joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
push edi
mov edi, dword [ebx + 8]
mov dword [ebp - 0x10], esi
cmp dword [esi + 0x88], 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
je 0x4a3c85
cmp dword [esi + 0x70], 0
je 0x4a3c85
cmp dword [esi + 0x78], 0
jne 0x4a3c67
cmp dword [esi + 0x80], 0
jne 0x4a3c85
add esi, 0x4c
mov ecx, edi
push esi
call fcn.004baa80
mov ecx, dword [esi + 0x3c]
mov eax, edi
mov dword [edi + 0x3c], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
cmp dword [esi + 0x18], 7
lea edx, [esi + 4]
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
jbe 0x4a3c99
mov edx, dword [esi + 4]
mov edi, dword [esi + 0x14]
test edi, edi
je 0x4a3d3a
lea eax, [edi - 1]
or ecx, 0xffffffff
cmp eax, ecx
cmovb ecx, eax
cmp word [edx + ecx*2], 0x5c
lea eax, [edx + ecx*2]
je 0x4a3ccd
nop dword [eax]
cmp eax, edx
je 0x4a3cf1
sub eax, 2
cmp word [eax], 0x5c
jne 0x4a3cc0
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x4a3cf1
lea ecx, [eax + 1]
cmp edi, ecx
jb 0x4a3d84
mov eax, edi
lea edx, [edx + ecx*2]
sub eax, ecx
or edi, 0xffffffff
cmp eax, 0xffffffff
cmovb edi, eax
test edi, edi
je 0x4a3d3a
mov eax, edi
mov dword [ebp - 0xc], 0
mov ecx, edx
test eax, eax
je 0x4a3d21
cmp word [edx], 0x2e
je 0x4a3d24
nop word [eax + eax]
cmp eax, 1
je 0x4a3d21
add ecx, 2
dec eax
cmp word [ecx], 0x2e
jne 0x4a3d10
jmp 0x4a3d24
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x4a3d3a
sub ecx, edx
sar ecx, 1
cmp ecx, 0xffffffff
je 0x4a3d3a
mov eax, edi
mov edi, ecx
cmp eax, ecx
cmovb edi, eax
cmp dword [esi + 0x48], 7
lea ecx, [esi + 0x34]
jbe 0x4a3d46
mov ecx, dword [esi + 0x34]
cmp dword [esi + 0x30], 7
mov eax, dword [esi + 0x44]
mov dword [ebp - 4], eax
lea eax, [esi + 0x1c]
mov dword [ebp - 0xc], eax
jbe 0x4a3d60
mov esi, dword [eax]
mov dword [ebp - 0xc], esi
mov esi, dword [ebp - 0x10]
push dword [ebp - 4]
push ecx
push dword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0xc]
push edi
push edx
push dword [esi]
call fcn.0049ef00
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.0043dab0
int3
Function at 0x4a42a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db6d9
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x78
mov eax, dword [0x68a140]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebx + 0xc]
lea ecx, [ebp - 0x68]
mov edi, dword [ebx + 8]
mov dword [ebp - 4], 0
push ecx
mov dword [ebp - 0x84], edi
mov ecx, eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x80], 0
call fcn.004a3c20
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [esi]
mov ecx, dword [ebp - 0x6c]
cmp dword [ecx + 0x30], 7
mov dword [ebp - 0x80], 1
mov edx, dword [eax]
lea eax, [ecx + 0x1c]
mov dword [ebp - 0x7c], eax
jbe 0x4a4353
mov esi, dword [eax]
mov dword [ebp - 0x7c], esi
cmp dword [ecx + 0x18], 7
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x70], eax
lea eax, [ecx + 4]
mov ecx, eax
jbe 0x4a4366
mov ecx, dword [eax]
push dword [eax + 0x10]
lea eax, [ebp - 0x1c]
movlpd qword [ebp - 0x1c], xmm0
push ecx
mov ecx, dword [edx + 0x20]
push eax
call fcn.004bc490
push dword [ebp - 0x70]
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x1c]
push dword [ebp - 0x7c]
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call dword [0x5f3508]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x80], 3
test edi, edi
je 0x4a43e0
or eax, 0xffffffff
lock xadd dword [edi + 4], eax
jne 0x4a43e0
mov eax, dword [edi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x5f3508]
mov ecx, edi
call esi
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
jne 0x4a43e0
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5f3508]
mov ecx, edi
call esi
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x74]
mov dword [ebp - 0x70], eax
cmp esi, eax
je 0x4a4444
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x6c]
add ecx, 0x1c
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x50]
push esi
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x78], eax
mov eax, dword [edi + 4]
push ecx
lea ecx, [ebp - 0x78]
push ecx
cmp eax, dword [edi + 8]
je 0x4a4434
mov edx, eax
call fcn.004a5dd0
add esp, 0x10
add dword [edi + 4], 0x40
jmp 0x4a443c
push eax
mov ecx, edi
call fcn.004a56e0
add esi, 0x18
cmp esi, dword [ebp - 0x70]
jne 0x4a43f4
lea ecx, [ebp - 0x28]
call fcn.00434610
lea ecx, [ebp - 0x68]
call fcn.00428f30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00599e5b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x4a63e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dba7e
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x68a140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
xor ecx, ecx
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov dword [ebp - 0x14], eax
mov word [edi], cx
mov dword [ebp - 4], ecx
lea ecx, [eax + 2]
mov eax, 0x55555556
mov dword [ebp - 0x20], 1
imul ecx
xor ecx, ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
ja 0x4a6484
xor eax, eax
mov dword [edi + 0x10], ecx
mov word [edi + ecx*2], ax
jmp 0x4a648e
push 0
push ecx
mov ecx, edi
call fcn.004286f0
mov edx, dword [ebp - 0x18]
xor esi, esi
cmp dword [edx + 0x14], 7
jbe 0x4a649b
mov edi, dword [edx]
mov ecx, dword [ebp - 0x14]
cmp ecx, 3
jl 0x4a6545
mov eax, 0xaaaaaaab
mul ecx
mov ecx, edx
shr ecx, 1
mov dword [ebp - 0x1c], ecx
lea eax, [ecx*4]
sub eax, ecx
neg eax
add dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
mov eax, ecx
inc ecx
mov dword [ebp + 8], ecx
movzx edx, byte [eax]
mov eax, ecx
inc ecx
shl edx, 0x10
mov dword [ebp + 8], ecx
movzx eax, byte [eax]
shl eax, 8
or edx, eax
mov eax, ecx
inc ecx
mov dword [ebp + 8], ecx
movzx eax, byte [eax]
or edx, eax
mov eax, edx
shr eax, 0x12
movzx eax, word [eax*2 + 0x62afa0]
mov word [edi + esi*2], ax
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, word [eax*2 + 0x62afa0]
mov word [edi + esi*2 + 2], ax
mov eax, edx
shr eax, 6
and edx, 0x3f
and eax, 0x3f
movzx eax, word [eax*2 + 0x62afa0]
mov word [edi + esi*2 + 4], ax
movzx eax, word [edx*2 + 0x62afa0]
mov word [edi + esi*2 + 6], ax
add esi, 4
sub dword [ebp - 0x1c], 1
jne 0x4a64c3
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp ecx, 2
jne 0x4a65a9
mov ecx, dword [ebp + 8]
mov eax, ecx
inc ecx
mov dword [ebp + 8], ecx
movzx edx, byte [eax]
movzx eax, byte [ecx]
shl edx, 8
or edx, eax
shl edx, 8
mov eax, edx
shr eax, 0x12
movzx eax, word [eax*2 + 0x62afa0]
mov word [edi + esi*2], ax
mov eax, edx
shr eax, 0xc
and eax, 0x3f
shr edx, 6
and edx, 0x3f
movzx eax, word [eax*2 + 0x62afa0]
mov word [edi + esi*2 + 2], ax
mov eax, 0x3d
mov cx, word [edx*2 + 0x62afa0]
mov word [edi + esi*2 + 4], cx
mov word [edi + esi*2 + 6], ax
mov eax, dword [ebp - 0x18]
jmp 0x4a65e5
cmp ecx, 1
jne 0x4a65e3
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
shl ecx, 0x10
mov eax, ecx
shr ecx, 0xc
shr eax, 0x12
and ecx, 0x3f
movzx eax, word [eax*2 + 0x62afa0]
mov word [edi + esi*2], ax
movzx eax, word [ecx*2 + 0x62afa0]
mov word [edi + esi*2 + 2], ax
mov dword [edi + esi*2 + 4], 0x3d003d
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599e5b
mov esp, ebp
pop ebp
ret
Function at 0x4ad5b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0xc], ebx
mov edi, dword [ebx]
push edi
call fcn.004b4360
mov edx, dword [ebp + 8]
and eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
mov esi, dword [ecx + eax*8 + 4]
cmp esi, dword [edx + 4]
jne 0x4ad5e0
xor esi, esi
jmp 0x4ad611
mov ebx, dword [ecx + eax*8]
lea eax, [esi + 8]
push eax
push edi
call fcn.004b3f90
test al, al
je 0x4ad60a
cmp esi, ebx
je 0x4ad608
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.004b3f90
test al, al
jne 0x4ad5f1
jmp 0x4ad60a
xor esi, esi
mov edx, dword [ebp + 8]
mov ebx, dword [esp + 0xc]
test esi, esi
je 0x4ad714
cmp esi, dword [edx + 4]
je 0x4ad714
cmp byte [esi + 0x50], 0
lea edi, [esi + 0x20]
mov eax, dword [ebx + 4]
jne 0x4ad6bd
mov esi, dword [ebx + 8]
lea ecx, [esp + 0x18]
mov al, byte [eax]
push esi
mov byte [esp + 0x14], al
call fcn.004a0f70
mov al, byte [esi + 0x20]
lea esi, [edi + 8]
mov byte [esp + 0x38], al
mov al, byte [esp + 0x10]
mov byte [edi], al
lea eax, [esp + 0x18]
cmp byte [esi + 0x28], 0
push eax
je 0x4ad694
movsx ecx, byte [esp + 0x34]
lea edx, [esp + 0x10]
inc ecx
mov dword [esp + 0x10], esi
call fcn.004ac9f0
mov al, byte [esp + 0x3c]
lea ecx, [esp + 0x1c]
add esp, 4
mov byte [esi + 0x20], al
call fcn.004a3370
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.004a0a80
mov al, byte [esp + 0x38]
mov byte [esi + 0x20], al
mov byte [esi + 0x28], 1
lea ecx, [esp + 0x18]
call fcn.004a3370
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov cl, byte [eax]
cmp cl, byte [edi]
jbe 0x4ad6d1
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0xc]
cmp dword [eax], 2
jne 0x4ad71f
lea eax, [esp + 0x48]
mov byte [esp + 0x38], 0
push eax
mov ecx, edi
mov byte [esp + 0x4c], 0
mov byte [esp + 0x7c], 0
call fcn.004b1cc0
cmp byte [esp + 0x78], 0
je 0x4ad704
lea ecx, [esp + 0x50]
call fcn.004a3370
cmp byte [esp + 0x38], 0
je 0x4ad714
lea ecx, [esp + 0x10]
call fcn.004a3370
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebx + 8]
mov byte [esp + 0x10], cl
lea ecx, [esp + 0x18]
push esi
call fcn.004a0f70
mov al, byte [esi + 0x20]
lea esi, [edi + 8]
mov byte [esp + 0x38], al
mov al, byte [esp + 0x10]
mov byte [edi], al
lea eax, [esp + 0x18]
cmp byte [esi + 0x28], 0
push eax
je 0x4ad694
movsx ecx, byte [esp + 0x34]
lea edx, [esp + 0x10]
inc ecx
mov dword [esp + 0x10], esi
call fcn.004ac9f0
mov al, byte [esp + 0x3c]
add esp, 4
mov byte [esi + 0x20], al
jmp 0x4ad6a6
Function at 0x4b4310
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x811c9dc5
lea ebx, [esi + eax*2]
cmp esi, ebx
je 0x4b4357
nop dword [eax + eax]
movzx edx, word [esi]
mov ecx, 0x19
lea eax, [edx - 0x61]
cmp cx, ax
sbb ecx, ecx
add esi, 2
and ecx, 0x20
add ecx, 0xffffffdf
and ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp esi, ebx
jne 0x4b4330
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4ba8f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ddb4d
mov eax, dword fs:[0]
push eax
push ebx
push ecx
push esi
mov eax, dword [0x68a140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
push dword [ebx + 0x24]
mov dword [esi + 0x18], eax
push dword [ebx + 0x20]
mov dword [esi + 0x1c], eax
push dword [ebx + 0x1c]
mov dword [esi + 0x20], eax
push dword [ebx + 0x18]
mov dword [esi + 0x24], eax
push dword [ebx + 0x14]
mov dword [esi + 0x28], eax
push dword [ebx + 0x10]
mov dword [esi + 0x2c], eax
push dword [ebx + 0xc]
mov dword [esi + 0x30], eax
push dword [ebx + 8]
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], 1
call fcn.004bad90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x20

Function at 0x4ba9b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ddb4d
mov eax, dword fs:[0]
push eax
push ebx
push ecx
push esi
mov eax, dword [0x68a140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
push dword [ebx + 0xc]
mov dword [esi + 0x18], eax
push dword [ebx + 8]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], 1
call fcn.004bb000
push dword [esi + 0x34]
mov ecx, esi
push dword [esi + 0x30]
push dword [esi + 0x2c]
push dword [esi + 0x28]
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esi + 0x1c]
push dword [esi + 0x18]
call fcn.004bad90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x4d0460
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e0378
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xc
push esi
mov eax, dword [0x68a140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
movups xmmword [esi + 0xc], xmm0
push 2
movq qword [esi + 0x1c], xmm0
mov dword [esi + 0x24], 0
push esi
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.0059979e
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
sub esp, 0x10
xorps xmm0, xmm0
mov eax, esp
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
movups xmm0, xmmword [ebx + 0xc]
movups xmmword [eax], xmm0
movq xmm0, qword [ebx + 0x1c]
movq qword [eax + 0x10], xmm0
xor eax, eax
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 7
mov word [ebx + 0xc], ax
call fcn.004d01e0
add esp, 0x18
mov word [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x58], eax
lea ecx, [esi + 0x90]
mov dword [esi + 0x6c], eax
xorps xmm0, xmm0
mov eax, dword [ebx + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x70], 0xffffffff
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], eax
mov eax, 1
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov word [esi + 0x8c], ax
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
movups xmmword [ecx + 0xc], xmm0
push 2
movq qword [ecx + 0x1c], xmm0
mov dword [ecx + 0x24], 0
push ecx
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
call fcn.0059979e
add esp, 8
lea ecx, [ebx + 0xc]
call fcn.00428f30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x1c
Function at 0x4d6200
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d15e0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x68a140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebx + 8]
push eax
call fcn.0047ab20
lea ecx, [edi + 0x28]
call fcn.004a2980
lea eax, [edi + 0x38]
mov word [edi + 0x30], 0
mov dword [edi + 0x34], 0
xorps xmm0, xmm0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
movups xmmword [eax + 0xc], xmm0
push 2
movq qword [eax + 0x1c], xmm0
mov dword [eax + 0x24], 0
push eax
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
call fcn.0059979e
mov eax, dword [ebx + 0x2c]
add esp, 8
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
test eax, eax
je 0x4d62ce
mov esi, dword [eax]
lea ecx, [ebx + 8]
cmp eax, ecx
setne dl
mov esi, dword [esi + 0x10]
mov ecx, esi
movzx edx, dl
push edx
call dword [0x5f3508]
mov ecx, dword [ebx + 0x2c]
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x28
Function at 0x4e03e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x58
mov eax, dword [0x68a140]
xor eax, esp
mov dword [esp + 0x54], eax
sub esp, 0xc
mov dword [esp + 0x1c], 0x44413833
mov eax, esp
mov dword [esp + 0x20], 0x38354432
movq xmm0, qword [esp + 0x1c]
mov dword [esp + 0x58], ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x5c], edx
movq qword [eax], xmm0
mov dword [eax + 8], 0xbe
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x6e657665
mov dword [esp + 0x18], 0x5f725f74
mov dword [esp + 0x1c], 0x637072
call fcn.00428b30
push 0x20
lea eax, [esp + 0x54]
push str.:_RPC_call_failed_with_code_
push eax
lea edx, [esp + 0x58]
call fcn.004e0240
add esp, 0xc
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 0x50]
lea ecx, [esp + 0x14]
push dword [esp + 0x50]
call fcn.004e0360
push 0x686b14
lea eax, [esp + 0x14]
push eax
call fcn.0059b61b
int3

Function at 0x4e2500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x14], 0x41454541
xorps xmm0, xmm0
mov eax, dword [ebp - 0x14]
mov edx, 7
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x41354141
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], ecx
mov ecx, esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x40], 0x6e657665
mov dword [ebp - 0x3c], 0x5f725f74
mov dword [ebp - 0x38], 0x637072
mov dword [ebp - 0x2c], 0x1c
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
call fcn.004254c0
add esp, 4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e40d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e1e50
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x170
mov eax, dword [0x68a140]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebx + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0x41454541
xor edx, edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1c], 0x41354141
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x180]
push eax
mov dword [ebp - 0x50], 0x6e657665
mov dword [ebp - 0x4c], 0x5f725f74
mov dword [ebp - 0x48], 0x637072
mov dword [ebp - 0x3c], 0x22
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0
call fcn.004254c0
add esp, 4
push str.asw::event_routing::rpc::impl::RpcEndpoint::AddAcceptedEventMask
lea ecx, [ebp - 0x180]
mov dword [ebp - 4], 0
call fcn.0043ba60
push str._this
mov ecx, eax
call fcn.0043ba60
lea ecx, [ebp - 0x21]
mov byte [ebp - 0x21], 0x22
push ecx
mov ecx, eax
call fcn.004f6750
lea ecx, [esi + 0x88]
push ecx
mov ecx, eax
call fcn.00428440
lea ecx, [ebp - 0x21]
mov byte [ebp - 0x21], 0x22
push ecx
mov ecx, eax
call fcn.004f6750
lea ecx, [ebp - 0x21]
mov byte [ebp - 0x21], 0x2c
push ecx
mov ecx, eax
call fcn.004f6750
lea ecx, [ebp - 0x21]
mov byte [ebp - 0x21], 0x22
push ecx
mov ecx, eax
call fcn.004f6750
push edi
mov ecx, eax
call fcn.00462d40
lea ecx, [ebp - 0x21]
mov byte [ebp - 0x21], 0x22
push ecx
mov ecx, eax
call fcn.004f6750
push 0x62a050
mov ecx, eax
call fcn.0043ba60
lea ecx, [ebp - 0x180]
mov dword [ebp - 4], 0xffffffff
call fcn.00426740
xorps xmm0, xmm0
lea ecx, [esi + 0x120]
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], ecx
call fcn.004d7bc0
mov byte [ebp - 0x18], 1
mov edx, edi
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x6c]
call fcn.004f4da0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x154]
push eax
call fcn.004f5a70
mov ecx, dword [ebp - 0x58]
cmp ecx, 0xf
jbe 0x4e427b
mov edx, dword [ebp - 0x6c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e4271
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e42d4
push ecx
push edx
call fcn.0059a0ba
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [esi + 0x28]
cmp dword [esi + 0x28], 0
jg 0x4e42ad
push dword [esi + 0x30]
mov dword [esi + 0x24], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00599e5b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.005a55ef
int3