joyce8/EMBER2024-capa huggingface dataset:
Function at 0x523440
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x53fb40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.005182b6
mov eax, dword [0x7a3ff8]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.005181e8
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.00523ee0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x5234e7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x5234de
cmp al, 0xff
je 0x5234de
dec al
mov byte [ecx], al
jmp 0x5234e7
push ecx
call fcn.0052d5cb
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x523518
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x52350f
cmp al, 0xff
je 0x52350f
dec al
mov byte [ecx], al
jmp 0x523518
push ecx
call fcn.0052d5cb
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x52fc32
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x52fc6a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0052dcbc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0052dc94
jmp 0x52fc76
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x531324
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x531366
call fcn.0053741b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x531366
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x53135d
xor eax, eax
jmp 0x53136e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00531374
pop edi
pop esi
pop ebx
ret 4

Function at 0x53794b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x537979
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x537997
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005378b1
jmp 0x537997
mov eax, dword [esi + 0x14]
test eax, eax
je 0x537997
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005378b1
test edi, edi
mov eax, edi
jne 0x537981
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4041fc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4e1008], 0x8088405
inc edx
mov dword [ebx + 0x4e1008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x404218
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4e1008], 0x8088405
inc edx
mov dword [ebx + 0x4e1008], edx
fld qword [ebx + 0x4e106c]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x4216d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4216d6
ret

Function at 0x45b9f8
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405d84
xor eax, eax
push ebp
push 0x45af8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004058d4
mov ebx, 1
xor edi, edi
mov eax, dword [ebp - 4]
call fcn.00405b94
mov dword [ebp - 0x18], eax
cmp ebx, dword [ebp - 0x18]
jg 0x45bb67
jmp 0x45baca
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx - 1]
mov byte [ebp - 9], al
xor eax, eax
mov al, byte [ebp - 9]
cmp eax, 0x3d
jg 0x45ba75
je 0x45ba9d
sub eax, 0x2b
je 0x45ba87
sub eax, 4
je 0x45ba8d
dec eax
sub eax, 0xa
jb 0x45ba93
jmp 0x45bab6
add eax, 0xffffffbf
sub eax, 0x1a
jb 0x45baa2
add eax, 0xfffffffa
sub eax, 0x1a
jb 0x45baac
jmp 0x45bab6
mov si, 0x3e
jmp 0x45baba
mov si, 0x3f
jmp 0x45baba
movzx esi, byte [ebp - 9]
sub si, 0xfffc
jmp 0x45baba
or esi, 0xffffffff
jmp 0x45baba
movzx esi, byte [ebp - 9]
sub si, 0x41
jmp 0x45baba
movzx esi, byte [ebp - 9]
sub si, 0x47
jmp 0x45baba
mov si, 0xfffe
cmp si, 0xfffe
je 0x45bac9
movzx eax, di
mov word [ebp + eax*2 - 0x12], si
inc edi
inc ebx
cmp ebx, dword [ebp - 0x18]
jg 0x45bad9
cmp di, 4
jb 0x45ba4d
cmp di, 4
jne 0x45bb5e
xor edi, edi
lea eax, [ebp - 0x1c]
mov dx, word [ebp - 0x12]
shl edx, 2
movsx ecx, word [ebp - 0x10]
shr ecx, 4
or dl, cl
call fcn.00405abc
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.00405b9c
mov eax, dword [ebp - 8]
cmp word [ebp - 0xe], 0xffff
je 0x45bb67
lea eax, [ebp - 0x20]
mov dx, word [ebp - 0x10]
shl edx, 4
movsx ecx, word [ebp - 0xe]
shr ecx, 2
or dl, cl
call fcn.00405abc
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.00405b9c
mov eax, dword [ebp - 8]
cmp word [ebp - 0xc], 0xffff
je 0x45bb67
lea eax, [ebp - 0x24]
mov dx, word [ebp - 0xe]
shl edx, 6
mov cx, word [ebp - 0xc]
or dl, cl
call fcn.00405abc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.00405b9c
mov eax, dword [ebp - 8]
cmp ebx, dword [ebp - 0x18]
jle 0x45baca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45af91
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004058f8
lea eax, [ebp - 4]
call fcn.004058d4
ret
Function at 0x47b2e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x47a789
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004635c8
mov edx, dword [ebp - 4]
lea eax, [ebx + 0xc]
call fcn.00405928
lea eax, [ebx + 0x28]
mov edx, dword [0x4e5004]
call fcn.00405928
lea eax, [ebx + 0x2c]
mov edx, dword [0x4e5008]
call fcn.00405928
lea eax, [ebx + 0x30]
mov edx, dword [0x4e500c]
call fcn.00405928
lea eax, [ebx + 0x38]
mov edx, dword [0x4e5010]
call fcn.00405928
lea eax, [ebx + 0x3c]
mov edx, dword [0x4e5014]
call fcn.00405928
lea eax, [ebx + 0x34]
mov edx, dword [0x4e5018]
call fcn.00405928
lea eax, [ebx + 0x40]
mov edx, dword [0x4e501c]
call fcn.00405928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a790
lea eax, [ebp - 4]
call fcn.004058d4
ret

Function at 0x47b394
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x47b39d
xchg dword [ebp - 4], ecx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405d84
xor eax, eax
push ebp
push 0x47a8da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405928
mov al, byte [0x47a8e8]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x2c]
call fcn.00464ae4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405928
mov al, byte [0x47a8e8]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x30]
call fcn.00464ae4
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00405928
mov al, byte [0x47a8e8]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x38]
call fcn.00464ae4
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00405928
mov al, byte [0x47a8e8]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x3c]
call fcn.00464ae4
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00405928
mov al, byte [0x47a8e8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
call fcn.00463b68
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov edx, dword [esi + 0x40]
call fcn.00464ae4
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.00405928
mov al, byte [0x47a8e8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebx]
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x34]
call fcn.00464ae4
mov edx, dword [ebp - 0x20]
mov eax, ebx
call fcn.00405928
mov al, byte [0x47a8e8]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebx]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x28]
call fcn.00464ae4
mov edx, dword [ebp - 0x24]
mov eax, ebx
call fcn.00405928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a8e1
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.004058f8
ret
Function at 0x4cf874
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4ced12
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x34]
add eax, 8
call fcn.004058d4
mov eax, dword [ebx + 0x34]
add eax, 0xc
call fcn.004058d4
mov eax, dword [ebx + 0x34]
add eax, 0x1c
call fcn.004058d4
mov eax, dword [ebx + 0x34]
add eax, 0x20
call fcn.004058d4
mov eax, dword [ebx + 0x34]
add eax, 0x18
call fcn.004058d4
mov eax, dword [ebx + 0x34]
add eax, 0x24
call fcn.004058d4
mov eax, dword [ebx + 0x34]
add eax, 0x28
call fcn.004058d4
mov eax, dword [ebx + 0x34]
add eax, 0x30
call fcn.004058d4
mov eax, dword [ebx + 0x34]
add eax, 0x34
call fcn.004058d4
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x10]
call fcn.00465cf8
mov eax, dword [ebx + 0x1c]
call fcn.00465cf8
mov eax, dword [ebx + 0x20]
call fcn.00465cf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cf91c
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4d2050
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d15a8
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x70], 0
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x4e364c]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x44]
add eax, 0x1c
mov edx, dword [0x4e3a98]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 4
mov dword [eax + 0x28], 8
mov dword [eax + 0x2c], 7
mov dword [eax + 0x34], 3
mov byte [eax + 9], 1
mov dword [eax + 0x30], 1
mov byte [eax + 0xa], 1
mov byte [eax + 0x21], 2
mov eax, dword [ebx + 0x34]
mov byte [eax + 4], 0
mov dword [eax + 0x38], 6
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4e3b54]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4e38d8]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4e37f4]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4e3c2c]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4e37a8]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4e36bc]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x4e386c]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x4e38b0]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x4e38e8]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x4e38a4]
mov edx, dword [edx]
call fcn.00405928
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d21b2
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d23d4
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d1955
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x4c], 1
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x4e3b50]
mov edx, dword [edx]
call fcn.00405928
mov ecx, dword [0x4e3780]
mov ecx, dword [ecx]
mov edx, dword [0x4e34cc]
mov edx, dword [edx]
mov eax, dword [ebx + 0x44]
add eax, 0x1c
call fcn.00405be0
mov eax, dword [ebx + 0x44]
add eax, 0xc
mov edx, dword [0x4e34cc]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 3
mov dword [eax + 0x28], 9
mov dword [eax + 0x2c], 7
mov dword [eax + 0x34], 2
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 5
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x44]
mov byte [eax + 9], 1
mov dword [eax + 0x30], 2
mov byte [eax + 0xa], 1
mov byte [eax + 0x21], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4e384c]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4e35a4]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4e34d8]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4e3938]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4e348c]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4e3bb8]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x4e3558]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x4e3588]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x4e35b0]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x4e3580]
mov edx, dword [edx]
call fcn.00405928
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d255f
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d271c
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d1c9d
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x4c], 1
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x4e3708]
mov edx, dword [edx]
call fcn.00405928
mov ecx, dword [0x4e3780]
mov ecx, dword [ecx]
mov edx, dword [0x4e3894]
mov edx, dword [edx]
mov eax, dword [ebx + 0x44]
add eax, 0x1c
call fcn.00405be0
mov eax, dword [ebx + 0x44]
add eax, 0xc
mov edx, dword [0x4e3894]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 9
mov dword [eax + 0x28], 9
mov dword [eax + 0x2c], 7
mov dword [eax + 0x34], 2
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 5
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x44]
mov byte [eax + 9], 1
mov dword [eax + 0x30], 2
mov byte [eax + 0xa], 1
mov byte [eax + 0x21], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4e3c00]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4e3978]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4e38a0]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4e34d4]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4e383c]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4e377c]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x4e3924]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x4e3960]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x4e3980]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x4e394c]
mov edx, dword [edx]
call fcn.00405928
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d28a7
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d27b2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d1c9d
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x4c], 1
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x4e3708]
mov edx, dword [edx]
call fcn.00405928
mov ecx, dword [0x4e3780]
mov ecx, dword [ecx]
mov edx, dword [0x4e3894]
mov edx, dword [edx]
mov eax, dword [ebx + 0x44]
add eax, 0x1c
call fcn.00405be0
mov eax, dword [ebx + 0x44]
add eax, 0xc
mov edx, dword [0x4e3894]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 9
mov dword [eax + 0x28], 9
mov dword [eax + 0x2c], 7
mov dword [eax + 0x34], 2
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 5
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x44]
mov byte [eax + 9], 1
mov dword [eax + 0x30], 2
mov byte [eax + 0xa], 1
mov byte [eax + 0x21], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4e3c00]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4e3978]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4e38a0]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4e34d4]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4e383c]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4e377c]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x4e3924]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x4e3960]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x4e3980]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x4e394c]
mov edx, dword [edx]
call fcn.00405928
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d28a7
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d2a64
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d1f40
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x4c], 1
mov byte [ebx + 0x30], 0
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 0
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 5
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4e3c14]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4e3988]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4e38b8]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4e34f0]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4e3864]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4e378c]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0x10
mov edx, dword [0x4e35dc]
mov edx, dword [edx]
call fcn.00405928
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d2b4a
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4d2dd4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d22ac
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x30], 1
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 0
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 6
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4e3ab8]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4e3800]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4e371c]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4e3b70]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4e36cc]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4e35f4]
mov edx, dword [edx]
call fcn.00405928
mov eax, dword [ebx + 0x38]
add eax, 0x10
mov edx, dword [0x4e3c74]
mov edx, dword [edx]
call fcn.00405928
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d2eb6
pop edi
pop esi
pop ebx
pop ebp
ret