joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b75e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d3674
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 0xc]
push 0x5f52a6
mov ecx, edi
mov dword [esp + 0x1c], 0
mov dword [esi], 0x5f5670
call fcn.0048cd50
mov dword [edi], 0x5f1580
mov eax, dword [esp + 0x20]
push eax
mov ecx, esi
mov byte [esp + 0x1c], 1
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.004b73c0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4b7700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d36aa
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 0xc]
push 0x5f524a
mov ecx, edi
mov dword [esp + 0x3c], 0
mov dword [esi], 0x5f5670
call fcn.0048cd50
mov dword [edi], 0x5f1580
mov eax, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 1
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0048c600
mov dword [esp + 0x10], 0x5f1580
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esi + 0x10]
mov byte [esp + 0x44], 2
call fcn.00402bb0
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x10], 0x5f1558
jb 0x4b77a9
mov edx, dword [esp + 0x18]
push edx
call fcn.004274fc
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4

Function at 0x4b9dd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d3b38
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi], method.CScrollView.virtual_364
lea edi, [esi + 0xc]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x1c], ebx
call fcn.0049fcb0
mov dword [esi + 0x28], 0x5f2b50
lea ecx, [esi + 0x2c]
mov byte [esp + 0x1c], 1
mov dword [esi], 0x5f57e8
mov dword [edi], 0x5f57cc
mov dword [esi + 0x10], 0x5f4bb8
mov dword [esi + 0x28], 0x5f5740
call fcn.004b9d40
mov al, byte [esp + 0x24]
mov dword [esi + 0x48], ebx
mov ecx, dword [esi + 4]
mov byte [esi + 0x44], al
mov byte [esi + 0x45], bl
mov byte [esi + 0x4c], bl
mov dword [esi + 0x30], ecx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4cd0d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5d64f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push 0
push eax
push ecx
mov ecx, esi
call fcn.0049fce0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x20], eax
imul eax, ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x30]
mov dword [esi + 0x24], ecx
imul eax, edx
imul ecx, edx
add eax, 7
add ecx, 7
sar ecx, 3
sar eax, 3
add eax, ecx
push eax
mov dword [esp + 0x18], 0
mov dword [esi], 0x5f9e34
mov dword [esi + 4], 0x5f9dfc
mov dword [esi + 0x28], edx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
call fcn.00427501
mov ecx, dword [esi + 0x34]
push ecx
push 0
push eax
mov dword [esi + 0x38], eax
call fcn.0044dac0
mov edx, dword [esi + 0x34]
add esp, 0x10
mov dword [esi + 0x3c], edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18
Function at 0x4cd580
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5d6528
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
xor ebx, ebx
push ebx
push eax
push ecx
mov ecx, esi
call fcn.0049fce0
mov edx, dword [esp + 0x28]
mov al, byte [esp + 0x2c]
mov cl, byte [esp + 0x30]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x38]
mov byte [esi + 0x21], cl
mov cl, byte [esp + 0x3c]
mov byte [esi + 0x20], al
mov eax, dword [esp + 0x34]
mov dword [esi + 0x28], edx
mov dl, byte [esp + 0x40]
mov byte [esi + 0x2c], cl
mov dword [esi + 0x24], eax
mov byte [esi + 0x2d], dl
xor ecx, ecx
add eax, 3
mov edx, 2
mul edx
seto cl
mov dword [esp + 0x18], ebx
mov dword [esi], 0x5f9e4c
mov dword [esi + 4], 0x5f9dfc
neg ecx
or ecx, eax
push ecx
call fcn.00427501
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x24]
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00427501
add esp, 8
cmp dword [esi + 0x1c], ebx
mov dword [esi + 0x44], eax
mov byte [esi + 0x2e], bl
mov dword [esi + 0x30], ebx
setl cl
mov byte [esi + 0x2f], cl
mov dword [esi + 0x38], ebx
mov word [eax], bx
movzx eax, word [esi + 0x24]
mov edx, dword [esi + 0x3c]
mov word [edx + 4], ax
mov ecx, dword [esi + 0x3c]
movzx eax, word [ecx + 4]
mov edx, dword [esi + 0x44]
mov word [edx + 2], ax
mov dword [esi + 0x48], 1
mov dword [esi + 0x50], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 0x24

Function at 0x4d1650
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x680f10]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
push 0x104
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x4d168f
push 0x5fa2f0
jmp 0x4d1694
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00403260
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0044abb9
add esp, 0x210
ret
Function at 0x4d1800
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5d696c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x30]
mov dword [eax], 0
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push 0
lea edx, [esp + 0x1c]
push edx
push 0
push esi
push edi
mov dword [esp + 0x40], 0
mov dword [esp + 0x34], 1
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
call ebx
test eax, eax
jne 0x4d1915
mov eax, dword [esp + 0x10]
push eax
call fcn.00427501
add esp, 4
test eax, eax
mov dword [esp + 0x18], eax
je 0x4d1915
lea ecx, [esp + 0x10]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
push 0
push esi
push edi
call ebx
test eax, eax
jne 0x4d1908
cmp dword [esp + 0x14], 7
jne 0x4d1908
mov edi, dword [esp + 0x18]
cmp word [edi], ax
mov esi, edi
je 0x4d190c
push esi
call fcn.005b8ee1
push str..PFB
push esi
call fcn.0044bc3b
add esp, 0xc
test eax, eax
jne 0x4d18fc
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4d18e0
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 2], cx
lea esi, [esi + eax*2 + 2]
jne 0x4d18c0
jmp 0x4d190c
mov ecx, dword [esp + 0x30]
push esi
call fcn.00406c80
jmp 0x4d190c
mov edi, dword [esp + 0x18]
push edi
call fcn.004274fc
add esp, 4
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x4d4610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d6dbe
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, ecx
fldz
push 1
fstp qword [esp + 0x18]
call fcn.004d1ed0
mov ebx, eax
test ebx, ebx
jne 0x4d4668
fldz
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.004d4130
mov esi, eax
test esi, esi
je 0x4d4652
mov ecx, edi
call fcn.004d4250
mov edi, eax
mov eax, dword [ebx + 4]
push 1
push eax
lea ecx, [esp + 0x24]
call fcn.004b9e70
mov ecx, esi
mov dword [esp + 0x78], 0
call fcn.004b57d0
mov ebx, dword [eax + 0x14]
mov ecx, esi
call fcn.004b57d0
cmp dword [eax + 0x18], 0x10
jb 0x4d46b1
mov eax, dword [eax + 4]
jmp 0x4d46b4
add eax, 4
push 0
push ebx
push eax
lea eax, [esp + 0x38]
push eax
call fcn.004b6c70
test edi, edi
je 0x4d46dd
push 1
lea ecx, [esp + 0x48]
call fcn.00506250
test eax, eax
je 0x4d46dd
push eax
mov ecx, edi
call fcn.004ba060
lea ecx, [esp + 0x44]
call fcn.004b5e10
lea ecx, [esp + 0x44]
call fcn.00504b00
test eax, eax
je 0x4d4738
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x3c]
call eax
mov ebx, eax
mov ebp, dword [ebx + 4]
mov esi, dword [ebp]
cmp esi, ebp
je 0x4d4738
cmp esi, dword [ebx + 4]
jne 0x4d4712
call fcn.0044b7ad
mov edi, dword [esi + 8]
mov edx, dword [edi]
mov eax, dword [edx + 8]
mov ecx, edi
call eax
cmp eax, 0x38
jne 0x4d472a
fld qword [edi + 0x30]
fstp qword [esp + 0x14]
cmp esi, dword [ebx + 4]
jne 0x4d4734
call fcn.0044b7ad
mov esi, dword [esi]
jmp 0x4d4704
lea ecx, [esp + 0x1c]
mov dword [esp + 0x78], 0xffffffff
call fcn.004b9bf0
fld qword [esp + 0x14]
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d7020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5d7363
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x680f10]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0xac]
mov edi, ecx
push 0x5fa833
lea ecx, [esp + 0x7c]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], 0
call fcn.0048cd50
push 1
mov ecx, edi
mov dword [esp + 0xa8], 1
call fcn.004d1ed0
mov ebp, eax
test ebp, ebp
jne 0x4d70cd
lea eax, [esp + 0x78]
push eax
mov ecx, ebx
call fcn.0048c220
mov dword [ebx], 0x5f1570
cmp dword [esp + 0x94], 0x10
mov dword [esp + 0x78], 0x5f1558
jb 0x4d7255
mov ecx, dword [esp + 0x80]
push ecx
jmp 0x4d724d
mov ecx, edi
call fcn.004d4130
mov esi, eax
test esi, esi
jne 0x4d710f
lea edx, [esp + 0x78]
push edx
mov ecx, ebx
call fcn.0048c220
cmp dword [esp + 0x94], 0x10
mov dword [ebx], 0x5f1570
mov dword [esp + 0x78], 0x5f1558
jb 0x4d7255
mov eax, dword [esp + 0x80]
push eax
jmp 0x4d724d
mov ecx, edi
call fcn.004d4250
mov edi, eax
mov eax, dword [ebp + 4]
push 1
push eax
lea ecx, [esp + 0x30]
call fcn.004b9e70
mov ecx, esi
mov byte [esp + 0xa4], 2
call fcn.004b57d0
mov ebp, dword [eax + 0x14]
mov ecx, esi
call fcn.004b57d0
cmp dword [eax + 0x18], 0x10
jb 0x4d714b
mov eax, dword [eax + 4]
jmp 0x4d714e
add eax, 4
push 0
push ebp
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.004b6c70
test edi, edi
je 0x4d7177
push 1
lea ecx, [esp + 0x54]
call fcn.00506250
test eax, eax
je 0x4d7177
push eax
mov ecx, edi
call fcn.004ba060
lea ecx, [esp + 0x50]
call fcn.004b5e10
lea ecx, [esp + 0x50]
call fcn.00504b00
test eax, eax
je 0x4d7208
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x3c]
call eax
push eax
lea ecx, [esp + 0x1c]
call fcn.004d88b0
mov eax, dword [esp + 0x1c]
mov edi, dword [eax]
mov byte [esp + 0xa4], 3
mov ebp, eax
cmp edi, ebp
je 0x4d71f7
cmp edi, eax
jne 0x4d71bd
call fcn.0044b7ad
mov esi, dword [edi + 8]
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
cmp eax, 0x38
jne 0x4d71e2
push 0xffffffffffffffff
push 0
add esi, 8
push esi
lea ecx, [esp + 0x88]
call fcn.00402bb0
mov eax, dword [esp + 0x1c]
cmp edi, eax
jne 0x4d71f3
call fcn.0044b7ad
mov eax, dword [esp + 0x1c]
mov edi, dword [edi]
jmp 0x4d71b0
lea ecx, [esp + 0x18]
mov byte [esp + 0xa4], 2
call fcn.00500e80
lea ecx, [esp + 0x78]
push ecx
mov ecx, ebx
call fcn.0048c220
lea ecx, [esp + 0x28]
mov dword [ebx], 0x5f1570
mov dword [esp + 0x14], 1
mov byte [esp + 0xa4], 1
call fcn.004b9bf0
cmp dword [esp + 0x94], 0x10
mov dword [esp + 0x78], 0x5f1558
jb 0x4d7255
mov edx, dword [esp + 0x80]
push edx
call fcn.004274fc
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.0044abb9
add esp, 0x94
ret 4
Function at 0x4d8260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dcc58
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
lea edi, [esi + 4]
push eax
mov ecx, edi
mov dword [esp + 0x1c], 0
mov dword [esi], 0x5faa34
call fcn.0048c220
fld qword [esp + 0x24]
mov dword [edi], 0x5f1570
fstp qword [esi + 0x30]
mov dword [esi + 0x28], 0x5f14a0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc
Function at 0x4e08d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5d839c
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x680f10]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
lea eax, [esp + 0x34]
push eax
mov esi, ecx
call fcn.004b8c70
mov edx, dword [eax + 0x18]
push 5
lea ecx, [eax + 4]
push 0x5fb314
push edx
push 0
mov dword [esp + 0x90], 0
call fcn.0048a450
test eax, eax
mov edi, 0x10
setne bl
cmp dword [esp + 0x50], edi
mov ebp, 0x5f1558
mov dword [esp + 0x80], 0xffffffff
mov dword [esp + 0x34], ebp
jb 0x4e095f
mov eax, dword [esp + 0x3c]
push eax
call fcn.004274fc
add esp, 4
test bl, bl
jne 0x4e0ad3
push 0x5fb26f
lea ecx, [esp + 0x58]
call fcn.0048cd50
push 0x5fb4cc
lea ecx, [esp + 0x18]
mov dword [esp + 0x84], 1
call fcn.0048cd50
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov byte [esp + 0x84], 2
call fcn.004b7a60
cmp dword [esp + 0x30], edi
mov esi, eax
mov byte [esp + 0x80], 1
mov dword [esp + 0x14], ebp
jb 0x4e09c3
mov edx, dword [esp + 0x1c]
push edx
call fcn.004274fc
add esp, 4
test esi, esi
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
mov dword [esp + 0x14], 0x5f13d0
jne 0x4e09fc
cmp dword [esp + 0x70], edi
mov dword [esp + 0x54], ebp
jb 0x4e0ad3
mov eax, dword [esp + 0x5c]
push eax
jmp 0x4e0acb
mov ecx, esi
call fcn.004b5800
push eax
lea ecx, [esp + 0x38]
call fcn.0048c600
mov dword [esp + 0x34], 0x5f1570
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x64]
mov byte [esp + 0x8c], 3
call fcn.00402bb0
cmp dword [esp + 0x50], edi
mov byte [esp + 0x80], 1
mov dword [esp + 0x34], ebp
jb 0x4e0a4e
mov edx, dword [esp + 0x3c]
push edx
call fcn.004274fc
add esp, 4
xor esi, esi
mov eax, dword [esi + 0x683838]
push eax
lea ecx, [esp + 0x18]
call fcn.0048cd50
cmp dword [esp + 0x30], edi
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x80], 4
jae 0x4e0a76
lea eax, [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x6c]
push ecx
push eax
push edx
push 0
lea ecx, [esp + 0x68]
call fcn.0048a450
test eax, eax
sete bl
cmp dword [esp + 0x30], edi
mov byte [esp + 0x80], 1
mov dword [esp + 0x14], ebp
jb 0x4e0ab0
mov eax, dword [esp + 0x1c]
push eax
call fcn.004274fc
add esp, 4
test bl, bl
jne 0x4e0af4
add esi, 4
cmp esi, 0x68
jb 0x4e0a50
cmp dword [esp + 0x70], edi
mov dword [esp + 0x54], ebp
jb 0x4e0ad3
mov edx, dword [esp + 0x5c]
push edx
call fcn.004274fc
add esp, 4
xor al, al
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0044abb9
add esp, 0x70
ret
cmp dword [esp + 0x70], edi
mov dword [esp + 0x54], ebp
jb 0x4e0b0b
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.004274fc
add esp, 4
mov al, 1
jmp 0x4e0ad5
Function at 0x4e1f50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d8643
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, ecx
xor ecx, ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], ecx
mov dword [eax + 0x54], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x4e24e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d86eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push ecx
xor edi, edi
mov ecx, esi
mov dword [esp + 0x20], edi
call fcn.004ec960
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [esi + 8], edi
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push eax
push esi
push ecx
push esi
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
mov dword [esp + 0x30], 0xffffffff
call fcn.004ecce0
mov eax, dword [esi + 4]
push eax
call fcn.004274fc
add esp, 4
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x4e3c30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d8a87
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.004b9d40
mov dword [esi + 0x18], 0x5fc1f4
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x2c], ebx
mov dword [esi], 0x5fc2ec
mov dword [esi + 0xc], 0x5f7778
mov dword [esi + 0x10], 0x5f8bb0
mov dword [esi + 0x18], 0x5fc2d8
mov dword [esp + 0x14], ebx
call sub.gdiplus.dll_GdipCreateMatrix
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ecx
lea edi, [esi + 0x20a8]
mov ecx, edi
mov byte [esp + 0x28], 1
call fcn.004eb7a0
mov dword [edi + 4], eax
mov byte [eax + 0x39], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
lea ecx, [esi + 0x20b4]
mov dword [edi + 8], ebx
call fcn.004dc760
push 0x68db1c
call sub.gdiplus.dll_GdipStringFormatGetGenericTypographic
lea edi, [esi + 0x2ab8]
mov dword [0x68db20], eax
mov dword [edi], ebx
mov edx, dword [0x68db1c]
push edi
push edx
call sub.gdiplus.dll_GdipCloneStringFormat
mov dword [edi + 4], eax
mov ecx, dword [edi]
lea eax, [esp + 0x10]
push eax
push ecx
call sub.gdiplus.dll_GdipGetStringFormatFlags
cmp eax, ebx
je 0x4e3d14
mov dword [edi + 4], eax
mov eax, dword [esp + 0x10]
mov edx, dword [edi]
or eax, 0x800
push eax
push edx
call sub.gdiplus.dll_GdipSetStringFormatFlags
cmp eax, ebx
je 0x4e3d2d
mov dword [edi + 4], eax
mov ecx, dword [edi]
lea eax, [esp + 0x18]
push eax
push 1
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 1
call sub.gdiplus.dll_GdipSetStringFormatMeasurableCharacterRanges
cmp eax, ebx
je 0x4e3d4f
mov dword [edi + 4], eax
fldz
push 0x2000
lea edx, [esi + 0x9c]
fst dword [esi + 0x28]
push ebx
fstp dword [esi + 0x3c]
push edx
mov dword [esi + 0x2ac0], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov byte [esi + 0x2ab7], bl
mov dword [esi + 0x24], ebx
mov byte [esi + 0x2c], 0xff
mov byte [esi + 0x2d], bl
mov byte [esi + 0x38], bl
mov byte [esi + 0x20a4], 1
mov dword [esi + 0x20a0], ebx
call fcn.0044dac0
push 0x5c
lea eax, [esi + 0x40]
push ebx
push eax
call fcn.0044dac0
mov cl, byte [esp + 0x48]
add esp, 0x18
mov byte [esi + 0x209c], cl
mov byte [esi + 0x2ab6], bl
mov byte [esi + 0x209d], bl
mov byte [esi + 0x209e], bl
mov byte [esi + 0x209f], bl
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
Function at 0x4f1a00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d9f3e
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0x5fcbb4
lea ecx, [esp + 0xc]
call fcn.0048cd50
lea eax, [esp + 8]
push eax
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.004b7950
cmp dword [esp + 0x24], 0x10
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 8], 0x5f1558
jb 0x4f1a6e
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004274fc
add esp, 4
test esi, esi
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
mov dword [esp + 8], 0x5f13d0
je 0x4f1b01
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
cmp eax, 4
jne 0x4f1b01
mov ecx, esi
call fcn.004b5810
cmp eax, 3
jb 0x4f1b01
push 2
mov ecx, esi
call fcn.004b5830
mov esi, eax
test esi, esi
je 0x4f1b01
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
cmp eax, 1
jne 0x4f1b01
mov ecx, esi
call fcn.004b57f0
fcomp qword [0x659f18]
fnstsw ax
test ah, 0x44
jnp 0x4f1aee
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret

Function at 0x4f21c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5da0a7
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0x5fcbf8
lea ecx, [esp + 0xc]
call fcn.0048cd50
lea eax, [esp + 8]
push eax
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.004b7950
cmp dword [esp + 0x24], 0x10
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 8], 0x5f1558
jb 0x4f222e
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004274fc
add esp, 4
test esi, esi
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
mov dword [esp + 8], 0x5f13d0
je 0x4f227a
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
cmp eax, 4
jne 0x4f227a
mov ecx, esi
call fcn.004b5810
cmp eax, 4
setae al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret