joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430c5a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4debab
call fcn.004d34a0
push ecx
mov eax, dword [0x4ebc94]
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
lea ecx, [esi + 0x24]
mov dword [ebp - 4], edi
mov dword [esi], 0x4f3fac
call fcn.0046740e
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.0046740e
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 2
call fcn.0043e3b7
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x68], edi
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 5
mov dword [esi + 0x80], edi
call dword [0x4eb6c8]
lea eax, [esi + 0xa0]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
lea ecx, [esi + 0xb0]
mov byte [ebp - 4], 7
call dword [0x4eb6c8]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x44af72
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e018a
call fcn.004d34a0
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, ecx
inc ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], ebx
xor edi, edi
lea ecx, [esi + 0x14]
mov dword [ebp - 4], edi
mov dword [esi], 0x4f6fb4
call dword [0x4eb6c8]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], bl
call dword [0x4eb6c8]
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
call dword [0x4eb6c8]
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x80]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
push dword [ebp + 8]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
mov dword [esi + 8], ebx
call dword [0x4eb748]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x78], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x7c], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x450859
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4508a0
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4508a0
xor edx, edx
mov eax, esi
shl eax, 3
push 6
pop ecx
div ecx
lea ecx, [eax + eax*2]
shl ecx, 1
mov edx, ecx
mov ecx, esi
shl ecx, 3
sub ecx, edx
dec ecx
dec ecx
je 0x450893
dec ecx
dec ecx
jne 0x450896
inc eax
inc eax
jmp 0x450896
add eax, 3
mov ecx, dword [ebp + 0xc]
inc eax
cmp dword [ecx], eax
jae 0x4508a7
mov dword [ecx], eax
push 0xfffffffffffffff0
pop eax
pop edi
pop esi
leave
ret
push ebx
xor edx, edx
push 3
pop ecx
mov eax, esi
div ecx
mov ecx, dword [ebp + 8]
xor edx, edx
lea eax, [eax + eax*2]
test eax, eax
jbe 0x45092d
push 3
dec eax
pop esi
div esi
inc eax
lea edx, [eax + eax*2]
mov dword [ebp - 4], edx
movzx esi, byte [edi]
inc edi
movzx edx, byte [edi]
mov ebx, esi
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x4f72a8]
inc edi
mov dword [ebp + 0x10], edx
movzx edx, byte [edi]
mov byte [ecx], bl
mov ebx, dword [ebp + 0x10]
shr ebx, 4
shl esi, 4
add ebx, esi
and ebx, 0x3f
mov bl, byte [ebx + 0x4f72a8]
inc edi
inc ecx
mov byte [ecx], bl
mov ebx, dword [ebp + 0x10]
mov esi, edx
shr esi, 6
lea esi, [esi + ebx*4]
and esi, 0x3f
mov bl, byte [esi + 0x4f72a8]
inc ecx
mov byte [ecx], bl
and edx, 0x3f
mov dl, byte [edx + 0x4f72a8]
inc ecx
mov byte [ecx], dl
inc ecx
dec eax
jne 0x4508ca
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
cmp edx, esi
jae 0x450982
movzx eax, byte [edi]
inc edx
cmp edx, esi
jae 0x45093f
movzx edi, byte [edi + 1]
jmp 0x450941
xor edi, edi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x4f72a8]
mov byte [ecx], bl
shl eax, 4
mov ebx, edi
shr ebx, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + 0x4f72a8]
inc ecx
mov byte [ecx], al
inc ecx
cmp edx, esi
jae 0x45097a
and edi, 0xf
mov al, byte [edi*4 + 0x4f72a8]
mov byte [ecx], al
jmp 0x45097d
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov edx, dword [ebp + 0xc]
mov eax, ecx
sub eax, dword [ebp + 8]
pop ebx
mov dword [edx], eax
mov byte [ecx], 0
xor eax, eax
jmp 0x4508a3
Function at 0x450997
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
push ebx
push esi
push edi
je 0x450aad
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x450aad
xor esi, esi
xor ebx, ebx
xor edx, edx
test edi, edi
jbe 0x450aa9
mov eax, edi
sub eax, edx
cmp eax, 2
jb 0x4509d8
cmp byte [edx + ecx], 0xd
jne 0x4509d8
cmp byte [edx + ecx + 1], 0xa
je 0x450a13
mov al, byte [edx + ecx]
cmp al, 0xa
je 0x450a13
cmp al, 0x3d
jne 0x4509ed
inc ebx
cmp ebx, 2
ja 0x450aad
cmp al, 0x7f
ja 0x450aad
movzx eax, al
mov al, byte [eax + 0x4f72e8]
cmp al, 0x7f
je 0x450aad
cmp al, 0x40
jae 0x450a12
test ebx, ebx
jne 0x450aad
inc esi
inc edx
cmp edx, edi
jb 0x4509c2
test esi, esi
je 0x450aa9
mov ecx, dword [ebp + 0xc]
lea eax, [esi + esi*2]
lea eax, [eax + eax + 7]
shr eax, 3
cmp dword [ecx], eax
jae 0x450a37
mov dword [ecx], eax
push 0xfffffffffffffff0
jmp 0x450aaf
mov ecx, dword [ebp + 8]
push 3
xor ebx, ebx
xor esi, esi
test edx, edx
pop edi
jbe 0x450aa1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0xd
je 0x450a99
cmp al, 0xa
je 0x450a99
movzx eax, al
movzx eax, byte [eax + 0x4f72e8]
xor edx, edx
cmp al, 0x40
sete dl
shl ebx, 6
and eax, 0x3f
or eax, ebx
mov ebx, eax
sub edi, edx
inc esi
cmp esi, 4
jne 0x450a99
xor esi, esi
test edi, edi
jbe 0x450a84
shr eax, 0x10
mov byte [ecx], al
inc ecx
cmp edi, 1
jbe 0x450a91
mov eax, ebx
shr eax, 8
mov byte [ecx], al
inc ecx
cmp edi, 2
jbe 0x450a99
mov byte [ecx], bl
inc ecx
inc dword [ebp + 0x10]
dec dword [ebp - 4]
jne 0x450a48
sub ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
jmp 0x450ab0
push 0xffffffffffffffee
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x454b43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [ebp + 0x10]
sub eax, 0x80
push edi
je 0x454b7f
sub eax, 0x40
je 0x454b74
sub eax, 0x40
je 0x454b69
or eax, 0xffffffff
jmp 0x454c5f
mov edi, dword [ebp + 8]
mov dword [edi], 0xe
jmp 0x454b88
mov edi, dword [ebp + 8]
mov dword [edi], 0xc
jmp 0x454b88
mov edi, dword [ebp + 8]
mov dword [edi], 0xa
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x118]
push dword [ebp + 0xc]
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.004548c7
mov eax, dword [ebp - 0x118]
shl eax, 4
add eax, dword [ebp - 0x114]
add esp, 0xc
mov ecx, dword [eax]
mov dword [esi], ecx
push 4
pop ecx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
mov edi, dword [edi]
add esi, ecx
dec edi
sub eax, 0x1c
test edi, edi
jle 0x454c42
mov dword [ebp + 0x10], edi
push ebx
mov edx, ecx
movzx edi, byte [eax + 3]
movzx edi, byte [edi + 0x4f7528]
movzx ebx, byte [eax + 2]
movzx ebx, byte [ebx + 0x4f7528]
mov edi, dword [edi*4 + 0x4f9328]
xor edi, dword [ebx*4 + 0x4f8f28]
movzx ebx, byte [eax + 1]
movzx ebx, byte [ebx + 0x4f7528]
xor edi, dword [ebx*4 + 0x4f8b28]
mov ebx, dword [eax]
and ebx, 0xff
movzx ebx, byte [ebx + 0x4f7528]
xor edi, dword [ebx*4 + 0x4f8728]
add eax, ecx
mov dword [esi], edi
add esi, ecx
dec edx
jne 0x454be4
sub eax, 0x20
dec dword [ebp + 0x10]
jne 0x454be2
pop ebx
mov edx, dword [eax]
mov dword [esi], edx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
add esi, ecx
add eax, ecx
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
xor eax, eax
pop esi
pop edi
leave
ret
Function at 0x455a8a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x52e480]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp byte [ebp + 0xc], al
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov word [ebp - 8], ax
mov word [ebp - 0x12], ax
mov word [ebp - 0x10], 0x74
mov word [ebp - 0xe], 0x72
mov word [ebp - 0xc], 0x75
mov word [ebp - 0xa], 0x65
mov word [ebp - 0x1c], 0x66
mov word [ebp - 0x1a], 0x61
mov word [ebp - 0x18], 0x6c
mov word [ebp - 0x16], 0x73
mov word [ebp - 0x14], 0x65
lea eax, [ebp - 0x10]
jne 0x455aec
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call dword [0x4eb6c0]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004d34f7
leave
ret

Function at 0x45b6aa
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e121e
call fcn.004d34a0
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x14]
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4f9df0
call dword [0x4eb6ec]
xor edi, edi
lea ecx, [esi + 0x34]
mov dword [ebp - 4], edi
call dword [0x4eb6ec]
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call dword [0x4eb6ec]
mov eax, dword [ebp + 8]
or dword [esi + 0x10], 0xffffffff
or dword [esi + 0x70], 0xffffffff
push 0x400
mov dword [esi + 8], eax
lea eax, [esi + 0x74]
push edi
push eax
mov dword [esi + 0xc], edi
mov dword [esi + 4], edi
mov dword [esi + 0x30], edi
mov word [esi + 0x6c], di
call fcn.004d3556
or dword [esi + 0x478], 0xffffffff
mov ecx, dword [ebp - 0xc]
add esp, 0xc
or dword [esi + 0x47c], 0xffffffff
mov dword [esi + 0x474], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x471a6b
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4e2652
call fcn.004d34a0
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 8], edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0x4fa084
mov dword [esi], 0x4fca50
mov dword [esi + 4], 0x4fca44
mov dword [esi + 0x14], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], 0x4fc960
mov dword [esi + 0x1c], edi
lea ebx, [esi + 0x20]
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.00461ef6
mov dword [ebx], 0x4fab30
mov dword [esi + 0x30], edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 3
call dword [0x4eb6c8]
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 4
call fcn.0046740e
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x50], edi
mov dword [esi + 0xc], edi
pop edi
mov dword [esi + 0x18], esi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x47a9b6
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e32c6
call fcn.004d34a0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 4], 0x4f70a0
mov dword [esi + 8], 0x4f70a0
lea ecx, [esi + 0x14]
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4fd440
mov dword [esi + 4], 0x4fd540
mov dword [esi + 8], 0x4fd53c
call fcn.004cea8d
mov dword [ebp - 4], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 2
call fcn.004cea8d
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 3
call fcn.004cea8d
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 6
call dword [0x4eb6c8]
lea ecx, [esi + 0xa4]
mov byte [ebp - 4], 7
call dword [0x4eb6c8]
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 8
call dword [0x4eb6c8]
lea ecx, [esi + 0xdc]
mov byte [ebp - 4], 9
call dword [0x4eb6c8]
lea ecx, [esi + 0x108]
mov byte [ebp - 4], 0xa
call dword [0x4eb6c8]
lea ecx, [esi + 0x12c]
mov byte [ebp - 4], 0xb
call fcn.004cea8d
lea eax, [esi + 0x138]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea ecx, [esi + 0x14c]
mov byte [ebp - 4], 0xd
mov dword [esi + 0x148], ebx
call fcn.004772a4
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov byte [esi + 0x20], bl
mov byte [esi + 0xfc], bl
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
mov byte [esi + 0xfe], bl
mov dword [esi + 0x124], ebx
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x128], bl
mov byte [esi + 0xff], bl
mov byte [esi + 0xfd], bl
mov byte [esi + 0x15c], bl
mov dword [esi + 0x160], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x489ff0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4e44dc
call fcn.004d34a0
push ecx
mov eax, dword [0x4ebc94]
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
lea ecx, [esi + 0x38]
mov dword [ebp - 4], edi
mov dword [esi], 0x4feac4
call fcn.004542ff
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
lea eax, [esi + 0x84]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
lea eax, [esi + 0x94]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
lea eax, [esi + 0xa4]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
lea eax, [esi + 0xb4]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
lea ecx, [esi + 0xc4]
mov byte [ebp - 4], 9
call dword [0x4eb6c8]
lea ecx, [esi + 0xe0]
mov byte [ebp - 4], 0xa
call fcn.00489c62
lea ecx, [esi + 0x238]
mov byte [ebp - 4], 0xb
call dword [0x4eb6c8]
lea ecx, [esi + 0x254]
mov byte [ebp - 4], 0xc
call dword [0x4eb6c8]
lea ecx, [esi + 0x270]
mov byte [ebp - 4], 0xd
call dword [0x4eb6c8]
lea ecx, [esi + 0x28c]
mov byte [ebp - 4], 0xe
call dword [0x4eb6c8]
lea ecx, [esi + 0x2b0]
mov byte [ebp - 4], 0xf
call fcn.004cea8d
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
inc eax
or dword [esi + 0x2ac], 0xffffffff
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x2a8], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c0], edi
mov dword [esi + 0x2c4], edi
mov dword [esi + 0x2c8], edi
mov dword [esi + 0x2cc], edi
mov dword [esi + 0x34], eax
mov dword [esi + 0x58], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x48c7c4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e4993
call fcn.004d34a0
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
mov dword [esi + 0x30], eax
call fcn.0048e4c7
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 3
call fcn.004542ff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x490452
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e4fb9
call fcn.004d34a0
push ecx
mov eax, ecx
xor ecx, ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x20], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
leave
ret
Function at 0x49257f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e5240
call fcn.004d34a0
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0xc], edi
mov dword [ebp - 0x10], esi
mov dword [eax], 0x4fa084
mov dword [ebp - 4], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00452bc7
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x5e0], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x49930a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e59b2
call fcn.004d34a0
push ecx
mov eax, ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x54], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x60], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x74], ecx
lea edx, [eax + 0x78]
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
leave
ret

Function at 0x4993f6
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e5acb
call fcn.004d34a0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x500074
mov dword [esi + 4], 0x50006c
mov dword [esi + 8], 0x500064
mov dword [esi + 0xc], 0x500050
lea ecx, [esi + 0x3b4]
mov dword [ebp - 4], 0x12
call fcn.0047c59d
lea ecx, [esi + 0x3a4]
mov byte [ebp - 4], 0x11
call fcn.00431bcf
lea ecx, [esi + 0x398]
mov byte [ebp - 4], 0x10
call fcn.0049906f
lea ecx, [esi + 0x388]
mov byte [ebp - 4], 0xf
call fcn.004ad4fe
lea ecx, [esi + 0x2b0]
mov byte [ebp - 4], 0xe
call fcn.004a0771
lea ecx, [esi + 0x218]
mov byte [ebp - 4], 0xd
call fcn.0049937d
lea ecx, [esi + 0x1e4]
mov byte [ebp - 4], 0xc
call fcn.004a2b14
lea ecx, [esi + 0x174]
mov byte [ebp - 4], 0xb
call fcn.004a1b2a
lea ecx, [esi + 0x154]
mov byte [ebp - 4], 0xa
call dword [0x4eb4fc]
lea ecx, [esi + 0x138]
mov byte [ebp - 4], 9
call dword [0x4eb4fc]
lea ecx, [esi + 0x11c]
mov byte [ebp - 4], 8
call dword [0x4eb4fc]
lea ecx, [esi + 0x100]
mov byte [ebp - 4], 7
call dword [0x4eb4fc]
lea ecx, [esi + 0xd4]
mov byte [ebp - 4], 6
call fcn.0049e330
lea ecx, [esi + 0xc8]
mov byte [ebp - 4], 5
call fcn.00499044
lea ecx, [esi + 0xac]
mov byte [ebp - 4], 4
call dword [str.Y_bES]
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 3
call fcn.004ab857
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 2
call fcn.004ab7bb
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.004a3ec8
mov byte [ebp - 4], 0
lea ecx, [esi + 0x30]
call fcn.0047c59d
lea ecx, [esi + 0x20]
call fcn.0040211c
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x499401
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e5acb
call fcn.004d34a0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x500074
mov dword [esi + 4], 0x50006c
mov dword [esi + 8], 0x500064
mov dword [esi + 0xc], 0x500050
lea ecx, [esi + 0x3b4]
mov dword [ebp - 4], 0x12
call fcn.0047c59d
lea ecx, [esi + 0x3a4]
mov byte [ebp - 4], 0x11
call fcn.00431bcf
lea ecx, [esi + 0x398]
mov byte [ebp - 4], 0x10
call fcn.0049906f
lea ecx, [esi + 0x388]
mov byte [ebp - 4], 0xf
call fcn.004ad4fe
lea ecx, [esi + 0x2b0]
mov byte [ebp - 4], 0xe
call fcn.004a0771
lea ecx, [esi + 0x218]
mov byte [ebp - 4], 0xd
call fcn.0049937d
lea ecx, [esi + 0x1e4]
mov byte [ebp - 4], 0xc
call fcn.004a2b14
lea ecx, [esi + 0x174]
mov byte [ebp - 4], 0xb
call fcn.004a1b2a
lea ecx, [esi + 0x154]
mov byte [ebp - 4], 0xa
call dword [0x4eb4fc]
lea ecx, [esi + 0x138]
mov byte [ebp - 4], 9
call dword [0x4eb4fc]
lea ecx, [esi + 0x11c]
mov byte [ebp - 4], 8
call dword [0x4eb4fc]
lea ecx, [esi + 0x100]
mov byte [ebp - 4], 7
call dword [0x4eb4fc]
lea ecx, [esi + 0xd4]
mov byte [ebp - 4], 6
call fcn.0049e330
lea ecx, [esi + 0xc8]
mov byte [ebp - 4], 5
call fcn.00499044
lea ecx, [esi + 0xac]
mov byte [ebp - 4], 4
call dword [str.Y_bES]
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 3
call fcn.004ab857
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 2
call fcn.004ab7bb
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.004a3ec8
mov byte [ebp - 4], 0
lea ecx, [esi + 0x30]
call fcn.0047c59d
lea ecx, [esi + 0x20]
call fcn.0040211c
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x49962d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e5be9
call fcn.004d34a0
push ecx
push ecx
mov eax, dword [0x4ebc94]
push ebx
push esi
mov esi, ecx
mov dword [esi + 4], 0x4ffe64
mov dword [esi + 8], 0x4ffe6c
xor ebx, ebx
push edi
lea edi, [esi + 0xc]
mov dword [edi + 4], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0x10], esi
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], eax
lea ecx, [esi + 0x30]
mov dword [ebp - 4], ebx
mov dword [esi], 0x500074
mov dword [esi + 4], 0x50006c
mov dword [esi + 8], 0x500064
mov dword [edi], 0x500050
call fcn.0049e43e
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.004a3e88
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 2
call fcn.004ab910
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 3
call fcn.004ab9c3
lea ecx, [esi + 0xac]
mov byte [ebp - 4], 4
call dword [0x4eb6c8]
lea ecx, [esi + 0xc8]
mov byte [ebp - 4], 5
call fcn.004cea8d
lea ecx, [esi + 0xd4]
mov byte [ebp - 4], 6
call fcn.0049e428
mov byte [esi + 0xf8], bl
lea ecx, [esi + 0x100]
mov byte [ebp - 4], 7
mov dword [esi + 0xfc], ebx
call dword [0x4eb6ec]
lea ecx, [esi + 0x11c]
mov byte [ebp - 4], 8
call dword [0x4eb6ec]
push 0x4ec7fe
lea ecx, [esi + 0x138]
mov byte [ebp - 4], 9
call dword [0x4eb510]
push 0x4ec7fe
lea ecx, [esi + 0x154]
mov byte [ebp - 4], 0xa
call dword [0x4eb510]
lea ecx, [esi + 0x174]
mov byte [ebp - 4], 0xb
mov byte [esi + 0x170], bl
call fcn.004a1add
lea ecx, [esi + 0x1e4]
mov byte [ebp - 4], 0xc
call fcn.004a2b49
lea ecx, [esi + 0x218]
mov byte [ebp - 4], 0xd
call fcn.0049930a
lea ecx, [esi + 0x2b0]
mov byte [ebp - 4], 0xe
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2a8], ebx
mov byte [esi + 0x2ac], bl
call fcn.004a091f
push esi
lea ecx, [esi + 0x388]
mov byte [ebp - 4], 0xf
call fcn.004ad586
lea ecx, [esi + 0x398]
mov byte [ebp - 4], 0x10
call fcn.004cea8d
lea eax, [esi + 0x3a4]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea ecx, [esi + 0x3b4]
mov byte [ebp - 4], 0x12
call fcn.0049e43e
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push ebx
push 0x80000000
push ebx
push ecx
mov dword [esi + 0x390], 0x3ac
mov dword [esi + 0x394], 0x258
mov dword [eax], ebx
mov eax, esp
mov dword [ebp - 0x14], esp
push 0xfffffffffffffffd
mov ecx, edi
mov byte [ebp - 4], 0x13
mov dword [eax], ebx
call fcn.004975dc
call fcn.004a7331
call fcn.004973cf
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4af019
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e7083
call fcn.004d34a0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov byte [esi], bl
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 8], ebx
push dword [ebp + 8]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call dword [0x4eb510]
or dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x28], ebx
mov word [esi + 0x30], bx
mov word [esi + 0x32], bx
mov word [esi + 0x34], bx
mov byte [esi + 0x36], bl
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4b48ee
Capabilities:
Parse pe header

Disassembly:
push 0x2c
push 0x501610
call fcn.004d3604
push 0x1c
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
call dword [0x4eb1e4]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x4b495a
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
je 0x4b4932
xor al, al
or dword [ebp - 4], 0xffffffff
jmp 0x4b4960
mov edx, dword [eax + 0xd8]
lea esi, [edx + ecx]
cmp dword [ebp + 0xc], esi
jb 0x4b492a
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x4b492a
mov al, 1
jmp 0x4b492c
or dword [ebp - 4], 0xffffffff
xor al, al
call fcn.004d363f
ret