joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432bb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c5ff8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push 0x4d73c4
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0
call dword [sym.imp.engine.dll_public:_void___thiscall_CTString::constructor_char_const__]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 1
call dword [sym.imp.engine.dll_public:_class_CTFileName___thiscall_CTFileName::NoExt_void_]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
mov ecx, eax
mov byte [esp + 0x34], 2
call dword [sym.imp.engine.dll_public:_class_CTString___thiscall_CTString::operator_class_CTString_const__]
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 5
call dword [sym.imp.engine.dll_public:_void___thiscall_CTFileName::destructor_void_]
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 4
call dword [sym.imp.engine.dll_public:_void___thiscall_CTString::destructor_void_]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.engine.dll_public:_void___thiscall_CTFileName::constructor_class_CTString_const__]
lea ecx, [esp + 0xc]
push ecx
mov byte [esp + 0x30], 6
call dword [sym.imp.engine.dll_int___cdecl_FileExists_class_CTFileName_const__]
add esp, 4
test eax, eax
je 0x432c7e
lea edx, [esp + 0xc]
push edx
lea ecx, [esi + 0x290]
call dword [sym.imp.engine.dll_public:_void___thiscall_CTextureObject::SetData_t_class_CTFileName_const__]
mov esi, dword [esi + 0x154]
mov esi, dword [esi + 0x198]
lea eax, [esp + 0x34]
push eax
lea ecx, [esi + 0x48]
call dword [0x4d04f4]
jmp 0x432cb0
push 4
push 0x4d73cc
lea ecx, [esp + 0x24]
call dword [sym.imp.engine.dll_public:_void___thiscall_CTFileName::constructor_char_const___int_]
push eax
lea ecx, [esi + 0x290]
mov byte [esp + 0x30], 7
call dword [sym.imp.engine.dll_public:_void___thiscall_CTextureObject::SetData_t_class_CTFileName_const__]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 6
call dword [sym.imp.engine.dll_public:_void___thiscall_CTFileName::destructor_void_]
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 4
call dword [sym.imp.engine.dll_public:_void___thiscall_CTFileName::destructor_void_]
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0
call dword [sym.imp.engine.dll_public:_void___thiscall_CTString::destructor_void_]
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.engine.dll_public:_void___thiscall_CTFileName::destructor_void_]
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x43a490
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20c
mov eax, dword [0x4fee70]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x210], eax
mov eax, dword [esi + 0x18]
push edi
push eax
call sub.imm32.dll_ImmGetContext
push 0x80
lea ebx, [esi + 0x134a]
push ebx
mov edx, eax
push 8
xor eax, eax
mov ecx, 0x800
mov edi, ebx
push edx
mov dword [esp + 0x1c], edx
rep stosd dword es:[edi], eax
call sub.imm32.dll_ImmGetCompositionStringW
mov edi, dword [esp + 0xc]
push 0x80
lea eax, [esi + 0x4354]
push eax
push 0x20
push edi
call sub.imm32.dll_ImmGetCompositionStringW
cdq
and edx, 3
add eax, edx
sar eax, 2
test ebx, ebx
mov dword [esi + 0x4554], eax
je 0x43a5db
push ebx
call dword [sym.imp.msvcr71.dll_wcslen]
add esp, 4
push 0
push 0
test eax, eax
push 0x80
setne cl
push edi
mov dword [esi + 0x4350], eax
mov byte [esi + 0x1348], cl
call sub.imm32.dll_ImmGetCompositionStringW
mov dword [esi + 0x434c], eax
mov al, byte [ebp + 8]
test al, al
je 0x43a5d1
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x7f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x200
lea edx, [esp + 0x14]
push edx
stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
push 0x10
push eax
call sub.imm32.dll_ImmGetCompositionStringW
mov edi, eax
xor edx, edx
test edi, edi
jle 0x43a593
jmp 0x43a580
mov cl, byte [esp + edx + 0x10]
cmp cl, 1
je 0x43a593
cmp cl, 3
je 0x43a593
inc edx
cmp edx, edi
jl 0x43a580
cmp edx, edi
je 0x43a59d
mov dword [esi + 0x4350], edx
cmp edx, edi
mov ebx, edx
jge 0x43a5b2
mov al, byte [esp + edx + 0x10]
cmp byte [esp + ebx + 0x10], al
jne 0x43a5b2
inc ebx
cmp ebx, edi
jl 0x43a5a7
mov ecx, 0x80
xor eax, eax
lea edi, [esi + 0x4354]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0xc]
mov dword [esi + 0x4354], edx
mov dword [esi + 0x4358], ebx
mov ecx, dword [esi + 0x18]
push edi
push ecx
call sub.imm32.dll_ImmReleaseContext
mov ecx, dword [esp + 0x214]
call fcn.004c0057
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43a710
Capabilities:
Get file version info

Disassembly:
sub esp, 0x814
mov eax, dword [0x4fee70]
push edi
mov edi, dword [esp + 0x81c]
cmp edi, 2
mov dword [esp + 0x814], eax
mov dword [esp + 4], ecx
jb 0x43a74b
xor eax, eax
pop edi
mov ecx, dword [esp + 0x810]
call fcn.004c0057
add esp, 0x814
ret 4
mov eax, dword [ecx + 0x4598]
cmp dword [0x4ff180], eax
je 0x43a973
cmp eax, 0xe0080404
mov dword [0x4ff180], eax
je 0x43a777
cmp eax, 0xe0090404
je 0x43a777
cmp eax, 0xe00e0804
jne 0x43a78b
push 0x3ff
lea ecx, [esp + 0x18]
push ecx
push eax
call sub.imm32.dll_ImmGetIMEFileNameW
test eax, eax
jne 0x43a7a4
mov dword [0x4ff17c], 0
mov dword [0x4ff178], 0
jmp 0x43a973
push esi
mov esi, dword [sym.imp.kernel32.dll_CompareStringW]
push 0xffffffffffffffff
push 0x4d8594
push 0xffffffffffffffff
lea edx, [esp + 0x24]
push edx
push 1
push 0x409
call esi
cmp eax, 2
je 0x43a854
push 0xffffffffffffffff
push 0x4d85b0
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x43a854
push 0xffffffffffffffff
push 0x4d85cc
push 0xffffffffffffffff
lea ecx, [esp + 0x24]
push ecx
push 1
push 0x409
call esi
cmp eax, 2
je 0x43a854
push 0xffffffffffffffff
push 0x4d85e8
push 0xffffffffffffffff
lea edx, [esp + 0x24]
push edx
push 1
push 0x409
call esi
cmp eax, 2
je 0x43a854
push 0xffffffffffffffff
push 0x4d8604
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x43a854
mov dword [0x4ff17c], 0
mov dword [0x4ff178], 0
jmp 0x43a972
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x43a972
push ebx
mov ebx, dword [sym.imp.kernel32.dll_GetProcessHeap]
push esi
push 0
call ebx
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x43a96a
mov eax, dword [esp + 0x14]
push edi
push esi
push eax
lea ecx, [esp + 0x28]
push ecx
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x43a95e
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0x4d8620
push edi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x43a95e
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0xc]
xor edx, edx
mov dh, al
and eax, 0xffff0000
or edx, eax
shl edx, 8
call fcn.0043a6f0
cmp eax, 0x404
jne 0x43a91d
cmp edx, 0x4020000
je 0x43a945
cmp edx, 0x4030000
je 0x43a945
cmp edx, 0x4040000
je 0x43a945
cmp edx, 0x5000000
je 0x43a945
cmp edx, 0x5010000
je 0x43a945
cmp edx, 0x5020000
je 0x43a945
cmp edx, 0x6000000
je 0x43a945
mov ecx, dword [esp + 0xc]
call fcn.0043a6f0
cmp eax, 0x804
jne 0x43a95e
cmp edx, 0x4010000
je 0x43a945
cmp edx, 0x4020000
je 0x43a945
cmp edx, 0x5030000
jne 0x43a95e
mov ecx, dword [esp + 0xc]
call fcn.0043a6f0
or eax, edx
mov dword [0x4ff178], eax
mov ecx, dword [esi + 0xc]
mov dword [0x4ff17c], ecx
push edi
push 0
call ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov edi, dword [esp + 0x824]
pop ebx
pop esi
mov eax, dword [edi*4 + 0x4ff178]
mov ecx, dword [esp + 0x814]
pop edi
call fcn.004c0057
add esp, 0x814
ret 4
Function at 0x43b290
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x4fee70]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x220]
xor ebx, ebx
push ebx
push ecx
push ebx
mov dword [esp + 0x220], eax
mov eax, dword [esp + 0x228]
push eax
push 0x18
push 0x320
push 0xffffffffffffff9c
push 0xbb8
push 0x40800000
mov dword [esi], 0x4d8624
mov dword [esi + 0x14], eax
mov byte [esi + 0x324], bl
mov dword [esi + 0x328], ebx
mov dword [esi + 0x33c], ebx
mov dword [esi + 0x340], ebx
mov dword [esi + 0x344], ebx
push ebx
push 0x4d8530
mov byte [esi + 0x1348], bl
mov dword [esi + 0x4554], ebx
mov dword [0x4ff16c], esi
push ebx
mov word [esi + 0x1c], bx
call dword [sym.imp.user32.dll_CreateWindowExW]
push ebx
push eax
mov dword [esi + 0x18], eax
call dword [sym.imp.user32.dll_ShowWindow]
mov edx, dword [esi + 0x18]
push 0xfffffffffffffffc
push edx
call dword [sym.imp.user32.dll_GetWindowLongA]
push 0x43aea0
mov dword [esi + 0x320], eax
mov eax, dword [esi + 0x18]
push 0xfffffffffffffffc
push eax
call dword [sym.imp.user32.dll_SetWindowLongA]
mov ecx, esi
call fcn.0043a230
push 0x105
lea ecx, [esp + 0xc]
push ecx
mov byte [esi + 0x31c], 1
mov byte [esi + 0x4558], bl
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x43b3eb
lea edx, [esp + 8]
push 0x4d853c
push edx
call dword [sym.imp.msvcr71.dll_wcscat]
add esp, 8
lea eax, [esp + 8]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x45a0], eax
je 0x43b3eb
push edi
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x4d8554
push eax
call edi
cmp eax, ebx
je 0x43b3ab
mov dword [esi + 4], eax
mov ecx, dword [esi + 0x45a0]
push 0x4d8560
push ecx
call edi
cmp eax, ebx
je 0x43b3c0
mov dword [esi + 8], eax
mov edx, dword [esi + 0x45a0]
push 0x4d8570
push edx
call edi
cmp eax, ebx
je 0x43b3d5
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x45a0]
push 0x4d857c
push eax
call edi
cmp eax, ebx
pop edi
je 0x43b3eb
mov dword [esi + 0x10], eax
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
pop ebx
call fcn.004c0057
add esp, 0x210
ret 8
Function at 0x43bdf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c6b75
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push 0
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call dword [sym.imp.uitoolkit.dll_public:_void___thiscall_csComponent::constructor_class_csComponent___enum_csComponentFrameStyle_]
lea ecx, [esi + 0x154]
mov dword [esp + 0x10], 0
mov dword [esi], 0x4d8640
call dword [sym.imp.engine.dll_public:_void___thiscall_CTString::constructor_void_]
lea ecx, [esi + 0x158]
mov byte [esp + 0x10], 1
call dword [sym.imp.engine.dll_public:_void___thiscall_CTString::constructor_void_]
lea ecx, [esi + 0x15c]
mov byte [esp + 0x10], 2
call dword [sym.imp.engine.dll_public:_void___thiscall_CTString::constructor_void_]
lea ecx, [esi + 0x160]
mov byte [esp + 0x10], 3
call dword [sym.imp.engine.dll_public:_void___thiscall_CTString::constructor_void_]
mov edx, dword [esi + 0xc4]
or edx, 0x28
mov ecx, esi
mov byte [esp + 0x10], 4
mov dword [esi + 0xc4], edx
call fcn.0043bb60
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov al, byte [esp + 0x1c]
mov dword [esi + 0x16c], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x174], edx
mov edx, dword [esp + 0x30]
mov byte [esi + 0x180], al
mov dword [esi + 0x170], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x190], edx
mov edx, dword [esp + 0x2c]
movzx eax, al
mov dword [esi + 0x194], ecx
mov dword [esi + 0x184], edx
mov ecx, dword [0x4ff170]
push eax
call fcn.0043a360
mov ecx, dword [0x4ff170]
call fcn.0043a210
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20

Function at 0x43d0e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c6d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
lea ebx, [edi + 4]
xor ebp, ebp
mov ecx, ebx
mov dword [esp + 0x1c], ebp
call dword [sym.imp.engine.dll_public:_void___thiscall_CTString::constructor_void_]
lea esi, [edi + 8]
mov ecx, esi
mov byte [esp + 0x1c], 1
call fcn.00428150
mov edx, dword [esp + 0x24]
mov dword [edi + 0x474], ebp
mov word [esi], bp
mov dword [esi + 4], ebp
mov dword [esi + 0x30], ebp
mov word [esi + 0x34], bp
xor eax, eax
lea ecx, [esi + 0x36]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov byte [ecx + 0x10], al
lea eax, [esp + 0x28]
push eax
mov ecx, ebx
mov byte [esp + 0x20], 2
mov dword [edi], edx
call dword [0x4d04f4]
mov eax, dword [esp + 0x2c]
cmp eax, ebp
je 0x43d16e
push eax
mov ecx, esi
call fcn.0043d620
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.engine.dll_public:_void___thiscall_CTString::destructor_void_]
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x43da80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c6d7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push 0
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call dword [sym.imp.uitoolkit.dll_public:_void___thiscall_csComponent::constructor_class_csComponent___enum_csComponentFrameStyle_]
lea ecx, [esi + 0x15c]
mov dword [esp + 0x10], 0
mov dword [esi], 0x4d8818
call dword [sym.imp.engine.dll_public:_void___thiscall_CTextureObject::constructor_void_]
mov ecx, esi
mov byte [esp + 0x10], 1
call fcn.0043d960
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
mov ecx, esi
call dword [sym.imp.uitoolkit.dll_public:_void___thiscall_csComponent::SetPos_long_int__long_int_]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
mov ecx, esi
call dword [sym.imp.uitoolkit.dll_public:_void___thiscall_csComponent::SetSize_long_int__long_int_]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
mov ecx, esi
mov dword [esi + 0x174], edx
mov dword [esi + 0x158], eax
call fcn.0043d970
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c

Function at 0x445ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c7bdf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push 0
push eax
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
mov dword [esp + 0x38], 0
call dword [sym.imp.engine.dll_public:_void___thiscall_CTString::constructor_class_CTString_const__]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, esi
call fcn.00419730
mov edi, dword [sym.imp.engine.dll_public:_void___thiscall_CTextureObject::constructor_void_]
lea ecx, [esi + 0x238]
mov byte [esp + 0x14], 1
mov dword [esi], 0x4d9fc8
call edi
lea ecx, [esi + 0x250]
mov byte [esp + 0x14], 2
call edi
lea ecx, [esi + 0x268]
mov byte [esp + 0x14], 3
call edi
lea ecx, [esi + 0x280]
mov byte [esp + 0x14], 4
call edi
lea ecx, [esi + 0x298]
mov byte [esp + 0x14], 5
call edi
lea ecx, [esi + 0x2b0]
mov byte [esp + 0x14], 6
call edi
lea ecx, [esi + 0x2c8]
mov byte [esp + 0x14], 7
call edi
mov ecx, esi
mov byte [esp + 0x14], 8
call fcn.00445aa0
mov ecx, esi
call fcn.00445d50
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 0xffffffff
call dword [sym.imp.engine.dll_public:_void___thiscall_CTString::destructor_void_]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 0x20
Function at 0x44ea60
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4c89ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call fcn.0046fe10
mov ecx, dword [sym.imp.engine.dll_public:_void___thiscall_CTextureObject::destructor_void_]
mov edx, dword [sym.imp.engine.dll_public:_void___thiscall_CTextureObject::constructor_void_]
push ecx
push edx
push 3
push 0x18
lea eax, [esi + 0x9dc]
push eax
mov dword [esp + 0x30], 0
mov dword [esi], 0x4d3810
call fcn.004c027a
mov ecx, esi
mov byte [esp + 0x1c], 1
call fcn.0044dcd0
or eax, 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 0xc], 5
mov word [esp + 0x10], ax
call fcn.00471b70
mov ecx, dword [eax + 0x2dcc]
lea edx, [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [0x4feed0]
push edx
mov dword [esp + 0x10], 2
call fcn.0040b9b0
mov ecx, eax
call fcn.00488f30
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xa98], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x456750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c928f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x630]
mov edi, dword [sym.imp.engine.dll_class_Xenesis2::Foundation::Memory::xEncryptMemory____cdecl_Xenesis2::Foundation::Memory::theEncryptMemory_void_]
push 1
mov ebx, 0x4dac94
push eax
mov dword [esp + 0x20], 0xf
mov dword [esi + 0x62c], ebx
call edi
mov ecx, eax
call fcn.00415790
mov ecx, dword [esi + 0x624]
push 1
push ecx
mov byte [esp + 0x20], 0xe
mov dword [esi + 0x620], ebx
call edi
mov ecx, eax
call fcn.00415790
mov edx, dword [esi + 0x618]
push 1
push edx
mov byte [esp + 0x20], 0xd
mov dword [esi + 0x614], ebx
call edi
mov ecx, eax
call fcn.00415790
mov eax, dword [esi + 0x60c]
push 1
push eax
mov byte [esp + 0x20], 0xc
mov dword [esi + 0x608], ebx
call edi
mov ecx, eax
call fcn.00415790
mov ecx, dword [esi + 0xe8]
push 1
mov ebx, 0x4dac9c
push ecx
mov byte [esp + 0x20], 0xb
mov dword [esi + 0xe4], ebx
call edi
mov ecx, eax
call fcn.00415790
mov edx, dword [esi + 0xdc]
push 1
push edx
mov byte [esp + 0x20], 0xa
mov dword [esi + 0xd8], ebx
call edi
mov ecx, eax
call fcn.00415790
mov eax, dword [esi + 0xd0]
push 1
push eax
mov byte [esp + 0x20], 9
mov dword [esi + 0xcc], ebx
call edi
mov ecx, eax
call fcn.00415790
mov byte [esp + 0x18], 8
mov ecx, dword [esi + 0xc4]
push 1
push ecx
mov dword [esi + 0xc0], ebx
call edi
mov ecx, eax
call fcn.00415790
mov edx, dword [esi + 0xb8]
push 1
push edx
mov byte [esp + 0x20], 7
mov dword [esi + 0xb4], ebx
call edi
mov ecx, eax
call fcn.00415790
mov eax, dword [esi + 0xac]
push 1
mov ebx, 0x4d38c0
push eax
mov byte [esp + 0x20], 6
mov dword [esi + 0xa8], ebx
call edi
mov ecx, eax
call fcn.00415790
mov ecx, dword [esi + 0xa0]
push 1
push ecx
mov byte [esp + 0x20], 5
mov dword [esi + 0x9c], ebx
call edi
mov ecx, eax
call fcn.00415790
mov edx, dword [esi + 0x94]
push 1
mov ebx, 0x4dac98
push edx
mov byte [esp + 0x20], 4
mov dword [esi + 0x90], ebx
call edi
mov ecx, eax
call fcn.00415790
mov eax, dword [esi + 0x88]
push 1
push eax
mov byte [esp + 0x20], 3
mov dword [esi + 0x84], ebx
call edi
mov ecx, eax
call fcn.00415790
mov ecx, dword [esi + 0x7c]
push 1
push ecx
mov byte [esp + 0x20], 2
mov dword [esi + 0x78], ebx
call edi
mov ecx, eax
call fcn.00415790
mov edx, dword [esi + 0x70]
push 1
push edx
mov byte [esp + 0x20], 1
mov dword [esi + 0x6c], ebx
call edi
mov ecx, eax
call fcn.00415790
mov eax, dword [esi + 0x64]
push 1
push eax
mov byte [esp + 0x20], 0
mov dword [esi + 0x60], ebx
call edi
mov ecx, eax
call fcn.00415790
push 0x456650
push 4
push 0xc
add esi, 0x30
push esi
mov dword [esp + 0x28], 0xffffffff
call fcn.004c01fc
pop edi
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x45693a
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c928f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x630]
mov edi, dword [sym.imp.engine.dll_class_Xenesis2::Foundation::Memory::xEncryptMemory____cdecl_Xenesis2::Foundation::Memory::theEncryptMemory_void_]
push 1
mov ebx, 0x4dac94
push eax
mov dword [esp + 0x20], 0xf
mov dword [esi + 0x62c], ebx
call edi
mov ecx, eax
call fcn.00415790
mov ecx, dword [esi + 0x624]
push 1
push ecx
mov byte [esp + 0x20], 0xe
mov dword [esi + 0x620], ebx
call edi
mov ecx, eax
call fcn.00415790
mov edx, dword [esi + 0x618]
push 1
push edx
mov byte [esp + 0x20], 0xd
mov dword [esi + 0x614], ebx
call edi
mov ecx, eax
call fcn.00415790
mov eax, dword [esi + 0x60c]
push 1
push eax
mov byte [esp + 0x20], 0xc
mov dword [esi + 0x608], ebx
call edi
mov ecx, eax
call fcn.00415790
mov ecx, dword [esi + 0xe8]
push 1
mov ebx, 0x4dac9c
push ecx
mov byte [esp + 0x20], 0xb
mov dword [esi + 0xe4], ebx
call edi
mov ecx, eax
call fcn.00415790
mov edx, dword [esi + 0xdc]
push 1
push edx
mov byte [esp + 0x20], 0xa
mov dword [esi + 0xd8], ebx
call edi
mov ecx, eax
call fcn.00415790
mov eax, dword [esi + 0xd0]
push 1
push eax
mov byte [esp + 0x20], 9
mov dword [esi + 0xcc], ebx
call edi
mov ecx, eax
call fcn.00415790
mov byte [esp + 0x18], 8
mov ecx, dword [esi + 0xc4]
push 1
push ecx
mov dword [esi + 0xc0], ebx
call edi
mov ecx, eax
call fcn.00415790
mov edx, dword [esi + 0xb8]
push 1
push edx
mov byte [esp + 0x20], 7
mov dword [esi + 0xb4], ebx
call edi
mov ecx, eax
call fcn.00415790
mov eax, dword [esi + 0xac]
push 1
mov ebx, 0x4d38c0
push eax
mov byte [esp + 0x20], 6
mov dword [esi + 0xa8], ebx
call edi
mov ecx, eax
call fcn.00415790
mov ecx, dword [esi + 0xa0]
push 1
push ecx
mov byte [esp + 0x20], 5
mov dword [esi + 0x9c], ebx
call edi
mov ecx, eax
call fcn.00415790
mov edx, dword [esi + 0x94]
push 1
mov ebx, 0x4dac98
push edx
mov byte [esp + 0x20], 4
mov dword [esi + 0x90], ebx
call edi
mov ecx, eax
call fcn.00415790
mov eax, dword [esi + 0x88]
push 1
push eax
mov byte [esp + 0x20], 3
mov dword [esi + 0x84], ebx
call edi
mov ecx, eax
call fcn.00415790
mov ecx, dword [esi + 0x7c]
push 1
push ecx
mov byte [esp + 0x20], 2
mov dword [esi + 0x78], ebx
call edi
mov ecx, eax
call fcn.00415790
mov edx, dword [esi + 0x70]
push 1
push edx
mov byte [esp + 0x20], 1
mov dword [esi + 0x6c], ebx
call edi
mov ecx, eax
call fcn.00415790
mov eax, dword [esi + 0x64]
push 1
push eax
mov byte [esp + 0x20], 0
mov dword [esi + 0x60], ebx
call edi
mov ecx, eax
call fcn.00415790
push 0x456650
push 4
push 0xc
add esi, 0x30
push esi
mov dword [esp + 0x28], 0xffffffff
call fcn.004c01fc
pop edi
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x456bd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c92a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x4fee70]
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
push esi
mov esi, dword [sym.imp.engine.dll_class_Xenesis2::Foundation::Memory::xEncryptMemory____cdecl_Xenesis2::Foundation::Memory::theEncryptMemory_void_]
mov dword [esp + 0x18], eax
push 1
lea eax, [esp + 0x14]
push eax
push edx
call esi
mov ecx, eax
call fcn.004067e0
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
push ecx
lea ecx, [esp + 8]
mov dword [esp + 0x34], eax
call fcn.00456a40
lea edx, [esp + 0x30]
push edx
mov ecx, eax
mov dword [esp + 0x28], 0
call fcn.00455bc0
mov edx, dword [eax + 4]
push 1
lea ecx, [esp + 0x14]
push ecx
push edx
call esi
mov ecx, eax
call fcn.004067e0
mov eax, dword [esp + 8]
push 1
push eax
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0xc], 0x4dac98
call esi
mov ecx, eax
call fcn.00415790
mov ecx, dword [esp + 0x1c]
mov ax, word [esp + 0x10]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x18]
pop esi
call fcn.004c0057
add esp, 0x24
ret