joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69a094
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x69a0ac
add esp, 0xfffffff0
call fcn.004086b4
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x69a1c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00406464
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x69a1b0
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.00505a38
xor eax, eax
push ebp
push 0x69a19d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00505a38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.0040adac
jmp 0x69a16e
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.0040b0d8
mov eax, dword [ebx + 4]
call fcn.0040a334
dec eax
jle 0x69a182
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x69a15c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69a1a4
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69a1cd
lea eax, [ebp - 4]
call fcn.00409e84
ret

Function at 0x6bfa4c
Capabilities:
Persist via ginadll registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x6bfb47
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.006bf73c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6bfb25
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.004eee0c
mov edx, 0x6bfb64
mov eax, dword [ebp - 8]
call fcn.004ef098
test al, al
je 0x6bfaec
mov edx, 0x6bfbdc
mov eax, dword [ebp - 8]
call fcn.004efeac
test al, al
je 0x6bfae4
lea ecx, [ebp - 0x10]
mov edx, 0x6bfbdc
mov eax, dword [ebp - 8]
call fcn.004ef920
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00424fe8
mov edx, dword [ebp - 0xc]
mov ecx, 1
mov eax, 0x6bfbf8
call fcn.0040b2a0
test eax, eax
setg byte [ebp - 1]
mov eax, dword [ebp - 8]
call fcn.004eeddc
cmp byte [ebp - 1], 0
jne 0x6bfb0f
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.004eee0c
mov edx, 0x6bfc14
mov eax, dword [ebp - 8]
call fcn.004f0238
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bfb2c
mov eax, dword [ebp - 8]
call fcn.00408084
ret
Function at 0x6c228c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6c23a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004b16c0
mov esi, eax
lea edx, [ebp - 0x1c]
mov eax, dword [edi + 0x18]
add eax, 4
call fcn.006c1bd4
mov edx, dword [ebp - 0x1c]
lea eax, [esi + 0xc]
call fcn.0040a2c0
lea ecx, [ebp - 0x20]
mov eax, dword [edi + 0x18]
add eax, 0xc
mov dl, 1
call fcn.006c1cac
mov edx, dword [ebp - 0x20]
lea eax, [esi + 0x14]
mov ecx, 0
call fcn.0040aa28
lea eax, [edi + 4]
lea edx, [ebp - 8]
push edx
push eax
call fcn.00413578
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00413580
lea eax, [ebp - 0x18]
call fcn.00429bb4
fstp qword [esi + 0x18]
wait
lea eax, [esi + 0x28]
mov edx, dword [edi + 0x18]
mov edx, dword [edx + 0x14]
mov ecx, 0
call fcn.0040a5c4
lea eax, [esi + 0x2c]
mov edx, dword [edi + 0x18]
mov edx, dword [edx + 0x20]
mov ecx, 0
call fcn.0040a5c4
lea ecx, [ebp - 0x24]
mov eax, dword [edi + 0x18]
add eax, 0x2c
xor edx, edx
call fcn.006c1cac
mov edx, dword [ebp - 0x24]
lea eax, [esi + 0x30]
mov ecx, 0
call fcn.0040aa28
mov ebx, dword [edi + 0x10]
mov eax, dword [edi + 0xc]
dec eax
test eax, eax
jl 0x6c2384
inc eax
mov edi, eax
mov eax, dword [ebx + 4]
test eax, eax
je 0x6c2381
mov edx, dword [esi + 0x24]
xchg edx, eax
call fcn.006c2564
add ebx, 0x3c
dec edi
jne 0x6c236e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c23ae
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00409e9c
lea eax, [ebp - 0x1c]
call fcn.00409e60
ret
Function at 0x6c2564
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6c26cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004b16c0
mov ebx, eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov dword [ebx + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 4
mov eax, esi
call fcn.006c1b6c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x10]
call fcn.0040a2c0
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 1
mov edx, 4
mov eax, esi
call fcn.006c1b6c
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0xc]
call fcn.0040a2c0
push 0
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
mov edx, 1
mov eax, esi
call fcn.006c1b6c
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x14]
call fcn.0040a2c0
lea ecx, [ebp - 0x28]
mov eax, dword [esi + 0xc]
add eax, 4
mov dl, 1
call fcn.006c1cac
mov edx, dword [ebp - 0x28]
lea eax, [ebx + 0x28]
mov ecx, 0
call fcn.0040aa28
mov eax, dword [esi + 0xc]
add eax, 0x20
lea edx, [ebp - 8]
push edx
push eax
call fcn.00413578
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00413580
lea eax, [ebp - 0x18]
call fcn.00429bb4
fstp qword [ebx + 0x18]
wait
mov eax, dword [esi + 0xc]
add eax, 0x28
lea edx, [ebp - 8]
push edx
push eax
call fcn.00413578
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00413580
lea eax, [ebp - 0x18]
call fcn.00429bb4
fstp qword [ebx + 0x20]
wait
lea eax, [ebx + 0x30]
mov edx, dword [esi + 0xc]
mov edx, dword [edx + 0xc]
mov ecx, 0
call fcn.0040a5c4
lea ecx, [ebp - 0x2c]
mov eax, dword [esi + 0xc]
add eax, 0x44
xor edx, edx
call fcn.006c1cac
mov edx, dword [ebp - 0x2c]
lea eax, [ebx + 0x34]
mov ecx, 0
call fcn.0040aa28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c26d4
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00409e9c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00409ecc
ret

Function at 0x6c6ae4
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call fcn.00413ad4
cmp eax, 0x1c
jne 0x6c6b60
cmp dword [esp + 0x10], 0x1000
jne 0x6c6b60
cmp dword [esp + 4], 0
je 0x6c6b60
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call fcn.004136e8
test eax, eax
je 0x6c6b60
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x6c6b60
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x6c6b60
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6e1864
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6e186c
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x6e19db
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x54], 0
jne 0x6e19a4
mov eax, ebx
call fcn.005bfce8
test al, al
je 0x6e19a4
mov eax, dword [ebx + 0x38]
mov edx, dword [eax]
call dword [edx + 0x94]
mov esi, eax
call fcn.00413638
cmp esi, eax
je 0x6e18cc
lea eax, [ebp - 0x30]
call fcn.005c2330
cmp byte [ebp - 0x20], 0
je 0x6e18dc
cmp dword [ebx + 0x3c], 0x80000000
jb 0x6e18dc
mov eax, dword [ebx + 0x3c]
call fcn.005c3034
mov dword [ebx + 0x54], eax
jmp 0x6e1990
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x38]
call fcn.0040da80
lea ecx, [ebp - 8]
mov edx, 0x10
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xbc]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x6e196f
push 2
lea ecx, [ebp - 0xa]
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x6e1990
cmp word [ebp - 0xa], 0x5a4d
jne 0x6e1990
push 4
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x3c]
add edx, 0x3c
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x6e1990
mov eax, dword [ebx + 0x3c]
add eax, dword [ebp - 0x10]
mov dword [ebx + 0x54], eax
push 4
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x54]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x6e1968
cmp dword [ebp - 0x10], 0x4550
je 0x6e1990
xor eax, eax
mov dword [ebx + 0x54], eax
jmp 0x6e1990
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
pop ecx
call fcn.005bf628
cmp dword [ebx + 0x54], 0
jne 0x6e19a4
xor ecx, ecx
mov edx, 2
mov eax, ebx
call fcn.005bf628
mov ebx, dword [ebx + 0x54]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e19e2
lea eax, [ebp - 0x34]
call fcn.00409e3c
lea eax, [ebp - 0x30]
mov edx, dword [0x5c1d9c]
call fcn.0040b68c
lea eax, [ebp - 8]
call fcn.0040da68
lea eax, [ebp - 4]
call fcn.0040da68
ret

Function at 0x6efcd8
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
pushfd
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [0x771654]
cmp eax, 0x1c
jne 0x6efd53
cmp dword [ebp - 0xc], 0x1000
jne 0x6efd4e
cmp dword [ebp - 0x18], 0
je 0x6efd4e
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], eax
je 0x6efd4e
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x6efd2d
mov eax, dword [ebp - 0x18]
cmp eax, 0x80000000
jae 0x6efd53
push 2
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [0x771628]
cmp eax, 0
je 0x6efd4e
push edi
push esi
mov eax, dword [ebp - 0x18]
push eax
call dword [0x77169c]
add ebx, dword [ebp - 0x10]
jmp 0x6efcef
popfd
popal
add esp, 0x20
pop ebp
ret 0xc
Function at 0x719d1c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x719d4a
mov eax, ebx
call fcn.0071a7d8
cmp dword [ebx + 0x40], 0
je 0x719d43
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x719dbb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x719dad
cmp dword [ebx + 8], 0
je 0x719d6c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x719d7e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x719dad
cmp dword [ebx + 8], 0
je 0x719d5f
cmp eax, 3
je 0x719d91
dec eax
jne 0x719d5f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x719d5f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x719d5f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x719dd9
cmp dword [ebx + 0x14], 0xcc
je 0x719dd9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00719de4
pop ebx
ret
Function at 0x734438
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x734447
add esp, 0xfffffff0
call fcn.004086b4
mov esi, ecx
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.00408054
mov dword [edi + 0x94], esi
mov word [edi + 4], 0xffeb
mov dl, 1
mov eax, dword [0x4f391c]
call fcn.004f9b94
mov esi, eax
mov dword [edi + 8], esi
mov dword [esi + 0xc], edi
mov dword [esi + 8], 0x734634
mov edx, 0xffffff
mov eax, esi
call fcn.004f9d80
mov edx, 0x7345c8
mov eax, esi
call fcn.004fa0a8
mov edx, 8
mov eax, esi
call fcn.004fa120
movzx edx, byte [0x7345d8]
mov eax, esi
call fcn.004fa14c
mov byte [edi + 0xc], 1
mov byte [edi + 0xd], 0
mov byte [edi + 0xe], 1
mov byte [edi + 0xf], 1
mov byte [edi + 0x10], 1
mov byte [edi + 0x11], 0
mov dword [edi + 0x14], 0x9f6c36
mov dword [edi + 0x18], 0xc59d62
mov dword [edi + 0x1c], 0xc59d62
mov dword [edi + 0x20], 0xd0b387
mov dword [edi + 0x24], 0x80520c
mov dword [edi + 0x28], 0xff000011
mov dword [edi + 0x2c], 0xff000011
mov dword [edi + 0x30], 0xff000011
mov dword [edi + 0x34], 0xff000011
mov dword [edi + 0x38], 0xc59147
mov dword [edi + 0x3c], 0xffffff
mov dword [edi + 0x48], 0xac732e
mov dword [edi + 0x4c], 0xba7c32
mov dword [edi + 0x40], 0xccb19d
mov eax, dword [edi + 0x48]
mov dword [edi + 0x44], eax
mov dword [edi + 0x50], 0xd0b387
mov dword [edi + 0x54], 0xd0b387
mov dword [edi + 0x58], 0xc59147
mov dword [edi + 0x5c], 0x80520c
mov dword [edi + 0x60], 0xc59d62
mov dword [edi + 0x64], 0xc59d62
mov dword [edi + 0x68], 0xd0b387
mov dword [edi + 0x6c], 0x80520c
mov dword [edi + 0x70], 0xd0b387
mov dword [edi + 0x74], 0xd0b387
mov dword [edi + 0x78], 0xc59147
mov dword [edi + 0x7c], 0x80520c
mov eax, dword [edi + 0x6c]
mov dword [edi + 0x88], eax
mov eax, dword [edi + 0x64]
mov dword [edi + 0x8c], eax
mov dword [edi + 0x84], 7
mov eax, edi
test bl, bl
je 0x7345b4
call fcn.0040870c
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x7389ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov dword [ebx + 0x29c], esi
movzx eax, byte [ebx + 0x2a0]
sub al, 2
jb 0x7389c7
je 0x7389d4
jmp 0x7389e9
movzx edx, word [esi + 4]
mov eax, ebx
call fcn.005a87e8
jmp 0x7389e9
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x7389e9
movzx edx, word [eax + 0x80]
mov eax, ebx
call fcn.005a87e8
mov edx, dword [esi + 8]
mov eax, ebx
call fcn.005a8690
movzx edx, byte [esi + 0xc]
mov eax, ebx
call fcn.00730f20
movzx edx, byte [esi + 0xd]
mov eax, ebx
call fcn.00730f3c
movzx edx, byte [esi + 0xe]
mov eax, ebx
call fcn.0073125c
movzx edx, byte [esi + 0xf]
mov eax, ebx
call fcn.00731284
movzx edx, byte [esi + 0x10]
mov eax, ebx
call fcn.0072c454
movzx edx, byte [esi + 0x11]
mov eax, ebx
call fcn.0072c464
mov edx, dword [esi + 0x14]
mov eax, ebx
call fcn.00731504
mov edx, dword [esi + 0x18]
mov eax, ebx
call fcn.0072c474
mov edx, dword [esi + 0x1c]
mov eax, ebx
call fcn.0072c48c
mov edx, dword [esi + 0x20]
mov eax, ebx
call fcn.0072c4a4
mov edx, dword [esi + 0x24]
mov eax, ebx
call fcn.0072c4bc
mov edx, dword [esi + 0x28]
mov eax, ebx
call fcn.0072c4d4
mov edx, dword [esi + 0x2c]
mov eax, ebx
call fcn.0072c4ec
mov edx, dword [esi + 0x30]
mov eax, ebx
call fcn.0072c504
mov edx, dword [esi + 0x34]
mov eax, ebx
call fcn.0072c51c
mov edx, dword [esi + 0x38]
mov eax, ebx
call fcn.0073111c
mov edx, dword [esi + 0x3c]
mov eax, ebx
call fcn.00731144
mov edx, dword [esi + 0x40]
mov eax, ebx
call fcn.00731194
mov edx, dword [esi + 0x44]
mov eax, ebx
call fcn.0073116c
mov edx, dword [esi + 0x48]
mov eax, ebx
call fcn.007311bc
mov edx, dword [esi + 0x4c]
mov eax, ebx
call fcn.007311e4
mov edx, dword [esi + 0x50]
mov eax, ebx
call fcn.007312ac
mov edx, dword [esi + 0x54]
mov eax, ebx
call fcn.007312d4
mov edx, dword [esi + 0x58]
mov eax, ebx
call fcn.007312fc
mov edx, dword [esi + 0x5c]
mov eax, ebx
call fcn.00731324
mov edx, dword [esi + 0x60]
mov eax, ebx
call fcn.0073134c
mov edx, dword [esi + 0x64]
mov eax, ebx
call fcn.00731374
mov edx, dword [esi + 0x68]
mov eax, ebx
call fcn.0073139c
mov edx, dword [esi + 0x6c]
mov eax, ebx
call fcn.007313c4
mov edx, dword [esi + 0x70]
mov eax, ebx
call fcn.007313ec
mov edx, dword [esi + 0x74]
mov eax, ebx
call fcn.00731414
mov edx, dword [esi + 0x78]
mov eax, ebx
call fcn.0073143c
mov edx, dword [esi + 0x7c]
mov eax, ebx
call fcn.00731464
movzx edx, byte [esi + 0x80]
mov eax, ebx
call fcn.00738df4
mov edx, dword [esi + 0x84]
mov eax, ebx
call fcn.00738dc4
mov edx, dword [esi + 0x88]
mov eax, ebx
call fcn.00739954
mov edx, dword [esi + 0x8c]
mov eax, ebx
call fcn.0073996c
movzx edx, byte [esi + 0x90]
mov eax, ebx
call fcn.005d785c
movzx edx, byte [esi + 0x91]
mov eax, ebx
call fcn.0073152c
movzx edx, byte [esi + 0x92]
mov eax, ebx
call fcn.00731554
pop esi
pop ebx
ret
Function at 0x3f0018f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push ebx
push esi
push edi
push str._noassert
call sym.tier0_s.dll_Plat_CommandLineParamExists
add esp, 4
test al, al
jne 0x3f001adb
push str._nocrashdialog
call sym.tier0_s.dll_Plat_CommandLineParamExists
add esp, 4
test al, al
jne 0x3f001adb
call sym.tier0_s.dll_ThreadInMainThread
test al, al
jne 0x3f00193b
call sym.tier0_s.dll_Plat_IsInDebugSession
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str._debugbreak
call sym.tier0_s.dll_Plat_CommandLineParamExists
add esp, 4
test al, al
je 0x3f001955
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x3f048008], 0
je 0x3f001adb
mov esi, dword [0x3f04e648]
mov dword [ebp - 4], 0x3f04e648
test esi, esi
je 0x3f001a09
jmp 0x3f001980
mov edi, dword [esi + 0x20c]
lea ebx, [esi + 0x20c]
push esi
push dword [ebp + 8]
call fcn.3f01ffd8
add esp, 8
test eax, eax
jne 0x3f0019fc
mov ecx, dword [esi + 0x200]
mov al, 1
cmp ecx, 0xffffffff
jne 0x3f0019b7
xor edx, edx
movzx eax, al
cmp dword [esi + 0x204], ecx
cmove eax, edx
mov edx, dword [ebp + 0xc]
cmp edx, ecx
jl 0x3f0019c6
cmp edx, dword [esi + 0x204]
jle 0x3f0019ca
test al, al
jne 0x3f0019fc
mov eax, dword [esi + 0x208]
test eax, eax
jle 0x3f001adb
add eax, 0xffffffff
mov dword [esi + 0x208], eax
jne 0x3f001adb
mov eax, dword [ebp - 4]
push 0x210
push esi
mov dword [eax], edi
call fcn.3f01a49b
add esp, 8
jmp 0x3f0019ff
mov dword [ebp - 4], ebx
mov esi, edi
test edi, edi
jne 0x3f001980
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [0x3f04e64c], ebx
mov dword [0x3f04e650], esi
mov dword [0x3f04e654], edi
mov byte [0x3f04e642], 0
mov dword [0x3f04e658], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x3f001890
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x3f04e658]
test eax, eax
jne 0x3f001ab9
push edi
push esi
push ebx
push str.File:__s_nLine:__d_n_Ts_n_nClick_Abort_to_break_in_the_debugger__Retry_to_continue_or_Ignore_to_disable_assert_dialogs_for_this_process.
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.3f001b50
add esp, 0x18
mov byte [ebp - 5], 0
lea eax, [ebp - 0x804]
push 0x12002
push str.Assert_Dialog
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 3
jne 0x3f001aa1
pop edi
pop esi
mov byte [0x3f04e642], 1
mov al, byte [0x3f04e642]
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x3f001acf
mov al, byte [0x3f04e642]
pop edi
pop esi
mov byte [0x3f048008], 0
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x3f001500
push eax
push 0x65
push dword [0x3f04e644]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov al, byte [0x3f04e642]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3f003a80
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x18], 0x20
jb 0x3f003a9c
xor al, al
mov esp, ebp
pop ebp
ret
push 0x3f0364fc
call fcn.3f003b50
add esp, 4
test eax, eax
jne 0x3f003ac6
push str.AuthenticAMD
call fcn.3f003b50
add esp, 4
test eax, eax
jne 0x3f003ac6
xor cl, cl
mov al, cl
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
setne cl
test eax, eax
je 0x3f003b46
mov eax, dword [ebp - 4]
push edi
cmp dword [ebp - 8], eax
je 0x3f003b11
mov edi, dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push eax
push esi
call edi
test eax, eax
setne cl
test eax, eax
je 0x3f003b0e
push dword [ebp - 8]
push esi
call edi
test eax, eax
setne cl
mov eax, dword [ebp - 4]
test cl, cl
je 0x3f003b45
cmp eax, 1
jbe 0x3f003b45
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov esi, eax
push esi
call edi
test eax, eax
je 0x3f003b43
push eax
push esi
call edi
test eax, eax
pop edi
setne cl
pop esi
mov al, cl
mov esp, ebp
pop ebp
ret
xor cl, cl
pop edi
pop esi
mov al, cl
mov esp, ebp
pop ebp
ret
Function at 0x3f004140
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [edi]
test ecx, ecx
je 0x3f004159
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi], 0
cmp esi, 4
jne 0x3f0041cf
cmp byte [0x3f04e758], 0
jne 0x3f004191
push 0x3f0366c0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GetLogicalProcessorInformationEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x3f04e75c], eax
nop
mov byte [0x3f04e758], 1
cmp dword [0x3f04e75c], 0
jne case.0x3f0041d8.1
call fcn.3f0038a0
test eax, eax
jne case.0x3f0041d8.2
call fcn.3f003a80
test al, al
je case.0x3f0041d8.0
push 0x34
call fcn.3f01a46b
add esp, 4
test eax, eax
je 0x3f0041fe
mov ecx, eax
call fcn.3f002b60
mov dword [edi], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp esi, 3
ja case.0x3f0041d8.0
jmp dword [esi*4 + 0x3f00432c]
push 0x1c
call fcn.3f01a46b
add esp, 4
test eax, eax
je 0x3f0041fe
mov ecx, eax
call fcn.3f002ee0
mov dword [edi], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov dword [edi], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x14
call fcn.3f01a46b
mov esi, eax
add esp, 4
test esi, esi
je 0x3f00431d
mov dword [esi], vtable.GlpiImpl.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.3f0038a0
test eax, eax
jne 0x3f004257
push 0x3f036600
push 0x28a
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_tier0CPUTopology.cpp
call sym.tier0_s.dll_public:_static_bool___cdecl_AssertMsgHelper_1_::AssertFailed_char_const___unsigned_int__char_const__
add esp, 0xc
test al, al
jne 0x3f004257
int3
push ebx
call fcn.3f0038a0
mov ebx, eax
test ebx, ebx
jne 0x3f00427f
push 0x3f03677c
push 0x28d
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_tier0CPUTopology.cpp
call sym.tier0_s.dll_public:_static_bool___cdecl_AssertMsgHelper_1_::AssertFailed_char_const___unsigned_int__char_const__
add esp, 0xc
test al, al
jne 0x3f00427f
int3
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0
call ebx
push dword [ebp + 8]
call fcn.3f0203a0
add esp, 4
mov dword [esi + 4], eax
lea ecx, [ebp + 8]
push ecx
push eax
call ebx
mov eax, 0xaaaaaaab
mov dword [esi + 0x10], 0
mul dword [ebp + 8]
pop ebx
shr edx, 4
mov dword [esi + 8], edx
test edx, edx
je 0x3f0042d3
mov eax, dword [esi + 4]
add eax, 4
cmp dword [eax], 0
jne 0x3f0042cb
inc dword [esi + 0x10]
add eax, 0x18
sub edx, 1
jne 0x3f0042c3
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xc], eax
mov dword [edi], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 8
call fcn.3f01a46b
mov esi, eax
add esp, 4
test esi, esi
je 0x3f00431d
lea eax, [ebp - 0x48]
mov dword [esi], vtable.DefaultImpl.0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x34]
mov dword [esi + 4], ecx
mov dword [edi], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
xor esi, esi
mov dword [edi], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4