joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b300
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
lea edx, [esp]
push ebx
push ebp
push esi
push edi
mov edi, ecx
push eax
mov ecx, dword [0x6a9038]
add ecx, 8
push ecx
push edx
call fcn.004e7760
mov esi, dword [esp + 0x34]
mov edx, dword [eax]
mov ecx, esi
add esp, 0xc
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov ecx, dword [0x6a9038]
mov eax, dword [edi + 0x388]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub edx, eax
cmp word [edi + 0x38], 0x132
setne cl
inc ecx
sar edx, cl
add eax, edx
mov dword [edi + 0x388], eax
mov ecx, dword [0x6a9038]
mov edi, dword [esi + 8]
mov edx, dword [ecx + 0xc]
mov ecx, dword [esi + 4]
sub eax, edx
mov edx, dword [esi]
add ecx, eax
mov eax, edi
mov dword [esi + 4], ecx
mov ecx, edx
sar ecx, 0x1f
mov ebx, ecx
sar eax, 0x1f
xor ebx, edx
mov edx, eax
xor edx, edi
add ebx, edx
sub ebx, ecx
sub ebx, eax
cmp ebx, 0xbb8000
mov ebx, dword [esp + 0x2c]
jge 0x42b3d9
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
mov dword [esp + 0x30], 1
call fcn.004e7680
mov edx, dword [esi]
mov edi, dword [esi + 8]
mov ecx, edx
mov eax, edi
sar ecx, 0x1f
mov ebp, ecx
sar eax, 0x1f
xor ebp, edx
mov edx, eax
xor edx, edi
add ebp, edx
sub ebp, ecx
sub ebp, eax
shl ebx, 1
cmp ebp, 0xbb8000
jl 0x42b39e
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
mov edi, ebx
jle 0x42b3fe
push ebx
sar edi, 1
call fcn.004e5da0
mov ecx, dword [esi + 8]
sub eax, edi
shl eax, 0xc
add esp, 4
add ecx, eax
mov dword [esi + 8], ecx
jmp 0x42b414
push ebx
sar edi, 1
call fcn.004e5da0
mov ecx, dword [esi]
sub eax, edi
shl eax, 0xc
add esp, 4
add ecx, eax
mov dword [esi], ecx
push ebx
call fcn.004e5da0
mov ebp, dword [esi + 4]
mov ecx, dword [esp + 0x24]
sub eax, edi
push esi
shl eax, 0xc
lea edx, [esp + 0x18]
add ebp, eax
push ecx
push edx
mov dword [esi + 4], ebp
call fcn.004e7720
mov ecx, dword [esp + 0x34]
mov edx, dword [eax]
add esp, 0x10
mov dword [ecx], edx
mov edx, dword [eax + 4]
pop edi
pop esi
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
pop ebp
pop ebx
mov dword [ecx + 8], eax
add esp, 0xc
ret 0x10
Function at 0x43b2a0
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x536f06
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [0x56f1b4]
push edi
mov edi, dword [esp + 0x30]
mov edx, dword [0x56f1bc]
mov eax, dword [edi]
sar eax, 0xc
sub eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [edi + 8]
sar eax, 0xc
sub eax, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
test eax, eax
jle 0x43b3fa
mov ebx, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x38]
push esi
mov dword [esp + 0x38], eax
push 0x1000
call fcn.004e5da0
mov esi, eax
mov eax, dword [esp + 0x48]
push eax
call fcn.004e5da0
and esi, 0xfff
add esp, 8
shl esi, 2
push 0x80
movsx edx, word [esi + 0x610c48]
movsx ecx, word [esi + 0x610c4a]
imul edx, eax
imul ecx, eax
mov eax, dword [ebp]
mov esi, dword [ebx]
sar edx, 0xc
sar ecx, 0xc
imul eax, edx
imul esi, ecx
mov ebp, dword [ebp + 4]
add eax, esi
mov esi, dword [ebx + 4]
imul ebp, edx
imul esi, ecx
imul ecx, dword [ebx + 8]
add esi, ebp
mov ebp, dword [esp + 0x40]
imul edx, dword [ebp + 8]
add ecx, edx
mov edx, dword [edi]
add edx, eax
mov dword [esp + 0x14], edx
mov edx, dword [edi + 4]
add edx, esi
mov esi, dword [edi + 8]
mov dword [esp + 0x18], edx
mov edx, ecx
sar eax, 0xc
imul eax, dword [esp + 0x28]
sar ecx, 0xc
imul ecx, dword [esp + 0x20]
add edx, esi
sub ecx, eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x4c], ecx
jns 0x43b3ba
call fcn.004088a0
add esp, 4
mov dword [esp + 0x48], eax
test eax, eax
mov dword [esp + 0x30], 0
je 0x43b3e1
lea ecx, [esp + 0x10]
push 0xffffffffffffffff
push ecx
jmp 0x43b3d9
call fcn.004088a0
add esp, 4
mov dword [esp + 0x48], eax
test eax, eax
mov dword [esp + 0x30], 1
je 0x43b3e1
lea edx, [esp + 0x10]
push 1
push edx
push edi
mov ecx, eax
call fcn.0043b020
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
dec eax
mov dword [esp + 0x38], eax
jne 0x43b2fb
pop esi
pop ebp
mov ecx, dword [esp + 0x20]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x43bee0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x536fb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
mov esi, ecx
push 1
push eax
mov dword [esp + 0xc], esi
call fcn.0040c210
mov edx, dword [esp + 0x18]
mov dword [esi], 0x53b7f0
lea ecx, [esi + 0x10]
mov dword [esp + 0x10], 0
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x28]
mov edx, dword [edx + 8]
push eax
mov dword [ecx + 8], edx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
push edx
mov ecx, esi
call fcn.0040c600
mov ax, word [esp + 0x2c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov word [esi + 0x5c], ax
mov eax, dword [esp + 0x30]
push ecx
push edx
push eax
mov ecx, esi
call fcn.0040c630
mov cx, word [esp + 0x3c]
push 0
push 0
mov word [esi + 0x5e], cx
push 0
push 0
mov ecx, esi
call fcn.0040c670
mov edx, dword [esp + 0x40]
mov ecx, esi
push edx
push 0
call fcn.0040c5b0
mov ax, word [esp + 0x44]
mov cl, byte [esp + 0x48]
mov dx, word [esp + 0x4c]
mov word [esi + 0x60], ax
mov ax, word [esp + 0x50]
mov byte [esi + 0x6c], cl
mov cx, word [esp + 0x54]
mov word [esi + 0x64], ax
mov ax, word [esp + 0x5c]
mov word [esi + 0x62], dx
mov dx, word [esp + 0x58]
mov word [esi + 0x6a], ax
mov eax, dword [esp + 0x60]
mov word [esi + 0x66], cx
test ax, ax
mov word [esi + 0x68], dx
mov word [esi + 0xe], ax
jne 0x43bfdd
cmp word [esi + 0x5c], ax
jne 0x43bfdd
xor eax, eax
jmp 0x43bfe2
mov eax, 1
push str.CGlowFlash_centrefaderate_and_lifetime_both_zero.
push eax
call fcn.004015b0
add esp, 8
mov ecx, esi
call fcn.0043c040
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x4c
Function at 0x44a670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5374d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00408fa0
lea edi, [esi + 0x8c]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi], 0x53b99c
mov eax, dword [0x56ea9c]
mov ecx, dword [eax + 0x34]
push ecx
mov ecx, esi
call fcn.00409210
mov ecx, esi
call fcn.00409390
push ebx
push 0x40
push ebx
mov ecx, esi
call fcn.004093c0
push 0xa
call fcn.004e5da0
mov edx, dword [esp + 0x3c]
add eax, 0xa
mov dword [esi + 0x84], eax
mov eax, edi
mov ecx, dword [edx]
push 0x1000
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov edx, dword [edx + 8]
mov dword [eax + 8], edx
call fcn.004e5da0
add esp, 8
mov ebx, 1
mov ecx, esi
push eax
mov eax, dword [esp + 0x40]
push ebx
push ebx
push eax
push edi
call fcn.00409560
lea ecx, [esp + 0x38]
lea edi, [esi + 0x10]
push ecx
lea edx, [esi + 0x3c]
push edi
lea eax, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x48], ebx
call fcn.004e7760
add esp, 0xc
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.004e7840
mov edx, dword [eax]
add esp, 0xc
mov dword [esi + 0x98], edx
mov ecx, dword [eax + 4]
mov dword [esi + 0x9c], ecx
mov edx, dword [eax + 8]
lea eax, [esp + 0x38]
mov dword [esi + 0xa0], edx
mov dword [esp + 0x38], ebx
push eax
lea ecx, [esi + 0x48]
push edi
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.004e7760
add esp, 0xc
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004e7840
mov ecx, dword [eax]
add esp, 0xc
mov dword [esi + 0xa4], ecx
mov ecx, esi
mov edx, dword [eax + 4]
mov dword [esi + 0xa8], edx
mov eax, dword [eax + 8]
mov dword [esi + 0xac], eax
call fcn.0044a820
mov ecx, dword [esp + 0x28]
mov byte [esi + 0x3b], 0x25
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x44a689
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5374d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00408fa0
lea edi, [esi + 0x8c]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi], 0x53b99c
mov eax, dword [0x56ea9c]
mov ecx, dword [eax + 0x34]
push ecx
mov ecx, esi
call fcn.00409210
mov ecx, esi
call fcn.00409390
push ebx
push 0x40
push ebx
mov ecx, esi
call fcn.004093c0
push 0xa
call fcn.004e5da0
mov edx, dword [esp + 0x3c]
add eax, 0xa
mov dword [esi + 0x84], eax
mov eax, edi
mov ecx, dword [edx]
push 0x1000
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov edx, dword [edx + 8]
mov dword [eax + 8], edx
call fcn.004e5da0
add esp, 8
mov ebx, 1
mov ecx, esi
push eax
mov eax, dword [esp + 0x40]
push ebx
push ebx
push eax
push edi
call fcn.00409560
lea ecx, [esp + 0x38]
lea edi, [esi + 0x10]
push ecx
lea edx, [esi + 0x3c]
push edi
lea eax, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x48], ebx
call fcn.004e7760
add esp, 0xc
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.004e7840
mov edx, dword [eax]
add esp, 0xc
mov dword [esi + 0x98], edx
mov ecx, dword [eax + 4]
mov dword [esi + 0x9c], ecx
mov edx, dword [eax + 8]
lea eax, [esp + 0x38]
mov dword [esi + 0xa0], edx
mov dword [esp + 0x38], ebx
push eax
lea ecx, [esi + 0x48]
push edi
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.004e7760
add esp, 0xc
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004e7840
mov ecx, dword [eax]
add esp, 0xc
mov dword [esi + 0xa4], ecx
mov ecx, esi
mov edx, dword [eax + 4]
mov dword [esi + 0xa8], edx
mov eax, dword [eax + 8]
mov dword [esi + 0xac], eax
call fcn.0044a820
mov ecx, dword [esp + 0x28]
mov byte [esi + 0x3b], 0x25
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x457e00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push str.Heap_sizes:
call fcn.004015b0
add esp, 4
xor ebx, ebx
xor edi, edi
mov esi, 0x60d214
mov eax, dword [esi]
mov ecx, dword [esi + 4]
add eax, 0x20
push str.Bad_values_for_HEAPBOT_and_HEAPTOP
cmp eax, ecx
setb cl
push ecx
call fcn.004015b0
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, eax
mov dword [edi*4 + 0x60d118], ebx
shl edx, 0x1c
sub edx, eax
mov dword [edi*4 + 0x60d204], ebx
push edi
push eax
lea edx, [edx + ecx + 0xfffffe0]
mov ecx, dword [eax]
shl edx, 4
and ecx, 0xf
xor edx, ecx
mov dword [eax], edx
call fcn.00457c90
mov edx, dword [esi + 4]
mov ecx, dword [esi]
sub edx, ecx
push edx
push edi
push str.Heap__d:__ld_bytes_
call fcn.004015b0
add esp, 0x1c
add esi, 8
inc edi
cmp esi, 0x60d224
jl 0x457e19
push 0x54d564
call fcn.004015b0
mov eax, dword [0x60d21c]
add esp, 4
lea ecx, [eax + eax*2]
pop edi
shl ecx, 4
add ecx, eax
mov eax, dword [0x60d220]
shl ecx, 1
lea edx, [eax + eax*2]
pop esi
shl edx, 4
add edx, eax
mov eax, 0x51eb851f
shl edx, 1
sub edx, ecx
pop ebx
mul edx
shr edx, 5
mov dword [0x60d228], edx
ret
Function at 0x45b0e0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x537ae8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call fcn.00412c00
mov ebx, dword [esp + 0x80]
mov edi, dword [esp + 0x7c]
mov dword [esi], 0x53bb2c
xor ebp, ebp
movsx eax, word [ebx]
mov ecx, dword [edi]
mov dword [esp + 0x74], ebp
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [ecx + eax*2]
mov ecx, dword [edi + 4]
movsx eax, word [ebx + 2]
mov dword [esp + 0x3c], edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [ecx + eax*2]
mov ecx, dword [edi + 8]
movsx eax, word [ebx + 4]
mov dword [esp + 0x40], edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [ecx + eax*2]
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x48], edx
call fcn.004f54a0
mov edx, edi
mov dword [esi + 0x5c], eax
lea ecx, [esi + 0x44]
mov dword [esp + 0x34], ebp
mov eax, dword [edx]
mov dword [esp + 0x38], ebp
mov dword [ecx], eax
mov dword [esp + 0x3c], ebp
mov eax, dword [edx + 4]
mov dword [esp + 0x28], ebp
mov dword [ecx + 4], eax
lea eax, [esi + 0x50]
mov edx, dword [edx + 8]
mov dword [esp + 0x2c], ebp
mov dword [ecx + 8], edx
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi + 4]
mov dword [esp + 0x30], ebp
mov dword [eax + 4], edx
mov ecx, dword [edi + 8]
mov dword [eax + 8], ecx
movsx edx, word [ebx]
movsx eax, word [ebx + 2]
movsx ecx, word [ebx + 4]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
lea edx, [esp + 0x28]
mov dword [esp + 0x24], ecx
lea eax, [esp + 0x34]
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.004e5e20
movsx eax, word [0x61144a]
lea ecx, [esp + 0x20]
lea edi, [esi + 0x1c]
lea edx, [eax + eax*4]
lea eax, [esp + 0x28]
shl edx, 3
sar edx, 0xc
mov dword [esp + 0x20], edx
push eax
lea edx, [esp + 0x5c]
push ecx
push edx
call fcn.004e77d0
mov edx, dword [eax]
mov ecx, edi
push 0x1000
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
movsx eax, word [0x611448]
lea ecx, [eax + eax*4]
shl ecx, 3
sar ecx, 0xc
mov dword [esp + 0x30], ecx
call fcn.004e5da0
mov ecx, dword [esp + 0x30]
and eax, 0xfff
shl eax, 2
movsx edx, word [eax + 0x610c48]
movsx eax, word [eax + 0x610c4a]
imul edx, ecx
imul eax, ecx
sar edx, 0xc
sar eax, 0xc
mov dword [esp + 0xa0], edx
lea ecx, [esp + 0x44]
mov dword [esp + 0x9c], eax
lea edx, [esp + 0xa0]
push ecx
lea eax, [esp + 0x6c]
push edx
push eax
call fcn.004e77d0
add esp, 0x2c
lea ecx, [esp + 0x30]
lea edx, [esp + 0x7c]
push eax
push ecx
lea eax, [esp + 0x5c]
push edx
push eax
call fcn.004e77d0
add esp, 0xc
lea ecx, [esp + 0x64]
push eax
push ecx
call fcn.004e7720
add esp, 0xc
mov ecx, edi
push eax
call fcn.004e7590
push ebp
push ebp
push 0xff
mov ecx, esi
call fcn.00412cf0
push ebp
push ebp
push ebp
mov ecx, esi
call fcn.00412d20
mov ebx, dword [esi + 0x3c]
push 0x14
or ebx, 0x2000000
mov dword [esi + 0x3c], ebx
call fcn.004e5da0
mov ecx, dword [esp + 0x70]
add esp, 4
add eax, 0xa
mov word [esi + 0xe], ax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret 8
Function at 0x45b0fa
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x537ae8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call fcn.00412c00
mov ebx, dword [esp + 0x80]
mov edi, dword [esp + 0x7c]
mov dword [esi], 0x53bb2c
xor ebp, ebp
movsx eax, word [ebx]
mov ecx, dword [edi]
mov dword [esp + 0x74], ebp
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [ecx + eax*2]
mov ecx, dword [edi + 4]
movsx eax, word [ebx + 2]
mov dword [esp + 0x3c], edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [ecx + eax*2]
mov ecx, dword [edi + 8]
movsx eax, word [ebx + 4]
mov dword [esp + 0x40], edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [ecx + eax*2]
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x48], edx
call fcn.004f54a0
mov edx, edi
mov dword [esi + 0x5c], eax
lea ecx, [esi + 0x44]
mov dword [esp + 0x34], ebp
mov eax, dword [edx]
mov dword [esp + 0x38], ebp
mov dword [ecx], eax
mov dword [esp + 0x3c], ebp
mov eax, dword [edx + 4]
mov dword [esp + 0x28], ebp
mov dword [ecx + 4], eax
lea eax, [esi + 0x50]
mov edx, dword [edx + 8]
mov dword [esp + 0x2c], ebp
mov dword [ecx + 8], edx
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi + 4]
mov dword [esp + 0x30], ebp
mov dword [eax + 4], edx
mov ecx, dword [edi + 8]
mov dword [eax + 8], ecx
movsx edx, word [ebx]
movsx eax, word [ebx + 2]
movsx ecx, word [ebx + 4]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
lea edx, [esp + 0x28]
mov dword [esp + 0x24], ecx
lea eax, [esp + 0x34]
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.004e5e20
movsx eax, word [0x61144a]
lea ecx, [esp + 0x20]
lea edi, [esi + 0x1c]
lea edx, [eax + eax*4]
lea eax, [esp + 0x28]
shl edx, 3
sar edx, 0xc
mov dword [esp + 0x20], edx
push eax
lea edx, [esp + 0x5c]
push ecx
push edx
call fcn.004e77d0
mov edx, dword [eax]
mov ecx, edi
push 0x1000
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
movsx eax, word [0x611448]
lea ecx, [eax + eax*4]
shl ecx, 3
sar ecx, 0xc
mov dword [esp + 0x30], ecx
call fcn.004e5da0
mov ecx, dword [esp + 0x30]
and eax, 0xfff
shl eax, 2
movsx edx, word [eax + 0x610c48]
movsx eax, word [eax + 0x610c4a]
imul edx, ecx
imul eax, ecx
sar edx, 0xc
sar eax, 0xc
mov dword [esp + 0xa0], edx
lea ecx, [esp + 0x44]
mov dword [esp + 0x9c], eax
lea edx, [esp + 0xa0]
push ecx
lea eax, [esp + 0x6c]
push edx
push eax
call fcn.004e77d0
add esp, 0x2c
lea ecx, [esp + 0x30]
lea edx, [esp + 0x7c]
push eax
push ecx
lea eax, [esp + 0x5c]
push edx
push eax
call fcn.004e77d0
add esp, 0xc
lea ecx, [esp + 0x64]
push eax
push ecx
call fcn.004e7720
add esp, 0xc
mov ecx, edi
push eax
call fcn.004e7590
push ebp
push ebp
push 0xff
mov ecx, esi
call fcn.00412cf0
push ebp
push ebp
push ebp
mov ecx, esi
call fcn.00412d20
mov ebx, dword [esi + 0x3c]
push 0x14
or ebx, 0x2000000
mov dword [esi + 0x3c], ebx
call fcn.004e5da0
mov ecx, dword [esp + 0x70]
add esp, 4
add eax, 0xa
mov word [esi + 0xe], ax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret 8
Function at 0x470630
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x6150e4], eax
call fcn.00509570
test al, al
je 0x470653
push 1
call fcn.00506160
push 4
call fcn.00430880
add esp, 8
call fcn.00470950
call fcn.00479ca0
call fcn.004728e0
call fcn.004795b0
call fcn.0050ef40
cmp dword [0x6150e4], 2
jne 0x47067c
call fcn.00430880
jmp 0x470686
call fcn.00482b20
call fcn.00516010
push 0
call fcn.0052a101
nop
nop
nop
xor eax, eax
mov dword [0x614cb4], 0x3f800000
mov dword [0x614ca8], eax
mov dword [0x614cac], eax
mov dword [0x614cb0], eax
ret
Function at 0x4810c0
Capabilities:
Check http status code

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, 3
push edi
mov eax, dword [esi + 0x320]
cmp eax, ebp
ja case.default.0x4810dc
jmp dword [eax*4 + 0x4812f0]
mov ecx, esi
call fcn.004040e0
push 1
xor ebx, ebx
push 1
push 0x13
mov ecx, esi
mov dword [esi + 0x324], ebx
mov dword [esi + 0x328], ebx
call fcn.0047e0a0
push 0xffffffffffffffff
push ebx
push 0x13
mov ecx, esi
mov dword [esi + 0x388], ebx
call fcn.00460c10
mov eax, dword [esi + 0x320]
pop edi
inc eax
mov dword [esi + 0x320], eax
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
cmp word [esi + 0x128], 0x11
jl 0x4812e6
xor ebx, ebx
lea edi, [esi + 8]
push ebx
push edi
push 0x804b
call fcn.00471ea0
mov ecx, dword [0x56f3b8]
add esp, 0xc
push ebx
push edi
call fcn.00416880
cmp byte [0x6828d3], bl
je 0x4811a4
push ebx
push ebx
call fcn.004794a0
add esp, 8
cmp ax, 2
ja 0x481181
push 1
push ebx
push 6
push ebx
call fcn.004794d0
add esp, 0x10
push 1
push ebx
call fcn.004794a0
add esp, 8
cmp ax, 2
ja 0x4811a4
push 0xc8
push 1
push 0xa
push ebx
call fcn.004794d0
add esp, 0x10
push esi
call fcn.0043a400
mov ecx, dword [esi + 0x320]
mov eax, dword [esi + 0x31c]
add esp, 4
inc ecx
cmp eax, 0x14
mov dword [esi + 0x320], ecx
jne 0x48121f
mov esi, dword [0x60daac]
xor ebp, ebp
cmp esi, ebx
je 0x4812e6
cmp ebp, 2
jge 0x4812e6
cmp word [esi + 0x38], 0x191
jne 0x481210
lea eax, [esi + 8]
push eax
push edi
call fcn.004e6220
add esp, 8
cmp eax, 0x2bc
jae 0x481210
mov ecx, dword [0x6a9038]
cmp esi, dword [ecx + 0xe48]
je 0x481210
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x14]
inc ebp
mov esi, dword [esi + 0x20]
cmp esi, ebx
jne 0x4811d5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov ecx, dword [0x6a9038]
cmp byte [ecx + 0xad4], bl
je 0x48127a
cmp byte [ecx + 0x8e8], bl
jne 0x48123d
cmp byte [ecx + 0x8e9], bl
je 0x48127a
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x10], 6
mov dword [esp + 0x14], 0xd
mov word [esp + 0x18], 0x1e
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
call dword [eax + 0xc]
mov ecx, dword [0x6a9038]
call fcn.004bb710
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov dword [esi + 0x320], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov al, byte [esi + 0x142]
xor ebx, ebx
cmp al, bl
je 0x4812e6
cmp dword [esi + 0x31c], 0x14
jne 0x4812b5
mov dword [esi + 0x31c], 2
mov dword [esi + 0x320], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov dword [esi + 0x31c], ebp
mov dword [esi + 0x320], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov al, byte [esi + 0x142]
xor ebx, ebx
cmp al, bl
je 0x4812e6
jmp 0x48129d
push str.Unknown_substate_
push 0
call fcn.004015b0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4810c5
Capabilities:
Check http status code

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, 3
push edi
mov eax, dword [esi + 0x320]
cmp eax, ebp
ja case.default.0x4810dc
jmp dword [eax*4 + 0x4812f0]
mov ecx, esi
call fcn.004040e0
push 1
xor ebx, ebx
push 1
push 0x13
mov ecx, esi
mov dword [esi + 0x324], ebx
mov dword [esi + 0x328], ebx
call fcn.0047e0a0
push 0xffffffffffffffff
push ebx
push 0x13
mov ecx, esi
mov dword [esi + 0x388], ebx
call fcn.00460c10
mov eax, dword [esi + 0x320]
pop edi
inc eax
mov dword [esi + 0x320], eax
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
cmp word [esi + 0x128], 0x11
jl 0x4812e6
xor ebx, ebx
lea edi, [esi + 8]
push ebx
push edi
push 0x804b
call fcn.00471ea0
mov ecx, dword [0x56f3b8]
add esp, 0xc
push ebx
push edi
call fcn.00416880
cmp byte [0x6828d3], bl
je 0x4811a4
push ebx
push ebx
call fcn.004794a0
add esp, 8
cmp ax, 2
ja 0x481181
push 1
push ebx
push 6
push ebx
call fcn.004794d0
add esp, 0x10
push 1
push ebx
call fcn.004794a0
add esp, 8
cmp ax, 2
ja 0x4811a4
push 0xc8
push 1
push 0xa
push ebx
call fcn.004794d0
add esp, 0x10
push esi
call fcn.0043a400
mov ecx, dword [esi + 0x320]
mov eax, dword [esi + 0x31c]
add esp, 4
inc ecx
cmp eax, 0x14
mov dword [esi + 0x320], ecx
jne 0x48121f
mov esi, dword [0x60daac]
xor ebp, ebp
cmp esi, ebx
je 0x4812e6
cmp ebp, 2
jge 0x4812e6
cmp word [esi + 0x38], 0x191
jne 0x481210
lea eax, [esi + 8]
push eax
push edi
call fcn.004e6220
add esp, 8
cmp eax, 0x2bc
jae 0x481210
mov ecx, dword [0x6a9038]
cmp esi, dword [ecx + 0xe48]
je 0x481210
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x14]
inc ebp
mov esi, dword [esi + 0x20]
cmp esi, ebx
jne 0x4811d5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov ecx, dword [0x6a9038]
cmp byte [ecx + 0xad4], bl
je 0x48127a
cmp byte [ecx + 0x8e8], bl
jne 0x48123d
cmp byte [ecx + 0x8e9], bl
je 0x48127a
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x10], 6
mov dword [esp + 0x14], 0xd
mov word [esp + 0x18], 0x1e
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
call dword [eax + 0xc]
mov ecx, dword [0x6a9038]
call fcn.004bb710
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov dword [esi + 0x320], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov al, byte [esi + 0x142]
xor ebx, ebx
cmp al, bl
je 0x4812e6
cmp dword [esi + 0x31c], 0x14
jne 0x4812b5
mov dword [esi + 0x31c], 2
mov dword [esi + 0x320], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov dword [esi + 0x31c], ebp
mov dword [esi + 0x320], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov al, byte [esi + 0x142]
xor ebx, ebx
cmp al, bl
je 0x4812e6
jmp 0x48129d
push str.Unknown_substate_
push 0
call fcn.004015b0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret