joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bf80
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov ecx, dword [ebp + 8]
push esi
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x404]
push 0x3ff
push edx
call fcn.004543f1
mov esi, dword [0x896f18]
xor eax, eax
add esp, 0x10
cmp esi, 0x896f14
mov byte [ebp - 5], al
mov dword [ebp - 4], eax
je 0x41c172
push ebx
push edi
mov ax, word [esi + 8]
cmp ax, 0x1d1d
mov edi, dword [esi + 4]
je 0x41c136
cmp ax, 0x2d2d
jne 0x41c0fa
mov ecx, dword [esi + 0xc]
test ecx, ecx
jle 0x41bfec
cmp ecx, 0x40000000
jle 0x41c069
mov eax, dword [0x940094]
mov edx, dword [eax + 0x20]
test edx, edx
mov ax, word [esi + 0xa]
je 0x41c032
cmp ax, 0x1c
jge 0x41c011
movsx edx, ax
lea edx, [edx + edx*2]
mov edx, dword [edx*4 + 0x47b60c]
jmp 0x41c016
mov edx, str.UNKNOWN_TAG
push esi
lea ebx, [ebp - 0x404]
push ebx
push edx
movsx eax, ax
push eax
push ecx
push 0x10
push str.Z_Verify:_crazy_block_size__d__maybe_tag__d___s___during__s_at__p
call fcn.0041ac50
jmp 0x41c066
cmp ax, 0x1c
jge 0x41c047
movsx edx, ax
lea edx, [edx + edx*2]
mov edx, dword [edx*4 + 0x47b60c]
jmp 0x41c04c
mov edx, str.UNKNOWN_TAG
push esi
lea ebx, [ebp - 0x404]
push ebx
push edx
movsx eax, ax
push eax
push ecx
push str.Z_Verify:_crazy_block_size__d__maybe_tag__d___s___during__s_at__p
push 5
call fcn.0041b080
add esp, 0x1c
mov edx, dword [esi + 0xc]
cmp byte [edx + esi - 1], 0xcc
je 0x41c136
mov ecx, dword [0x940094]
mov eax, dword [ecx + 0x20]
test eax, eax
mov ax, word [esi + 0xa]
je 0x41c0c1
cmp ax, 0x1c
jge 0x41c09d
movsx ecx, ax
lea ecx, [ecx + ecx*2]
mov ecx, dword [ecx*4 + 0x47b60c]
jmp 0x41c0a2
mov ecx, str.UNKNOWN_TAG
push esi
lea esi, [ebp - 0x404]
push esi
push ecx
movsx eax, ax
push eax
push edx
push 0x10
push str.Z_Verify:_buffer_overrun_detected_in_block_sized__d__tagged_as__d___s___during__s_at__p
call fcn.0041ac50
add esp, 0x1c
jmp 0x41c136
cmp ax, 0x1c
jge 0x41c0d6
movsx ecx, ax
lea ecx, [ecx + ecx*2]
mov ecx, dword [ecx*4 + 0x47b60c]
jmp 0x41c0db
mov ecx, str.UNKNOWN_TAG
push esi
lea esi, [ebp - 0x404]
push esi
push ecx
movsx eax, ax
push eax
push edx
push str.Z_Verify:_buffer_overrun_detected_in_block_sized__d__tagged_as__d___s___during__s_at__p
push 5
call fcn.0041b080
add esp, 0x1c
jmp 0x41c136
mov ecx, dword [0x940094]
mov eax, dword [ecx + 0x20]
add esi, 0x10
test eax, eax
push esi
je 0x41c120
lea edx, [ebp - 0x404]
push edx
push 0x10
push str.Z_Verify:_memory_corruption_detected_during__s_in_block__p
call fcn.0041ac50
jmp 0x41c133
lea eax, [ebp - 0x404]
push eax
push str.Z_Verify:_memory_corruption_detected_during__s_in_block__p
push 5
call fcn.0041b080
add esp, 0x10
mov ecx, dword [0x896f24]
mov eax, dword [ebp - 4]
lea edx, [ecx + ecx]
mov ecx, eax
inc eax
cmp ecx, edx
mov dword [ebp - 4], eax
jle 0x41c162
lea edx, [ebp - 0x404]
push edx
push str.Z_Verify:_memory_chain_state_corrupted_during__s
push 5
call fcn.0041b080
add esp, 0xc
cmp edi, 0x896f14
mov esi, edi
jne 0x41bfc2
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41e710
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
cmp byte [esi], 0
je 0x41e7e3
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push edi
mov edi, 1
cmp byte [esi], 0xa
jne 0x41e738
mov byte [esi], 0xd
movsx eax, byte [esi]
push eax
call fcn.0045462b
xor edx, edx
mov dl, byte [esi]
movsx cx, al
mov word [ebp - 0x14], di
mov dword [ebp - 0x10], edi
mov word [ebp - 0xc], di
push edx
mov word [ebp - 0xa], cx
call fcn.0041e4f0
mov word [ebp - 8], ax
mov al, byte [esi]
movsx cx, al
mov word [ebp - 6], cx
mov ecx, dword [0x47d1e8]
add esp, 8
cmp ecx, edi
jle 0x41e788
movsx edx, al
push edi
push edx
call fcn.00452528
add esp, 8
jmp 0x41e797
mov ecx, dword [str.________________________________H]
movsx eax, al
movzx eax, byte [ecx + eax*2]
and eax, edi
mov ecx, dword [0x940074]
neg eax
sbb eax, eax
and eax, 0x80
lea edx, [ebp + 8]
push edx
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x14]
push eax
push ecx
call ebx
mov ecx, dword [0x940074]
lea edx, [ebp + 8]
push edx
push edi
lea eax, [ebp - 0x14]
push eax
push ecx
mov dword [ebp - 0x10], 0
call ebx
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x41e730
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41e930
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push str._HFILE
mov dword [ebp - 4], edi
xor ebx, ebx
mov dword [0x940070], esi
mov dword [0x94007c], eax
call fcn.0041e3d0
add esp, 4
test eax, eax
jle 0x41e97a
cmp eax, esi
jge 0x41e97a
mov ecx, dword [0x94007c]
mov edx, dword [ecx + eax*4 + 4]
push edx
call fcn.00451ef9
add esp, 4
mov dword [ebp - 4], eax
push str._HPARENT
call fcn.0041e3d0
add esp, 4
test eax, eax
jle 0x41e9a4
cmp eax, esi
jge 0x41e9a4
mov ecx, dword [0x94007c]
mov edx, dword [ecx + eax*4 + 4]
push edx
call fcn.00451ef9
add esp, 4
mov ebx, eax
push str._HCHILD
call fcn.0041e3d0
add esp, 4
test eax, eax
jle 0x41e9ce
cmp eax, esi
jge 0x41e9ce
mov ecx, dword [0x94007c]
mov edx, dword [ecx + eax*4 + 4]
push edx
call fcn.00451ef9
add esp, 4
mov edi, eax
mov esi, dword [ebp - 4]
test esi, esi
je 0x41eaab
test ebx, ebx
je 0x41eaab
test edi, edi
je 0x41eaab
push str.Initializing_for_qhost._n
mov dword [0x896f3c], 1
call fcn.00454447
add esp, 4
push 0
push 0
push 0
push 0
mov dword [0x940078], esi
mov dword [0x940080], ebx
mov dword [0x940084], edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0x940088], eax
jne 0x41ea3d
push str.Couldnt_create_heventDone_n
call fcn.00454447
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 8]
push eax
push 0
push 0
push 0x41e7f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x41ea79
mov ecx, dword [0x940088]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Couldnt_create_QHOST_thread_n
call fcn.00454447
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff6
mov dword [0x94008c], eax
call esi
mov edx, dword [0x94008c]
push 0x19
push 0x50
push edx
mov dword [0x940074], eax
call fcn.0041e590
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Qhost_not_present._n
call fcn.00454447
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41eb30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x8c7224]
fild dword [0x8c7224]
test eax, eax
jge 0x41eb49
fadd dword [0x4619b8]
fmul dword [0xb2d39c]
fild dword [ebp + 0xc]
fcompp
fnstsw ax
test ah, 5
jnp 0x41eb93
push esi
mov esi, dword [ebp + 0x10]
mov al, byte [esi]
test al, al
je 0x41eb92
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea ecx, [ecx]
movsx ecx, al
xor ecx, 0x80
push ecx
push ebx
push edi
call dword [0x8c7274]
mov al, byte [esi + 1]
add esp, 0xc
add edi, 8
inc esi
test al, al
jne 0x41eb70
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41fb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
mov eax, 0xffff
je 0x41fb34
mov ecx, dword [ebp + 8]
push ebx
push edi
movzx edi, byte [ecx]
xor ebx, ebx
movzx edx, ax
mov bh, al
shr edx, 8
xor edx, edi
xor bx, word [edx*2 + 0x47c300]
inc ecx
dec esi
mov eax, ebx
jne 0x41fb15
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x4261f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x68]
push edx
mov dword [ebp - 0x68], 0x67452301
mov dword [ebp - 0x64], 0xefcdab89
mov dword [ebp - 0x60], 0x98badcfe
mov dword [ebp - 0x5c], 0x10325476
call fcn.00426080
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.00426140
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
xor eax, ecx
mov ecx, dword [ebp - 0x10]
xor eax, edx
add esp, 0x14
xor eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x42c0e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x47cf98]
jns 0x42c0ed
jmp fcn.0042bfb0
mov eax, dword [0x8b2ea4]
mov ecx, dword [eax]
add eax, 4
mov dword [0x8b2ea4], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x42c740
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x10
push 0
push ebx
mov dword [ebp - 4], 0
call fcn.00451960
mov edi, dword [ebp + 8]
mov al, byte [edi]
add esp, 0xc
test al, al
mov esi, edi
je 0x42c85b
mov al, byte [esi]
cmp al, 0x2e
jne 0x42c77d
inc dword [ebp - 4]
jmp 0x42c7af
cmp al, 0x3a
je 0x42c7b7
cmp dword [0x47d1e8], 1
jle 0x42c79a
movsx eax, al
push 4
push eax
call fcn.00452528
add esp, 8
jmp 0x42c7ab
mov edx, dword [str.________________________________H]
movsx ecx, al
xor eax, eax
mov al, byte [edx + ecx*2]
and eax, 4
test eax, eax
je 0x42c80f
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x42c772
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x42c7c8
cmp eax, 3
jne 0x42c85b
mov esi, dword [ebp - 4]
push 0x7f
lea eax, [ebp - 0x84]
push edi
push eax
mov word [ebx], 2
mov word [ebx + 2], 0
call fcn.004525b0
mov cl, byte [ebp - 0x84]
add esp, 0xc
test cl, cl
mov byte [ebp - 5], 0
lea eax, [ebp - 0x84]
je 0x42c82b
lea esp, [esp]
cmp byte [eax], 0x3a
je 0x42c814
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42c800
jmp 0x42c82b
or esi, 0xffffffff
jmp 0x42c7cb
mov byte [eax], 0
inc eax
push eax
call fcn.00451ef9
add esp, 4
push eax
call sub.WSOCK32.dll_htons
mov word [ebx + 2], ax
cmp esi, 0xffffffff
je 0x42c84b
lea ecx, [ebp - 0x84]
push ecx
call sub.WSOCK32.dll_inet_addr
pop edi
mov dword [ebx + 4], eax
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x84]
push edx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x42c864
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
pop edi
pop esi
mov dword [ebx + 4], edx
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d180
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push edi
push esi
push ebx
call fcn.0042ca60
add esp, 0xc
test eax, eax
jne 0x42d2e2
mov eax, dword [ebx*4 + 0x8b4080]
test eax, eax
je 0x42d2d6
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [edi + 0xc]
lea edx, [ebp - 0x14]
push edx
mov edx, dword [edi + 8]
push 0
push ecx
push edx
push eax
mov dword [ebp - 4], 0x10
call sub.WSOCK32.dll_recvfrom
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x42d269
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x42d2d6
cmp eax, 0x2746
jne 0x42d213
mov eax, dword [ebp - 0x10]
mov cx, word [ebp - 0x12]
pop edi
mov dword [esi + 4], eax
mov dword [esi], 2
mov word [esi + 8], cx
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x47b1f4]
mov ecx, dword [edx + 0x20]
test ecx, ecx
je 0x42d241
call fcn.0042cda0
push eax
push 0x4000
push str.NET_GetPacket:__s_n
call fcn.0041ac50
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x2738
je 0x42d260
call fcn.0042cda0
push eax
push 0x4000
push str.WARNING__NET_GetPacket:__s
call fcn.0041ac50
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x8b3eb8]
mov eax, dword [0x8b3ebc]
mov ebx, dword [0x8b3ea8]
add edx, 1
adc eax, 0
mov dword [0x8b3ebc], eax
mov dword [0x8b3eb8], edx
mov eax, ecx
cdq
add ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [0x8b3ea8], ebx
mov ebx, dword [0x8b3eac]
adc ebx, edx
mov dx, word [ebp - 0x12]
mov dword [esi], 2
mov dword [esi + 4], eax
mov word [esi + 8], dx
cmp ecx, dword [edi + 0xc]
mov dword [0x8b3eac], ebx
jne 0x42d2df
push esi
call fcn.0042c960
push eax
push 0x4000
push str.Oversize_packet_from__s_n
call fcn.0041ac50
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x10], ecx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d2f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [ebp + 0x14]
mov eax, dword [edi]
cmp eax, 2
jne 0x42d318
mov eax, dword [ebp + 8]
mov esi, dword [eax*4 + 0x8b4080]
test esi, esi
jne 0x42d365
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x42d338
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call fcn.0042cb00
add esp, 0xc
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x42d353
mov ecx, dword [ebp + 8]
mov esi, dword [ecx*4 + 0x8b4080]
test esi, esi
jne 0x42d365
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push str.NET_SendPacket:_bad_address_type
push 0
call fcn.0041b080
mov esi, dword [ebp + 0x14]
add esp, 8
push ebx
lea edx, [ebp - 0x10]
push edx
push edi
call fcn.0042c900
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
add esp, 8
push 0x10
lea eax, [ebp - 0x10]
push eax
push 0
push ecx
push ebx
push esi
call sub.WSOCK32.dll_sendto
mov esi, eax
cmp esi, 0xffffffff
jne 0x42d42f
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x42d3b3
cmp eax, 0x2714
je 0x42d3b3
cmp eax, 0x2741
jne 0x42d3bc
cmp dword [edi], 1
jne 0x42d3bc
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [0x47b1f4]
mov ecx, dword [edx + 0x20]
test ecx, ecx
je 0x42d3da
cmp eax, 0x2746
jne 0x42d42f
pop ebx
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x2741
jne 0x42d3fd
push edi
call fcn.0042c960
add esp, 4
push eax
call fcn.0042cda0
push eax
push str.NET_SendPacket_Warning:__s_:__s_n
call fcn.0041b010
jmp 0x42d42c
cmp dword [edi], 1
je 0x42d42f
cmp dword [ebp + 0xc], 0xb
jne 0x42d40d
cmp dword [ebx], 0xffffffff
je 0x42d42f
cmp dword [ebp + 8], 1
jne 0x42d41a
cmp eax, 0x2746
je 0x42d42f
call fcn.0042cda0
push eax
push str.NET_SendPacket_ERROR:__s
push 4
call fcn.0041b080
add esp, 0xc
mov edi, dword [0x8b40b0]
mov edx, dword [0x8b40b4]
mov ecx, dword [0x8b3ec0]
add edi, 1
adc edx, 0
mov eax, esi
mov dword [0x8b40b4], edx
cdq
add ecx, eax
mov eax, dword [0x8b3ec4]
pop ebx
adc eax, edx
mov dword [0x8b40b0], edi
pop edi
mov dword [0x8b3ec4], eax
mov dword [0x8b3ec0], ecx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42d9a0
Capabilities:
Initialize winsock library

Disassembly:
push 0x8b3ef0
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x42d9c2
push str.Winsock_initialization_failed.
push 0
call fcn.0041b080
add esp, 8
push 0
push 0x46af8c
push str.net_rcvbuf
call fcn.0041fed0
push 0
push 0x46af8c
push str.net_sndbuf
mov dword [0x8b3ec8], eax
call fcn.0041fed0
mov dword [0x8b40a8], eax
mov eax, dword [0x47b1f4]
mov ecx, dword [eax + 0x20]
add esp, 0x18
test ecx, ecx
je 0x42da1f
mov ecx, dword [0x8b3eec]
mov eax, 2
cmp ecx, eax
je 0x42da1f
mov edx, ecx
or edx, eax
push eax
mov dword [0x8b3eec], edx
call fcn.0042d6c0
add esp, 4
push 0x4000
push str.Winsock_Initialized_n
call fcn.0041ac50
push 0x42d930
push str.net_restart
call fcn.00417e50
push 0x42cd00
push str.net_stats
call fcn.00417e50
add esp, 0x18
ret
Function at 0x447080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10b4
call fcn.00452050
lea eax, [ebx + 0xc]
lea ecx, [ebp - 0x10b4]
push 0x8c5eb0
mov dword [0x8c62b0], ebx
mov dword [0x8c62c0], eax
mov dword [0x8c62b8], ecx
mov dword [0x8c5ea8], 0
mov dword [0x8c62bc], 0x400
mov dword [0x8c62b4], 1
call fcn.00446ea0
mov eax, dword [0x8c5ea8]
xor ecx, ecx
add esp, 4
test eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jle 0x447205
push esi
push edi
lea esp, [esp]
mov esi, dword [ebp + ecx*4 - 0x10b4]
mov eax, dword [esi + 0xf8]
test eax, eax
mov dword [ebp - 8], esi
je 0x4471f1
mov eax, dword [ebx + 0x78]
cmp esi, eax
je 0x4471f1
mov ecx, dword [ebx + 0x40]
test ecx, ecx
jne 0x447203
test eax, eax
je 0x44713a
cmp dword [esi + 0x100], eax
je 0x4471f1
cmp dword [eax + 0x100], esi
je 0x4471f1
test dword [ebx + 0x7c], 0x4000000
jne 0x447150
test byte [esi + 0xb8], 2
jne 0x4471f1
mov eax, esi
call fcn.00447030
cmp dword [esi + 0xf8], 3
lea ecx, [esi + 0x10]
je 0x447168
mov ecx, 0x8b4d7c
mov dl, byte [esi + 0xb8]
push ecx
add esi, 4
test dl, 4
mov edx, dword [ebx + 0x7c]
push esi
push edx
mov edx, dword [ebx + 0x3c]
push eax
je 0x447190
lea eax, [ebx + 0x2c]
lea ecx, [ebx + 0x20]
push eax
push ecx
lea ecx, [ebp - 0xb4]
jmp 0x44719b
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
push eax
push ecx
lea ecx, [ebp - 0x7c]
mov eax, dword [ebx + 0x38]
push edx
push eax
push ecx
call fcn.0041a170
mov esi, eax
lea edi, [ebp - 0x44]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44]
add esp, 0x24
test eax, eax
jne 0x4471d0
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x4471d0
fld dword [ebp - 0x3c]
fcomp dword [ebx + 0x48]
fnstsw ax
test ah, 5
jp 0x4471f1
mov eax, dword [ebx + 0x44]
test eax, eax
mov edx, dword [ebp - 8]
lea edi, [ebx + 0x40]
lea esi, [ebp - 0x44]
mov ecx, 0xe
mov dword [ebp - 0x10], edx
rep movsd dword es:[edi], dword [esi]
je 0x4471f1
mov dword [ebx + 0x44], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
inc ecx
cmp ecx, eax
mov dword [ebp - 4], ecx
jl 0x4470f0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4475a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [0x8c7228]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
call fcn.0041cc10
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push edx
lea eax, [ebp - 0x400]
push 0x3ff
push eax
call fcn.004543f1
lea ecx, [ebp - 0x400]
push ecx
mov byte [ebp - 1], 0
call fcn.00451c40
add esp, 0x14
cmp eax, 0x384
jae 0x447601
lea edx, [ebp - 0x400]
push str._n_nPress_Retry_to_cause_a_debug_breakpoint._n
push edx
call fcn.004523b0
add esp, 8
push 0x32
push str.Quake_II_Fatal_Error
lea eax, [ebp - 0x400]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
jne 0x44762c
call fcn.0042fa10
push 0xdead
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 5
jne 0x447621
mov ecx, dword [0x47b1f4]
mov eax, dword [ecx + 0x20]
test eax, eax
jne 0x447657
call fcn.00449a90
push 1
call fcn.00435370
push str.precache_n
call fcn.00417650
add esp, 8
call fcn.0042d9a0
mov esp, ebp
pop ebp
ret
Function at 0x447a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5010
call fcn.00452050
mov eax, dword [0x8c66e0]
test eax, eax
je 0x447bc4
mov eax, dword [0x47b1f4]
test eax, eax
je 0x447bc4
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x447bc4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov edi, 1
nop
mov ecx, dword [0x8c62cc]
lea eax, [ebp - 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
test eax, eax
jne 0x447a82
push str.Error_getting__of_console_events
call fcn.004475a0
add esp, 4
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x447b73
mov ecx, dword [0x8c62cc]
lea edx, [ebp - 0x10]
push edx
push edi
lea eax, [ebp - 0x5010]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
test eax, eax
jne 0x447ab7
push str.Error_reading_console_input
call fcn.004475a0
add esp, 4
cmp dword [ebp - 0x10], edi
je 0x447ac9
push str.Couldnt_read_console_input
call fcn.004475a0
add esp, 4
cmp word [ebp - 0x5010], di
jne 0x447a60
mov eax, dword [ebp - 0x500c]
test eax, eax
jne 0x447a60
movsx eax, byte [ebp - 0x5002]
cmp eax, 8
mov dword [ebp - 4], eax
je 0x447b7b
cmp eax, 0xd
je 0x447b3a
cmp eax, 0x20
jl 0x447a60
cmp dword [0x8c62c8], 0x3fe
jae 0x447a60
mov ecx, dword [0x8c62d0]
push 0
lea edx, [ebp - 8]
push edx
push edi
lea eax, [ebp - 4]
push eax
push ecx
call esi
mov eax, dword [0x8c62c8]
mov dl, byte [ebp - 4]
mov byte [eax + 0x8c62d8], dl
inc eax
mov dword [0x8c62c8], eax
jmp 0x447a60
mov ecx, dword [0x8c62d0]
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x472dc8
push ecx
call esi
mov eax, dword [0x8c62c8]
test eax, eax
je 0x447a60
cmp eax, 0x3ff
jb 0x447ba8
push 2
push str.Sys_ConsoleInput:_Line_too_long__discarded._n
call fcn.0041ac50
add esp, 8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x8c62c8]
test eax, eax
je 0x447a60
push 0
lea edx, [ebp - 8]
push edx
dec eax
push 3
mov dword [0x8c62c8], eax
mov eax, dword [0x8c62d0]
push 0x472d94
push eax
call esi
jmp 0x447a60
pop edi
mov byte [eax + 0x8c62d8], 0
mov dword [0x8c62c8], 0
mov eax, 0x8c62d8
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x447bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x8c62c8]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x447c30
push eax
lea eax, [ebp - 0x103]
push 0x20
push eax
mov byte [ebp - 0x104], 0xd
call fcn.00451960
mov eax, dword [0x8c62c8]
add esp, 0xc
push 0
mov byte [ebp + eax - 0x103], 0xd
mov byte [ebp + eax - 0x102], 0
lea ecx, [ebp - 4]
push ecx
add eax, 2
push eax
mov eax, dword [0x8c62d0]
lea edx, [ebp - 0x104]
push edx
push eax
call esi
push edi
mov edi, dword [ebp + 8]
push 0
lea ecx, [ebp - 4]
push ecx
push edi
call fcn.00451c40
mov edx, dword [0x8c62d0]
add esp, 4
push eax
push edi
push edx
call esi
mov eax, dword [0x8c62c8]
test eax, eax
pop edi
je 0x447c6d
mov edx, dword [0x8c62d0]
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push 0x8c62d8
push edx
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x447dd0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x447e24
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x447e1d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x447e1c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
inc eax
push eax
call fcn.00454563
mov ebx, eax
push edi
push ebx
call fcn.004523a0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x448220
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x448238
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp + 8]
test esi, esi
mov edi, dword [ebp + 0x10]
je 0x44825c
push 0xfff
push edi
push 0x8c72e0
call fcn.004525b0
add esp, 0xc
mov byte [0x8c82df], 0
push edi
mov dword [0x8cc560], esi
call fcn.00448110
add esp, 4
push 0x7f
lea eax, [ebp - 0x9c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x9c]
push 0x5c
push ecx
call fcn.00454720
add esp, 8
lea edx, [ebp - 0x9c]
push edx
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [0x8c72c0]
push 0x8cc360
push eax
call fcn.0041e010
push 0x30000
push 0x20000
call fcn.00454f98
add esp, 0x10
call fcn.00431020
mov ebx, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, eax
lea esp, [esp]
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
call ebx
test eax, eax
je 0x448330
mov eax, dword [0x8c72b8]
test eax, eax
mov edx, dword [ebp - 0xc]
mov dword [0x8c72b4], edx
je 0x448303
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x448317
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
call ebx
test eax, eax
jne 0x4482e2
lea esp, [esp]
call fcn.00431020
mov esi, eax
sub eax, edi
cmp eax, 1
jl 0x448330
push eax
call fcn.0041c770
add esp, 4
mov edi, esi
jmp 0x4482d0