joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a422
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057ef5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x248
mov eax, ecx
push esi
push edi
mov dword [ebp - 0x30], eax
cmp dword [eax + 8], 0
jne 0x1001a5d1
mov eax, dword fs:[0x18]
mov dword [ebp - 0x28], 0
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0x38]
mov dword [ebp - 0x18], edi
cmp dword [edi + 0xc], 0
jbe 0x1001a5d1
lea esi, [edi + 0x18]
mov dword [ebp - 0x14], esi
nop dword [eax]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0x208
lea eax, [ebp - 0x258]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.1003d9f0
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov esi, dword [esi]
mov eax, dword [eax - 4]
add eax, edi
push esi
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.1003cef0
shr esi, 1
lea edi, [ebp - 0x258]
add esp, 0xc
lea edi, [edi + esi*2]
lea esi, [ebp - 0x258]
mov eax, esi
cmp eax, edi
je 0x1001a4da
movzx eax, word [esi]
push eax
call fcn.100440bb
mov word [esi], ax
add esp, 4
add esi, 2
cmp esi, edi
jne 0x1001a4c4
mov eax, dword [ebp - 0x14]
xor esi, esi
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
add eax, edx
mov dword [ebp - 0x2c], eax
cmp dword [eax + 4], esi
jbe 0x1001a58f
lea edi, [eax + 0x14]
mov ecx, dword [edi + 4]
xorps xmm0, xmm0
mov eax, dword [edi]
shr ecx, 1
add eax, edx
push ecx
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
movups xmmword [ebp - 0x48], xmm0
call fcn.10001fa0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x38], 0
je 0x1001a570
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x1c]
je 0x1001a563
movups xmm0, xmmword [ebp - 0x48]
mov dword [eax + 0x10], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x38]
movq qword [eax + 0x10], xmm0
xorps xmm0, xmm0
add dword [ebp - 0x20], 0x18
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
movups xmmword [ebp - 0x48], xmm0
jmp 0x1001a570
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.100068e0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.10001e00
mov eax, dword [ebp - 0x2c]
inc esi
mov edx, dword [ebp - 0x18]
add edi, 0x14
cmp esi, dword [eax + 4]
jb 0x1001a4f6
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.1001a830
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.100053d0
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp - 0x18]
inc eax
mov esi, dword [ebp - 0x14]
add esi, 0x18
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], esi
cmp eax, dword [edi + 0xc]
jb 0x1001a460
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10035d00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
jb 0x10035d1b
mov ebx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x10035d3c
mov edx, eax
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x10035d28
mov edx, dword [ebp + 8]
push esi
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [edi + 0x30]
call fcn.10011ad0
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x10035d54
mov ecx, dword [edi + 0x34]
cmp ecx, dword [edi + 0x34]
je 0x10035d77
mov ecx, dword [ecx + 0x20]
xor edx, edx
add ecx, dword [edi + 0x10]
mov eax, dword [ebp + 0xc]
adc edx, dword [edi + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 0x806d0013
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10038cc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x10038e23
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp - 4], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.100110c0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x10038df6
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
mov dword [ebp + 8], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x10038d76
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x10038de9
mov eax, dword [eax + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x10038db0
mov eax, dword [eax]
mov dword [ebp + 8], eax
cmp eax, ecx
je 0x10038da8
mov ebx, dword [ecx + 4]
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 4]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x10038de9
mov edi, eax
cmp dword [ebp + 8], eax
je 0x10038dc6
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x10038dff
cmp dword [ebp + 8], eax
jne 0x10038db7
mov eax, dword [ecx + 4]
mov dword [ebp + 8], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp + 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
mov ebx, dword [ebp - 0xc]
mov ecx, edx
cmp edx, esi
jne 0x10038d22
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 4]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x10038de9
push str.invalid_hash_bucket_count
call fcn.1003a092
int3
Function at 0x10038ea0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea edx, [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jle 0x10038ec8
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
dec esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
jmp 0x10038ed0
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
test esi, esi
jle 0x10038ee9
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [edx - 8]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
jmp 0x10038ef1
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
test esi, esi
jle 0x10038f0a
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [edx - 8]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
jmp 0x10038f12
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
test esi, esi
jle 0x10038f2b
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [edx - 8]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
jmp 0x10038f33
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, edx
mov dword [ebp - 4], 0
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x40], eax
mov eax, esi
mov dword [ebp - 0x3c], edx
cdq
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x10038f74
add dword [esp], 5
retf

Function at 0x10039000
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5d0
push ebx
push esi
xorps xmm0, xmm0
push edi
movlpd qword [ebp - 0x10], xmm0
push 0x33
call 0x1003901b
add dword [esp], 5
retf

Function at 0x10039300
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x104f69a8]
sub esp, 0x1a4
mov edx, dword [0x104f69ac]
push ebx
push esi
push edi
test eax, eax
jne 0x1003933b
test edx, edx
jne 0x1003933b
call fcn.10039000
mov esi, eax
mov dword [0x104f69a8], eax
mov edi, edx
mov dword [0x104f69ac], edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edi
jmp 0x10039345
mov esi, eax
mov dword [ebp - 0x10], eax
mov edi, edx
mov dword [ebp - 0x14], edx
test esi, esi
jne 0x10039351
test edi, edi
je 0x1003974d
lea ecx, [ebp - 0x98]
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
push 0x33
call 0x10039367
add dword [esp], 5
retf
pop edi
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x104fdc10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x104fdd1c
test eax, eax
je 0x104fdd1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x10518fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x104fdd03
lea edi, [eax + 4]
jmp 0x104fdc67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x104fdc7c
mov dword [ebp - 4], 2
jmp 0x104fdc9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x104fdc93
mov dword [ebp - 4], 1
jmp 0x104fdc9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x104fdd13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x104fdcd6
mov byte [ecx], 0x3d
jmp 0x104fdce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x104fdced
mov byte [ecx], 0x3d
jmp 0x104fdcf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x104fdc64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x104fdcb3
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x104fdd1c
test eax, eax
je 0x104fdd1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x10518fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x104fdd03
lea edi, [eax + 4]
jmp 0x104fdc67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x104fdc7c
mov dword [ebp - 4], 2
jmp 0x104fdc9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x104fdc93
mov dword [ebp - 4], 1
jmp 0x104fdc9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x104fdd13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x104fdcd6
mov byte [ecx], 0x3d
jmp 0x104fdce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x104fdced
mov byte [ecx], 0x3d
jmp 0x104fdcf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x104fdc64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0xbcfd00], 1
mov dword [0xbcfcfc], 1
mov dword [0xbcfcf8], 1
mov dword [0xbcfcf0], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x5ca014], eax
mov eax, dword [0xbcfd0c]
test eax, eax
je 0x4010b0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0xbcfd20]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0xbcfd08]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x588324], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060
Function at 0x402370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x402395
cmp dword [ebp - 0xc], 1
jne 0x4024f0
jmp 0x4024f6
mov eax, dword [ebp + 0xa4]
mov dword [esp + 0x9c], eax
mov eax, dword [ebp + 0xa0]
mov dword [esp + 0x98], eax
mov eax, dword [ebp + 0x9c]
mov dword [esp + 0x94], eax
mov eax, dword [ebp + 0x98]
mov dword [esp + 0x90], eax
mov eax, dword [ebp + 0x94]
mov dword [esp + 0x8c], eax
mov eax, dword [ebp + 0x90]
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 0x8c]
mov dword [esp + 0x84], eax
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___super_fnc__27
mov dword [ebp - 0xc], 1
jmp 0x4024f1
nop
jmp 0x402380
leave
ret
Function at 0x408454
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x408479
cmp dword [ebp - 0xc], 1
je 0x40857d
jmp 0x408578
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___super_fnc__2803
mov dword [ebp - 0xc], 1
nop
jmp 0x408464
nop
leave
ret
Function at 0x408ddb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x408f04
cmp dword [ebp - 0xc], 1
je 0x408e00
jmp 0x408eff
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___super_fnc__2791
mov dword [ebp - 0xc], 0
nop
jmp 0x408deb
nop
leave
ret
Function at 0x4155f6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x415753
cmp dword [ebp - 0xc], 1
je 0x41561b
jmp 0x41574e
mov eax, dword [ebp + 0x98]
mov dword [esp + 0x90], eax
mov eax, dword [ebp + 0x94]
mov dword [esp + 0x8c], eax
mov eax, dword [ebp + 0x90]
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 0x8c]
mov dword [esp + 0x84], eax
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___super_fnc__2955
mov dword [ebp - 0xc], 0
nop
jmp 0x415606
nop
leave
ret