joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb220
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edx, 0x400000
mov ecx, dword [ebp + 0xc]
cmp eax, edx
push esi
mov esi, dword [ebp + 8]
cmova eax, edx
push edi
mov edi, dword [ebp + 0x14]
lea edx, [ebp - 8]
push 0
push edx
push eax
push ecx
push dword [esi + 0x14]
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne cl
test edi, edi
je 0x4bb26e
mov eax, dword [ebp - 8]
mov dword [edi], eax
test cl, cl
je 0x4bb286
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x4bb2ad
mov edx, dword [ecx]
push eax
push dword [esi + 0x20]
call dword [edx]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 0x10
test eax, eax
jne 0x4bb2c8
pop edi
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 0x10
jle 0x4bb2d2
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006b3266
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4bb3d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push ebx
push edi
mov edi, dword [ebp + 0xc]
push ecx
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4bb443
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4bb443
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4bb427
pop edi
mov eax, 0x80004005
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 8
jle 0x4bb454
movzx eax, ax
pop edi
or eax, 0x80070000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 8]
xor eax, eax
add eax, ebx
mov dword [edi], eax
adc ecx, 0
xor eax, eax
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.006b3266
mov esp, ebp
pop ebp
ret 8
Function at 0x4c14b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, ecx
ret
Function at 0x4c1c50
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4c1c7a
test al, 0x10
jne 0x4c1c7a
test al, 1
je 0x4c1c7a
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x4c1c7a
xor al, al
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
pop esi
setne al
ret

Function at 0x4c24d0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6fd1e8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x7e6410]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x7e6410]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00424710
push dword [ebp + 0xc]
lea eax, [esp + 0x2c]
push dword [ebp + 8]
push eax
call fcn.004c23f0
add esp, 0x24
mov dword [esp + 0x38], 0
cmp dword [eax + 0x14], 0x10
jb 0x4c254d
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, esi
lea eax, [esp + 0xc]
push eax
call fcn.006b643e
cmp dword [esp + 0x24], 0x10
mov dword [esi], 0x751a98
jb 0x4c2576
push dword [esp + 0x10]
call fcn.006b31f8
add esp, 4
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi], 0x751af4
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c3840
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6fd34c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
mov eax, dword [ebx + 4]
push 0x10
mov dword [ebp - 0x28], vtable.TagLib::ByteVector.0
mov edi, dword [eax + 0xc]
call fcn.006b6815
add esp, 4
test eax, eax
jne 0x4c38a0
mov byte [ebp - 0xd], al
lea eax, [ebp - 0xd]
push 0x7da8d8
push eax
call fcn.006b4394
mov dword [ebp - 0x20], eax
push 0
push edi
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.004c2870
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 2
mov ebx, dword [ebx + 4]
cmp dword [ebx + 0xc], 0
jbe 0x4c38d1
mov eax, dword [ebx + 4]
mov ebx, dword [ebx + 8]
add ebx, dword [eax]
jmp 0x4c38d3
xor ebx, ebx
lea ecx, [ebp - 0x28]
call fcn.004c3bf0
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0xc], 0
jbe 0x4c38ee
mov eax, dword [ecx + 4]
mov esi, dword [ecx + 8]
add esi, dword [eax]
jmp 0x4c38f0
xor esi, esi
cmp edi, 4
jb 0x4c3999
lea ecx, [ebx + 3]
lea esp, [esp]
movzx eax, byte [ecx - 3]
mov dl, byte [eax + 0x78bf40]
cmp dl, 0x80
je 0x4c3999
movzx eax, byte [ecx - 2]
mov al, byte [eax + 0x78bf40]
cmp al, 0x80
je 0x4c3999
shr al, 4
and al, 3
shl dl, 2
or al, dl
mov byte [esi], al
inc esi
mov al, byte [ecx - 1]
cmp al, 0x3d
je 0x4c3996
movzx eax, al
mov dl, byte [eax + 0x78bf40]
cmp dl, 0x80
je 0x4c3999
movzx eax, byte [ecx - 2]
shr dl, 2
and dl, 0xf
movzx eax, byte [eax + 0x78bf40]
shl al, 4
or al, dl
mov byte [esi], al
inc esi
mov al, byte [ecx]
cmp al, 0x3d
je 0x4c3996
movzx eax, al
mov dl, byte [eax + 0x78bf40]
cmp dl, 0x80
je 0x4c3999
movzx eax, byte [ecx - 1]
and dl, 0x3f
sub edi, 4
add ecx, 4
mov al, byte [eax + 0x78bf40]
shl al, 6
or al, dl
mov byte [esi], al
inc esi
cmp edi, 4
jae 0x4c3900
jmp 0x4c3999
sub edi, 4
test edi, edi
jne 0x4c3a09
lea ecx, [ebp - 0x28]
call fcn.004c3bf0
mov edi, dword [ebp - 0x24]
mov edx, dword [edi + 0xc]
test edx, edx
je 0x4c39b9
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
add ecx, dword [eax]
jmp 0x4c39bb
xor ecx, ecx
sub esi, ecx
mov byte [ebp - 0x14], 0
cmp esi, edx
je 0x4c39f4
lea ecx, [ebp - 0x28]
call fcn.004c3bf0
mov edi, dword [ebp - 0x24]
mov eax, dword [edi + 8]
add eax, dword [edi + 0xc]
mov ecx, dword [edi + 4]
push eax
call fcn.004c3c70
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edi + 8]
add eax, esi
push eax
call fcn.004c3cc0
mov dword [edi + 0xc], esi
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push eax
call fcn.004c2c50
push ecx
mov byte [ebp - 4], 0
mov ecx, edi
jmp 0x4c3a19
mov ecx, dword [ebp - 0x18]
call fcn.004c2b20
mov byte [ebp - 4], 0
push ecx
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], 1
call fcn.004c2ee0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c3a40
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6fd378
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
mov dword [ebp - 0x14], 0
mov edi, dword [eax + 0xc]
test edi, edi
je 0x4c3bce
lea ecx, [edi - 1]
mov eax, 0xaaaaaaab
mul ecx
push 0
shr edx, 1
lea ecx, [ebp - 0x1c]
lea eax, [edx*4 + 4]
push eax
call fcn.004c2bd0
mov dword [ebp - 4], 0
mov esi, dword [esi + 4]
cmp dword [esi + 0xc], 0
jbe 0x4c3ab7
mov eax, dword [esi + 4]
mov esi, dword [esi + 8]
add esi, dword [eax]
jmp 0x4c3ab9
xor esi, esi
lea ecx, [ebp - 0x1c]
call fcn.004c3bf0
mov ebx, dword [ebp - 0x18]
cmp dword [ebx + 0xc], 0
jbe 0x4c3ad4
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 8]
add ecx, dword [eax]
jmp 0x4c3ad6
xor ecx, ecx
cmp edi, 3
jb 0x4c3b4e
mov eax, 0xaaaaaaab
mul edi
mov ebx, edx
shr ebx, 1
movzx eax, byte [esi]
sub edi, 3
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movsx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movsx edx, byte [esi + 1]
movzx eax, byte [esi + 2]
and edx, 0xf
shr eax, 6
shl edx, 2
or edx, eax
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
movsx eax, byte [esi + 2]
add esi, 3
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], al
add ecx, 4
dec ebx
jne 0x4c3ae6
mov ebx, dword [ebp - 0x18]
test edi, edi
je 0x4c3bb1
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
cmp edi, 1
jbe 0x4c3b95
movsx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movsx eax, byte [esi + 1]
and eax, 0xf
movzx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
jmp 0x4c3bab
movsx eax, byte [esi]
and eax, 3
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
add ecx, 3
mov byte [ecx], 0x3d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.004c2c50
push ecx
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.004c2ee0
jmp 0x4c3bd6
mov ecx, dword [ebp + 8]
call fcn.004c2b20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c9680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6fdc10
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
push 0x78d5f4
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 0
call fcn.004c2e30
mov dword [esp + 0x30], 0
mov esi, dword [edi + 8]
lea ecx, [esi + 0x1c]
call fcn.004cee70
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
add ecx, 4
call fcn.004ce1d0
mov eax, dword [eax + 4]
cmp dword [eax + 0xc], 0
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x18]
setne bl
mov dword [esp + 0x14], vtable.TagLib::ByteVector.0
test ecx, ecx
je 0x4c970f
push ecx
call fcn.004c2ee0
lea ecx, [esp + 0x14]
test bl, bl
je 0x4c9796
push 0x78d5f4
call fcn.004c2e30
mov dword [esp + 0x30], 1
mov esi, dword [edi + 8]
lea ecx, [esi + 0x1c]
call fcn.004cee70
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
add ecx, 4
call fcn.004ce1d0
mov esi, eax
mov ecx, esi
call fcn.004cef00
mov eax, dword [esi + 4]
mov esi, dword [ebp + 8]
push esi
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], vtable.TagLib::ByteVector.0
test ecx, ecx
je 0x4c977f
push ecx
call fcn.004c2ee0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x78d604
call fcn.004c2e30
mov dword [esp + 0x30], 2
mov esi, dword [edi + 8]
lea ecx, [esi + 0x1c]
call fcn.004cee70
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
add ecx, 4
call fcn.004ce1d0
mov eax, dword [eax + 4]
cmp dword [eax + 0xc], 0
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x18]
setne bl
mov dword [esp + 0x14], vtable.TagLib::ByteVector.0
test ecx, ecx
je 0x4c97eb
push ecx
call fcn.004c2ee0
test bl, bl
je 0x4c9856
push 0x78d604
lea ecx, [esp + 0x20]
call fcn.004c2e30
mov dword [esp + 0x30], 3
mov esi, dword [edi + 8]
lea ecx, [esi + 0x1c]
call fcn.004cee70
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x1c]
push eax
add ecx, 4
call fcn.004ce1d0
mov esi, eax
mov ecx, esi
call fcn.004cef00
mov eax, dword [esi + 4]
mov esi, dword [ebp + 8]
push esi
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x1c], vtable.TagLib::ByteVector.0
jmp 0x4c9775
mov ecx, dword [ebp + 8]
call fcn.004c50e0
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c9880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6fdc10
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
push 0x78d5fc
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 0
call fcn.004c2e30
mov dword [esp + 0x30], 0
mov esi, dword [edi + 8]
lea ecx, [esi + 0x1c]
call fcn.004cee70
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
add ecx, 4
call fcn.004ce1d0
mov eax, dword [eax + 4]
cmp dword [eax + 0xc], 0
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x18]
setne bl
mov dword [esp + 0x14], vtable.TagLib::ByteVector.0
test ecx, ecx
je 0x4c990f
push ecx
call fcn.004c2ee0
lea ecx, [esp + 0x14]
test bl, bl
je 0x4c9996
push 0x78d5fc
call fcn.004c2e30
mov dword [esp + 0x30], 1
mov esi, dword [edi + 8]
lea ecx, [esi + 0x1c]
call fcn.004cee70
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
add ecx, 4
call fcn.004ce1d0
mov esi, eax
mov ecx, esi
call fcn.004cef00
mov eax, dword [esi + 4]
mov esi, dword [ebp + 8]
push esi
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], vtable.TagLib::ByteVector.0
test ecx, ecx
je 0x4c997f
push ecx
call fcn.004c2ee0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x78d610
call fcn.004c2e30
mov dword [esp + 0x30], 2
mov esi, dword [edi + 8]
lea ecx, [esi + 0x1c]
call fcn.004cee70
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
add ecx, 4
call fcn.004ce1d0
mov eax, dword [eax + 4]
cmp dword [eax + 0xc], 0
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x18]
setne bl
mov dword [esp + 0x14], vtable.TagLib::ByteVector.0
test ecx, ecx
je 0x4c99eb
push ecx
call fcn.004c2ee0
test bl, bl
je 0x4c9a56
push 0x78d610
lea ecx, [esp + 0x20]
call fcn.004c2e30
mov dword [esp + 0x30], 3
mov esi, dword [edi + 8]
lea ecx, [esi + 0x1c]
call fcn.004cee70
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x1c]
push eax
add ecx, 4
call fcn.004ce1d0
mov esi, eax
mov ecx, esi
call fcn.004cef00
mov eax, dword [esi + 4]
mov esi, dword [ebp + 8]
push esi
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x1c], vtable.TagLib::ByteVector.0
jmp 0x4c9975
mov ecx, dword [ebp + 8]
call fcn.004c50e0
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c9a80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6fdc10
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
push 0x78d608
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 0
call fcn.004c2e30
mov dword [esp + 0x30], 0
mov esi, dword [edi + 8]
lea ecx, [esi + 0x1c]
call fcn.004cee70
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
add ecx, 4
call fcn.004ce1d0
mov eax, dword [eax + 4]
cmp dword [eax + 0xc], 0
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x18]
setne bl
mov dword [esp + 0x14], vtable.TagLib::ByteVector.0
test ecx, ecx
je 0x4c9b0f
push ecx
call fcn.004c2ee0
lea ecx, [esp + 0x14]
test bl, bl
je 0x4c9b96
push 0x78d608
call fcn.004c2e30
mov dword [esp + 0x30], 1
mov esi, dword [edi + 8]
lea ecx, [esi + 0x1c]
call fcn.004cee70
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
add ecx, 4
call fcn.004ce1d0
mov esi, eax
mov ecx, esi
call fcn.004cef00
mov eax, dword [esi + 4]
mov esi, dword [ebp + 8]
push esi
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], vtable.TagLib::ByteVector.0
test ecx, ecx
je 0x4c9b7f
push ecx
call fcn.004c2ee0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x78d61c
call fcn.004c2e30
mov dword [esp + 0x30], 2
mov esi, dword [edi + 8]
lea ecx, [esi + 0x1c]
call fcn.004cee70
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
add ecx, 4
call fcn.004ce1d0
mov eax, dword [eax + 4]
cmp dword [eax + 0xc], 0
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x18]
setne bl
mov dword [esp + 0x14], vtable.TagLib::ByteVector.0
test ecx, ecx
je 0x4c9beb
push ecx
call fcn.004c2ee0
test bl, bl
je 0x4c9c56
push 0x78d61c
lea ecx, [esp + 0x20]
call fcn.004c2e30
mov dword [esp + 0x30], 3
mov esi, dword [edi + 8]
lea ecx, [esi + 0x1c]
call fcn.004cee70
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x1c]
push eax
add ecx, 4
call fcn.004ce1d0
mov esi, eax
mov ecx, esi
call fcn.004cef00
mov eax, dword [esi + 4]
mov esi, dword [ebp + 8]
push esi
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x1c], vtable.TagLib::ByteVector.0
jmp 0x4c9b75
mov ecx, dword [ebp + 8]
call fcn.004c50e0
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4dedb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6fff7e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push 4
mov dword [edi], vtable.TagLib::RefCounter.0
call fcn.006b6815
add esp, 4
test eax, eax
jne 0x4dee01
mov byte [ebp - 0xd], al
lea eax, [ebp - 0xd]
push 0x7da8d8
push eax
call fcn.006b4394
mov dword [eax], 1
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
lea ecx, [edi + 0x18]
mov dword [edi], vtable.TagLib::MP4::Item::ItemPrivate.0
mov byte [edi + 8], 1
mov dword [edi + 0xc], 0xff
call fcn.004c7350
mov dword [edi + 0x18], vtable.TagLib::StringList.0
lea ecx, [edi + 0x24]
mov byte [ebp - 4], 1
call fcn.00513d10
mov dword [edi + 0x24], vtable.TagLib::ByteVectorList.0
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 2
call fcn.004df430
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e0740
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x700148
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [esp + 0x14]
push ecx
push 0xffffffffffffffff
push edi
push eax
call fcn.004e0250
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x18]
cmp dword [eax + 0xc], 0
je 0x4e082d
mov eax, dword [eax + 8]
xor edx, edx
push 1
mov ecx, dword [eax]
lea ecx, [ecx + 8]
call fcn.004c4680
add esp, 4
lea ecx, [esp + 0x10]
push edx
push eax
call fcn.004defe0
push 0
lea eax, [edi + 8]
mov byte [esp + 0x3c], 1
push eax
lea ecx, [esp + 0x28]
call fcn.004c5710
lea eax, [esp + 0x10]
mov byte [esp + 0x38], 2
push eax
lea eax, [esp + 0x24]
mov ecx, esi
push eax
call fcn.004e8b30
mov byte [esp + 0x38], 1
mov edx, dword [esp + 0x24]
mov dword [esp + 0x20], vtable.TagLib::String.0
mov eax, dword [edx + 4]
mov ecx, dword [eax]
mov eax, dword [edx + 4]
dec ecx
mov dword [eax], ecx
jne 0x4e0809
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4e0809
mov eax, dword [ecx]
push 1
call dword [eax]
mov byte [esp + 0x38], 0
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 4]
mov ecx, dword [eax]
mov eax, dword [edx + 4]
dec ecx
mov dword [eax], ecx
jne 0x4e0829
mov ecx, dword [esp + 0x10]
push 1
mov eax, dword [ecx]
call dword [eax]
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x18], vtable.TagLib::List_class_TagLib::ByteVector_.0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4e0864
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4e0864
lea ecx, [edi + 8]
call fcn.004c7430
push dword [edi + 8]
call fcn.006b31f8
add esp, 4
push edi
call fcn.006b31f8
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4