joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ea90
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454fa0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4a2eb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor edi, edi
push edi
mov dword [esi + 0x64], edi
call fcn.00423300
mov eax, dword [0x4a509c]
push 1
mov dword [ebp - 0x20], eax
mov dword [0x4a509c], 0xffffffff
mov byte [ebp - 0x11], 0
call fcn.0040c300
mov byte [esi + 2], 1
add esp, 8
xor eax, eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x20]
mov dword [ebp - 4], edi
mov dword [esi + 0x18], ecx
mov byte [esi + 0x60], al
mov dword [esi + 0x24], edx
mov edi, dword [0x4a4750]
mov dword [ebp - 0x18], edi
cmp edi, dword [0x4a4754]
jae 0x42ec2f
mov ebx, dword [edi]
mov eax, dword [ebx + 0x10]
movzx ecx, word [eax + 0x168]
test cx, cx
js 0x42ebc4
mov ecx, dword [ebx + 0xc]
test byte [ecx + 0x56], 0x10
je 0x42ebc4
lea edx, [ebp - 0x18]
push edx
mov ecx, esi
call fcn.0042e820
test al, al
jne 0x42ec24
mov byte [ebp - 0x11], 1
mov byte [esi + 2], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x38]
lea eax, [esi + 0x50]
push eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x3c], edx
call fcn.00436780
push 0
call fcn.0040c300
mov ecx, dword [ebp - 0x20]
add esp, 8
cmp byte [ebp - 0x11], 0
mov dword [0x4a509c], ecx
je 0x42ec6f
call fcn.00427830
mov edx, dword [0x4a4754]
mov eax, dword [0x4a4750]
push edx
push eax
mov ecx, esi
call fcn.00428fe0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [eax + 0x18]
test ax, ax
jns 0x42ec27
mov eax, dword [esi + 0x18]
cmp eax, dword [esi + 0x14]
jbe 0x42ec27
mov ecx, dword [ebx + 0xc]
movzx eax, word [ecx + 6]
push eax
call fcn.0040b5d0
add esp, 4
test al, al
je 0x42ec27
lea edx, [ebp - 0x12]
push edx
push ebx
mov ecx, esi
call fcn.00428d40
test al, al
je 0x42ec27
cmp byte [ebp - 0x12], 0
push edi
mov ecx, esi
je 0x42ec12
call fcn.0042bb70
sub edi, 4
add edi, 4
jmp 0x42eb12
call fcn.00428df0
sub eax, 4
mov edi, eax
add edi, 4
jmp 0x42eb12
mov edi, dword [ebp - 0x18]
add edi, 4
jmp 0x42eb12
cmp byte [ebp - 0x11], 0
jne 0x42eb5a
mov ecx, esi
call fcn.0042c990
test al, al
jne 0x42eb5a
jmp 0x42eb56
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f530
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x4a2eb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, edi
mov dword [ebp - 0x58], 0
call fcn.0042f280
mov esi, eax
push 0x28
lea eax, [ebp - 0x54]
push eax
push edi
mov dword [0x4aaf98], edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x42f56f
xor ecx, ecx
mov word [ebp - 0x54], cx
lea edx, [ebp - 0x60]
push edx
lea eax, [ebp - 0x54]
push eax
call fcn.00434e80
add esp, 8
test eax, eax
jne 0x42f594
fldz
mov dword [ebp - 0x58], 0x579
fst qword [ebp - 0x60]
jmp 0x42f669
mov ax, word [ebp - 0x5a]
mov cx, word [0x4a2db0]
movzx edx, ax
and edx, 0x7ff0
cmp dx, cx
jge 0x42f5b7
fldz
fst qword [ebp - 0x60]
jmp 0x42f669
xor edx, edx
cmp word [0x4aafa6], cx
setge dl
xor ecx, ecx
test ax, ax
setns cl
xor edx, ecx
je 0x42f5e0
fldz
mov dword [ebp - 0x58], 0x57a
fst qword [ebp - 0x60]
jmp 0x42f669
lea edx, [ebp - 0x68]
push edx
lea ebx, [ebp - 0x74]
mov eax, esi
call fcn.0042ed40
mov ecx, dword [ebp - 0x6e]
mov ax, word [0x4a2db0]
and ecx, 0x7ff0
add esp, 4
cmp cx, ax
jge 0x42f613
fldz
mov dword [ebp - 0x58], 0x582
fst qword [ebp - 0x60]
jmp 0x42f616
fld qword [ebp - 0x60]
fld st(0)
fld qword [ebp - 0x68]
fsub st(1), st(0)
fxch st(1)
fstp qword [ebp - 0x68]
cmp word [ebp - 0x62], ax
jl 0x42f63f
cmp word [0x4aafa6], ax
jl 0x42f63f
fstp st(1)
mov dword [ebp - 0x58], 0x57b
fst qword [ebp - 0x60]
jmp 0x42f641
fstp st(0)
fld st(0)
fabs
fld qword [ebp - 0x74]
fld st(0)
fabs
fsubp st(2)
fxch st(1)
fstp qword [ebp - 0x68]
cmp word [ebp - 0x62], ax
jl 0x42f667
fstp st(1)
mov dword [ebp - 0x58], 0x583
fst qword [ebp - 0x60]
jmp 0x42f669
fstp st(0)
sub esp, 8
mov eax, esi
fstp qword [esp]
call fcn.0042eea0
fld qword [ebp - 0x60]
sub esi, dword [0x4aafb4]
add esp, 8
push 1
sub esp, 8
add esi, 0x387
fstp qword [esp]
call fcn.0042f0e0
push 0
call fcn.0042f4c0
mov eax, dword [ebp - 0x58]
add esp, 0x10
pop esi
pop ebx
test eax, eax
je 0x42f6e0
push eax
push 1
call fcn.0041d730
add esp, 8
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffff0000
push 0
push 0xb1
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439fc0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00439fc0
mov esp, ebp
pop ebp
ret
Function at 0x42f6f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4a2eb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push edi
mov edi, ecx
push 0x357
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, dword [0x4a42b4]
sub esi, dword [0x4a42b0]
xor ecx, ecx
sar esi, 2
mov dword [ebp - 0x18], eax
mov dword [0x4aafb4], ecx
push ecx
cmp esi, 5
jg 0x42f7d7
push eax
mov dword [0x4aafb0], ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, 5
jge 0x42f7fb
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp - 0x1c]
add ecx, 0x387
push ecx
push edi
call ebx
push 0
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp - 0x1c], esi
jne 0x42f782
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 5
jl 0x42f756
mov esi, dword [ebp - 0x10]
push 0x35e
push edi
call ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
add esi, 3
mov dword [ebp - 8], esi
lea esi, [ebp - 0x14]
call fcn.0042f220
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
push 1
sub edx, eax
push edx
mov edx, dword [ebp - 0xc]
sub edx, ecx
push edx
push eax
mov eax, dword [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x42f7fb
add esi, 0xfffffffb
push esi
push ecx
push 2
push eax
mov dword [0x4aafb0], esi
call dword [sym.imp.USER32.dll_SetScrollRange]
mov ecx, dword [ebp - 0x18]
push 1
push 0
push 2
push ecx
call dword [sym.imp.USER32.dll_SetScrollPos]
call fcn.0042ed10
test eax, eax
je 0x42f840
push 0
push 0x35d
push edi
call ebx
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
push 0
push 0x35a
push edi
call ebx
push eax
call esi
push 0
push 0x35b
push edi
call ebx
push eax
call esi
push 0
push 0x35c
push edi
call ebx
push eax
call esi
jmp 0x42f86b
push 0x6d
call fcn.0040f250
push 0x66
call fcn.0040f250
add esp, 8
call fcn.0042ed10
test eax, eax
je 0x42f86b
push 0
push 0x35b
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
call fcn.0042f140
push 1
call fcn.0042f4c0
add esp, 4
push 0x387
push edi
call ebx
mov ecx, eax
call fcn.0042f2c0
mov eax, dword [0x4a74c4]
test eax, eax
jne 0x42f897
mov eax, dword [0x4a74c8]
push edi
push eax
call fcn.00436fc0
mov edx, dword [ebp - 0x20]
add esp, 8
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00439fc0
mov esp, ebp
pop ebp
ret
Function at 0x431470
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454fe0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x34
mov edi, ecx
call sub.mfc100u.dll_new
mov esi, eax
xor eax, eax
add esp, 4
mov dword [ebp - 0x14], esi
cmp esi, eax
je 0x4314fe
mov ecx, dword [edi + 4]
mov dword [esi], ecx
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
mov ecx, dword [edi + 4]
mov edx, dword [ebp + 8]
mov word [esi + 0x30], ax
mov dword [ebp - 4], eax
push edx
lea eax, [esi + 0xc]
push eax
add edi, 0xd
push edi
mov dword [esi + 8], ecx
call fcn.00431280
mov ecx, dword [ebp - 0xc]
add esp, 0xc
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp + 8], eax
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x49a000
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3

Function at 0x435ac0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x6d
cmp dword [ebp + 8], edi
jne 0x435afc
mov eax, edi
mov ecx, esi
call fcn.00435a40
lea eax, [edi - 1]
mov ecx, esi
call fcn.00435a40
mov edi, 0x6a
mov eax, esi
call fcn.00435a70
mov edi, 0x6b
mov eax, esi
call fcn.00435a70
pop edi
pop ebp
ret
mov eax, esi
call fcn.00435a70
mov edi, 0x6c
mov eax, esi
call fcn.00435a70
lea eax, [edi - 2]
mov ecx, esi
call fcn.00435a40
lea eax, [edi - 1]
mov ecx, esi
pop edi
pop ebp
jmp fcn.00435a40

Function at 0x4371e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 0x7e
push edi
je 0x437225
mov eax, 0x7e
lea edx, [ebp - 0x206]
mov word [ebp - 0x208], ax
mov eax, esi
sub edx, esi
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x437210
lea esi, [ebp - 0x208]
lea ecx, [ebp - 0x410]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x437253
push edi
push 0
push esi
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x437258
xor eax, eax
mov word [edi], ax
xor eax, eax
cmp word [edi], ax
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x437310
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004381d0
Function at 0x4374f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0x40
lea ecx, [ebp - 0x80]
push ecx
push 0x1001
xor eax, eax
push esi
mov word [ebx], ax
call edi
test eax, eax
je 0x43759c
push 0x40
lea edx, [ebp - 0x100]
push edx
push 7
push esi
call edi
test eax, eax
je 0x43759c
lea eax, [ebp - 0x80]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x437537
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [ebp - 0x100]
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x437551
sub eax, esi
sar eax, 1
lea eax, [eax + edx + 2]
cmp eax, dword [ebp + 0xc]
ja 0x43759c
lea ecx, [ebp - 0x80]
push ecx
push ebx
call fcn.00436660
mov edx, 0x5f
lea ecx, [ebp - 0x100]
mov word [eax], dx
push ecx
add eax, 2
push eax
call fcn.00436660
add esp, 0x10
pop edi
xor edx, edx
pop esi
mov word [eax], dx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4381d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
xor ebx, ebx
cmp edi, 0x400
jne 0x4381fb
call dword [sym.imp.AoWrap.dll_class_AxUserContext____cdecl_GetAxUserContext_void_]
mov eax, dword [eax + 0x94]
cmp eax, ebx
je 0x4381fb
mov edi, eax
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
jne 0x438216
mov dword [str._._____], ebx
mov byte [0x4bbf60], bl
jmp 0x438256
jle 0x438225
mov dword [str._._____], eax
mov byte [0x4bbf60], bl
jmp 0x438256
cmp eax, 0xffffffff
je 0x438256
push 0x80
lea eax, [ebp - 0x100]
push eax
push 0x8000000f
push edi
call esi
test eax, eax
je 0x43824f
movzx ecx, byte [ebp - 0x100]
mov dword [str._._____], ecx
mov byte [0x4bbf60], 1
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jle 0x43826a
mov dword [0x4a2d98], eax
mov byte [0x4bbf61], bl
jmp 0x43829a
cmp eax, 0xffffffff
je 0x43829a
push 0x80
lea edx, [ebp - 0x100]
push edx
push 0x8000000e
push edi
call esi
test eax, eax
je 0x438293
movzx eax, word [ebp - 0x100]
mov dword [0x4a2d98], eax
mov byte [0x4bbf61], 1
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jle 0x4382b3
pop edi
pop esi
mov byte [0x4bbf62], bl
mov dword [0x4a2de8], eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0xffffffff
je 0x4382eb
push 0x80
lea ecx, [ebp - 0x100]
push ecx
push 0x80000010
push edi
call esi
test eax, eax
je 0x4382e4
lea edx, [ebp - 0x100]
push 0x4a2de8
push edx
call fcn.00434f10
add esp, 8
mov byte [0x4bbf62], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x439fc0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a2eb0]
jne 0x439fca
repz ret
jmp fcn.0043a624
Function at 0x442d30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x455b70
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
xor ebx, ebx
push edi
mov byte [esi + 0x30], bl
call edx
lea ecx, [esi + 0x5c]
call fcn.00440f70
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov dword [esi + 0x48], eax
cmp dword [edi], ebx
jne 0x442d86
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push edi
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [edi]
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edi
push 0x4985f8
push eax
call edx
cmp eax, ebx
jge 0x442de6
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
push 0x36
push str.RowsetDataBase.Load:_Could_not_get_IAccessor_interface
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.004021a0
push 0x49becc
lea ecx, [ebp - 0x28]
push ecx
mov dword [ebp - 4], 0xffffffff
call sub.MSVCR100.dll__CxxThrowException
mov ecx, dword [ebp + 0x10]
mov eax, dword [edi]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push ebx
push ecx
mov ecx, dword [esi + 0x40]
push ebx
push ecx
mov ecx, dword [esi + 0x34]
push ecx
push 2
push eax
call edx
cmp eax, ebx
jge 0x442e49
mov edi, dword [edi]
mov eax, dword [edi]
mov ecx, dword [eax + 8]
push edi
call ecx
xor edx, edx
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], ebx
mov word [ebp - 0x44], dx
push 0x35
push str.RowsetDataBase.prepareLoad:_Could_not_create_Accessor
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 1
call fcn.004021a0
push 0x49becc
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 4], 0xffffffff
call sub.MSVCR100.dll__CxxThrowException
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], ebx
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x447570
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x455fb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
mov ecx, dword [edi]
mov dword [esp + 8], esi
mov dword [esi], ecx
test ecx, ecx
je 0x4475a1
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov dword [esi + 4], vtable.AgActivities::EmptyIter.0
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0xc], ecx
mov dx, word [edi + 0x10]
mov word [esi + 0x10], dx
xor eax, eax
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
push eax
lea edx, [edi + 0x14]
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push edx
mov dword [esp + 0x20], 0
mov word [ecx], ax
call fcn.004020a0
xor eax, eax
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
push eax
lea edx, [edi + 0x30]
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push edx
mov byte [esp + 0x20], 1
mov word [ecx], ax
call fcn.004020a0
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
movzx ecx, byte [edi + 0x50]
mov byte [esi + 0x50], cl
movzx edx, byte [edi + 0x51]
mov byte [esi + 0x51], dl
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov ecx, dword [edi + 0x50]
mov dword [esi + 0x50], ecx
mov edx, dword [edi + 0x54]
mov dword [esi + 0x54], edx
movzx eax, byte [edi + 0x58]
mov byte [esi + 0x58], al
movzx ecx, byte [edi + 0x4c]
mov byte [esi + 0x4c], cl
mov edx, dword [edi + 0x4c]
mov dword [esi + 0x4c], edx
movzx eax, byte [edi + 0x5c]
mov byte [esi + 0x5c], al
movzx ecx, byte [edi + 0x5d]
mov byte [esi + 0x5d], cl
movzx edx, byte [edi + 0x5e]
mov byte [esi + 0x5e], dl
movzx eax, byte [edi + 0x5f]
mov byte [esi + 0x5f], al
movzx ecx, byte [edi + 0x60]
mov byte [esi + 0x60], cl
movzx edx, byte [edi + 0x61]
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x61], dl
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x447e20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456010
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x34
mov edi, ecx
call sub.mfc100u.dll_new
mov esi, eax
xor eax, eax
add esp, 4
mov dword [ebp - 0x14], esi
cmp esi, eax
je 0x447eae
mov ecx, dword [edi + 4]
mov dword [esi], ecx
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
mov ecx, dword [edi + 4]
mov edx, dword [ebp + 8]
mov word [esi + 0x30], ax
mov dword [ebp - 4], eax
push edx
lea eax, [esi + 0xc]
push eax
add edi, 0xd
push edi
mov dword [esi + 8], ecx
call fcn.00447b50
mov ecx, dword [ebp - 0xc]
add esp, 0xc
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp + 8], eax
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x49a000
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3
Function at 0x44afb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456350
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4a2eb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push 0x34
call sub.mfc100u.dll_new
mov esi, eax
xor eax, eax
add esp, 4
mov dword [ebp - 0x14], esi
cmp esi, eax
je 0x44b049
mov ecx, dword [edi + 4]
mov dword [esi], ecx
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
mov ecx, dword [edi + 4]
mov edx, dword [ebp + 8]
mov word [esi + 0x30], ax
mov dword [ebp - 4], eax
push edx
lea eax, [esi + 0xc]
push eax
add edi, 0xd
push edi
mov dword [esi + 8], ecx
call fcn.0044ad90
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp + 8], eax
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x49a000
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3

Function at 0x44c330
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4564d0
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4a2eb0]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push esi
push edi
mov eax, dword [0x4a2eb0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x90]
mov esi, ecx
mov ecx, dword [esp + 0x8c]
xor ebx, ebx
mov dword [esp + 0x18], eax
xor edx, edx
mov eax, ecx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
lea edi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x44c3a0
sub eax, edi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.004021a0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x40]
mov dword [esp + 0x88], ebx
call fcn.0044be60
push ebx
lea edx, [esp + 0x3c]
push edx
mov ecx, esi
mov byte [esp + 0x88], 1
call fcn.0044c270
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.0044c1b0
mov esi, 8
cmp dword [esp + 0x6c], esi
jb 0x44c40e
mov ecx, dword [esp + 0x58]
push ecx
call sub.mfc100u.dll_delete
add esp, 4
xor edx, edx
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], ebx
mov word [esp + 0x58], dx
cmp dword [esp + 0x4c], esi
jb 0x44c434
mov eax, dword [esp + 0x38]
push eax
call sub.mfc100u.dll_delete
add esp, 4
xor ecx, ecx
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], cx
cmp dword [esp + 0x30], esi
jb 0x44c45a
mov edx, dword [esp + 0x1c]
push edx
call sub.mfc100u.dll_delete
add esp, 4
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439fc0
add esp, 0x74
ret 0xc
Function at 0x44db40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4568a0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4a2eb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push 0x34
call sub.mfc100u.dll_new
mov esi, eax
xor eax, eax
add esp, 4
mov dword [ebp - 0x14], esi
cmp esi, eax
je 0x44dbd9
mov ecx, dword [edi + 4]
mov dword [esi], ecx
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
mov ecx, dword [edi + 4]
mov edx, dword [ebp + 8]
mov word [esi + 0x30], ax
mov dword [ebp - 4], eax
push edx
lea eax, [esi + 0xc]
push eax
add edi, 0xd
push edi
mov dword [esi + 8], ecx
call fcn.0044dac0
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp + 8], eax
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x49a000
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3