joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467150
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1fc4
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5061ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0044bb50
mov dword [esi + method.DM::IDMReg.virtual_4], vtable.DM::IDMItemPanelOwner.0
mov dword [esi + method.DM::DMArrayT_class_DM::DMZipItem__.virtual_0], vtable.DM::DMArrayT_struct_DM::stLCITEMEX__.0
mov dword [ebp - 4], 0
mov dword [esi + 0x180], 0
mov dword [esi + 0x184], 0
mov dword [esi + 0x188], 0
mov dword [esi + 0x18c], 0
lea eax, [esi + 0x190]
mov dword [eax], vtable.DM::DMMapT_int__class_DM::CRect_.0
mov dword [ebp - 0x14], eax
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0x11
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0xa
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x10], 0x3f400000
mov dword [eax + 0x14], 0x3e800000
mov dword [eax + 0x18], 0x40100000
mov dword [eax + 0x1c], 0x26
mov dword [eax + 0x20], 0
mov byte [ebp - 4], 2
lea edi, [esi + 0x1d4]
mov dword [esi], vtable.DM::DUIListCtrlEx.0
mov ebx, 3
mov dword [esi + method.DM::DUIListBoxEx.1.virtual_0], vtable.DM::DUIListCtrlEx.1.0
mov dword [esi + method.DM::DMArrayT_class_DM::DMZipItem__.virtual_0], vtable.DM::DUIListCtrlEx.2.0
mov dword [eax], vtable.DM::DUIListCtrlEx.3.0
mov ecx, edi
call fcn.004253c0
add edi, 4
sub ebx, 1
jne 0x467257
mov dword [esi + 0x1e0], ebx
mov dword [esi + 0x1e4], ebx
mov dword [esi + 0x1f0], ebx
mov dword [esi + 0x1f4], ebx
mov dword [esi + 0x1fc], ebx
mov dword [esi + 0x200], ebx
mov dword [esi + 0x204], ebx
mov dword [esi + 0x208], ebx
mov dword [esi + 0x1c4], 0xffffffff
mov dword [esi + 0x1c8], 0xffffffff
mov dword [esi + 0x1cc], 0x14
mov dword [esi + 0x1d0], 0x14
mov byte [esi + 0x1d7], bl
or dword [esi + 0x1d4], 0xffffff
mov byte [esi + 0x1db], bl
or dword [esi + 0x1d8], 0xffffff
mov byte [esi + 0x1df], bl
or dword [esi + 0x1dc], 0xffffff
mov eax, dword [esi + 0x48]
mov dword [esi + 0x1e9], ebx
mov dword [esi + 0x1f8], ebx
mov byte [eax + 0x19], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e230
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp edi, 0xf
jne 0x46e26f
mov eax, dword [ebp + 0xc]
push eax
mov dword [esi + 8], 1
call fcn.0046dde0
mov dword [ebx], 0
cmp dword [esi + 8], 0
je 0x46e3a6
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x10
cmp edi, 0x100
jne 0x46e29b
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shr eax, 0x10
push eax
movzx eax, cx
mov ecx, esi
push eax
mov eax, dword [ebp + 0xc]
movzx eax, ax
push eax
mov dword [esi + 8], 1
call fcn.0046e0c0
jmp 0x46e253
cmp edi, 0x101
jne 0x46e2c7
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shr eax, 0x10
push eax
movzx eax, cx
mov ecx, esi
push eax
mov eax, dword [ebp + 0xc]
movzx eax, ax
push eax
mov dword [esi + 8], 1
call fcn.0046e190
jmp 0x46e253
cmp edi, 0x104
jne 0x46e308
push 0x12
mov dword [esi + 8], 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x46e337
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shr eax, 0x10
push eax
movzx eax, cx
mov ecx, esi
push eax
mov eax, dword [ebp + 0xc]
movzx eax, ax
push eax
call fcn.0046e0c0
jmp 0x46e253
cmp edi, 0x105
jne 0x46e35f
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esi + 8], 1
mov dword [ebp + 8], eax
cmp eax, 0x12
je 0x46e343
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x46e343
mov dword [esi + 8], 0
jmp 0x46e253
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shr eax, 0x10
push eax
movzx eax, cx
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.0046e190
jmp 0x46e253
cmp edi, 7
jne 0x46e380
mov dword [esi + 8], 1
call fcn.0046e4e0
mov ecx, dword [esi + 0xec]
call fcn.004599e0
jmp 0x46e253
cmp edi, 8
jne 0x46e39c
mov ecx, dword [esi + 0xec]
mov dword [esi + 8], 1
call fcn.004594f0
jmp 0x46e253
cmp dword [esi + 8], 0
jne 0x46e263
push ebx
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push edi
call fcn.004054c0
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x46e710
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x12
mov edi, ecx
call esi
mov ecx, 0x8000
test cx, ax
push 0x11
seta bl
call esi
mov ecx, 0x8000
test cx, ax
push 0x10
seta bh
call esi
mov ecx, 0x8000
test cx, ax
seta al
test bl, bl
jne 0x46e78b
test bh, bh
jne 0x46e75d
test al, al
jne 0x46e773
mov eax, 1
xor ecx, ecx
jmp 0x46e7cb
test al, al
jne 0x46e76b
mov eax, 4
lea ecx, [eax - 2]
jmp 0x46e7cb
test bh, bh
jne 0x46e77d
test al, al
je 0x46e7c1
mov eax, 2
lea ecx, [eax - 1]
jmp 0x46e7cb
test al, al
je 0x46e7c1
mov eax, 0x10
lea ecx, [eax - 0xd]
jmp 0x46e7cb
test bh, bh
jne 0x46e7a1
test al, al
jne 0x46e79d
mov eax, 8
lea ecx, [eax - 4]
jmp 0x46e7cb
test bh, bh
je 0x46e7b3
test al, al
jne 0x46e7af
mov eax, 0x40
lea ecx, [eax - 0x3a]
jmp 0x46e7cb
test bh, bh
jne 0x46e7c1
test al, al
je 0x46e7c1
mov eax, 0x20
lea ecx, [eax - 0x1b]
jmp 0x46e7cb
mov eax, 0x80
mov ecx, 7
mov word [edi + 0xe0], cx
test word [edi + 0xe8], ax
je 0x46e7e9
mov ax, word [edi + 0xe6]
mov word [edi + 0xe0], ax
pop edi
pop esi
pop ebx
ret
Function at 0x46f170
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp edi, 8
jne 0x46f1de
call fcn.0045ad10
test eax, eax
jne 0x46f1d8
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push ebx
push 0x12
call edi
mov ebx, 0x8000
test bx, ax
jne 0x46f1d7
push 0x10
call edi
test bx, ax
jne 0x46f1d7
push 0x11
call edi
test bx, ax
jne 0x46f1d7
push 2
mov ecx, esi
call fcn.00416580
mov esi, eax
test esi, esi
je 0x46f1d7
mov edx, dword [esi]
mov ecx, esi
push str.IPEdit
mov edx, dword [edx + 0x28]
call edx
test al, al
je 0x46f1d7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x74]
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
push edi
call fcn.004ad2c2
add esp, 4
test eax, eax
je 0x46f1d8
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push edi
call fcn.0045bb60
mov ecx, esi
call fcn.0046e950
test al, al
jne 0x46f1d8
mov ecx, esi
call fcn.0045ad10
cmp eax, 2
jle 0x46f1d8
push 3
mov ecx, esi
call fcn.00416580
mov esi, eax
test esi, esi
je 0x46f1d8
mov edx, dword [esi]
mov ecx, esi
push str.IPEdit
mov edx, dword [edx + 0x28]
call edx
test al, al
je 0x46f1d8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x74]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x46f6d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2692
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5061ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0044bb50
mov dword [esi + method.DM::IDMReg.virtual_4], vtable.DM::IDMItemPanelOwner.0
mov dword [ebp - 4], 0
mov dword [esi + method.DM::DMTreeT_struct_DM::stTVITMEX__.virtual_0], vtable.DM::DMTreeT_struct_DM::stTVITMEX__.0
mov dword [esi + 0x180], 0
mov dword [esi + 0x184], 0
lea eax, [esi + 0x188]
mov dword [eax], vtable.DM::DMMapT_unsigned_long_int__class_DM::CRect_.0
mov dword [ebp - 0x14], eax
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0x11
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0xa
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x10], 0x3f400000
mov dword [eax + 0x14], 0x3e800000
mov dword [eax + 0x18], 0x40100000
mov dword [eax + 0x1c], 0x26
mov dword [eax + 0x20], 0
mov byte [ebp - 4], 2
lea edi, [esi + 0x1c8]
mov dword [esi], vtable.DM::DUITreeCtrlEx.0
mov ebx, 3
mov dword [esi + method.DM::DUIListBoxEx.1.virtual_0], vtable.DM::DUITreeCtrlEx.1.0
mov dword [esi + method.DM::DUITreeCtrlEx.2.virtual_0], vtable.DM::DUITreeCtrlEx.2.0
mov dword [eax], vtable.DM::DUITreeCtrlEx.3.0
mov ecx, edi
call fcn.004253c0
add edi, 4
sub ebx, 1
jne 0x46f7c3
mov dword [esi + 0x1f8], ebx
mov dword [esi + 0x1fc], ebx
mov dword [esi + 0x200], ebx
mov dword [esi + 0x204], ebx
mov dword [esi + 0x208], ebx
mov dword [esi + 0x1c0], ebx
mov dword [esi + 0x1c4], ebx
mov dword [esi + 0x1bc], ebx
mov dword [esi + 0x1ec], ebx
mov dword [esi + 0x1e8], ebx
mov dword [esi + 0x1e4], ebx
mov ecx, dword [esi + 0x208]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x46f83b
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x46f831
mov eax, dword [ecx]
call dword [eax]
mov dword [esi + 0x208], 0
mov eax, dword [esi + 0x48]
mov ecx, esi
mov dword [esi + 0x1d4], 0x14
mov dword [esi + 0x1d8], 0x32
mov dword [esi + 0x1dc], 0x10
mov byte [eax + 0x19], 1
mov dword [esi + 0x160], 0x28
mov word [esi + 0x1e0], 0
mov byte [esi + 0x1cb], 0
or dword [esi + 0x1c8], 0xffffff
mov byte [esi + 0x1cf], 0
or dword [esi + 0x1cc], 0xffffff
push 0
mov byte [esi + 0x1d3], 0
or dword [esi + 0x1d0], 0xffffff
push 0
call fcn.0044ec20
push 0
push 0
mov ecx, esi
call fcn.0044ebc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47b570
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov bl, 1
push edi
push esi
mov edi, ecx
xor bh, bh
call fcn.004b32b5
add esp, 4
test eax, eax
jne 0x47b5e7
nop dword [eax]
test bh, bh
jne 0x47b5e7
push esi
push 1
lea eax, [ebp + 0xb]
push 1
push eax
call fcn.004ad898
movzx eax, byte [ebp + 0xb]
add esp, 0x10
cmp eax, 0x3b
ja case.0x47b5b5.1
movzx eax, byte [eax + 0x47b604]
jmp dword [eax*4 + 0x47b5f0]
lea eax, [edi + 0x48]
mov ecx, edi
push eax
push esi
call fcn.0047bba0
jmp case.0x47b5b5.0
push esi
mov ecx, edi
call fcn.0047bfc0
jmp case.0x47b5b5.0
mov bh, 1
jmp case.0x47b5b5.0
xor bl, bl
push esi
call fcn.004b32b5
add esp, 4
test eax, eax
je 0x47b590
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 4

Function at 0x47b5da
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov bl, 1
push edi
push esi
mov edi, ecx
xor bh, bh
call fcn.004b32b5
add esp, 4
test eax, eax
jne 0x47b5e7
nop dword [eax]
test bh, bh
jne 0x47b5e7
push esi
push 1
lea eax, [ebp + 0xb]
push 1
push eax
call fcn.004ad898
movzx eax, byte [ebp + 0xb]
add esp, 0x10
cmp eax, 0x3b
ja case.0x47b5b5.1
movzx eax, byte [eax + 0x47b604]
jmp dword [eax*4 + 0x47b5f0]
lea eax, [edi + 0x48]
mov ecx, edi
push eax
push esi
call fcn.0047bba0
jmp case.0x47b5b5.0
push esi
mov ecx, edi
call fcn.0047bfc0
jmp case.0x47b5b5.0
mov bh, 1
jmp case.0x47b5b5.0
xor bl, bl
push esi
call fcn.004b32b5
add esp, 4
test eax, eax
je 0x47b590
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 4
Function at 0x47b660
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5061ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x4d9038
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
mov esi, ecx
xor bl, bl
call fcn.004ad58f
mov eax, dword [ebp - 0x14]
add esp, 0xc
test eax, eax
je 0x47b7b5
push eax
push 6
xor ecx, ecx
mov byte [ebp - 0xc], bl
lea eax, [ebp - 0xc]
mov dword [ebp - 0xb], ecx
push 1
push eax
mov word [ebp - 7], cx
call fcn.004ad898
push 6
lea eax, [ebp - 0xc]
push str.GIF89a
push eax
call fcn.004b6270
add esp, 0x1c
test eax, eax
jne 0x47b7a5
push dword [ebp - 0x14]
lea eax, [esi + 0x24]
push 2
push 1
push eax
call fcn.004ad898
push dword [ebp - 0x14]
lea eax, [esi + 0x26]
push 2
push 1
push eax
call fcn.004ad898
push dword [ebp - 0x14]
lea eax, [ebp - 0xd]
push 1
push 1
push eax
call fcn.004ad898
mov cl, byte [ebp - 0xd]
add esp, 0x30
test cl, cl
jns 0x47b712
mov byte [esi + 0x28], 1
jmp 0x47b716
mov byte [esi + 0x28], 0
movzx edx, cl
mov eax, edx
shr eax, 4
and eax, 7
inc eax
cmp byte [esi + 0x28], 0
mov dword [esi + 0x2c], eax
je 0x47b744
shr cl, 3
and edx, 7
and cl, 1
mov eax, 1
mov byte [esi + 0x30], cl
lea ecx, [edx + 1]
shl eax, cl
mov dword [esi + 0x34], eax
push dword [ebp - 0x14]
lea eax, [ebp - 0xd]
push 1
push 1
push eax
call fcn.004ad898
push dword [ebp - 0x14]
movzx eax, byte [ebp - 0xd]
push 1
mov dword [esi + 0x38], eax
lea eax, [ebp - 0xd]
push 1
push eax
call fcn.004ad898
movzx eax, byte [ebp - 0xd]
add esp, 0x20
cmp byte [esi + 0x28], 0
mov dword [esi + 0x3c], eax
je 0x47b78f
mov eax, dword [esi + 0x34]
push 1
lea eax, [eax + eax*2]
push eax
push dword [ebp - 0x14]
call fcn.004adc1d
add esp, 0xc
push dword [ebp - 0x14]
mov ecx, esi
call fcn.0047b570
mov bl, al
test bl, bl
je 0x47b7a5
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x20], ecx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x47b7b5
push eax
call fcn.004ad64c
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0048e386
mov esp, ebp
pop ebp
ret 4
Function at 0x47bba0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5061ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2d]
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
push esi
push 1
push 1
push eax
mov byte [ebp - 0x2e], 1
call fcn.004ad898
movzx eax, byte [ebp - 0x2d]
add esp, 0x10
dec eax
cmp eax, 0xfe
ja case.0x47bbe7.2
movzx eax, byte [eax + 0x47bd94]
jmp dword [eax*4 + 0x47bd88]
push esi
call fcn.004b32b5
add esp, 4
test eax, eax
jne 0x47bc93
nop
push esi
push 1
lea eax, [ebp - 0x2d]
push 1
push eax
call fcn.004ad898
mov al, byte [ebp - 0x2d]
add esp, 0x10
test al, al
je 0x47bc93
cmp al, 4
jne 0x47bc73
push esi
push 1
lea eax, [ebp - 0x2d]
mov byte [edi], 1
push 1
push eax
call fcn.004ad898
mov cl, byte [ebp - 0x2d]
movzx eax, cl
shr eax, 2
and eax, 7
mov dword [edi + 8], eax
mov al, cl
shr al, 1
and cl, 1
push esi
and al, 1
mov byte [edi + 2], cl
push 2
mov byte [edi + 1], al
lea eax, [edi + 4]
push 1
push eax
call fcn.004ad898
push esi
push 1
lea eax, [ebp - 0x2d]
push 1
push eax
call fcn.004ad898
movzx eax, byte [ebp - 0x2d]
add esp, 0x30
mov dword [edi + 0xc], eax
jmp 0x47bc82
push 1
movzx eax, al
push eax
push esi
call fcn.004adc1d
add esp, 0xc
push esi
call fcn.004b32b5
add esp, 4
test eax, eax
je 0x47bc00
mov al, byte [ebp - 0x2e]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e386
mov esp, ebp
pop ebp
ret 8
cmp byte [ebx + 0x44], 0
jne 0x47bd15
movaps xmm0, xmmword [str._vNETSCAPE2.0]
push esi
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0x1c], 0
call fcn.004ae216
push esi
push 0x11
mov edi, eax
mov byte [ebp - 0x18], 0
lea eax, [ebp - 0x18]
xorps xmm0, xmm0
push 1
push eax
movups xmmword [ebp - 0x17], xmm0
call fcn.004ad898
push 0xe
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004b6270
add esp, 0x20
test eax, eax
jne 0x47bd09
movzx ecx, byte [ebp - 9]
movzx eax, byte [ebp - 0xa]
shl ecx, 8
add ecx, eax
mov byte [ebx + 0x44], 1
mov dword [ebx + 0x40], ecx
push 0
push edi
push esi
call fcn.004adc1d
add esp, 0xc
push esi
call fcn.004b32b5
add esp, 4
test eax, eax
jne 0x47bc93
push esi
push 1
lea eax, [ebp - 0x2d]
push 1
push eax
call fcn.004ad898
mov al, byte [ebp - 0x2d]
add esp, 0x10
test al, al
je 0x47bc93
push 1
movzx eax, al
push eax
push esi
call fcn.004adc1d
push esi
call fcn.004b32b5
add esp, 0x10
test eax, eax
je 0x47bd26
mov al, byte [ebp - 0x2e]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048e386
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048e386
mov esp, ebp
pop ebp
ret 8
Function at 0x47bfc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push 0x18
mov edi, ecx
call fcn.0048e397
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 8], eax
push esi
movups xmmword [eax], xmm0
mov eax, dword [ebp - 8]
push 2
push 1
movq qword [eax + 0x10], xmm0
push dword [ebp - 8]
call fcn.004ad898
mov eax, dword [ebp - 8]
push esi
push 2
add eax, 2
push 1
push eax
call fcn.004ad898
mov eax, dword [ebp - 8]
push esi
push 2
add eax, 4
push 1
push eax
call fcn.004ad898
mov eax, dword [ebp - 8]
push esi
push 2
add eax, 6
push 1
push eax
call fcn.004ad898
add esp, 0x44
lea eax, [ebp - 1]
push esi
push 1
push 1
push eax
call fcn.004ad898
mov al, byte [ebp - 1]
add esp, 0x10
test al, al
jns 0x47c05d
movzx ecx, al
mov eax, 1
and ecx, 7
inc ecx
shl eax, cl
push 1
lea eax, [eax + eax*2]
push eax
push esi
call fcn.004adc1d
add esp, 0xc
push esi
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.004ad898
push esi
call fcn.004b32b5
add esp, 0x14
test eax, eax
jne 0x47c0a9
push esi
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.004ad898
mov al, byte [ebp - 1]
add esp, 0x10
test al, al
je 0x47c0a9
push 1
movzx eax, al
push eax
push esi
call fcn.004adc1d
push esi
call fcn.004b32b5
add esp, 0x10
test eax, eax
je 0x47c078
cmp byte [edi + 0x48], 0
je 0x47c0be
mov eax, dword [ebp - 8]
movups xmm0, xmmword [edi + 0x48]
movups xmmword [eax + 8], xmm0
mov byte [edi + 0x48], 0
lea eax, [ebp - 8]
push eax
lea ecx, [edi + 8]
call fcn.00447e70
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x47d440
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3050
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x5061ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
push 1
push dword [edi + 0xc]
mov dword [edi + 0x3c], eax
mov dword [edi + 0x38], 0
mov dword [edi + 0x34], 0
call dword [sym.imp.GDI32.dll_SetBkMode]
mov dword [ebp - 0x80], 0
mov eax, dword [edi + 0x3c]
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea eax, [ebp - 0x80]
push eax
push 1
push 0
push ecx
mov ecx, esp
push 0xff000000
call fcn.004096b0
mov ecx, dword [edi + 0x3c]
call dword [esi + 0x3c]
mov eax, dword [edi]
mov ecx, edi
push 0
push dword [ebp - 0x80]
call dword [eax + 0xc]
mov dword [ebp - 0x7c], 0
mov eax, dword [edi + 0x3c]
mov byte [ebp - 4], 1
mov esi, dword [eax]
lea eax, [ebp - 0x7c]
push eax
push ecx
mov ecx, esp
push 0xff000000
call fcn.004096b0
mov ecx, dword [edi + 0x3c]
call dword [esi + 0x40]
mov eax, dword [edi]
mov ecx, edi
push 0
push dword [ebp - 0x7c]
call dword [eax + 0xc]
mov dword [ebp - 0x78], 0
push 0x58
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.004a7c50
push 0x4d924c
lea eax, [ebp - 0x50]
mov byte [ebp - 0x52], 5
push 0x20
push eax
mov dword [ebp - 0x6c], 0x14
call fcn.004aceb2
mov ecx, dword [edi + 0x3c]
lea edx, [ebp - 0x78]
add esp, 0x18
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x6c]
push edx
call dword [eax + 0x34]
mov eax, dword [edi]
mov ecx, edi
push 0
push dword [ebp - 0x78]
call dword [eax + 0xc]
mov dword [ebp - 0x74], 0
mov ecx, dword [edi + 0x3c]
lea edx, [ebp - 0x74]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [ebp - 0x74]
push 0
push dword [ebp + 0x10]
mov eax, dword [ecx]
push dword [ebp + 0xc]
call dword [eax + 0xc]
mov eax, dword [edi]
mov ecx, edi
push 0
push dword [ebp - 0x74]
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x74]
or esi, 0xffffffff
mov byte [ebp - 4], 2
test ecx, ecx
je 0x47d599
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x47d599
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x78]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x47d5b2
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x47d5b2
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x7c]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x47d5cb
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x47d5cb
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x47d5e5
lock xadd dword [ecx + 4], esi
dec esi
jne 0x47d5e5
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e386
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47f940
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d33d1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5061ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0x11
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xa
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x10], 0x3f400000
mov dword [esi + 0x14], 0x3e800000
mov dword [esi + 0x18], 0x40100000
mov dword [esi + 0x1c], 0x26
mov dword [esi + 0x20], 0
mov dword [esi], vtable.DM::DMTransNode.0
mov eax, dword [0x50b538]
mov dword [esi + 0x34], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push eax
lea ecx, [esi + 0x34]
call fcn.00404b00
mov eax, dword [esi + 0x34]
cmp dword [eax - 8], 0
jne 0x47f9f9
push str.custom
lea ecx, [esi + 0x34]
call fcn.00404ba0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff4
mov dword [ebp - 4], 3
cmp ecx, dword [0x50b534]
je 0x47fa23
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x47fa23
push ecx
call fcn.00433990
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x482080
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
call fcn.00481fe0
test al, al
je 0x4820b2
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x482420
push 0
push 0
call fcn.004b67cc
add esp, 0x18
mov dword [esi + 8], eax
xor eax, eax
cmp eax, dword [ebp - 4]
pop esi
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x4820c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cd978
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5061ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi + 0x60], eax
mov byte [edi + 0x64], 1
nop
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
mov dword [ebp - 0x10], eax
call fcn.00481db0
test al, al
je 0x4821a8
lea esi, [edi + 0x3c]
mov dword [ebp - 0x14], esi
test esi, esi
je 0x482129
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 0x2c], 0
mov dword [ebp - 4], 0
je 0x48213e
lea ecx, [edi + 0x24]
call fcn.004466e0
lea ebx, [edi + 0xc]
push ebx
lea ecx, [edi + 0x24]
call fcn.00481c30
mov ecx, ebx
call fcn.004466e0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x482163
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, edi
call fcn.00481e20
mov esi, dword [edi + 0x68]
cmp esi, 0xffffffff
je 0x482185
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x10]
xor ecx, ecx
sub esi, eax
cmp eax, dword [edi + 0x68]
cmova esi, ecx
push 0x4ff
push esi
push 0
lea eax, [edi + 0x58]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp byte [edi + 0x65], 0
jne 0x4821a8
cmp eax, 0xffffffff
jne 0x482100
mov esi, dword [edi + 0x24]
test esi, esi
je 0x4821cc
nop
mov ecx, dword [esi + 8]
mov esi, dword [esi]
test ecx, ecx
je 0x4821c8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4821c8
mov eax, dword [ecx]
call dword [eax]
test esi, esi
jne 0x4821b0
lea ecx, [edi + 0x24]
call fcn.004466e0
mov eax, dword [edi + 0x5c]
test eax, eax
je 0x4821e2
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [edi + 0x64], 0
mov eax, 1
mov dword [edi + 0x60], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret