joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1590
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x5f4964]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x9c], 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b15ce
mov eax, dword [ebp - 0x9c]
jmp 0x4b169f
mov edx, dword [ebp - 8]
push edx
call fcn.0056f277
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4b168d
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0x5abae4
mov edx, dword [ebp - 0x10]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4b168d
cmp dword [ebp + 0xc], 0
je 0x4b168d
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
and ecx, 0xffff
movzx edx, cx
push edx
push str.StringFileInfo_04x_04xProductName
push 0x80
lea eax, [ebp - 0x98]
push eax
call fcn.00419550
add esp, 0x14
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4b168d
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00417ad0
test eax, eax
jl 0x4b168d
mov dword [ebp - 0x9c], 1
mov edx, dword [ebp - 0x10]
push edx
call fcn.0056ba57
add esp, 4
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0056ab51
mov esp, ebp
pop ebp
ret

Function at 0x4b1880
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.0056d570
mov eax, dword [0x5f4964]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b18b6
cmp dword [ebp - 8], 0x1fff
jbe 0x4b18ba
xor eax, eax
jmp 0x4b191d
lea edx, [ebp - 0x2010]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4b191b
lea edx, [ebp - 0x2018]
push edx
lea eax, [ebp - 0x2014]
push eax
push 0x5abb80
lea ecx, [ebp - 0x2010]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4b191b
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x2014]
mov ecx, dword [eax + 0xc]
mov dword [edx], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x2014]
mov ecx, dword [eax + 8]
mov dword [edx + 4], ecx
mov eax, 1
jmp 0x4b191d
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0056ab51
mov esp, ebp
pop ebp
ret
Function at 0x4b24d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b2506
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4b2506
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4b2509
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4b4a60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a0
mov eax, dword [0x5f4964]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x430], 0
mov dword [ebp - 8], 0
mov byte [ebp - 1], 0
mov dword [ebp - 0x438], 0x209
xor eax, eax
mov word [ebp - 0x428], ax
push 0x410
push 0
lea ecx, [ebp - 0x426]
push ecx
call fcn.0056b960
add esp, 0xc
push 0x208
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x428]
push eax
call fcn.004b8690
add esp, 0xc
lea ecx, [ebp - 0x42c]
push ecx
push 0x8b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x4b4c61
lea edx, [ebp - 0x43c]
push edx
push 1
push 2
push 0
push 0
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x4b4c61
lea ecx, [ebp - 0x430]
push ecx
push 0x5b0948
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x4b4c61
mov dword [ebp - 0x444], 0
xor edx, edx
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x440], 0x20
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x444], eax
mov ecx, dword [ebp - 0x430]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea edx, [ebp - 0x444]
push edx
push 0x19
mov eax, dword [ebp - 0x43c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x4b4c61
mov dword [ebp - 0x4a0], 0
xor ecx, ecx
mov dword [ebp - 0x49c], ecx
mov dword [ebp - 0x498], ecx
mov dword [ebp - 0x494], ecx
mov dword [ebp - 0x490], 0
push 0x40
push 0
lea edx, [ebp - 0x48c]
push edx
call fcn.0056b960
add esp, 0xc
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x43c]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x4a0], 0
je 0x4b4c4b
mov ecx, dword [ebp - 0x4a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x49c], 0
je 0x4b4c61
mov edx, dword [ebp - 0x49c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x430], 0
je 0x4b4c77
mov eax, dword [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x43c], 0
je 0x4b4c8d
mov ecx, dword [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x42c], 0
je 0x4b4ca3
mov edx, dword [ebp - 0x42c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 1], 0
cmp dword [ebp - 0x434], 1
jne 0x4b4cb4
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0056ab51
mov esp, ebp
pop ebp
ret
Function at 0x4b8f60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret 0x18
Function at 0x4bb270
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x4bb2b0
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x4bb29f
push 0x43
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x4bb2ab
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4bb400
lea ecx, [ebp - 0x10]
call fcn.00415da0
lea ecx, [ebp - 0x20]
call fcn.00415da0
lea ecx, [ebp - 0x10]
call fcn.00415da0
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [ebp - 0x20]
call fcn.00415da0
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x10]
call fcn.00416060
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x10]
call fcn.00416050
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x20]
call fcn.00416060
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.00416060
sub esi, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x20]
call fcn.00416050
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.00416050
sub esi, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 4], ecx
push 0
push 0x14
lea edx, [ebp - 0x10]
push edx
call fcn.00414d10
add esp, 0xc
movzx eax, byte [ebp + 0x14]
test eax, eax
jne 0x4bb3b8
mov dword [ebp - 0x2c], 1
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
jne 0x4bb387
mov edx, dword [ebp - 0x2c]
or edx, 4
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
movzx eax, byte [ebp + 0xc]
neg eax
sbb eax, eax
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4bb400
push 1
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
jne 0x4bb400
push 1
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0xfffffffffffffffe
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c51a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
push 0x7f
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.004c3d80
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 8]
test edx, edx
jne 0x4c51cf
jmp 0x4c5306
mov eax, dword [ebp - 4]
push eax
call fcn.004c3f90
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
je 0x4c51f3
cmp dword [ebp - 0x14], 2
je 0x4c5285
jmp 0x4c5306
cmp dword [ebp - 4], 0xa
jne 0x4c5261
mov ecx, dword [ebp - 0x10]
call fcn.004f83b0
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004c8d90
add esp, 8
movzx edx, al
test edx, edx
jne 0x4c521f
jmp 0x4c5345
push 0x5b27c0
push 0
mov ecx, dword [ebp - 0x10]
call fcn.004c90e0
mov ecx, eax
call fcn.00403580
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004c90e0
mov ecx, eax
call fcn.00447b90
push eax
call fcn.00536e30
add esp, 0x10
movzx eax, al
test eax, eax
jne 0x4c525f
jmp 0x4c5345
jmp 0x4c526b
jmp 0x4c5306
push 0x12
mov ecx, dword [ebp + 8]
call fcn.004c8cc0
movzx ecx, al
test ecx, ecx
je 0x4c5280
jmp 0x4c528b
jmp 0x4c533c
cmp dword [ebp - 4], 0x12
jne 0x4c52ed
mov ecx, dword [ebp - 0x10]
call fcn.004f7420
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004c8d90
add esp, 8
movzx eax, al
test eax, eax
jne 0x4c52b1
jmp 0x4c5345
push 0x5b27e4
push 0
mov ecx, dword [ebp - 0x10]
call fcn.004c9100
mov ecx, eax
call fcn.00403580
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004c9100
mov ecx, eax
call fcn.00447b90
push eax
call fcn.00536e30
add esp, 0x10
movzx ecx, al
test ecx, ecx
jne 0x4c52eb
jmp 0x4c5345
jmp 0x4c52f1
jmp 0x4c5306
mov ecx, dword [ebp + 8]
call fcn.004c3f10
movzx edx, al
test edx, edx
je 0x4c5304
jmp 0x4c5341
jmp 0x4c533c
cmp dword [ebp - 4], 0
je 0x4c531d
mov eax, dword [ebp - 4]
push eax
call fcn.004c3f80
add esp, 4
cmp eax, 4
jne 0x4c5321
jmp 0x4c5341
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00536490
add esp, 8
movzx eax, al
test eax, eax
jne 0x4c533c
jmp 0x4c5345
jmp 0x4c51a9
mov al, 1
jmp 0x4c5347
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x4c5350
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.004c90e0
mov ecx, eax
call fcn.00403580
test eax, eax
jbe 0x4c53b0
push 0x5b2808
push 1
mov ecx, dword [ebp - 4]
call fcn.004c90e0
mov ecx, eax
call fcn.00403580
push eax
mov ecx, dword [ebp - 4]
call fcn.004c90e0
mov ecx, eax
call fcn.00447b90
push eax
call fcn.00536e30
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.004c90e0
push eax
push 1
call fcn.00536a70
add esp, 0xc
mov ecx, dword [ebp - 4]
call fcn.004c9100
mov ecx, eax
call fcn.00403580
test eax, eax
jbe 0x4c5409
push 0x5b282c
push 1
mov ecx, dword [ebp - 4]
call fcn.004c9100
mov ecx, eax
call fcn.00403580
push eax
mov ecx, dword [ebp - 4]
call fcn.004c9100
mov ecx, eax
call fcn.00447b90
push eax
call fcn.00536e30
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.004c9100
push eax
push 2
call fcn.00536a70
add esp, 0xc
mov esp, ebp
pop ebp
ret 4
Function at 0x4c5410
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.004c90e0
mov ecx, eax
call fcn.00403580
test eax, eax
jbe 0x4c5473
push str.qh.connect.PhoneNumber.country_code
push 1
mov ecx, dword [ebp - 4]
call fcn.004c90e0
mov ecx, eax
call fcn.00403580
push eax
mov ecx, dword [ebp - 4]
call fcn.004c90e0
mov ecx, eax
call fcn.00447b90
push eax
call fcn.00536e30
add esp, 0x10
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
call fcn.004c90e0
push eax
push 1
call fcn.004c8db0
add esp, 0xc
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 4]
call fcn.004c9100
mov ecx, eax
call fcn.00403580
test eax, eax
jbe 0x4c54cf
push str.qh.connect.PhoneNumber.phone_number
push 1
mov ecx, dword [ebp - 4]
call fcn.004c9100
mov ecx, eax
call fcn.00403580
push eax
mov ecx, dword [ebp - 4]
call fcn.004c9100
mov ecx, eax
call fcn.00447b90
push eax
call fcn.00536e30
add esp, 0x10
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.004c9100
push eax
push 2
call fcn.004c8db0
add esp, 0xc
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x4f9aa0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x59a948
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
mov eax, dword [0x5f4964]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
xor ebx, ebx
mov dword [esp + 0xc], ecx
add ecx, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], eax
mov eax, dword [0x5f3a64]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], bl
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x4000000
mov dword [esp + 0x34], 0x2000000
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov esi, dword [esp + 0x60]
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
mov dword [esp + 0x50], ebx
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call edx
test al, al
je 0x4f9b49
cmp byte [esp + 0x24], bl
je 0x4f9b49
mov bl, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x50], 0xffffffff
call fcn.005372e0
mov al, bl
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x48
ret
Function at 0x4fa200
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x59a948
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
mov eax, dword [0x5f4964]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
xor ebx, ebx
mov dword [esp + 0xc], ecx
add ecx, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], eax
mov eax, dword [0x5f3a64]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], bl
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x4000000
mov dword [esp + 0x34], 0x2000000
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov esi, dword [esp + 0x60]
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
mov dword [esp + 0x50], ebx
call edx
lea eax, [esp + 0xc]
push esi
push eax
call fcn.004fa120
add esp, 8
test al, al
je 0x4fa2a9
cmp byte [esp + 0x24], bl
je 0x4fa2a9
mov bl, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x50], 0xffffffff
call fcn.005372e0
mov al, bl
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x48
ret

Function at 0x4faca0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x59aa26
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f4964]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi], eax
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [eax], vtable.google::protobuf::TextFormat::Parser::ParserImpl::ParserErrorCollector.0
mov dword [eax + 4], esi
push eax
mov eax, dword [esp + 0x28]
lea edi, [esi + 0x14]
push eax
mov ecx, edi
mov dword [esp + 0x20], 0
call fcn.0053a740
cmp byte [esp + 0x48], 0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x34]
mov dword [esi + 0xa4], ecx
mov cl, byte [esp + 0x38]
mov dword [esi + 0xa8], edx
mov dl, byte [esp + 0x3c]
mov byte [esi + 0xac], cl
mov cl, byte [esp + 0x40]
mov eax, 1
mov byte [esi + 0xad], dl
mov dl, byte [esp + 0x44]
mov byte [esi + 0xae], cl
mov cl, byte [esp + 0x4c]
mov byte [esp + 0x18], al
mov byte [esi + 0xaf], dl
mov byte [esi + 0xb0], cl
mov byte [esi + 0xb1], 0
mov byte [esi + 0x98], al
mov dword [esi + 0x9c], eax
je 0x4fad77
mov byte [esi + 0xa0], 0
mov byte [esi + 0xa1], al
mov ecx, edi
call fcn.0053b9a0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x30
Function at 0x4fd610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59abd9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f4964]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], eax
mov dword [esp + 0x1c], esi
mov byte [esi + 4], al
mov ebx, dword [edi + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], 1
cmp dword [edi + 0xc], ebx
jbe 0x4fd677
call fcn.0056adc1
mov ebp, dword [edi + 0xc]
mov ecx, dword [edi]
mov dword [esp + 0x20], ecx
cmp ebp, dword [edi + 0x10]
jbe 0x4fd68a
call fcn.0056adc1
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov edi, dword [edi]
push esi
push edx
push ebx
push eax
push ebp
push edi
call fcn.004fce20
add esp, 0x18
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x4ffa50
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x59af80
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
mov eax, dword [0x5f4964]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
push 1
xor ebx, ebx
push 0x5bcf58
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.00404d10
cmp dword [esp + 0x28], 0x10
mov eax, dword [esp + 0x14]
mov dword [esp + 0x50], ebx
lea ecx, [esi + 0x18]
jae 0x4ffaaf
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x24]
push edx
push eax
mov eax, dword [ecx + 0x14]
push eax
push ebx
call fcn.00422080
test eax, eax
jne 0x4ffad2
lea ecx, [esi + 0x14]
call fcn.0053b9a0
mov byte [esp + 0xf], 1
jmp 0x4ffad6
mov byte [esp + 0xf], bl
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x50], 0xffffffff
jb 0x4ffaf2
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0056a760
add esp, 4
push 1
cmp byte [esp + 0x13], bl
je 0x4ffb1e
mov ecx, dword [esp + 0x5c]
push 0x5bcf54
call fcn.00404d10
mov al, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x48
ret 4
push 0x5c8df8
lea ecx, [esp + 0x34]
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
call fcn.00404d10
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
mov dword [esp + 0x54], 1
call fcn.004fe4e0
cmp dword [esp + 0x44], 0x10
mov byte [esp + 0xf], al
mov dword [esp + 0x50], 0xffffffff
jb 0x4ffb70
mov eax, dword [esp + 0x30]
push eax
call fcn.0056a760
add esp, 4
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
cmp byte [esp + 0xf], bl
je 0x4ffbac
mov ecx, dword [esp + 0x58]
push 1
push 0x5c8e04
call fcn.00404d10
mov al, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x48
ret 4
xor al, al
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x48
ret 4
Function at 0x501870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x59b40a
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5f4964]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f4964]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov esi, ecx
xor ebp, ebp
mov dword [esp + 0x18], esi
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], ebp
mov byte [esp + 0x5c], bl
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x84], ebp
call fcn.004ffa50
test al, al
jne 0x501914
cmp dword [esp + 0x70], 0x10
jb 0x5018e9
mov eax, dword [esp + 0x5c]
push eax
call fcn.0056a760
add esp, 4
xor al, al
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0056ab51
add esp, 0x70
ret
mov esi, dword [esp + 0x18]
push 1
push 0x5bcf54
lea ecx, [esp + 0x44]
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], ebp
mov byte [esp + 0x48], 0
call fcn.00404d10
mov edx, dword [esp + 0x40]
or ebx, 1
cmp dword [esp + 0x54], 0x10
mov byte [esp + 0x80], 1
mov dword [esp + 0x1c], ebx
jae 0x501953
lea edx, [esp + 0x40]
lea eax, [esi + 0x18]
mov esi, dword [eax + 0x14]
mov eax, esi
cmp eax, esi
jae 0x50195f
mov edi, dword [esp + 0x50]
mov ecx, esi
cmp esi, edi
jb 0x50196b
mov ecx, edi
mov eax, dword [esp + 0x18]
add eax, 0x18
cmp dword [eax + 0x18], 0x10
jb 0x50197d
mov eax, dword [eax + 4]
jmp 0x501980
add eax, 4
push ecx
push edx
push eax
call fcn.004178f0
add esp, 0xc
cmp eax, ebp
jne 0x50199e
cmp esi, edi
jb 0x50199e
xor eax, eax
cmp esi, edi
setne al
cmp eax, ebp
je 0x501a06
push 1
push 0x5c8e04
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
call fcn.00404d10
mov eax, dword [esp + 0x24]
or ebx, 2
mov esi, 0x10
mov dword [esp + 0x80], 2
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x38], esi
jae 0x5019e4
lea eax, [esp + 0x24]
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 0x2c]
add ecx, 0x18
push eax
push edx
push ebp
call fcn.00422080
test eax, eax
je 0x501a0b
mov byte [esp + 0x17], 1
jmp 0x501a10
mov esi, 0x10
mov byte [esp + 0x17], 0
test bl, 2
je 0x501a3c
and ebx, 0xfffffffd
cmp dword [esp + 0x38], esi
jb 0x501a2b
mov eax, dword [esp + 0x24]
push eax
call fcn.0056a760
add esp, 4
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebp
mov byte [esp + 0x24], 0
mov dword [esp + 0x80], ebp
test bl, 1
je 0x501a5e
and ebx, 0xfffffffe
cmp dword [esp + 0x54], esi
jb 0x501a5e
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0056a760
add esp, 4
cmp byte [esp + 0x17], 0
mov ecx, dword [esp + 0x18]
je 0x501a8b
call fcn.005014a0
test al, al
jne 0x501910
cmp dword [esp + 0x70], 0x10
jb 0x5018e9
mov edx, dword [esp + 0x5c]
push edx
jmp 0x5018e1
lea eax, [esp + 0x58]
push eax
call fcn.004fe4e0
test al, al
je 0x501ab3
cmp dword [esp + 0x70], esi
jb 0x501aac
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.0056a760
add esp, 4
mov al, 1
jmp 0x5018eb
cmp dword [esp + 0x70], esi
jb 0x5018e9
mov edx, dword [esp + 0x5c]
push edx
jmp 0x5018e1