joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4711f0
Capabilities:
Create thread

Disassembly:
cmp byte [esi + 0x77], bl
jg 0x4711b4
lea edi, [esi + 0x78]
mov eax, dword [edi]
cmp word [eax], bx
je 0x471158
push edi
lea ecx, [ebp - 8]
call 0x4b6a18
push str..Visible
lea ecx, [ebp - 8]
call 0x4ae327
push 0x4ab2d4
push dword [ebp - 8]
mov ecx, esi
call 0x4be4d4
lea ecx, [ebp - 8]
call 0x4a836e
mov eax, dword [edi]
cmp word [eax], bx
je 0x47118c
invalid
push edi
lea ecx, [ebp - 8]
call 0x4b6a4c
push str..Visable
lea ecx, [ebp - 8]
call 0x4ae35b
push 0x4ab2d4
push dword [ebp - 8]
mov ecx, esi
call 0x4be508
lea ecx, [ebp - 8]
call 0x4a83a2
cmp byte [esi + 0x75], bl
jne 0x4711b7
test byte [esi + 0x49], 0x10
je 0x4711a9
push 0x57
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esi + 0x18]
call dword [0x4a6834]
jmp 0x4711b4
push 5
push dword [esi + 0x18]
call dword [0x4a6838]
cmp byte [esi + 0x75], bl
jl 0x4711cd
push ebx
push 0x1f4
push 0x270c
push dword [esi + 0x18]
call dword [0x4a6844]
mov eax, 0x20000
test dword [esi + 0x48], eax
je 0x47120a
cmp dword [0x4c10f8], ebx
jne 0x47120a
push 0x4c0bcc
push 0x10000
mov dword [0x4c10fc], esi
push dword [esi + 0x18]
jbe 0x47120a

Function at 0x472c79
Capabilities:
Parse credit card information

Disassembly:
cmp cx, 0x3d
je 0x472c7d
inc eax
inc eax
mov cx, word [eax]
cmp cx, di
jne 0x472c6b
jmp 0x472c86
mov word [eax], di
add eax, 2
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x60]
mov edi, dword [ebp + 0x7c]
push esi
mov dword [ebp + 0x5c], eax
xor bl, bl
call fcn.004815df
cmp word [esi], 0x3a
pop ecx
jne 0x472cb7
cmp word [esi + 2], 0x3a
jne 0x472cb7
mov edi, dword [0x4c0fe0]
inc bl
add esi, 4
mov dword [ebp + 0x5c], 0x4c0fb8
mov eax, dword [ebp + 0x60]
and dword [ebp + 0x18], 0
cmp byte [eax + 0x92], 0
jne 0x472ce0
test byte [eax + 9], 0xf
jne 0x472ce0
mov ecx, dword [ebp + 0x60]
push 1
push 0
lea eax, [ebp + 0x18]
push eax
push esi
call 0x4be8cd
jmp 0x472cf1
mov ecx, dword [ebp + 0x60]
push 1
push 0

Function at 0x472ceb
Capabilities:
Parse credit card information

Disassembly:
push esi
call 0x4bdbe9
mov esi, dword [ebp + 0x18]
lea ecx, [ebp + 0x1c]
call 0x4afe76
Function at 0x472cfc
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [ebp + 0x60]
push 1
push 0
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x4c]
call 0x4be9f6
mov eax, dword [ebp + 0x1c]
mov dword [ebp + 0x68], eax
cmp word [esi], 0x40
inc eax
jne 0x472fb8
push str._DeskTopFresh
push esi
call dword [0x4a64e0]
test eax, eax
jne 0x472f0f
mov esi, dword [ebp + 0x68]
push 9
push esi
push str.clearicon
mov dword [ebp + 0x7c], 0xfff80000
clc
dec dword [ecx + 0x77e87475]
test dword [ebx], eax
add byte [ebx - 0x3f7bf33c], al
je 0x472dbf
mov ax, word [esi + 0x12]
or ax, 0x20
cmp ax, 0x61
jb 0x472d68
cmp ax, 0x7a
jbe 0x472dbf
lea ecx, [ebp + 0x78]
call 0x4afeea
push 0x23
pop ecx
mov esi, str._userprofile_AppDataLocalMicrosoftWindowsExplorer_thumbcache.db
lea edi, [ebp - 0xd0]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x60]
push 1
push 0
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp - 0xd0]
push eax
movsw word es:[edi], word [esi]
call 0x4bdc91
mov ecx, dword [ebp + 0x60]
push 1
push dword [ebp + 0x78]
call fcn.00487150
add dword [ebp + 0x74], 0x12
mov eax, dword [ebp + 0x74]
cmp word [eax], 0
je 0x472db7
add dword [ebp + 0x74], 2
lea ecx, [ebp + 0x78]
call 0x4a9fd5
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x74]
push eax
call 0x4bb744
test byte [ebp + 0x7c], 0x40
mov esi, dword [0x4a6848]
pop ecx
pop ecx
mov ebx, 0xffff
je 0x472dea
xor edi, edi
push edi
push edi
push 0x1a
push ebx
call esi
jmp 0x472dec
xor edi, edi
test byte [ebp + 0x7c], 0x20
je 0x472df9
push edi
push edi
push 0x1a
push ebx
call esi
test byte [ebp + 0x7c], 0x10
push str._TaskIcoMenu
push esi
call dword [0x4a64e0]
test eax, eax
jne 0x472fb8
add byte [eax], al
invalid
push dword [ebp + 0x68]
push 0x4a9cdc
call 0x4ab4e6
add byte [eax + eax*8 + 0x42755959], al
push dword [ebp + 0x68]
Function at 0x472d18
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [ebp + 0x60]
push 1
push 0
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x4c]
call 0x4be9f6
mov eax, dword [ebp + 0x1c]
mov dword [ebp + 0x68], eax
cmp word [esi], 0x40
inc eax
jne 0x472fb8
push str._DeskTopFresh
push esi
call dword [0x4a64e0]
test eax, eax
jne 0x472f0f
mov esi, dword [ebp + 0x68]
push 9
push esi
push str.clearicon
mov dword [ebp + 0x7c], 0xfff80000
clc
dec dword [ecx + 0x77e87475]
test dword [ebx], eax
add byte [ebx - 0x3f7bf33c], al
je 0x472dbf
mov ax, word [esi + 0x12]
or ax, 0x20
cmp ax, 0x61
jb 0x472d68
cmp ax, 0x7a
jbe 0x472dbf
lea ecx, [ebp + 0x78]
call 0x4afeea
push 0x23
pop ecx
mov esi, str._userprofile_AppDataLocalMicrosoftWindowsExplorer_thumbcache.db
lea edi, [ebp - 0xd0]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x60]
push 1
push 0
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp - 0xd0]
push eax
movsw word es:[edi], word [esi]
call 0x4bdc91
mov ecx, dword [ebp + 0x60]
push 1
push dword [ebp + 0x78]
call fcn.00487150
add dword [ebp + 0x74], 0x12
mov eax, dword [ebp + 0x74]
cmp word [eax], 0
je 0x472db7
add dword [ebp + 0x74], 2
lea ecx, [ebp + 0x78]
call 0x4a9fd5
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x74]
push eax
call 0x4bb744
test byte [ebp + 0x7c], 0x40
mov esi, dword [0x4a6848]
pop ecx
pop ecx
mov ebx, 0xffff
je 0x472dea
xor edi, edi
push edi
push edi
push 0x1a
push ebx
call esi
jmp 0x472dec
xor edi, edi
test byte [ebp + 0x7c], 0x20
je 0x472df9
push edi
push edi
push 0x1a
push ebx
call esi
test byte [ebp + 0x7c], 0x10
push str._TaskIcoMenu
push esi
call dword [0x4a64e0]
test eax, eax
jne 0x472fb8
add byte [eax], al
invalid
push dword [ebp + 0x68]
push 0x4a9cdc
call 0x4ab4e6
add byte [eax + eax*8 + 0x42755959], al
push dword [ebp + 0x68]
Function at 0x473036
Capabilities:
Parse credit card information

Disassembly:
and al, 0xe8
xchg ebx, eax
pop eax
add al, 0
xor ecx, ecx
mov cx, word [esi]
xor edx, edx
cmp cx, di
mov eax, esi
mov dword [ebp + 0x74], eax
je 0x47306b
cmp cx, 0x2e
jne 0x473055
mov edx, eax
inc eax
inc eax
mov cx, word [eax]
cmp cx, di
jne 0x47304d
cmp edx, edi
mov dword [ebp + 0x74], eax
je 0x47306b
mov eax, edx
mov dword [ebp + 0x74], eax
cmp word [eax], 0x2e
mov dword [ebp + 0x58], edi
jne 0x47307f
mov word [eax], di
inc eax
inc eax
mov dword [ebp + 0x74], eax
mov dword [ebp + 0x58], eax
lea eax, [ebp + 0x74]
push eax
call 0x4aa2e9
cmp dword [ebp + 0x58], edi
pop ecx
je 0x4730a4
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0x58], eax
lea eax, [ebp + 0x74]
push eax
call fcn.0047760b
mov eax, dword [ebp + 0x74]
pop ecx
mov word [eax], di
mov ebx, dword [ebp + 0x78]
test ebx, ebx
mov byte [ebp + 0x57], 0
mov byte [ebp + 0x74], 0
je 0x47314d
cmp word [ebx], 0
mov ecx, ebx
je 0x47314d
push 0x7e
pop edi
xor edx, edx
mov dx, word [ecx]
mov eax, edx
call 0x4aa2fb
test al, al
jne 0x47314d
cmp dx, 0x2e
je 0x47313c
cmp dx, 0x24
je 0x47313c
cmp dx, 0x25
je 0x47313c
cmp dx, 0x2a
jne 0x4730f4
or byte [ebp + 0x74], 4
jmp 0x473141
cmp dx, di
jne 0x473141
lea eax, [ecx + 2]
cmp word [eax], di
jne 0x473109
or byte [ebp + 0x74], 2
mov ecx, eax
jmp 0x473141
cmp dx, di
jne 0x473141
lea eax, [ecx + 2]
cmp word [eax], 0x2e
jne 0x47311d
or byte [ebp + 0x74], 8
jmp 0x473105
cmp dx, di
jne 0x473141
lea eax, [ecx + 2]
cmp word [eax], 0x2a
jne 0x473131
or byte [ebp + 0x74], 0xa
jmp 0x473105
cmp dx, di
jne 0x473141
or byte [ebp + 0x74], 1
jmp 0x473141
mov al, byte [ecx]
mov byte [ebp + 0x57], al
inc ecx
inc ecx
cmp word [ecx], 0
jne 0x4730c6
and dword [ebp + 8], 0
and dword [ebp + 0xc], 0
cmp byte [ebp + 0x74], 0
je 0x47316d
push dword [ebp + 0x74]
mov ecx, dword [ebp + 0x60]
lea eax, [ebp + 0x1c]
push eax
call 0x4c49d7
mov dword [ebp + 0x68], eax
lea ecx, [ebp + 0x10]
call 0x4b02ef
cmp byte [ebp + 0x57], 0
je 0x473196
cmp byte [ebp + 0x57], 0x2e
je 0x473196
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0x68]
push eax
call 0x4c414c
add esp, 0x10
les edx, [eax]
Function at 0x4750f7
Capabilities:
Get disk information

Disassembly:
pop ecx
mov edx, dword [ebp + 0x70]
mov ax, word [edx]
cmp ax, 0x2a
je 0x474eff
cmp ax, 0x2f
je 0x474eff
cmp ax, 0x2d
jne 0x4751fe
cmp ax, 0x2d
jne 0x474f29
cmp word [edx + 2], ax
jne 0x474f29
xor ecx, ecx
mov cx, word [edx + 4]
mov eax, ecx
call 0x4ac141
test al, al
jne 0x4751ee
cmp cx, bx
je 0x4751ee
push 2
lea eax, [ebp + 0x70]
push eax
push 0x4b1224
call 0x4b3f75
add esp, 0xc
test al, al
je 0x474f4e
mov eax, dword [ebp + 0x58]
and eax, 0xfffffffe
or eax, 6
mov dword [ebp + 0x58], eax
jmp 0x474ee3
mov esi, dword [ebp + 0x70]
push 3
add esi, 2
push esi
push 0x4b1220
call 0x4ad4d8
add esp, 0xc
test al, al
je 0x474f75
add dword [ebp + 0x70], 8
mov dword [ebp + 0x58], 6
jmp 0x474f8d
push 7
push esi
push str.delims:
call 0x4ad4f9
add esp, 0xc
test al, al
je 0x474fa9
add dword [ebp + 0x70], 0x10
or dword [ebp + 0x58], 0xa
lea eax, [ebp + 0x70]
push eax
call 0x4b0600
mov eax, dword [ebp + 0x70]
mov ax, word [eax]
mov word [ebp + 0x3c], ax
jmp 0x4751c8
push 0xffffffffffffffff
lea eax, [ebp + 0x70]
push eax
push 0x4ac1e4
call 0x4b3fb2
add esp, 0xc
test al, al
jne 0x4751e0
push 0xffffffffffffffff
lea eax, [ebp + 0x70]
push eax
push 0x4a7c9c
call 0x4b3fcd
add esp, 0xc
test al, al
jne 0x4751e0
xor esi, esi
inc esi
push esi
lea eax, [ebp + 0x70]
push eax
push 0x4af544
call 0x4b402d
add esp, 0xc
test al, al
jne 0x4751d7
push 2
lea eax, [ebp + 0x70]
push eax
push 0x4b070c
call 0x4b4005
add esp, 0xc
test al, al
jne 0x4751d7
push 3
lea eax, [ebp + 0x70]
inc ebp
jo 0x47506d
push 0x4ab400
call 0x4b4020
add esp, 0xc
test al, al
je 0x475036
mov dword [ebp + 4], esi
jmp 0x474ee3
push 3
lea eax, [ebp + 0x70]
push eax
push 0x4b1214
call 0x4b403f
add esp, 0xc
test al, al
je 0x475055
mov dword [ebp + 0x44], esi
jmp 0x474ee3
push 4
lea eax, [ebp + 0x70]
push eax
push str.qu
call 0x4b405e
add esp, 0xc
test al, al
je 0x475078
mov dword [ebp + 0x44], 2
jmp 0x474ee3
push 4
lea eax, [ebp + 0x70]
push eax
push str.off
call 0x4b4081
add esp, 0xc
test al, al
je 0x475097
mov dword [ebp + 8], esi
jmp 0x474ee3
push 2
lea eax, [ebp + 0x70]
push eax
push 0x4b1200
call 0x4b40a0
add esp, 0xc
test al, al
je 0x4750b6
or edi, 0x10
jmp 0x474ee3
push 3
push dword [ebp + 0x70]
push 0x4b11fc
call 0x4ad63c
add esp, 0xc
test al, al
je 0x4750e6
add dword [ebp + 0x70], 6
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x70]
push eax
or edi, 0x10
call 0x4bda58
pop ecx
jmp 0x474ee2
push 4
lea eax, [ebp + 0x70]
push eax
push str._O:N
call 0x4b40ef
add esp, 0xc
les ecx, [esp + eax*4]
invalid
je 0x475109
mov dword [ebp + 0x54], 0x20
jmp 0x474ee3
push 5
lea eax, [ebp + 0x70]
push eax
push str._O:_N
call 0x4b4112
add esp, 0xc
test al, al
je 0x47512c
mov dword [ebp + 0x54], 0x60
jmp 0x474ee3
push 4
lea eax, [ebp + 0x70]
push eax
push str.cur
call 0x4b4135
add esp, 0xc
test al, al
je 0x47514b
mov dword [ebp + 0x2c], esi
invalid
cwde

Function at 0x4751b4
Capabilities:
Get disk information

Disassembly:
jne 0x4751c9
add dword [ebp + 0x5c], 2
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x5c]
push eax
call 0x4b6e00
pop ecx
Function at 0x47520e
Capabilities:
Get disk information

Disassembly:
imul ecx, dword [edx], 0x404d8d56
call 0x4baaad
push esi
lea ecx, [ebp + 0x4c]
call 0x4baab6
push esi
lea ecx, [ebp + 0x5c]
call 0x4baabf
cmp dword [ebp + 0x44], ebx
mov esi, dword [ebp + 0x70]
je 0x4752dd
cmp dword [ebp + 0x58], 1
jne 0x4752dd
lea ecx, [ebp + 0x54]
call str._nrc:_d
push 2
mov ecx, esi
pop edi
push 1
push 0x2c
lea eax, [ebp + 0x70]
inc ebp
jo 0x475335
lea ecx, [ebp - 8]
dec ebp
clc
call 0x4c34a1
push 2
pop edi
push ebx
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp]
push eax
call 0x4b4fa5
mov eax, dword [ebp + 0x18]
add esp, 0xc
cmp dword [ebp + 0x58], ebx
mov edx, eax
push 0x5c
mov dword [ebp + 0x50], edx
pop esi
jne 0x47536e
xor ecx, ecx
mov cx, word [eax]
jmp 0x475363

Function at 0x47524f
Capabilities:
Get disk information

Disassembly:
mov ax, word [ecx]
cmp ax, 0x22
jne 0x47528a
add dword [ebp + 0x70], edi
push 0x22
lea eax, [ebp + 0x70]
call fcn.00486f5f
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
pop ecx
je 0x47528f
add dword [ebp + 0x70], edi
jmp 0x47528f
cmp ax, 0x2c
je 0x47528f
call 0x4ac4a7
test al, al
jne 0x47528f
add ecx, edi
mov ax, word [ecx]
mov dword [ebp + 0x70], ecx
cmp ax, bx
jne 0x475273
lea eax, [ebp + 0x70]
push eax
call 0x4ac4f9
pop ecx
mov ecx, dword [ebp + 0x70]
mov ax, word [ecx]
cmp ax, bx
je fcn.004752aa
cmp ax, 0x2c
jne fcn.0047524f

Function at 0x4752aa
Capabilities:
Get disk information

Disassembly:
mov eax, dword [ebp + 0x70]
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp + 0x54]
call 0x4b2559
mov ecx, dword [ebp + 0x60]
push 1
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x54]
call 0x4c0fb4
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x54]
dec ebp
push esp
mov dword [ebp], eax
call 0x4ac4f1
add bl, ch
invalid

Function at 0x4752e2
Capabilities:
Get disk information

Disassembly:
inc ebp
jo 0x475335
and al, 0x75
or edi, eax
inc ebp
and byte [ebx], al
add byte [eax], al
add bl, ch
sbb ah, byte [esi + 0x3b]
into

Function at 0x475330
Capabilities:
Get disk information

Disassembly:
mov eax, ecx
call 0x4ac548
test al, al
jne 0x47536e
cmp cx, 0x40
jne 0x475332
mov dword [ebp + 0x20], 1
jmp 0x47535b
cmp cx, 0x24
jne 0x475341
mov dword [ebp + 0x20], 3
jmp 0x47535b
cmp cx, si
jne 0x475352
cmp word [edx + 2], si
je 0x47536a
or dword [ebp + 0x48], 1
jmp 0x47535b
cmp cx, 0x21
jne 0x47536e
or dword [ebp + 0x48], edi
add edx, edi
mov cx, word [edx]
mov dword [ebp + 0x50], edx
cmp cx, bx
jne 0x475318
jmp 0x47536e
mov byte [ebp + 0x67], 1
lea eax, [ebp + 0x50]
push eax
call 0x4ac5d8
mov eax, dword [ebp + 0x58]
Function at 0x4753d4
Capabilities:
Get disk information

Disassembly:
add dword [ebp + 0x70], edi
push 1
push esi
lea eax, [ebp + 0x70]
push eax
lea ecx, [ebp - 8]
call 0x4c359a
push ebx
lea ecx, [ebp + 0x40]
push ecx
push eax
call 0x4b5098
add esp, 0xc
cmp dword [ebp + 0x58], ebx
jne 0x475421
invalid
mov eax, dword [ebp + 0x70]
cmp word [eax], si
jne 0x475421
add dword [ebp + 0x70], edi
push esi
lea eax, [ebp - 0x44]
push eax
push 1
push esi
cmp dword [ebp - 0x44], ebx
jg 0x47542d
mov dword [ebp - 0x44], 0xfffffff8
mov eax, dword [ebp + 0x70]
cmp word [eax], si
je 0x47543d
invalid
xor esi, esi
inc esi
jmp 0x475a0e
add dword [ebp + 0x70], edi
lea eax, [ebp + 0x70]
push eax
call 0x4ac6aa
pop ecx
push 0xffffffffffffffff
push dword [ebp + 0x70]
lea ecx, [ebp + 0x5c]
call 0x4acc2c
lea ecx, [ebp + 0x4c]
call 0x4acc34
lea ecx, [ebp + 0x40]
call 0x4acc3c
lea ecx, [ebp + 0x18]
call 0x4acc44
lea ecx, [ebp - 8]
call 0x4acc4c
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x68
leave
ret 0x10

Function at 0x4753f8
Capabilities:
Get disk information

Disassembly:
sub byte [ebx + 0x39667045], cl
xor byte [ebp + 0x20], dh

Function at 0x47540c
Capabilities:
Get disk information

Disassembly:
lea eax, [ebp + 0x70]
push eax
lea ecx, [ebp - 8]
call 0x4c35cc
push eax
call 0x4b5312
add esp, 0xc
invalid

Function at 0x475420
Capabilities:
Get disk information

Disassembly:
lea eax, [ebp + 0x70]
push eax
lea ecx, [ebp - 8]
call 0x4c35cc
push eax
call 0x4b5312
add esp, 0xc
invalid
Function at 0x4757f7
Capabilities:
Get disk information

Disassembly:
add dword [eax], eax
add byte [esi - 0x77], ah
popfd
mov al, 0xfd
invalid
Function at 0x47889c
Capabilities:
Create thread

Disassembly:
clc
call 0x4b5912
mov esi, dword [ebp - 8]
push esi
call 0x4afa93
mov eax, dword [ebp - 0xc]
or ebx, dword [ebp - 0x28]
mov dword [esi], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop ecx
xor ecx, ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 4
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x58]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x60]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 0x64]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea eax, [ebp - 0x38]
push eax
push 0x10000
push esi
push 0x478177
push dword [ebp - 0x4c]
mov dword [ebp - 0x38], ecx
dec ebp
enter 0xffffffffffff8851, 0x4d
or edi, edi
adc eax, 0x4a61b0
mov edi, eax
xor ebx, ebx
test edi, edi
jne 0x478954
cmp dword [ebp - 0x1c], ebx
jne 0x478954
mov esi, 0x4c1b94
push esi
call dword [0x4a64f0]
sub dword [0x4c1338], 1
cmp dword [ebp - 0x30], ebx
je 0x47894d
sub dword [0x4c133c], 1

Function at 0x47905d
Capabilities:
Inspect section memory permissions

Disassembly:
fcos
xor byte [ebx + 0x75ff1045], cl
sub bh, bh
xor byte [esi + 0x57], dl
push esi
push edi
call 0x4ab593
mov eax, dword [ebp + 0x38]
cmp byte [ecx + 0x458b5043], cl
xor byte [ecx + 0x458b5443], cl
xor al, 0x68
xchg esp, eax
sbb ecx, dword [eax + eax - 0x39]
add ebx, dword [eax - 0x76ffb4eb]
adc eax, 0x4389004b
pop eax
call dword [0x4a64f0]
mov eax, dword [esi + 0x28]
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x34]
shr eax, 0xa1
test eax, 0x20007
test byte [ebp + 0x36], 0x40
mov dword [ebp + 0x18], eax
inc ebp
invalid
je 0x4790af
mov dword [ebp + 0x18], edi
mov esi, dword [ebp + 0x2c]
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
lea edx, [ebx + 0x40]
mov edi, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 0x28]
add esi, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x2c]
add eax, ecx
xor edi, edi
cmp dword [ebp + 0x30], 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], esi
clc
mov dword [ebp - 4], eax
mov dword [ebp + 0x20], edi
je 0x4790e9
mov dword [ebp + 0x20], 0x10000000
mov ecx, dword [ebp + 0x34]
test ecx, 0x4000000
je 0x4790f8
invalid
or byte [ebp + 0x22], 0x80
test ecx, 0x10000000
Function at 0x479068
Capabilities:
Inspect section memory permissions

Disassembly:
fcos
xor byte [ebx + 0x75ff1045], cl
sub bh, bh
xor byte [esi + 0x57], dl
push esi
push edi
call 0x4ab593
mov eax, dword [ebp + 0x38]
cmp byte [ecx + 0x458b5043], cl
xor byte [ecx + 0x458b5443], cl
xor al, 0x68
xchg esp, eax
sbb ecx, dword [eax + eax - 0x39]
add ebx, dword [eax - 0x76ffb4eb]
adc eax, 0x4389004b
pop eax
call dword [0x4a64f0]
mov eax, dword [esi + 0x28]
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x34]
shr eax, 0xa1
test eax, 0x20007
test byte [ebp + 0x36], 0x40
mov dword [ebp + 0x18], eax
inc ebp
invalid
je 0x4790af
mov dword [ebp + 0x18], edi
mov esi, dword [ebp + 0x2c]
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
lea edx, [ebx + 0x40]
mov edi, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 0x28]
add esi, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x2c]
add eax, ecx
xor edi, edi
cmp dword [ebp + 0x30], 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], esi
clc
mov dword [ebp - 4], eax
mov dword [ebp + 0x20], edi
je 0x4790e9
mov dword [ebp + 0x20], 0x10000000
mov ecx, dword [ebp + 0x34]
test ecx, 0x4000000
je 0x4790f8
invalid
or byte [ebp + 0x22], 0x80
test ecx, 0x10000000

Function at 0x479071
Capabilities:
Inspect section memory permissions

Disassembly:
fcos
xor byte [ebx + 0x75ff1045], cl
sub bh, bh
xor byte [esi + 0x57], dl
push esi
push edi
call 0x4ab593
mov eax, dword [ebp + 0x38]
cmp byte [ecx + 0x458b5043], cl
xor byte [ecx + 0x458b5443], cl
xor al, 0x68
xchg esp, eax
sbb ecx, dword [eax + eax - 0x39]
add ebx, dword [eax - 0x76ffb4eb]
adc eax, 0x4389004b
pop eax
call dword [0x4a64f0]
mov eax, dword [esi + 0x28]
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x34]
shr eax, 0xa1
test eax, 0x20007
test byte [ebp + 0x36], 0x40
mov dword [ebp + 0x18], eax
inc ebp
invalid
je 0x4790af
mov dword [ebp + 0x18], edi
mov esi, dword [ebp + 0x2c]
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
lea edx, [ebx + 0x40]
mov edi, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 0x28]
add esi, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x2c]
add eax, ecx
xor edi, edi
cmp dword [ebp + 0x30], 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], esi
clc
mov dword [ebp - 4], eax
mov dword [ebp + 0x20], edi
je 0x4790e9
mov dword [ebp + 0x20], 0x10000000
mov ecx, dword [ebp + 0x34]
test ecx, 0x4000000
je 0x4790f8
invalid
or byte [ebp + 0x22], 0x80
test ecx, 0x10000000
Function at 0x479086
Capabilities:
Inspect section memory permissions

Disassembly:
fcos
xor byte [ebx + 0x75ff1045], cl
sub bh, bh
xor byte [esi + 0x57], dl
push esi
push edi
call 0x4ab593
mov eax, dword [ebp + 0x38]
cmp byte [ecx + 0x458b5043], cl
xor byte [ecx + 0x458b5443], cl
xor al, 0x68
xchg esp, eax
sbb ecx, dword [eax + eax - 0x39]
add ebx, dword [eax - 0x76ffb4eb]
adc eax, 0x4389004b
pop eax
call dword [0x4a64f0]
mov eax, dword [esi + 0x28]
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x34]
shr eax, 0xa1
test eax, 0x20007
test byte [ebp + 0x36], 0x40
mov dword [ebp + 0x18], eax
inc ebp
invalid
je 0x4790af
mov dword [ebp + 0x18], edi
mov esi, dword [ebp + 0x2c]
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
lea edx, [ebx + 0x40]
mov edi, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 0x28]
add esi, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x2c]
add eax, ecx
xor edi, edi
cmp dword [ebp + 0x30], 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], esi
clc
mov dword [ebp - 4], eax
mov dword [ebp + 0x20], edi
je 0x4790e9
mov dword [ebp + 0x20], 0x10000000
mov ecx, dword [ebp + 0x34]
test ecx, 0x4000000
je 0x4790f8
invalid
or byte [ebp + 0x22], 0x80
test ecx, 0x10000000

Function at 0x4790a8
Capabilities:
Inspect section memory permissions

Disassembly:
fcos
xor byte [ebx + 0x75ff1045], cl
sub bh, bh
xor byte [esi + 0x57], dl
push esi
push edi
call 0x4ab593
mov eax, dword [ebp + 0x38]
cmp byte [ecx + 0x458b5043], cl
xor byte [ecx + 0x458b5443], cl
xor al, 0x68
xchg esp, eax
sbb ecx, dword [eax + eax - 0x39]
add ebx, dword [eax - 0x76ffb4eb]
adc eax, 0x4389004b
pop eax
call dword [0x4a64f0]
mov eax, dword [esi + 0x28]
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x34]
shr eax, 0xa1
test eax, 0x20007
test byte [ebp + 0x36], 0x40
mov dword [ebp + 0x18], eax
inc ebp
invalid
je 0x4790af
mov dword [ebp + 0x18], edi
mov esi, dword [ebp + 0x2c]
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
lea edx, [ebx + 0x40]
mov edi, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 0x28]
add esi, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x2c]
add eax, ecx
xor edi, edi
cmp dword [ebp + 0x30], 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], esi
clc
mov dword [ebp - 4], eax
mov dword [ebp + 0x20], edi
je 0x4790e9
mov dword [ebp + 0x20], 0x10000000
mov ecx, dword [ebp + 0x34]
test ecx, 0x4000000
je 0x4790f8
invalid
or byte [ebp + 0x22], 0x80
test ecx, 0x10000000