcn.004f58e0
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov byte [esp + 0x84], 5
call fcn.004d3100
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004d3100
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.004f5850
lea ecx, [esp + 0x1c]
call fcn.004f5b70
lea eax, [esp + 0x18]
lea ecx, [esp + 0x20]
push eax
mov word [esp + 0x20], 1
call fcn.004f6590
xor bl, bl
mov ecx, 0x554070
call fcn.004ed850
push 0x19
push 0x19
push 0x12c
push 3
push 0x554070
call fcn.004f1d40
add esp, 0x14
lea ecx, [esp + 0x20]
lea edx, [esp + 0x54]
push 0
push ecx
push edx
mov ecx, 0x554070
call fcn.004f3fa0
lea ecx, [esp + 0x54]
call fcn.004f71e0
sub esp, 0x24
mov ecx, 0x554070
mov eax, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004ed9a0
lea ecx, [esp + 0x54]
call fcn.004f7290
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ecx
lea ecx, [esp + 0x38]
call fcn.004f7610
lea ecx, [esp + 0x10]
call fcn.004f5b70
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
call fcn.004f5c20
test al, al
jne 0x480ea9
lea ecx, [esp + 0x30]
call fcn.004f76e0
push 0xc8
call fcn.00446990
add esp, 4
inc bl
cmp bl, 3
jb 0x480dfc
jmp 0x480eae
cmp bl, 3
jb 0x480f2c
lea ecx, [esp + 8]
mov byte [esp + 0x80], 4
call fcn.004f5980
lea ecx, [esp + 0xc]
mov byte [esp + 0x80], 3
call fcn.004f5980
lea ecx, [esp + 0x10]
mov byte [esp + 0x80], 2
call fcn.004f5980
lea ecx, [esp + 0x18]
mov byte [esp + 0x80], 1
call fcn.004f5980
lea ecx, [esp + 0x30]
mov byte [esp + 0x80], 0
call fcn.004f71e0
lea ecx, [esp + 0x20]
mov dword [esp + 0x80], 0xffffffff
call fcn.004f61c0
or ax, 0xffff
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x7c
ret
lea ecx, [esp + 8]
mov byte [esp + 0x80], 4
call fcn.004f5980
lea ecx, [esp + 0xc]
mov byte [esp + 0x80], 3
call fcn.004f5980
lea ecx, [esp + 0x10]
mov byte [esp + 0x80], 2
call fcn.004f5980
lea ecx, [esp + 0x18]
mov byte [esp + 0x80], 1
call fcn.004f5980
lea ecx, [esp + 0x30]
mov byte [esp + 0x80], 0
call fcn.004f71e0
lea ecx, [esp + 0x20]
mov dword [esp + 0x80], 0xffffffff
call fcn.004f61c0
mov ecx, dword [esp + 0x78]
pop esi
xor ax, ax
mov dword fs:[0], ecx
pop ebx
add esp, 0x7c
ret
Function at 0x4918d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x527108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push 5
push 0x54c1bc
lea ecx, [esp + 0xc]
call fcn.004f58e0
push 0
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
call fcn.004f5870
push 5
push 0x54c1b4
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.004f58e0
lea eax, [esp + 4]
mov ecx, esi
push eax
mov byte [esp + 0x24], 2
call fcn.004d3100
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004d3100
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0
call fcn.004f5870
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x34], 3
call fcn.004f5850
mov ecx, esi
mov byte [esp + 0x30], 2
call fcn.0049d480
push 5
push 0x548218
lea ecx, [esp + 0xc]
call fcn.004f5de0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0
call fcn.004f5870
lea ecx, [esp + 0x10]
call fcn.004f5b70
push 5
push 0x548210
lea ecx, [esp + 0x10]
call fcn.004f5de0
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.004d3100
lea edx, [esp + 8]
mov ecx, esi
push edx
call fcn.004d3100
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0
call fcn.004f5870
lea eax, [esp + 0x14]
mov byte [esp + 0x28], 4
push eax
push ecx
mov ecx, esp
lea edx, [esp + 0x14]
mov dword [esp + 0x20], esp
push edx
call fcn.004f5850
mov ecx, esi
mov byte [esp + 0x30], 2
call fcn.0049d480
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call fcn.004f5980
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call fcn.004f5980
lea ecx, [esp + 4]
mov dword [esp + 0x20], 0xffffffff
call fcn.004f5980
mov ecx, dword [esp + 0x18]
mov ax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret
Function at 0x4918e8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x527108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push 5
push 0x54c1bc
lea ecx, [esp + 0xc]
call fcn.004f58e0
push 0
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
call fcn.004f5870
push 5
push 0x54c1b4
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.004f58e0
lea eax, [esp + 4]
mov ecx, esi
push eax
mov byte [esp + 0x24], 2
call fcn.004d3100
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004d3100
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0
call fcn.004f5870
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x34], 3
call fcn.004f5850
mov ecx, esi
mov byte [esp + 0x30], 2
call fcn.0049d480
push 5
push 0x548218
lea ecx, [esp + 0xc]
call fcn.004f5de0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0
call fcn.004f5870
lea ecx, [esp + 0x10]
call fcn.004f5b70
push 5
push 0x548210
lea ecx, [esp + 0x10]
call fcn.004f5de0
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.004d3100
lea edx, [esp + 8]
mov ecx, esi
push edx
call fcn.004d3100
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0
call fcn.004f5870
lea eax, [esp + 0x14]
mov byte [esp + 0x28], 4
push eax
push ecx
mov ecx, esp
lea edx, [esp + 0x14]
mov dword [esp + 0x20], esp
push edx
call fcn.004f5850
mov ecx, esi
mov byte [esp + 0x30], 2
call fcn.0049d480
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call fcn.004f5980
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call fcn.004f5980
lea ecx, [esp + 4]
mov dword [esp + 0x20], 0xffffffff
call fcn.004f5980
mov ecx, dword [esp + 0x18]
mov ax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret
Function at 0x49ef80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x527fb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push 9
push 0x54c9c4
lea ecx, [esp + 0x14]
call fcn.004f58e0
push 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
call fcn.004f5870
mov eax, dword [esp + 0x28]
mov ebx, 1
push eax
push 5
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], bl
call fcn.004f5c80
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004d3100
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0
call fcn.004f5870
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x30], 2
call fcn.004f5850
mov ecx, esi
mov byte [esp + 0x2c], bl
call fcn.0049dc80
test al, al
je 0x49f114
lea ecx, [esp + 8]
call fcn.004f5d00
cmp ax, 5
jl 0x49f114
push 5
lea ecx, [esp + 0xc]
call fcn.004f5b60
mov bl, al
lea ecx, [esp + 8]
and ebx, 0xff
call fcn.004f5d00
movsx ecx, ax
sub ecx, 6
cmp ebx, ecx
jge 0x49f06b
push 5
lea ecx, [esp + 0xc]
call fcn.004f5b60
mov byte [esp + 0x28], al
jmp 0x49f07a
lea ecx, [esp + 8]
call fcn.004f5d00
sub al, 6
mov byte [esp + 0x28], al
test al, al
jne 0x49f0b2
lea ecx, [esp + 8]
mov byte [esp + 0x1c], al
call fcn.004f5980
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004f5980
xor ax, ax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x18
ret 8
xor bl, bl
test al, al
jbe 0x49f0db
mov esi, dword [esp + 0x24]
xor dx, dx
lea ecx, [esp + 8]
mov dl, bl
add edx, 6
push edx
call fcn.004f5b60
mov byte [esi], al
mov al, byte [esp + 0x28]
inc bl
inc esi
cmp bl, al
jb 0x49f0bc
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 0
movzx si, al
call fcn.004f5980
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004f5980
mov ax, si
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x18
ret 8
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 0
call fcn.004f5980
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004f5980
mov ecx, dword [esp + 0x14]
pop esi
or ax, 0xffff
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 8