joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e31a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b14bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi], 0x6c354c
mov dword [esp + 0x14], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
push fcn.00527170
push fcn.00527000
push 2
push 0x5d8
lea eax, [esi + 0x4c]
push eax
mov byte [esp + 0x28], 2
call fcn.005ce6bb
lea ecx, [esi + 0xbfc]
mov byte [esp + 0x14], 3
call fcn.00527000
lea ecx, [esi + 0x11d4]
mov byte [esp + 0x14], 4
call fcn.0052d480
lea ecx, [esi + 0x1244]
mov byte [esp + 0x14], 5
call fcn.0052b880
mov dword [esi + 0x24a4], ebx
mov dword [esi + 0x24a0], ebx
mov dword [esi + 0x24a8], ebx
mov dword [esi + 0x24ac], ebx
mov byte [esi + 0x24b8], 0xff
mov byte [esi + 0x24b9], bl
mov dword [esi + 0x24bc], ebx
mov dword [esi + 0x24c0], ebx
mov dword [esi + 0x24c4], ebx
mov dword [esi + 0x24c8], ebx
lea eax, [esi + 0x24b8]
mov byte [eax + 0x14], 0xff
mov byte [eax + 0x15], bl
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
add eax, 0x14
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov byte [eax + 0x14], 0xff
add eax, 0x14
mov byte [eax + 1], bl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov byte [esp + 0x14], 7
mov byte [esi + 0x24f4], 0xff
mov byte [esi + 0x24f5], bl
mov dword [esi + 0x24f8], ebx
mov dword [esi + 0x24fc], ebx
mov dword [esi + 0x2500], ebx
lea ecx, [esi + 0x2610]
mov dword [esi + 0x2504], ebx
call fcn.004230b0
mov ecx, dword [esp + 0xc]
mov byte [0x21fe128], bl
mov dword [0x21fe12c], ebx
mov byte [0x2201970], bl
mov dword [esi + 0x26c0], ebx
mov dword [esi + 0x24b0], ebx
mov byte [esi + 0x250d], bl
mov dword [esi + 0x26c8], ebx
mov byte [esi + 0x26c4], bl
mov byte [esi + 0x2508], bl
mov byte [esi + 0x2509], bl
mov byte [esi + 0x250a], 1
mov byte [esi + 0x250b], 0xff
mov byte [esi + 0x250c], 0xff
mov dword [esi + 0xc], 0x1f9
mov dword [esi + 0x10], 0x16b
mov dword [esi + 0x24b4], 0xffffffff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4e4580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6b15d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi], 0x6c3598
mov dword [esi + 0x2c], 2
mov dword [esp + 0x14], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
push fcn.00527170
push fcn.00527000
push 3
push 0x5d8
lea eax, [esi + 0x40]
push eax
mov byte [esp + 0x28], 1
call fcn.005ce6bb
mov dword [esi + 0x11cc], ebx
mov dword [esi + 0x11c8], ebx
mov dword [esi + 0x11d0], ebx
mov dword [esi + 0x11d4], ebx
lea ecx, [esi + 0x11d8]
mov byte [esp + 0x14], 3
call fcn.0052d480
lea ecx, [esi + 0x1248]
mov byte [esp + 0x14], 4
call fcn.0052b880
lea ecx, [esi + 0x24a4]
mov byte [esp + 0x14], 5
call fcn.004230b0
mov byte [esi + 0x2665], bl
mov dword [esi + 0x2668], ebx
mov dword [esi + 0x266c], ebx
mov dword [esi + 0x2670], ebx
mov dword [esi + 0x2674], ebx
lea eax, [esi + 0x2664]
add eax, 0x14
mov cl, 0xff
mov byte [eax - 0x14], cl
mov byte [eax], cl
mov byte [eax + 1], bl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov byte [eax + 0x14], cl
mov byte [eax + 0x15], bl
mov dword [eax + 0x18], ebx
add eax, 0x14
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
add eax, 0x14
mov byte [eax], cl
mov byte [eax + 1], bl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
add eax, 0x14
mov byte [eax], cl
mov byte [eax + 1], bl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov byte [esi + 0x26c8], cl
mov byte [esi + 0x26c9], bl
mov dword [esi + 0x26cc], ebx
mov dword [esi + 0x26d0], ebx
mov dword [esi + 0x26d4], ebx
mov dword [esi + 0x26d8], ebx
mov byte [esi + 0x26dd], cl
mov byte [esi + 0x26df], cl
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x26e4], ebx
mov dword [esi + 0x26e8], ebx
mov dword [esi + 0x26ec], ebx
mov dword [esi + 0x26f0], ebx
mov dword [esi + 0x26f4], ebx
mov dword [esi + 0x26f8], ebx
mov dword [esi + 0x26fc], ebx
mov byte [esi + 0x26dc], 1
mov byte [esi + 0x26de], 1
mov dword [esi + 0x26e0], 5
mov dword [esi + 0xc], 0x1f9
mov dword [esi + 0x10], 0x16b
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4e52b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
push esi
push edi
push 0x7191e0
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 0x6bb5d5
push 0x6c35f4
push str.INTERFACE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4e530e
mov edi, str.TRUE
lea esi, [esp + 8]
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
sete al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x7191e0
lea eax, [esp + 0xc]
push eax
push 0x6c35f4
push str.INTERFACE
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e5de0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b16e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi], 0x6c3608
mov dword [esp + 0x18], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
push fcn.00527170
push fcn.00527000
push 4
push 0x5d8
lea eax, [esi + 0x4c]
push eax
mov byte [esp + 0x2c], 2
call fcn.005ce6bb
lea ecx, [esi + 0x17ac]
mov byte [esp + 0x18], 3
call fcn.00527000
lea ecx, [esi + 0x1d84]
mov byte [esp + 0x18], 4
call fcn.0052d480
lea ecx, [esi + 0x1df4]
mov byte [esp + 0x18], 5
call fcn.0052b880
lea ecx, [esi + 0x3058]
mov byte [esp + 0x18], 6
call fcn.004230b0
mov dword [esi + 0x3050], ebx
mov byte [esi + 0x320d], bl
mov dword [esi + 0xc], 0xff
mov dword [esi + 0x10], 0x1a1
xor eax, eax
lea edi, [esi + 0x320e]
mov ecx, 0x20
rep stosd dword es:[edi], eax
lea edi, [esi + 0x328e]
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4e69d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6b17bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi], 0x6c3770
mov dword [esp + 0x14], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
lea ecx, [esi + 0x80]
mov byte [esp + 0x14], 5
call fcn.004230b0
mov eax, dword [esi]
mov ecx, esi
mov byte [esp + 0x14], 6
mov dword [esi + 0x20], 1
mov dword [esi + 4], 0x286
mov dword [esi + 8], 0x4d
mov byte [esi + 0x7c], 0xff
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov byte [esi + 0x144], bl
mov dword [esi + 0x140], ebx
call dword [eax + 0xc]
mov ecx, esi
call fcn.00526820
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4e97b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6b1826
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi], 0x6c37b8
mov dword [esp + 0x14], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
push fcn.00527170
push fcn.00527000
push 3
push 0x5d8
lea eax, [esi + 0x3c]
push eax
mov byte [esp + 0x28], 1
call fcn.005ce6bb
mov dword [esi + 0x11c8], ebx
mov dword [esi + 0x11c4], ebx
mov dword [esi + 0x11cc], ebx
mov dword [esi + 0x11d0], ebx
lea ecx, [esi + 0x11d4]
mov byte [esp + 0x14], 3
call fcn.0052d480
lea ecx, [esi + 0x1244]
mov byte [esp + 0x14], 4
call fcn.0052b880
lea ecx, [esi + 0x24a0]
mov byte [esp + 0x14], 5
call fcn.004230b0
mov byte [esi + 0x2661], bl
mov dword [esi + 0x2664], ebx
mov dword [esi + 0x2668], ebx
mov dword [esi + 0x266c], ebx
mov dword [esi + 0x2670], ebx
lea eax, [esi + 0x2660]
mov cl, 0xff
mov byte [eax], cl
mov byte [eax + 0x14], cl
mov byte [eax + 0x15], bl
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x20], ebx
mov dword [eax + 0x24], ebx
add eax, 0x14
mov byte [eax + 0x14], cl
mov byte [eax + 0x15], bl
mov dword [eax + 0x18], ebx
add eax, 0x14
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov byte [esi + 0x269d], cl
mov byte [esi + 0x269f], cl
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x269c], 1
mov byte [esi + 0x269e], 1
mov dword [esi + 0x26a0], 3
mov dword [esi + 0xc], 0x1f9
mov dword [esi + 0x10], 0x16b
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4f86f0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x6b1dc1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [0x70aab8]
xor esi, esi
test edi, edi
jle 0x4f8855
mov ecx, dword [0x2203688]
mov eax, dword [ecx + 0x404]
shl eax, 8
mov dl, 0x80
lea ebx, [ebx]
mov ebx, dword [esi*8 + 0x70a6d0]
add ebx, eax
test byte [ebx + ecx + 4], dl
jne 0x4f8758
inc esi
cmp esi, edi
jl 0x4f8730
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
cmp dword [esi*8 + 0x70a6d0], 0x1c
jne 0x4f876a
push 0xd
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [esi*8 + 0x70a6d0]
cmp ecx, 1
je 0x4f87c2
mov edx, dword [0x2201ffc]
xor eax, eax
mov edi, edi
cmp eax, edx
je 0x4f878d
cmp ecx, dword [eax*4 + 0x2201c48]
je 0x4f87f1
inc eax
cmp eax, 0x14
jl 0x4f8780
mov eax, 0x2201db8
cmp ecx, dword [eax]
je 0x4f8817
add eax, 4
cmp eax, 0x2201de0
jl 0x4f8798
mov eax, 0x70a608
jmp 0x4f87b0
cmp ecx, dword [eax]
je 0x4f8869
add eax, 4
cmp eax, 0x70a684
jl 0x4f87b0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov ecx, dword [esi*8 + 0x70a6d4]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4f87d3
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push 0x254
call fcn.005cc96d
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x4f883d
mov ecx, eax
call fcn.005293b0
jmp 0x4f883f
push 0x254
call fcn.005cc96d
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 1
je 0x4f883d
mov ecx, eax
call fcn.005293b0
jmp 0x4f883f
xor eax, eax
mov dword [esp + 0x18], 0xffffffff
mov dword [0x2202038], eax
push 0xa
mov ecx, eax
call fcn.005297a0
mov ecx, dword [esp + 0x10]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
push 0x254
call fcn.005cc96d
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 2
je 0x4f889e
mov ecx, eax
call fcn.005293b0
mov dword [esp + 0x18], 0xffffffff
mov dword [0x2202038], eax
push 0xb
jmp 0x4f884e
xor eax, eax
mov dword [esp + 0x18], 0xffffffff
mov dword [0x2202038], eax
push 0xb
jmp 0x4f884e
Function at 0x4f88c0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x6b1dc1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [0x70aabc]
xor esi, esi
test edi, edi
jle 0x4f8a58
mov ecx, dword [0x2203688]
mov eax, dword [ecx + 0x404]
shl eax, 8
mov dl, 0x80
lea ebx, [ebx]
mov ebx, dword [esi*8 + 0x70a6d0]
add ebx, eax
test byte [ebx + ecx + 4], dl
jne 0x4f8928
inc esi
cmp esi, edi
jl 0x4f8900
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
cmp dword [0x708598], 4
jne 0x4f895d
cmp dword [esi*8 + 0x70a6d0], 0x94
jne 0x4f895d
pop edi
mov dword [esi*8 + 0x70a6d0], 1
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
cmp dword [esi*8 + 0x70a6d0], 0x1c
jne 0x4f896f
push 0xd
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [esi*8 + 0x70a6d0]
cmp ecx, 1
je 0x4f89c5
mov edx, dword [0x2201dec]
xor eax, eax
cmp eax, edx
je 0x4f8990
cmp ecx, dword [eax*4 + 0x2201db8]
je 0x4f89f4
inc eax
cmp eax, 0xa
jl 0x4f8983
mov eax, 0x2201c48
jmp 0x4f89a0
cmp ecx, dword [eax]
je 0x4f8a1a
add eax, 4
cmp eax, 0x2201c98
jl 0x4f89a0
mov eax, 0x70a608
cmp ecx, dword [eax]
je 0x4f8a6c
add eax, 4
cmp eax, 0x70a684
jl 0x4f89b3
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov ecx, dword [esi*8 + 0x70a6d4]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4f89d6
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push 0x254
call fcn.005cc96d
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x4f8a40
mov ecx, eax
call fcn.005293b0
jmp 0x4f8a42
push 0x254
call fcn.005cc96d
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 1
je 0x4f8a40
mov ecx, eax
call fcn.005293b0
jmp 0x4f8a42
xor eax, eax
mov dword [esp + 0x18], 0xffffffff
mov dword [0x2202038], eax
push 0xa
mov ecx, eax
call fcn.005297a0
mov ecx, dword [esp + 0x10]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
push 0x254
call fcn.005cc96d
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 2
je 0x4f8aa1
mov ecx, eax
call fcn.005293b0
mov dword [esp + 0x18], 0xffffffff
mov dword [0x2202038], eax
push 0xb
jmp 0x4f8a51
xor eax, eax
mov dword [esp + 0x18], 0xffffffff
mov dword [0x2202038], eax
push 0xb
jmp 0x4f8a51
Function at 0x4fa0f0
Capabilities:
Check http status code

Disassembly:
sub esp, 0xc
push ebp
mov ebp, ecx
mov ecx, dword [0x2201ef0]
or eax, 0xffffffff
cmp ecx, eax
mov dword [esp + 0xc], ebp
je 0x4fa218
cmp dword [0x2201ff8], eax
je 0x4fa218
fld dword [0x2203260]
push edi
call fcn.005cd414
mov ecx, ebp
mov edi, eax
call fcn.004f7630
cmp eax, 0xc8
jg 0x4fa15a
mov eax, dword [ebp + 0xbf0]
mov ecx, dword [ebp + 0xbec]
add eax, 0x9c
add ecx, 0x13
push eax
push ecx
lea ecx, [ebp + 0x1abac]
call fcn.00549a70
pop edi
pop ebp
add esp, 0xc
ret
mov eax, edi
cdq
push ebx
push esi
and edx, 0x1ff
add eax, edx
mov esi, 0x200
sub esi, edi
sar eax, 9
cmp esi, 0xc8
jle 0x4fa17e
mov esi, 0xc8
and edi, 0x800001ff
jns 0x4fa18e
dec edi
or edi, 0xfffffe00
inc edi
mov ebx, dword [ebp + 0xbf0]
mov dword [esp + 0x10], edi
add edi, esi
mov dword [esp + 0x14], edi
add ebx, 0x9c
xor edi, edi
shl eax, 4
lea ebp, [eax + ebp + 0x1abac]
fild dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0xbec]
sub esp, 8
fmul dword [0x6c11bc]
add eax, 0x13
mov ecx, ebp
fstp dword [esp + 4]
fild dword [esp + 0x18]
fmul dword [0x6c11bc]
fstp dword [esp]
push 0x3f800000
push 0
push esi
push 0x200
push ebx
push eax
push 0xffffffffffffffff
call fcn.00549ba0
add ebx, esi
add edi, esi
mov esi, 0xc8
sub esi, edi
add ebp, 0x10
cmp edi, 0xc8
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], esi
jl 0x4fa1b0
pop esi
pop ebx
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x4fea20
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6b1fc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi], 0x6c43b8
mov dword [esp + 0x18], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
lea ebx, [esi + 0x68]
mov ecx, ebx
mov byte [esp + 0x18], 3
call fcn.00527000
push fcn.00527170
push fcn.00527000
push 2
push 0x5d8
lea eax, [esi + 0x640]
push eax
mov byte [esp + 0x2c], 4
call fcn.005ce6bb
lea ecx, [esi + 0x11f0]
mov byte [esp + 0x18], 5
call fcn.0052b880
push fcn.0052b980
push fcn.0052b880
push 2
push 0x125c
lea ecx, [esi + 0x244c]
push ecx
mov byte [esp + 0x2c], 6
call fcn.005ce6bb
push fcn.0052d500
push fcn.0052d480
push 2
push 0x70
lea edx, [esi + 0x4904]
push edx
mov byte [esp + 0x2c], 7
call fcn.005ce6bb
mov dword [esi + 0x20], edi
mov dword [esi + 0xc], 0x1fa
mov dword [esi + 0x10], 0x1e8
mov eax, dword [0x70859c]
add eax, 0xfffffdf2
mov byte [esp + 0x18], 8
mov dword [esi + 4], eax
mov dword [esi + 8], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x34], edi
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
mov ecx, esi
call fcn.00526820
fld dword [0x70aae8]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x3f800000
push edi
push 0x3f400000
push 0x3f000000
push 0x3f800000
push edi
push 0x3f000000
push 0x3e800000
push 0x3f800000
push edi
push 0x3e800000
push edi
push 1
push 0x20
push 0x80
push str.talk1_close_button.tga
push edi
push 0x16
push 0x16
push 0x20
push 0x20
call fcn.005cd414
fld dword [0x70aae4]
push eax
call fcn.005cd414
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 8]
push eax
push ecx
mov ecx, ebx
call fcn.00528830
xor eax, eax
lea edi, [esi + 0x49e4]
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x503c30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6b21b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi], 0x6c459c
mov dword [esp + 0x18], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
push fcn.00527170
push fcn.00527000
push 4
push 0x5d8
lea eax, [esi + 0x60]
push eax
mov byte [esp + 0x2c], 2
call fcn.005ce6bb
push fcn.00527170
push fcn.00527000
push 0xc
push 0x5d8
lea ecx, [esi + 0x17c0]
push ecx
mov byte [esp + 0x2c], 3
call fcn.005ce6bb
lea ebx, [esi + 0x5de0]
mov ecx, ebx
mov byte [esp + 0x18], 4
call fcn.00527000
mov eax, dword [esi]
mov dword [esi + 0x20], edi
mov edx, dword [0x70859c]
add edx, 0xfffffed7
mov ecx, esi
mov byte [esp + 0x18], 5
mov dword [esi + 4], edx
mov dword [esi + 8], edi
mov dword [esi + 0xc], 0x115
mov dword [esi + 0x10], 0x1d1
call dword [eax + 0xc]
mov ecx, esi
call fcn.00526820
push edi
push edi
push edi
push edi
push edi
push edi
push edi
xor ecx, ecx
push edi
mov dword [esi + 0x3c], ecx
push edi
mov dword [esi + 0x40], ecx
push 0x3f800000
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edi
push edi
push 0x3f400000
fld dword [0x70ad0c]
push 0x3f000000
push 0x3f800000
push edi
push 0x3f000000
push 0x3e800000
push 0x3f800000
push edi
push 0x3e800000
push edi
push 1
push 0x20
push 0x80
push str.talk1_close_button.tga
push edi
push 0x16
push 0x16
push 0x20
push 0x20
call fcn.005cd414
fld dword [0x70ad08]
push eax
call fcn.005cd414
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push edx
push eax
mov ecx, ebx
call fcn.00528830
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret