joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dd90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e1449
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov dword [esp + 0x18], 0
lea eax, [esp + 0x34]
mov dword [esp + 0x28], 1
push eax
lea ecx, [esp + 0x20]
call fcn.0042b1c0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x13]
call fcn.0042e140
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x14]
mov byte [esp + 0x2c], 3
push eax
call fcn.00433600
mov esi, eax
mov ecx, dword [esp + 0x34]
push str.QTime_
mov byte [esp + 0x2c], 4
mov byte [ecx + 0x14], 0
lea ecx, [esp + 0x38]
call fcn.004037f0
mov edx, dword [esi]
mov edi, eax
mov ecx, dword [edx + 0xc]
push dword [edx + 4]
add ecx, edx
push ecx
mov ecx, edi
call fcn.0042b500
mov ecx, dword [edi]
cmp byte [ecx + 0x14], 0
je 0x42de35
push 0x20
call fcn.00426720
mov ecx, dword [edi]
push 0x29
call fcn.00426720
mov ecx, dword [edi]
cmp byte [ecx + 0x14], 0
je 0x42de4d
push 0x20
call fcn.00426720
mov eax, dword [esp + 0x10]
or esi, 0xffffffff
mov ecx, dword [eax]
test ecx, ecx
je 0x42de6f
cmp ecx, esi
je 0x42de7c
mov ecx, esi
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x42de7c
mov eax, dword [esp + 0x10]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
test ecx, ecx
je 0x42de9b
cmp ecx, 0xffffffff
je 0x42dea8
lock xadd dword [eax], esi
dec esi
setne al
test al, al
jne 0x42dea8
mov eax, dword [esp + 0x14]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov dword [esi], ecx
inc dword [ecx + 0xc]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 1
mov byte [esp + 0x28], 1
call fcn.0042b2f0
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 0
call fcn.0042b250
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x42e930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e1506
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x64a000]
xor eax, esp
mov dword [esp + 0x2c], eax
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x28]
xorps xmm0, xmm0
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x14], 0
movdqu xmmword [esp + 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x2e]
push eax
movzx eax, word [esp + 0x2e]
push eax
movzx eax, word [esp + 0x30]
push eax
call fcn.00430bf0
mov dword [esp + 0x20], eax
movzx eax, word [esp + 0x3c]
mov ecx, eax
mov dword [esp + 0x24], edx
shl ecx, 4
sub ecx, eax
movzx eax, word [esp + 0x3e]
push 0x20
lea eax, [eax + ecx*4]
mov ecx, eax
shl ecx, 4
sub ecx, eax
movzx eax, word [esp + 0x44]
lea eax, [eax + ecx*4]
imul ecx, eax, 0x3e8
movzx eax, word [esp + 0x46]
add ecx, eax
mov dword [esp + 0x2c], ecx
call fcn.004c0c97
mov edi, eax
add esp, 0x10
mov dword [esp + 0xc], edi
mov dword [esp + 0x44], 0
test edi, edi
je 0x42ea6f
mov dword [edi], 0
lea ecx, [edi + 0x18]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.0046f080
mov dword [edi + 0x1c], 0
lea ecx, [esp + 0x20]
and dword [edi + 0x1c], 0xffffff2f
mov byte [esp + 0x44], 1
call fcn.0046f080
mov ecx, dword [edi + 0x18]
mov edx, eax
mov eax, dword [edx]
mov dword [edi + 0x18], eax
mov dword [edx], ecx
lea ecx, [esp + 0x20]
call fcn.00472620
lea eax, [esp + 0x1c]
mov dword [edi + 0x10], 0
push eax
lea eax, [esp + 0x18]
mov dword [edi + 0x14], 0
push eax
mov ecx, edi
call fcn.00432030
jmp 0x42ea71
xor edi, edi
mov dword [esi], edi
test edi, edi
je 0x42ea80
mov ecx, 1
lock xadd dword [edi], ecx
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004c17c4
add esp, 0x3c
ret
Function at 0x433680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e1990
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi]
mov dword [esp + 0x18], 0
cmp edi, 0xffffffff
jle 0x433882
cmp edi, 0x5265c00
jge 0x433882
mov eax, dword [esp + 0x30]
add eax, 0xfffffffe
cmp eax, 5
ja case.default.0x4336d6
jmp dword [eax*4 + 0x4338a0]
lea eax, [esp + 0x30]
push eax
call fcn.0045f9a0
add esp, 4
push 1
push esi
mov esi, dword [esp + 0x34]
mov ecx, eax
push esi
mov dword [esp + 0x30], 0
call fcn.00460460
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 0xffffffff
call fcn.0045b510
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 8
lea eax, [esp + 0xc]
push eax
call fcn.0045f9a0
add esp, 4
push 0
push esi
mov esi, dword [esp + 0x34]
mov ecx, eax
push esi
mov dword [esp + 0x30], 1
call fcn.00460460
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.0045b510
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 8
lea ecx, [esp + 0x10]
call fcn.0045b4b0
push 1
push esi
mov esi, dword [esp + 0x34]
mov ecx, eax
push esi
mov dword [esp + 0x30], 2
call fcn.00460460
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.0045b510
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 8
lea ecx, [esp + 0x14]
call fcn.0045b4b0
push 0
push esi
mov esi, dword [esp + 0x34]
mov ecx, eax
push esi
mov dword [esp + 0x30], 3
call fcn.00460460
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xffffffff
call fcn.0045b510
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 8
mov eax, 0x10624dd3
mov esi, dword [esp + 0x2c]
imul edi
mov ecx, 0x3c
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cdq
idiv ecx
mov eax, 0x4a90be59
mov ecx, edi
push edx
imul edi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x36ee80
sub ecx, eax
mov eax, 0x45e7b273
imul ecx
mov eax, 0x4a90be59
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul edi
push ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str._02d:_02d:_02d
push esi
call fcn.00418cc0
add esp, 0x14
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 8
mov eax, dword [esp + 0x2c]
mov dword [eax], 0x4ed20c
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 8
Function at 0x43bab0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e22f6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0
mov dword [edi + 4], 0x4ed20c
mov dword [esp + 0x18], 0
mov dword [edi + 8], 0x4ed20c
mov dword [edi + 0x14], 0x4ed20c
mov dword [edi + 0x20], 0x4ed20c
mov dword [edi + 0x24], 0x4ed20c
mov dword [edi + 0x28], 0x4ed20c
mov esi, dword [esp + 0x20]
mov eax, dword [esi + 8]
mov dword [edi + 0x30], eax
cmp dword [esi + 4], 3
sete al
mov byte [edi + 0x34], al
cmp dword [esi + 4], 5
sete al
mov byte [edi + 0x35], al
mov dword [edi + 0x48], 0x4ed20c
mov dword [edi + 0x50], 0x4ed20c
mov dword [edi + 0x68], 0
mov dword [edi + 0x74], 0x4ed20c
mov byte [esp + 0x18], 9
call fcn.004446a0
push dword [esi + 4]
lea eax, [esp + 0x24]
push esi
push eax
call fcn.00443870
add esp, 0xc
mov eax, dword [esp + 0x20]
mov byte [esp + 0x18], 0xa
mov ecx, dword [eax + 0xc]
mov esi, dword [eax + 4]
add ecx, eax
push esi
push ecx
mov ecx, edi
call fcn.004426f0
cmp eax, esi
sete al
mov byte [edi + 0x2e], al
test al, al
jne 0x43bb9b
push str.missing_left_delim
mov ecx, edi
mov byte [edi + 0x2d], al
call fcn.0043f240
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x43bbbc
cmp ecx, 0xffffffff
je 0x43bbc9
or ecx, 0xffffffff
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x43bbc9
mov eax, dword [esp + 0x20]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x43bbe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e238e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0x4ed20c
mov dword [esp + 0x14], 0
mov dword [esi + 8], 0x4ed20c
mov dword [esi + 0x14], 0x4ed20c
mov dword [esi + 0x20], 0x4ed20c
mov dword [esi + 0x24], 0x4ed20c
mov dword [esi + 0x28], 0x4ed20c
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x30], eax
mov al, byte [esp + 0x20]
mov byte [esi + 0x34], al
mov dword [esi + 0x48], 0x4ed20c
mov dword [esi + 0x50], 0x4ed20c
mov dword [esi + 0x68], 0
mov dword [esi + 0x74], 0x4ed20c
mov byte [esp + 0x14], 9
call fcn.004446a0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8
Function at 0x43ca30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e2561
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
lea eax, [esp + 0x30]
mov dword [esp + 0x24], 1
push eax
lea ecx, [esp + 0x1c]
call fcn.0042b1c0
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00443580
mov ebx, eax
mov ecx, dword [esi]
push str.QRegExp_patternSyntax
mov byte [esp + 0x28], 3
mov esi, dword [ecx + 8]
mov ecx, dword [esp + 0x34]
mov byte [ecx + 0x14], 0
lea ecx, [esp + 0x34]
call fcn.004037f0
mov edi, eax
push esi
mov ecx, dword [edi]
call fcn.00426870
mov ecx, dword [edi]
cmp byte [ecx + 0x14], 0
je 0x43cabf
push 0x20
call fcn.00426720
push str.__pattern
mov ecx, edi
call fcn.004037f0
mov edx, dword [ebx]
mov esi, eax
mov ecx, dword [edx + 0xc]
push dword [edx + 4]
add ecx, edx
push ecx
mov ecx, esi
call fcn.0042b500
mov ecx, dword [esi]
cmp byte [ecx + 0x14], 0
je 0x43caee
push 0x20
call fcn.00426720
push 0x51e0d8
mov ecx, esi
call fcn.004037f0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
test ecx, ecx
je 0x43cb1b
cmp ecx, 0xffffffff
je 0x43cb28
or ecx, 0xffffffff
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x43cb28
mov eax, dword [esp + 0x10]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov dword [esi], ecx
inc dword [ecx + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 1
mov byte [esp + 0x24], 1
call fcn.0042b2f0
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call fcn.0042b250
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x44d470
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e3041
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x34]
push str.QHash_
mov dword [esp + 0x2c], 1
mov cl, byte [eax + 0x14]
mov byte [esp + 0x17], cl
lea ecx, [esp + 0x38]
mov byte [eax + 0x14], 0
call fcn.004037f0
mov ebx, dword [esp + 0x38]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x18]
mov esi, dword [eax + 4]
test ecx, ecx
je 0x44d4e3
dec ecx
cmp dword [esi], eax
jne 0x44d670
add esi, 4
test ecx, ecx
jne 0x44d4d3
mov esi, eax
cmp esi, eax
je 0x44d5fc
lea ecx, [ecx]
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
push eax
push 0x28
call fcn.00426720
mov ecx, dword [esp + 0x38]
cmp byte [ecx + 0x14], 0
je 0x44d510
push 0x20
call fcn.00426720
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0xc]
push dword [ecx + 4]
add eax, ecx
lea ecx, [esp + 0x3c]
push eax
call fcn.0042b500
mov ecx, dword [esp + 0x38]
cmp byte [ecx + 0x14], 0
je 0x44d536
push 0x20
call fcn.00426720
push 0xffffffffffffffff
lea eax, [esp + 0x40]
push 0x4ecc68
push eax
call fcn.00403940
add esp, 0xc
mov ecx, dword [esp + 0x38]
push eax
mov byte [esp + 0x30], 2
call fcn.004266b0
mov eax, dword [esp + 0x3c]
mov byte [esp + 0x2c], 1
mov ecx, dword [eax]
test ecx, ecx
je 0x44d57f
cmp ecx, 0xffffffff
je 0x44d58c
or ecx, 0xffffffff
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x44d58c
mov eax, dword [esp + 0x3c]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
mov eax, dword [esp + 0x38]
cmp byte [eax + 0x14], 0
je 0x44d5a3
push 0x20
mov ecx, eax
call fcn.00426720
mov eax, dword [esp + 0x38]
push ecx
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [esp + 0x3c]
inc dword [eax + 0xc]
lea eax, [esp + 0x1c]
push eax
call fcn.00453650
add esp, 0xc
mov edi, eax
mov ecx, dword [edi]
push 0x29
mov byte [esp + 0x2c], 3
call fcn.00426720
mov ecx, dword [edi]
cmp byte [ecx + 0x14], 0
je 0x44d5db
push 0x20
call fcn.00426720
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call fcn.0042b250
push esi
call fcn.00463690
mov esi, eax
add esp, 4
cmp esi, dword [ebx]
jne 0x44d4f0
mov ecx, dword [esp + 0x34]
push 0x29
call fcn.00426720
mov eax, dword [esp + 0x34]
cmp byte [eax + 0x14], 0
je 0x44d61e
push 0x20
mov ecx, eax
call fcn.00426720
mov eax, dword [esp + 0x34]
mov cl, byte [esp + 0x13]
mov byte [eax + 0x14], cl
mov eax, dword [esp + 0x34]
cmp byte [eax + 0x14], 0
je 0x44d63c
push 0x20
mov ecx, eax
call fcn.00426720
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov dword [esi], eax
inc dword [eax + 0xc]
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], 1
mov byte [esp + 0x28], 0
call fcn.0042b250
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
mov esi, dword [esi]
jmp 0x44d4e5
Function at 0x44d680
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e3041
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x34]
push str.QMap_
mov dword [esp + 0x2c], 1
mov cl, byte [eax + 0x14]
mov byte [esp + 0x17], cl
lea ecx, [esp + 0x38]
mov byte [eax + 0x14], 0
call fcn.004037f0
mov ebx, dword [esp + 0x38]
mov eax, dword [ebx]
cmp dword [eax + 0xc], 0
je 0x44d6e4
mov esi, dword [eax + 0x14]
jmp 0x44d6e7
lea esi, [eax + 8]
add eax, 8
cmp esi, eax
je 0x44d801
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
push eax
push 0x28
call fcn.00426720
mov ecx, dword [esp + 0x38]
cmp byte [ecx + 0x14], 0
je 0x44d712
push 0x20
call fcn.00426720
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 0xc]
push dword [ecx + 4]
add eax, ecx
lea ecx, [esp + 0x3c]
push eax
call fcn.0042b500
mov ecx, dword [esp + 0x38]
cmp byte [ecx + 0x14], 0
je 0x44d738
push 0x20
call fcn.00426720
push 0xffffffffffffffff
lea eax, [esp + 0x40]
push 0x4ecc68
push eax
call fcn.00403940
add esp, 0xc
mov ecx, dword [esp + 0x38]
push eax
mov byte [esp + 0x30], 2
call fcn.004266b0
mov eax, dword [esp + 0x3c]
mov byte [esp + 0x2c], 1
mov ecx, dword [eax]
test ecx, ecx
je 0x44d781
cmp ecx, 0xffffffff
je 0x44d78e
or ecx, 0xffffffff
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x44d78e
mov eax, dword [esp + 0x3c]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
mov eax, dword [esp + 0x38]
cmp byte [eax + 0x14], 0
je 0x44d7a5
push 0x20
mov ecx, eax
call fcn.00426720
mov eax, dword [esp + 0x38]
push ecx
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [esp + 0x3c]
inc dword [eax + 0xc]
lea eax, [esp + 0x1c]
push eax
call fcn.00453650
add esp, 0xc
mov edi, eax
mov ecx, dword [edi]
push 0x29
mov byte [esp + 0x2c], 3
call fcn.00426720
mov ecx, dword [edi]
cmp byte [ecx + 0x14], 0
je 0x44d7dd
push 0x20
call fcn.00426720
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call fcn.0042b250
mov ecx, esi
call fcn.0046d5c0
mov esi, eax
mov eax, dword [ebx]
add eax, 8
cmp esi, eax
jne 0x44d6f2
mov ecx, dword [esp + 0x34]
push 0x29
call fcn.00426720
mov eax, dword [esp + 0x34]
cmp byte [eax + 0x14], 0
je 0x44d823
push 0x20
mov ecx, eax
call fcn.00426720
mov eax, dword [esp + 0x34]
mov cl, byte [esp + 0x13]
mov byte [eax + 0x14], cl
mov eax, dword [esp + 0x34]
cmp byte [eax + 0x14], 0
je 0x44d841
push 0x20
mov ecx, eax
call fcn.00426720
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov dword [esi], eax
inc dword [eax + 0xc]
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], 1
mov byte [esp + 0x28], 0
call fcn.0042b250
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x44d880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e3089
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x30]
push 0x28
mov dword [esp + 0x28], 1
mov bl, byte [eax + 0x14]
mov byte [eax + 0x14], 0
mov ecx, dword [esp + 0x34]
call fcn.00426720
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 0x14], 0
je 0x44d8e1
push 0x20
call fcn.00426720
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
xor esi, esi
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
sub edx, dword [eax + 8]
test edx, edx
jle 0x44d9a8
test esi, esi
je 0x44d966
push 0xffffffffffffffff
lea eax, [esp + 0x38]
push 0x4ecc68
push eax
call fcn.00403940
add esp, 0xc
mov ecx, dword [esp + 0x30]
push eax
mov byte [esp + 0x28], 2
call fcn.004266b0
mov eax, dword [esp + 0x34]
mov byte [esp + 0x24], 1
mov ecx, dword [eax]
test ecx, ecx
je 0x44d944
cmp ecx, 0xffffffff
je 0x44d951
or ecx, 0xffffffff
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x44d951
mov eax, dword [esp + 0x34]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 0x14], 0
je 0x44d966
push 0x20
call fcn.00426720
mov ecx, dword [esp + 0x30]
mov edx, dword [edi]
mov eax, dword [edx + 8]
add eax, esi
push dword [edx + eax*4 + 0x10]
push ecx
mov eax, esp
mov dword [eax], ecx
mov eax, dword [esp + 0x38]
inc dword [eax + 0xc]
lea eax, [esp + 0x18]
push eax
call fcn.00453650
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.0042b250
mov eax, dword [edi]
inc esi
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 8]
cmp esi, ecx
mov ecx, dword [esp + 0x30]
jl 0x44d8f7
push 0x29
call fcn.00426720
mov eax, dword [esp + 0x30]
cmp byte [eax + 0x14], 0
je 0x44d9c6
push 0x20
mov ecx, eax
call fcn.00426720
mov eax, dword [esp + 0x30]
mov byte [eax + 0x14], bl
mov eax, dword [esp + 0x30]
cmp byte [eax + 0x14], 0
je 0x44d9e0
push 0x20
mov ecx, eax
call fcn.00426720
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov dword [esi], eax
inc dword [eax + 0xc]
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], 1
mov byte [esp + 0x24], 0
call fcn.0042b250
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x456390
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e36f9
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
lea eax, [esp + 0x30]
mov dword [esp + 0x24], 1
push eax
lea ecx, [esp + 0x18]
call fcn.0042b1c0
mov ecx, dword [esp + 0x34]
push 0x51f03c
mov eax, dword [ecx]
push dword [eax + 4]
lea eax, [esp + 0x3c]
push eax
call fcn.00456740
mov esi, eax
mov ecx, dword [esp + 0x38]
push 0x51f028
mov byte [esp + 0x30], 3
mov byte [ecx + 0x14], 0
lea ecx, [esp + 0x3c]
call fcn.004037f0
mov edx, dword [esi]
mov edi, eax
mov ecx, dword [edx + 0xc]
push dword [edx + 4]
add ecx, edx
push ecx
mov ecx, edi
call fcn.0042b500
mov ecx, dword [edi]
cmp byte [ecx + 0x14], 0
je 0x45642b
push 0x20
call fcn.00426720
push 0x4ecc68
mov ecx, edi
call fcn.004037f0
push ecx
mov ecx, esp
mov eax, dword [eax]
mov dword [ecx], eax
inc dword [eax + 0xc]
lea eax, [esp + 0x18]
push eax
call fcn.004564e0
add esp, 0xc
mov ecx, eax
mov byte [esp + 0x28], 4
call fcn.004037f0
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 3
call fcn.0042b250
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
test ecx, ecx
je 0x456489
cmp ecx, 0xffffffff
je 0x456496
or ecx, 0xffffffff
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x456496
mov eax, dword [esp + 0x34]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov dword [esi], ecx
inc dword [ecx + 0xc]
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], 1
mov byte [esp + 0x24], 1
call fcn.0042b2f0
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call fcn.0042b250
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x4564e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e3751
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], 1
push eax
lea ecx, [esp + 0x14]
call fcn.0042b1c0
mov dword [esp + 8], 0x4ed20c
cmp dword [esp + 0x30], 0
lea ecx, [esp + 8]
mov byte [esp + 0x20], 3
jne 0x456549
push str.NoPatternOption
call fcn.00413a00
jmp 0x456642
push 0xc8
call fcn.0040f600
mov eax, dword [esp + 0x30]
mov ecx, eax
and ecx, 1
je 0x456570
push str.CaseInsensitiveOption
lea ecx, [esp + 0xc]
call fcn.00413c70
mov eax, dword [esp + 0x30]
mov ecx, eax
and ecx, 2
je 0x456589
push str.DotMatchesEverythingOption
lea ecx, [esp + 0xc]
call fcn.00413c70
mov eax, dword [esp + 0x30]
mov ecx, eax
and ecx, 4
je 0x4565a2
push str.MultilineOption
lea ecx, [esp + 0xc]
call fcn.00413c70
mov eax, dword [esp + 0x30]
mov ecx, eax
and ecx, 8
je 0x4565bb
push str.ExtendedPatternSyntaxOption
lea ecx, [esp + 0xc]
call fcn.00413c70
mov eax, dword [esp + 0x30]
mov ecx, eax
and ecx, 0x10
je 0x4565d4
push str.InvertedGreedinessOption
lea ecx, [esp + 0xc]
call fcn.00413c70
mov eax, dword [esp + 0x30]
mov ecx, eax
and ecx, 0x20
je 0x4565ed
push str.DontCaptureOption
lea ecx, [esp + 0xc]
call fcn.00413c70
mov eax, dword [esp + 0x30]
mov ecx, eax
and ecx, 0x40
je 0x456606
push str.UseUnicodePropertiesOption
lea ecx, [esp + 0xc]
call fcn.00413c70
mov eax, dword [esp + 0x30]
mov ecx, eax
and ecx, 0x80
je 0x456622
push str.OptimizeOnFirstUsageOption
lea ecx, [esp + 0xc]
call fcn.00413c70
mov eax, dword [esp + 0x30]
and eax, 0x100
je 0x456637
push str.DontAutomaticallyOptimizeOption
lea ecx, [esp + 0xc]
call fcn.00413c70
push 1
lea ecx, [esp + 0xc]
call fcn.00413db0
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x2c]
push str.QRegularExpression::PatternOptions_
mov byte [eax + 0x14], 0
call fcn.004037f0
mov ecx, dword [esp + 8]
mov esi, eax
push 0
mov edx, dword [ecx + 0xc]
push dword [ecx + 4]
add edx, ecx
mov ecx, esi
push edx
call fcn.0042b350
mov ecx, dword [esi]
cmp byte [ecx + 0x14], 0
je 0x45667f
push 0x20
call fcn.00426720
push 0x51f03c
mov ecx, esi
call fcn.004037f0
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esi], eax
inc dword [eax + 0xc]
mov eax, dword [esp + 8]
mov dword [esp + 0xc], 1
mov ecx, dword [eax]
test ecx, ecx
je 0x4566c1
cmp ecx, 0xffffffff
je 0x4566ce
or ecx, 0xffffffff
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x4566ce
mov eax, dword [esp + 8]
push 4
push 1
push eax
call fcn.00413640
add esp, 0xc
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call fcn.0042b2f0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call fcn.0042b250
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret