joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498910
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3085
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x6360e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push edx
push eax
call fcn.00498d70
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x49899a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x498ada
cmp dword [ebx + 8], 0x15555555
je 0x498af0
lea eax, [ebx + 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0xc
mov dword [ebp - 0x28], 0
call fcn.00577033
mov ecx, dword [ebp - 0x1c]
mov esi, eax
add esp, 4
mov dword [ebp - 0x28], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x605690]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x605690]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x498a8d
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.0059ef80
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.005a0870
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x498a6f
cmp eax, 0x200
jae 0x498a6d
shl eax, 3
cmp eax, ecx
jae 0x498a6f
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00498b20
push dword [ebp - 0x20]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00498d70
mov edx, dword [eax]
jmp 0x498a90
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x2c]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x20]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x498abb
mov dword [ecx + eax*8], esi
jmp 0x498acd
cmp ebx, edx
jne 0x498ac4
mov dword [ecx + eax*8], esi
jmp 0x498ad1
mov edx, dword [ebp - 0x1c]
cmp dword [ecx + eax*8 + 4], edx
jne 0x498ad1
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x24]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00562ccc
int3
Function at 0x498b20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, 0x1fffffff
mov esi, 1
push edi
mov edi, ecx
bsr ecx, eax
mov eax, esi
mov dword [ebp - 4], edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x498c6c
lea eax, [ecx - 1]
mov ebx, dword [edi + 4]
or eax, esi
mov dword [ebp - 0xc], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.00498c80
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp ecx, ebx
je 0x498c47
mov eax, ecx
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
movzx edx, byte [eax + 0xb]
imul esi, esi, 0x1000193
xor esi, edx
imul edx, esi, 0x1000193
mov esi, dword [edi + 0x18]
and esi, edx
mov edx, dword [edi + 0xc]
lea ebx, [edx + esi*8]
mov esi, dword [ebx]
mov dword [ebp - 8], ebx
cmp esi, dword [ebp - 0xc]
jne 0x498bd4
mov dword [ebx], eax
mov dword [ebx + 4], eax
jmp 0x498c3c
mov edx, dword [ebx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x498c0b
mov edx, dword [edx]
mov dword [ebp - 0x10], edx
cmp edx, eax
je 0x498c06
mov edi, dword [eax + 4]
mov ebx, dword [ebp - 0x10]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov ebx, dword [ebp - 8]
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
mov dword [ebx + 4], eax
jmp 0x498c39
cmp esi, edx
je 0x498c1c
nop
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x498c50
cmp esi, edx
jne 0x498c10
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov edx, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [edx], eax
mov edi, dword [ebp - 4]
mov eax, ecx
cmp ecx, dword [ebp - 0xc]
jne 0x498b82
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x498c39
push str.invalid_hash_bucket_count
call fcn.00562ccc
int3
Function at 0x49d330
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b34fd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6360e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x5f0e90]
mov dword [ebp - 0x20], ebx
mov edi, dword [eax]
mov eax, ebx
shr eax, 0x18
add edi, 4
mov dword [ebp - 0x18], eax
mov eax, ebx
shr eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, ebx
shr eax, 8
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], edi
call fcn.00562f7f
add esp, 4
test eax, eax
jne 0x49d41c
mov eax, dword [edi + 0x2c]
cmp eax, 0x7fffffff
je 0x49d423
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 4], 0
imul ecx, eax, 0x1000193
mov eax, dword [ebp - 0x10]
movzx eax, al
xor ecx, eax
mov eax, dword [ebp - 0x14]
imul edx, ecx, 0x1000193
lea ecx, [edi + 0x30]
movzx eax, al
xor edx, eax
imul eax, edx, 0x1000193
xor eax, dword [ebp - 0x18]
imul eax, eax, 0x1000193
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00498d70
cmp dword [eax + 4], 0
je 0x49d401
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
push ebx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 4]
push edi
call fcn.00562f90
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
call fcn.00562ac5
dec eax
push 6
mov dword [edi + 0x2c], eax
call fcn.00562ac5
int3

Function at 0x49dc30
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov byte [ebp - 1], dl
call fcn.0049c320
mov esi, eax
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49dcc2
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [ebp - 1], 0
mov eax, 1
mov ecx, 4
cmovne ecx, eax
push ecx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
call esi
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [ebp - 8]
call esi
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a32e0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3270
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
push esi
push edi
mov eax, dword [0x6360e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], vtable.nana::drawerbase::listbox::es_header::column.0
lea edx, [edi + 4]
xorps xmm0, xmm0
lea eax, [edx + 0x10]
movups xmmword [edx], xmm0
mov dword [eax], 0
xor ecx, ecx
mov dword [edx + 0x14], 0
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0xc]
movups xmm0, xmmword [eax]
movups xmmword [edx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edx + 0x10], xmm0
mov word [eax], cx
mov ecx, dword [ebx + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov eax, dword [ebx + 0x14]
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x2c], eax
mov eax, dword [ebx + 8]
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov byte [edi + 0x28], 1
mov dword [edi + 0x30], 0
mov dword [edi + 0x68], eax
test ecx, ecx
jne 0x4a3487
mov ecx, dword [eax + 8]
xor esi, esi
mov eax, dword [ecx]
cmp dword [eax + 0xc], esi
jne 0x4a3442
push 4
call fcn.00577033
add esp, 4
mov dword [ebp - 0x20], 5
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 5
push ecx
mov ecx, eax
call fcn.0046d360
mov ecx, dword [edi + 0x68]
mov esi, eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ecx + 8]
call fcn.0046db30
push eax
mov ecx, esi
call fcn.0046da20
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
test edx, edx
je 0x4a343d
cmp dword [edx + 4], 0
je 0x4a3432
mov ecx, dword [edx + 4]
or eax, 0xffffffff
mov dword [ebp - 0x1c], ecx
lock xadd dword [ecx + 4], eax
jne 0x4a3432
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x1c]
or eax, 0xffffffff
lock xadd dword [ecx + 8], eax
jne 0x4a342f
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
push 8
push edx
call fcn.005772b4
add esp, 8
mov ecx, esi
lea edx, [edi + 4]
mov eax, dword [edi + 0x68]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x7c]
add eax, eax
mov dword [edi + 0x1c], eax
cmp dword [edx + 0x14], 8
jb 0x4a3458
mov edx, dword [edx]
mov eax, dword [ebp - 0x24]
push dword [eax]
lea eax, [ebp - 0x28]
push edx
push eax
call fcn.0046de10
mov eax, dword [eax]
add dword [edi + 0x1c], eax
test esi, esi
je 0x4a3487
mov eax, dword [esi]
test eax, eax
je 0x4a347c
push eax
call fcn.0046fad0
push 4
push esi
call fcn.005772b4
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
Function at 0x4bdfb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b180d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6360e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [ebp - 0xd]
call fcn.004e3530
push dword [ebp + 8]
mov dword [ebp - 4], 0
mov esi, dword [edi + 0x14]
lea ecx, [esi + 4]
call fcn.004d5520
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0x10]
mov dword [ecx], eax
mov dword [esi + 0x14], ecx
mov esi, dword [0x65d354]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esi + 0x54]
cmp dword [ecx + 0x30], eax
jne 0x4be023
add dword [ecx + 0x34], 0xffffffff
jne 0x4be023
mov eax, dword [esi + 0x54]
mov dword [eax + 0x30], 0
push dword [esi + 0x54]
call fcn.00562f90
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4c1510
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x6360e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [eax + 0x14], 8
jb 0x4c1531
mov eax, dword [eax]
push 0x100
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2b8]
test eax, eax
mov ecx, dword [ebp - 4]
mov dword [esi + 4], eax
setne al
xor ecx, ebp
pop esi
call fcn.00577025
mov esp, ebp
pop ebp
ret 4
Function at 0x4d7490
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6466
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0x6360e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
lea eax, [edi + 0x2c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], eax
mov dword [eax], 0
mov dword [eax + 4], 0
lea esi, [eax + 8]
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], esi
push 0x40
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00577033
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea ecx, [edi + 0x50]
push 0
call fcn.004dde30
xorps xmm0, xmm0
movups xmmword [edi + 0xec], xmm0
mov dword [edi + 0xfc], 0
mov dword [edi + 0x100], 0xf
mov byte [edi + 0xec], 0
lea eax, [edi + 0x108]
mov byte [ebp - 4], 4
lea ecx, [eax + 0xc]
mov dword [ebp - 0x1c], eax
call fcn.004e5880
mov byte [ebp - 4], 5
push 0x74
mov dword [edi], 0
mov dword [edi + 4], 0
mov byte [edi + 0x28], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
call fcn.00577033
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 6
lea esi, [edi + 0xc]
push 0x68
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
push 0
push esi
mov dword [edi + 4], 1
mov dword [edi + 8], 1
mov dword [edi], vtable.std::_Ref_count_obj2_class_nana::scroll_1__.0
call fcn.00579030
add esp, 0xc
mov ecx, esi
call fcn.004df890
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x2c], esi
mov esi, eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x30], edi
mov edi, eax
test edi, edi
je 0x4d762d
or eax, 0xffffffff
lock xadd dword [edi + 4], eax
jne 0x4d762d
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
jne 0x4d762d
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov byte [esi + 0x48], 1
mov eax, esi
mov dword [esi + 0xd8], 0
mov dword [esi + 0xdc], 5
mov dword [esi + 0xe0], 0
mov dword [esi + 0xe4], 0
mov dword [esi + 0xe8], 0
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x10c], 0
mov dword [esi + 0x110], 0
mov byte [esi + 0x120], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4defa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6a05
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x6360e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
push 0x40
mov dword [edi + 4], 0
call fcn.00577033
mov esi, eax
add esp, 4
mov dword [edi + 4], esi
mov eax, dword [ebp + 0x14]
xorps xmm0, xmm0
mov dword [ebp - 4], 1
mov ecx, dword [eax]
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
jb 0x4df030
mov ecx, dword [ecx]
mov dword [ebp - 0x10], ecx
cmp eax, 0x7fffffff
ja 0x4df147
mov dword [esi + 0x24], 0xf
cmp eax, 0x10
jae 0x4df056
mov dword [esi + 0x20], eax
movups xmm0, xmmword [ecx]
movups xmmword [esi + 0x10], xmm0
jmp 0x4df0e1
mov edi, eax
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x4df06a
mov edi, SysReAllocString
jmp 0x4df074
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
xor ecx, ecx
mov eax, edi
add eax, 1
setb cl
neg ecx
or ecx, eax
cmp ecx, 0x1000
jb 0x4df0b1
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x4df14c
push eax
call fcn.00577033
add esp, 4
test eax, eax
je 0x4df151
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
jmp 0x4df0c4
test ecx, ecx
je 0x4df0c2
push ecx
call fcn.00577033
add esp, 4
mov ecx, eax
jmp 0x4df0c4
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x20], eax
inc eax
push eax
push dword [ebp - 0x10]
mov dword [esi + 0x10], ecx
push ecx
mov dword [esi + 0x24], edi
call fcn.00578ab0
mov edi, dword [ebp - 0x18]
add esp, 0xc
mov edx, dword [ebp + 0xc]
xorps xmm0, xmm0
movups xmmword [esi + 0x28], xmm0
mov eax, edi
movq qword [esi + 0x38], xmm0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ecx], edx
mov ecx, dword [edi + 4]
mov dword [ecx + 4], edx
mov ecx, dword [edi + 4]
mov dword [ecx + 8], edx
mov ecx, dword [edi + 4]
mov byte [ecx + 0xc], 0
mov ecx, dword [edi + 4]
mov byte [ecx + 0xd], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
call fcn.004015dd
call fcn.00401539
call fcn.0057c388
int3
Function at 0x4e6470
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b709a
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x6360e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x40], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 1
call fcn.004e5880
xorps xmm0, xmm0
movups xmmword [esi + 0x20], xmm0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0xf
mov byte [esi + 0x20], 0
movups xmmword [esi + 0x38], xmm0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0xf
mov byte [esi + 0x38], 0
mov byte [ebp - 4], 3
mov edi, dword [esi + 0x14]
push 0x38
mov dword [ebp - 0x3c], edi
call fcn.00577033
mov ecx, eax
mov dword [ebp - 0x38], 0x6022f8
lea eax, [ebp - 0x38]
mov dword [ebp - 0x44], ecx
add esp, 4
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 4
mov dword [ecx + 4], edi
lea edi, [ecx + 0x10]
mov word [ecx + 8], 0
mov dword [ecx], vtable.nana::basic_event_struct_nana::arg_elapse_::docker.0
mov dword [edi + 0x24], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x40], 1
test ecx, ecx
je 0x4e6594
cmp ecx, eax
jne 0x4e658a
mov eax, dword [ecx]
push edi
mov eax, dword [eax + 4]
call eax
mov dword [edi + 0x24], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4e6594
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x4e658d
mov dword [edi + 0x24], ecx
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x3c]
push 0
push dword [ebp - 0x44]
call fcn.00498700
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4e65b9
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov eax, dword [esi + 0x1c]
cmp dword [eax], 0x190
je 0x4e65e6
mov dword [eax], 0x190
mov ecx, dword [esi + 0x1c]
mov edx, dword [ecx + 4]
test edx, edx
je 0x4e65e6
push 0x4e57d0
push dword [ecx]
push dword [edx + 4]
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00577025
mov esp, ebp
pop ebp
ret
Function at 0x4ecad0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b771d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6360e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x10]
lea ebx, [esi + 0x10]
test ecx, ecx
je 0x4ecc24
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x4ecb14
mov eax, dword [esi]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004c44d0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x4ecb29
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x44], eax
cmp ecx, 8
jb 0x4ecb7d
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4ecb70
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ecc3f
push ecx
push edx
call fcn.005772b4
mov eax, dword [ebp - 0x44]
add esp, 8
cmp eax, 0x20
jae 0x4ecc24
lea ecx, [ebp - 0x44]
call fcn.004fefc0
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 0x10
jb 0x4ecb9d
mov esi, dword [esi]
push dword [ebx]
lea ecx, [ebp - 0x40]
push esi
call fcn.004c44d0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x4ecbb3
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x4ecbfd
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4ecbf3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ecc44
push ecx
push edx
call fcn.005772b4
add esp, 8
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x44]
test esi, esi
je 0x4ecc24
push 0x60279c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4ecc1d
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00577025
mov esp, ebp
pop ebp
ret
call fcn.0057c388
call fcn.0057c388
int3