joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4169f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bcae0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
lea eax, [esp + 0xc]
push ebp
push eax
mov edi, ecx
call fcn.00410700
add esp, 8
mov esi, eax
mov dword [esp + 0x30], 0
call fcn.0040f720
mov eax, dword [eax]
push 0xffffffffffffffff
push 0
push esi
lea ecx, [eax + 0x10]
call fcn.00402aa0
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0x30], 0xffffffff
jb 0x416a59
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004ade5d
add esp, 4
lea edx, [esp + 0x38]
push edx
call fcn.00408c00
mov ecx, eax
call fcn.004014f0
mov esi, eax
mov dword [esp + 0x30], 1
call fcn.0040f720
mov eax, dword [eax]
mov ecx, dword [esi]
push 0x51ff63
add eax, 0x10
push eax
push str.Language_switched_to:
push 0x51ff70
call fcn.00401560
mov ecx, eax
call fcn.00403390
mov ecx, eax
call fcn.00403370
mov ecx, eax
call fcn.00403f50
mov eax, dword [esp + 0x38]
test eax, eax
mov dword [esp + 0x30], 0xffffffff
je 0x416ad1
mov esi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec esi
mov edx, esi
test edx, edx
mov dword [eax], esi
jne 0x416ad1
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x14], ebp
call fcn.0040f720
mov eax, dword [eax]
add eax, 0x10
push eax
mov ecx, edi
call fcn.00416190
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x41c300
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4bd133
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x51eea4]
xor eax, dword [esp + 0x30]
push ebx
mov dword [esp + 0x24], eax
push esi
push 0x4f308c
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x40], 0
call fcn.00402f70
push 0x38
mov byte [esp + 0x44], 1
call fcn.004ad909
add esp, 0x10
mov dword [esp + 8], eax
test eax, eax
mov byte [esp + 0x34], 2
je 0x41c36a
mov ecx, eax
call fcn.00402110
mov esi, eax
jmp 0x41c36c
xor esi, esi
test esi, esi
mov dword [esp + 8], esi
je 0x41c377
inc dword [esi + 4]
mov edx, dword [esi]
push 1
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov byte [esp + 0x3c], 3
call dword [edx + 0x1c]
test al, al
je 0x41c3a5
mov edx, dword [esi]
push 5
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call dword [edx + 0xc]
cmp eax, 5
jne 0x41c3a5
mov bl, 1
jmp 0x41c3a7
xor bl, bl
mov ecx, dword [esi + 4]
dec ecx
mov eax, ecx
test eax, eax
mov dword [esp + 8], 0
mov dword [esi + 4], ecx
jne 0x41c3c4
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
mov eax, dword [esp + 0x24]
mov esi, 0x10
cmp eax, esi
mov eax, dword [esp + 0x10]
jae 0x41c3d9
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
cmp dword [esp + 0x24], esi
jb 0x41c3f3
mov eax, dword [esp + 0x10]
push eax
call fcn.004ade5d
add esp, 4
cmp dword [esp + 0x54], esi
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
jb 0x41c41b
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004ade5d
add esp, 4
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x28]
xor ecx, dword [esp + 0x38]
pop esi
mov al, bl
pop ebx
add esp, 0x30
jmp fcn.004ae650
Function at 0x426e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bd4a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x10]
mov ebp, dword [eax + 0xc]
mov edi, dword [esp + 0x30]
xor ebx, ebx
cmp ebp, ecx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x13], bl
mov dword [esp + 0x18], ecx
je 0x426f6a
mov eax, 0x4f26f0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x426e48
sub eax, edx
mov edx, dword [ebp + 0x14]
cmp edx, ebx
mov dword [esp + 0x14], eax
je 0x426e91
cmp edx, eax
mov ecx, edx
jb 0x426e64
mov ecx, eax
mov esi, dword [ebp + 0x18]
cmp esi, 0x10
lea eax, [ebp + 4]
jb 0x426e71
mov eax, dword [eax]
mov esi, eax
mov edi, 0x4f26f0
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x426e83
sbb eax, eax
sbb eax, 0xffffffff
mov edi, dword [esp + 0x30]
xor ebx, ebx
cmp eax, ebx
jne 0x426ee3
mov eax, dword [esp + 0x14]
cmp edx, eax
jb 0x426ee3
xor ecx, ecx
cmp edx, eax
setne cl
mov eax, ecx
cmp eax, ebx
jne 0x426ee3
mov eax, dword [ebp + 0x1c]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
add eax, 0x24
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402aa0
call fcn.00410370
fstp dword [esp + 0x30]
add esp, 0x1c
push ebx
mov ecx, edi
call fcn.0040dc90
mov edx, dword [esp + 0x14]
mov dword [eax], edx
jmp 0x426f4c
mov eax, 0x4f26ec
lea esi, [eax + 1]
jmp 0x426ef0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x426ef0
sub eax, esi
push eax
push 0x4f26ec
push edx
push ebx
mov ecx, ebp
call fcn.00401470
test eax, eax
jne 0x426f51
mov eax, dword [ebp + 0x1c]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
add eax, 0x24
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402aa0
call fcn.00410370
fstp dword [esp + 0x30]
add esp, 0x1c
push 1
mov ecx, edi
call fcn.0040dc90
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x18]
add ebp, 0x20
cmp ebp, eax
jne 0x426e40
cmp byte [esp + 0x13], bl
jne 0x426fb1
mov eax, dword [esp + 0x2c]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0xffffffffffffffff
push ebx
add eax, 0x24
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402aa0
call fcn.00410370
fstp dword [esp + 0x4c]
add esp, 0x1c
push ebx
mov ecx, edi
call fcn.0040dc90
mov esi, dword [esp + 0x30]
push 1
mov ecx, edi
mov dword [eax], esi
call fcn.0040dc90
mov dword [eax], esi
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx + 4]
dec eax
mov dword [esp + 0x24], 0xffffffff
mov dword [ecx + 4], eax
jne 0x426fcc
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 8
Function at 0x433910
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4be408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00401ed0
xor ebx, ebx
lea edi, [esi + 0x2c]
mov ecx, edi
mov dword [esp + 0x18], ebx
mov dword [esi], 0x4f4340
mov dword [esi + 0x20], 0x3f800000
mov dword [esi + 0x24], ebx
mov byte [esi + 0x28], bl
call fcn.00432230
mov ecx, dword [esp + 0x10]
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x38], ebx
mov al, 1
mov byte [esi + 0x3c], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x40], bl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x60], bl
mov eax, dword [esi + 0x30]
mov dword [esi + 0x38], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x43c260
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4bf28b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebp
push esi
push edi
push 0x38
mov ebp, ecx
call fcn.004ad909
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x34], 0
je 0x43c2a2
mov ecx, eax
call fcn.00402110
mov esi, eax
jmp 0x43c2a4
xor esi, esi
test esi, esi
mov dword [esp + 0xc], esi
je 0x43c2af
inc dword [esi + 4]
push ebx
mov edi, dword [esp + 0x40]
push edi
lea eax, [esp + 0x18]
push eax
mov ecx, ebp
mov dword [esp + 0x40], 1
call fcn.0043bef0
mov edx, dword [esi]
push 0
push eax
mov ecx, esi
mov byte [esp + 0x40], 2
call dword [edx + 0x1c]
mov bl, al
cmp dword [esp + 0x2c], 0x10
mov byte [esp + 0x38], 1
jb 0x43c2f3
mov eax, dword [esp + 0x18]
push eax
call fcn.004ade5d
add esp, 4
test bl, bl
pop ebx
je 0x43c34f
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
push edi
lea eax, [esp + 0x14]
push eax
mov ecx, ebp
call fcn.0043bef0
mov ecx, dword [eax + 0x18]
mov edi, 0x10
cmp ecx, edi
jb 0x43c31d
mov eax, dword [eax + 4]
jmp 0x43c320
add eax, 4
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
cmp dword [esp + 0x28], edi
jb 0x43c33a
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004ade5d
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
mov eax, dword [esi + 4]
dec eax
mov dword [esp + 0x34], 0xffffffff
mov dword [esi + 4], eax
jne 0x43c368
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x461190
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x51eea4]
xor eax, dword [ebp + 4]
push ebx
mov dword [esp + 0x224], eax
push esi
push edi
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x128], bl
mov ecx, 0x3f
lea edi, [esp + 0x129]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x28], bl
mov ecx, 0x3f
lea edi, [esp + 0x29]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xff
lea eax, [esp + 0x12c]
push eax
push str.USERNAME
mov byte [0x520280], bl
call esi
test eax, eax
je 0x46133e
push 0xff
lea ecx, [esp + 0x2c]
push ecx
push str.USERKEY
call esi
test eax, eax
jne 0x46121f
mov byte [esp + 0x28], bl
lea edx, [esp + 0x128]
push str.DEFAULT
push edx
call fcn.004b9f2a
add esp, 8
test eax, eax
je 0x46127d
lea eax, [esp + 0x28]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x461240
sub eax, edx
mov dword [esp + 0x24], eax
je 0x46127d
mov eax, dword [str.registered]
mov ecx, dword [0x4f5fc4]
mov dx, word [0x4f5fc8]
mov dword [0x520280], eax
mov al, byte [0x4f5fca]
mov dword [0x520284], ecx
mov word [0x520288], dx
mov byte [0x52028a], al
lea ecx, [esp + 0x14]
push ecx
push 1
push ebx
push str.SOFTWAREEnkordSvetlograd
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46133e
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
push edx
push 0x520688
push ebx
push ebx
push str.OrderURL
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x4612ce
cmp dword [esp + 0x10], edi
jbe 0x4612d4
mov byte [0x520688], bl
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push str.AffiliateBuild
mov edi, 0xa
push eax
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x46131e
cmp dword [esp + 0x10], edi
ja 0x46131e
lea ecx, [esp + 0x18]
push 0x4f26cc
push ecx
call fcn.004b9f2a
add esp, 8
neg eax
sbb al, al
inc al
mov byte [0x520680], al
jmp 0x461333
mov dx, word [0x4f5c40]
mov al, byte [0x4f5c42]
mov word [esp + 0x18], dx
mov byte [esp + 0x1a], al
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
xor ecx, dword [ebp + 4]
call fcn.004ae650
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ed10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
mov eax, dword [0x51eea4]
xor eax, dword [ebp + 4]
push ebx
mov dword [esp + 0x10c], eax
mov ax, word [0x4f6720]
push esi
push edi
mov ebx, ecx
mov cl, byte [0x4f6722]
mov word [esp + 0xc], ax
mov byte [esp + 0xe], cl
mov byte [esp + 0x10], 0
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
push 0xff
lea edx, [esp + 0x14]
stosw word es:[edi], ax
push edx
push str.TIMELEFTTOTAL
stosb byte es:[edi], al
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x46edfe
mov al, byte [esp + 0x15]
cmp al, 0x30
mov cl, byte [esp + 0x16]
mov byte [esp + 0xc], al
mov byte [esp + 0xd], cl
jne 0x46ed94
mov byte [esp + 0xc], cl
mov byte [esp + 0xd], 0
lea eax, [esp + 0xc]
push eax
call fcn.004aeb58
mov cl, byte [esp + 0x17]
mov esi, eax
mov al, byte [esp + 0x16]
add esp, 4
cmp al, 0x30
mov byte [esp + 0xc], al
mov byte [esp + 0xd], cl
jne 0x46edc0
mov byte [esp + 0xc], cl
mov byte [esp + 0xd], 0
lea ecx, [esp + 0xc]
push ecx
call fcn.004aeb58
imul eax, eax, 0x3c
mov dl, byte [esp + 0x14]
add esi, eax
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x14], dl
mov byte [esp + 0x15], 0
call fcn.004aeb58
imul eax, eax, 0xe10
add eax, esi
add esp, 8
imul eax, eax, 0x3e8
cdq
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov ecx, dword [esp + 0x114]
xor ecx, dword [ebp + 4]
call fcn.004ae650
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x483cf0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4c5771
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esi], 0x4f6f70
lea eax, [esi + 8]
xor ecx, ecx
mov edx, eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
push edi
lea ecx, [esi + 0x10]
xor edx, edx
mov edi, ecx
mov dword [edi], edx
mov dword [edi + 4], edx
lea edi, [esi + 0x18]
xor ebx, ebx
mov dword [esp + 0x10], esi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [esp + 0x24], ebx
mov dword [esi + 0x28], ebx
lea edx, [esi + 0x2c]
xor ebp, ebp
mov dword [edx], ebp
mov dword [edx + 4], ebp
mov dword [esi + 0x34], ebx
mov edx, ebp
mov dword [eax], edx
mov dword [eax + 4], ebp
mov eax, ebp
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
push 0x32
mov ecx, edi
mov byte [esp + 0x28], 2
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], ebp
call fcn.00483b90
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x483d94
push eax
call fcn.004ade5d
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov ecx, dword [esi + 0x28]
cmp ecx, ebx
mov dword [esi + 0x28], ebx
je 0x483db2
dec dword [ecx + 4]
jne 0x483db2
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esi + 0x34]
cmp ecx, ebx
mov dword [esi + 0x34], ebx
je 0x483dc7
dec dword [ecx + 4]
jne 0x483dc7
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x1c]
pop edi
mov dword [esi + 0x38], ebx
mov byte [esi + 4], bl
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x485ce0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4c59ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
mov eax, dword [0x51eea4]
xor eax, dword [esp + 0x70]
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x68], eax
push edi
mov esi, ecx
mov dword [esp + 0xc], ebx
mov eax, str.data_objects_balls_
mov dword [esp + 0x78], 1
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x485d34
sub eax, edi
push eax
push str.data_objects_balls_
lea ecx, [esp + 0x20]
call fcn.00402cd0
mov eax, dword [esp + 0x84]
push eax
lea ecx, [esp + 0x54]
push ecx
mov ecx, esi
mov byte [esp + 0x80], 2
call fcn.00485380
push str..xml
push eax
lea edx, [esp + 0x3c]
push edx
mov byte [esp + 0x84], 3
call fcn.00402f70
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x84], 4
call fcn.00402530
cmp dword [esp + 0x4c], 0x10
jb 0x485dac
mov eax, dword [esp + 0x38]
push eax
call fcn.004ade5d
add esp, 4
cmp dword [esp + 0x68], 0x10
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
mov byte [esp + 0x78], 2
jb 0x485dd5
mov ecx, dword [esp + 0x54]
push ecx
call fcn.004ade5d
add esp, 4
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x90]
push eax
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov esi, dword [eax]
cmp esi, ebx
je 0x485df9
inc dword [esi + 4]
mov eax, dword [esp + 0x84]
cmp eax, ebx
mov dword [esp + 0xc], esi
mov byte [esp + 0x78], 2
je 0x485e24
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov dword [esp + 0x14], edx
jne 0x485e24
mov eax, dword [ecx]
push 1
call dword [eax]
cmp esi, ebx
mov edi, dword [esp + 0x80]
mov dword [edi], esi
je 0x485e34
inc dword [esi + 4]
cmp dword [esp + 0x30], 0x10
mov dword [esp + 0x10], 1
jb 0x485e50
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004ade5d
add esp, 4
cmp esi, ebx
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov byte [esp + 0x78], bl
je 0x485e75
dec dword [esi + 4]
jne 0x485e75
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x6c]
xor ecx, dword [esp + 0x7c]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.004ae650
add esp, 0x70
ret 8
Function at 0x48d8c0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c6758
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, ecx
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
push 4
lea ecx, [edi + 8]
push ecx
mov ecx, esi
mov dword [esp + 0x18], 0
call dword [eax + 0xc]
mov edx, dword [esi]
push 4
lea eax, [edi + 0xc]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x10]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x14]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x18]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x1c]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x20]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x21]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x22]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x23]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x24]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x28]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x29]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x2a]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x2b]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x48]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x30]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x34]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x4c]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x50]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x51]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x54]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esi]
push 1
add edi, 0x58
push edi
mov ecx, esi
call dword [edx + 0xc]
mov eax, dword [esi + 4]
dec eax
mov dword [esp + 0x10], 0xffffffff
mov dword [esi + 4], eax
jne 0x48da29
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov ecx, dword [esp + 8]
pop edi
mov al, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x48da40
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c6758
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, ecx
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
push 4
lea ecx, [edi + 8]
push ecx
mov ecx, esi
mov dword [esp + 0x18], 0
call dword [eax + 8]
mov edx, dword [esi]
push 4
lea eax, [edi + 0xc]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x10]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x14]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x18]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x1c]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x20]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x21]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x22]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x23]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x24]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x28]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x29]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x2a]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x2b]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x48]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x30]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x34]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x4c]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x50]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 1
lea eax, [edi + 0x51]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 4
lea eax, [edi + 0x54]
push eax
mov ecx, esi
call dword [edx + 8]
mov edx, dword [esi]
push 1
add edi, 0x58
push edi
mov ecx, esi
call dword [edx + 8]
mov eax, dword [esi + 4]
dec eax
mov dword [esp + 0x10], 0xffffffff
mov dword [esi + 4], eax
jne 0x48dba9
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov ecx, dword [esp + 8]
pop edi
mov al, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4