joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5810
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4b5820
pop esi
xor eax, eax
pop ebx
ret 8
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x4b582f
pop esi
xor eax, eax
pop ebx
ret 8
mov edx, dword [esp + 0x10]
test edx, edx
jne 0x4b583e
pop esi
xor eax, eax
pop ebx
ret 8
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esi + 0x18]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
ret 8

Function at 0x4b58b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ecx]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push edi
test eax, eax
je 0x4b58fa
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4b58fa
test ebx, ebx
je 0x4b58fa
cmp dword [ebp], 0
jbe 0x4b58fa
push ebp
lea edx, [esp + 0x1c]
push ebx
push edx
push 0
push eax
mov eax, dword [ecx + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4b58fa
cmp dword [esp + 0x18], 1
jne 0x4b58fa
pop edi
mov eax, ebx
pop ebp
pop ebx
ret 0x10
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x4b5936
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push esi
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop esi
mov dword [ebp], ecx
pop edi
mov eax, ebx
pop ebp
pop ebx
ret 0x10
mov dword [ebp], 0
pop edi
pop ebp
xor eax, eax
pop ebx
ret 0x10

Function at 0x4b5950
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ecx]
sub esp, 8
test eax, eax
je 0x4b5996
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4b5996
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 4
push edx
lea edx, [esp + 8]
push edx
lea edx, [esp + 8]
push edx
push 0
push eax
mov eax, dword [ecx + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4b5996
mov eax, dword [esp]
cmp eax, 4
mov eax, dword [esp + 4]
je 0x4b599a
mov eax, dword [esp + 0x10]
add esp, 8
ret 8
Function at 0x4b5da0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x509496
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebx, ecx
push esi
push edi
xor ebp, ebp
lea ecx, [ebx + 0x38]
push eax
mov dword [esp + 0x14], ebx
mov dword [ebx + 0x20], 0x513bdc
mov dword [ebx + 0x34], ebp
call fcn.004f8490
mov edx, dword [esp + 0x40]
lea ecx, [ebx + 0x40]
push edx
mov dword [esp + 0x20], ebp
call fcn.004f8490
mov esi, dword [esp + 0x2c]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov byte [esp + 0x20], 1
call fcn.004fcaea
mov edx, eax
add esp, 4
cmp edx, ebp
mov dword [ebx], edx
je 0x4b5e2e
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov dword [ebx + 0x14], ecx
mov ecx, dword [esp + 0x24]
mov dword [ebx + 8], edx
mov edx, dword [esp + 0x28]
mov dword [ebx + 0x18], ecx
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ebx + 4], eax
mov dword [ebx + 0x10], ebp
mov dword [ebx + 0xc], ebp
mov dword [ebx + 0x48], ebp
mov dword [ebx + 0x1c], edx
pop esi
mov dword [ebx + 0x34], ebx
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20
Function at 0x4b6720
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x50952b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], 0x513bec
push 1
lea ecx, [esi + 0x80]
mov dword [esp + 0x18], ebx
call fcn.004f8490
mov ecx, dword [esp + 0xc]
mov eax, 0x13
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi], method.CClawDialog.virtual_536
mov dword [esi + 0xc], ebx
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0x77359400
mov dword [esi + 0x20], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 1
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 8], 1
mov dword [esi + 0x64], ebx
mov dword [esi + 0x2c], 3
mov dword [esi + 4], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x78], 5
mov dword [esi + 0x7c], 9
mov dword [esi + 0x90], 0x64
mov byte [esi + 0x94], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4bc440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x400
push edi
mov edi, ecx
mov ecx, dword [0x56fc80]
push str.PALETTE
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4bc46e
pop edi
add esp, 0x400
ret 0xc
mov edx, dword [0x56fc80]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4bc48a
pop edi
add esp, 0x400
ret 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x4bc49f
pop edi
add esp, 0x400
ret 0xc
push esi
lea ecx, [esp + 9]
mov esi, 0x100
mov dl, byte [eax]
inc eax
mov byte [ecx - 1], dl
add ecx, 4
mov dl, byte [eax]
inc eax
mov byte [ecx - 4], dl
mov dl, byte [eax]
inc eax
mov byte [ecx - 3], dl
mov byte [ecx - 2], 0
dec esi
jne 0x4bc4a9
mov eax, dword [esp + 0x414]
mov edx, dword [esp + 0x40c]
lea ecx, [esp + 8]
push eax
push ecx
push edx
mov ecx, edi
call fcn.004bbdf0
pop esi
pop edi
add esp, 0x400
ret 0xc
Function at 0x4bc860
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x4bc870
pop edi
xor eax, eax
pop esi
ret
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esi + 0x24]
mov edi, eax
mov eax, dword [esi + 0x20]
sub edi, ecx
cmp edi, eax
jb 0x4bc890
mov ecx, esi
call fcn.004bca10
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x14]
push ebx
test eax, eax
mov eax, dword [esi + 0x28]
je 0x4bc94a
cmp edi, eax
je 0x4bc9f5
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x30]
add eax, ecx
cmp ecx, eax
jge 0x4bc9db
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
mov bl, byte [edx + ecx*4]
xor edx, edx
mov dl, byte [eax + ecx*4]
mov eax, edx
mov edx, ebx
and edx, 0xff
sub eax, edx
imul eax, edi
cdq
idiv dword [esi + 0x20]
mov edx, dword [esi + 0xc]
add al, bl
mov byte [edx + ecx*4], al
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
mov bl, byte [eax + ecx*4 + 1]
xor eax, eax
mov al, byte [edx + ecx*4 + 1]
mov edx, ebx
and edx, 0xff
sub eax, edx
imul eax, edi
cdq
idiv dword [esi + 0x20]
mov edx, dword [esi + 0xc]
add al, bl
mov byte [edx + ecx*4 + 1], al
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
mov bl, byte [eax + ecx*4 + 2]
xor eax, eax
mov al, byte [edx + ecx*4 + 2]
mov edx, ebx
and edx, 0xff
sub eax, edx
imul eax, edi
cdq
idiv dword [esi + 0x20]
mov edx, dword [esi + 0xc]
add al, bl
mov byte [edx + ecx*4 + 2], al
mov eax, dword [esi + 0x30]
mov ebx, dword [esi + 0x2c]
inc ecx
add eax, ebx
cmp ecx, eax
jl 0x4bc8b7
jmp 0x4bc9db
cmp edi, eax
je 0x4bc9f5
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x30]
add eax, ecx
cmp ecx, eax
jge 0x4bc9db
mov edx, dword [esi + 0x18]
xor eax, eax
mov al, byte [esi + 0x1c]
mov bl, byte [edx + ecx*4]
mov edx, ebx
and edx, 0xff
sub eax, edx
imul eax, edi
cdq
idiv dword [esi + 0x20]
mov edx, dword [esi + 0xc]
add al, bl
mov byte [edx + ecx*4], al
mov eax, dword [esi + 0x18]
mov bl, byte [eax + ecx*4 + 1]
xor eax, eax
mov al, byte [esi + 0x1d]
mov edx, ebx
and edx, 0xff
sub eax, edx
imul eax, edi
cdq
idiv dword [esi + 0x20]
mov edx, dword [esi + 0xc]
add al, bl
mov byte [edx + ecx*4 + 1], al
mov eax, dword [esi + 0x18]
mov bl, byte [eax + ecx*4 + 2]
xor eax, eax
mov al, byte [esi + 0x1e]
mov edx, ebx
and edx, 0xff
sub eax, edx
imul eax, edi
cdq
idiv dword [esi + 0x20]
mov edx, dword [esi + 0xc]
add al, bl
mov byte [edx + ecx*4 + 2], al
mov eax, dword [esi + 0x30]
mov ebx, dword [esi + 0x2c]
inc ecx
add eax, ebx
cmp ecx, eax
jl 0x4bc95e
mov ecx, dword [esi + 0x2c]
mov ebx, dword [esi + 0xc]
mov eax, dword [esi + 4]
lea ebx, [ebx + ecx*4]
mov edx, dword [eax]
push ebx
mov ebx, dword [esi + 0x30]
push ebx
push ecx
push 0
push eax
call dword [edx + 0x18]
mov dword [esi + 0x28], edi
pop ebx
pop edi
mov eax, 1
pop esi
ret
Function at 0x4bdc90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5098ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push ebx
mov ebx, ecx
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x18]
push esi
push edi
xor edi, edi
mov eax, dword [ecx + 8]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], edi
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x30]
cmp eax, edi
je 0x4bdcfd
push eax
push 0x6ae
push str.C:ProjDDrawMgrDDRAWMGR.CPP
call fcn.004bdf60
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 8
push 0xc0
call fcn.004fcaea
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
cmp esi, edi
mov dword [esp + 0x18], edi
je 0x4bdd43
lea ecx, [esi + 0x94]
call fcn.004fb9fb
mov dword [esi], 0x513c78
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 4], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xb8], edi
jmp 0x4bdd45
xor esi, esi
mov eax, dword [esp + 0xc]
mov edx, dword [esi]
push eax
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
call dword [edx + 4]
test eax, eax
jne 0x4bdd7f
cmp esi, edi
je 0x4bdd69
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 8
push esi
mov ecx, ebx
call fcn.004bd1a0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4bee66
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, ecx
push 2
mov ecx, dword [0x56fc80]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4bee83
pop esi
pop ebp
pop ebx
ret 0xc
mov edx, dword [0x56fc80]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4bee9b
pop esi
pop ebp
pop ebx
ret 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4beeae
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [ebx + 8]
cmp word [ebx + 0xe], 8
mov ebp, dword [ebx + 4]
mov dword [esp + 0x14], eax
je 0x4beec7
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
lea edx, [esi + 0x10]
push edi
mov ecx, 0x1b
xor eax, eax
mov edi, edx
push eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
or ecx, 0x40
mov dword [edx], 0x6c
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x78], ecx
push eax
mov ecx, esi
mov dword [esi + 0x14], 7
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x18], edx
call fcn.004b9b60
test eax, eax
pop edi
jne 0x4bef0f
pop esi
pop ebp
pop ebx
ret 0xc
mov ecx, dword [ebx]
push 2
lea edx, [ecx + ebx + 0x400]
mov ecx, esi
push edx
call fcn.004ba560
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
Function at 0x4bf4f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x509948
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp]
call dword [eax + 0x14]
test eax, eax
je 0x4bf6c7
mov eax, dword [esp + 0x70]
xor ebx, ebx
cmp eax, ebx
jne 0x4bf52d
xor eax, eax
jmp 0x4bf6c7
cmp byte [eax], 0
jne 0x4bf539
xor eax, eax
jmp 0x4bf6c7
mov eax, dword [ebp + 0xa8]
cmp eax, 0x18
je 0x4bf54b
xor eax, eax
jmp 0x4bf6c7
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0x34]
lea esi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
mov dword [esp + 0x3c], eax
imul eax, ecx
mov dword [esp + 0x38], ecx
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov edx, eax
mov dword [esp + 0x18], ecx
mov edi, 0x530984
mov dword [esp + 0x1c], ecx
xor eax, eax
mov word [esp + 0x20], cx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x38], 0x28
and ecx, 3
mov word [esp + 0x44], 1
rep movsb byte es:[edi], byte [esi]
lea ecx, [edx + edx*2 + 0x3a]
mov word [esp + 0x46], 0x18
mov dword [esp + 0x1a], ecx
mov ecx, ebp
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x22], 0x3a
call fcn.004ba180
mov edi, eax
cmp edi, ebx
jne 0x4bf5ed
xor eax, eax
jmp 0x4bf6c7
lea ecx, [esp + 0x24]
call fcn.004fd528
mov eax, dword [esp + 0x78]
mov dword [esp + 0x68], ebx
cmp eax, ebx
push ebx
je 0x4bf6dc
mov edx, dword [esp + 0x74]
push 0x2001
push edx
lea ecx, [esp + 0x30]
call fcn.004fd63a
test eax, eax
jne 0x4bf644
mov ebp, dword [ebp + 8]
push ebx
push ebp
mov eax, dword [ebp]
call dword [eax + 0x80]
lea ecx, [esp + 0x24]
mov dword [esp + 0x68], 0xffffffff
call fcn.004fd57d
xor eax, eax
jmp 0x4bf6c7
push 2
push ebx
lea ecx, [esp + 0x2c]
call fcn.004fd7dc
lea eax, [esp + 0x14]
push 0xe
push eax
lea ecx, [esp + 0x2c]
call fcn.004fd791
lea ecx, [esp + 0x34]
push 0x2c
push ecx
lea ecx, [esp + 0x2c]
call fcn.004fd791
mov ebx, dword [ebp + 0x18]
dec ebx
test ebx, ebx
jl 0x4bf6a2
mov eax, dword [ebp + 0x1c]
xor esi, esi
test eax, eax
jle 0x4bf69f
mov ecx, dword [ebp + 0x20]
lea edx, [eax + eax*2]
imul ecx, ebx
add ecx, edi
push edx
push ecx
lea ecx, [esp + 0x2c]
call fcn.004fd791
mov eax, dword [ebp + 0x1c]
inc esi
cmp esi, eax
jl 0x4bf681
dec ebx
jns 0x4bf678
mov ebp, dword [ebp + 8]
push 0
push ebp
mov eax, dword [ebp]
call dword [eax + 0x80]
lea ecx, [esp + 0x24]
mov dword [esp + 0x68], 0xffffffff
call fcn.004fd57d
mov eax, 1
mov ecx, dword [esp + 0x60]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x5c
ret 0xc
mov ecx, dword [esp + 0x74]
push 0x1001
push ecx
lea ecx, [esp + 0x30]
call fcn.004fd63a
test eax, eax
jne 0x4bf650
mov ebp, dword [ebp + 8]
push ebx
push ebp
mov edx, dword [ebp]
call dword [edx + 0x80]
lea ecx, [esp + 0x24]
mov dword [esp + 0x68], 0xffffffff
call fcn.004fd57d
xor eax, eax
jmp 0x4bf6c7
Function at 0x4d2450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50a416
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x44
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
mov esi, ecx
jne 0x4d247f
xor eax, eax
jmp 0x4d2638
mov edi, dword [esi + 0xb0]
cmp edi, ebx
je 0x4d24b7
mov dword [esp + 0x10], edi
mov ecx, edi
mov dword [esp + 0x5c], ebx
call fcn.004d5ae0
lea ecx, [edi + 0x70]
mov dword [esp + 0x5c], 0xffffffff
call fcn.004d30b0
push edi
call fcn.004fcb13
add esp, 4
mov dword [esi + 0xb0], ebx
mov ecx, dword [esi + 0x30]
mov eax, dword [esi + 0x34]
dec ecx
dec eax
mov dword [esp + 0x50], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ecx
mov edi, dword [eax + 8]
cmp edi, ebx
jne 0x4d24e0
xor eax, eax
jmp 0x4d2638
mov eax, dword [eax + 0x24]
cmp eax, ebx
jne 0x4d24ee
xor eax, eax
jmp 0x4d2638
mov ecx, dword [eax + 0xb0]
push 0xb8
mov dword [esp + 0x40], ecx
mov edx, dword [eax + 0xb4]
mov dword [esp + 0x44], edx
mov ecx, dword [eax + 0xb8]
mov dword [esp + 0x38], ecx
mov edx, dword [eax + 0xbc]
mov dword [esp + 0x3c], edx
mov ecx, dword [eax + 0xc0]
mov dword [esp + 0x30], ecx
mov edx, dword [eax + 0xc4]
mov dword [esp + 0x34], edx
mov ecx, dword [eax + 0xc8]
mov dword [esp + 0x28], ecx
mov edx, dword [eax + 0xcc]
mov dword [esp + 0x2c], edx
mov ecx, dword [eax + 0xd0]
mov dword [esp + 0x20], ecx
mov edx, dword [eax + 0xd4]
mov dword [esp + 0x24], edx
mov ecx, dword [eax + 0xd8]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0xdc]
mov dword [esp + 0x1c], edx
call fcn.004fcaea
add esp, 4
cmp eax, ebx
mov ebp, 0x5144d0
je 0x4d2598
mov dword [eax + 0x70], ebp
mov dword [eax + 0x74], ebx
mov dword [eax + 0x78], ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0xb4], ebx
jmp 0x4d259a
xor eax, eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x28]
push edx
push ecx
lea edx, [esp + 0x38]
lea ecx, [esp + 0x40]
push edx
push ecx
lea edx, [esp + 0x50]
lea ecx, [esp + 0x58]
push edx
push ecx
push edi
mov ecx, eax
mov dword [esi + 0xb0], eax
call fcn.004d5880
test eax, eax
jne 0x4d260a
mov edi, dword [esi + 0xb0]
cmp edi, ebx
mov dword [esp + 0x64], edi
je 0x4d2600
mov ecx, edi
mov dword [esp + 0x5c], 1
call fcn.004d5ae0
push edi
mov dword [esp + 0x60], 0xffffffff
mov dword [edi + 0x70], ebp
call fcn.004fcb13
add esp, 4
mov dword [esi + 0xb0], ebx
xor eax, eax
jmp 0x4d2638
mov ebp, dword [esp + 0x68]
xor edi, edi
cmp ebp, ebx
jle 0x4d2633
mov edx, dword [esp + 0x64]
mov ecx, esi
push edx
call fcn.004d2650
cmp eax, ebx
je 0x4d2606
mov edx, dword [esp + 0x64]
add edx, eax
inc edi
cmp edi, ebp
mov dword [esp + 0x64], edx
jl 0x4d2614
mov eax, 1
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 8
Function at 0x4d8630
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50a648
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], method.CTextMgr.virtual_0
mov eax, dword [esi + 0x30]
mov dword [esp + 0x10], 0
test eax, eax
je 0x4d866b
push eax
call fcn.004fcb13
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esi + 0xc], 0xffff
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4e09b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004e00c0
test eax, eax
je 0x4e0a8f
mov eax, dword [esi + 0x24]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x4e0a2b
mov ecx, esi
call fcn.004e0100
push eax
mov ecx, esi
call fcn.004e00d0
mov edi, eax
test edi, edi
je 0x4e0a8f
mov ebx, dword [edi + 0x68]
call ebp
sub eax, dword [esi + 0x2c]
cmp eax, ebx
jbe 0x4e0a2b
mov ecx, edi
mov dword [esi + 0x24], 0
call fcn.004e1a10
test al, 0x20
jne 0x4e0a1f
mov ecx, edi
call fcn.004e1a10
test al, 0x10
je 0x4e0a16
push 0x15
jmp 0x4e0a18
push 5
mov ecx, edi
call fcn.004e1a20
call ebp
mov dword [esi + 0x30], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov ecx, esi
call fcn.004e00c0
test eax, eax
je 0x4e0a8f
call ebp
mov ebx, eax
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x4e0a8f
mov edx, dword [esi + 0x30]
mov eax, dword [esi + 0x34]
mov ecx, ebx
sub ecx, edx
cmp ecx, eax
jbe 0x4e0a8f
mov ecx, esi
call fcn.004e0100
push eax
mov ecx, esi
call fcn.004e00d0
mov edi, eax
test edi, edi
je 0x4e0a8f
mov ecx, edi
call fcn.004e1a10
test al, 0x10
je 0x4e0a82
sub eax, 0x10
mov ecx, edi
push eax
call fcn.004e1a20
mov dword [esi + 0x30], ebx
pop edi
pop esi
pop ebp
pop ebx
ret
or al, 0x10
mov ecx, edi
push eax
call fcn.004e1a20
mov dword [esi + 0x30], ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4e1df0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50a919
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x52c668]
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ebp, [esi + 0xc]
mov dword [ebp], eax
xor edi, edi
mov dword [esi + 0x10], 0x5145f4
mov dword [esp + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 1
call fcn.004e0d10
push str.no_description
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
mov dword [esi], 0x5145e0
mov dword [esi + 0x24], edi
call fcn.004fce17
push eax
mov ecx, ebp
mov byte [esp + 0x20], 3
call fcn.004fce96
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call fcn.004fcda9
push 0x24
mov dword [esi + 0x30], 9
call fcn.004fcaea
mov ecx, dword [esp + 0x18]
add esp, 4
mov dword [esi + 0x2c], eax
mov dword [esi + 4], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 8], edi
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4e4c80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50aaca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov edi, 0x514a08
mov dword [esp + 0xc], esi
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xcc], edi
lea ecx, [esi + 0xd4]
mov dword [esp + 0x18], ebx
call fcn.005031e0
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xe4], edi
lea ecx, [esi + 0xec]
mov byte [esp + 0x18], 2
call fcn.005031e0
mov eax, 0x5149fc
mov dword [esi + 0x108], ebx
mov dword [esi + 0x104], edi
mov dword [esi + 0x10c], eax
mov dword [esi + 0x110], ebx
mov dword [esi + 0x114], eax
mov eax, dword [esp + 0x20]
lea edx, [esi + 0xc]
mov dword [esi + 0x118], ebx
xor ecx, ecx
mov dword [esi], 0x514834
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
mov dword [edx], ecx
mov eax, dword [esp + 0x24]
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov word [edx + 0x10], cx
lea ecx, [esi + 0xbc]
push ecx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov word [esi + 0x34], bx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
call dword [sym.imp.USER32.dll_SetRectEmpty]
lea edx, [esi + 0x124]
push ebx
mov ecx, 0x55
xor eax, eax
mov edi, edx
push edx
mov dword [esi + 0xfc], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x120], ebx
push ebx
push 0x29
rep stosd dword es:[edi], eax
mov dword [edx], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov dword [esi + 0x278], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 8