joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b730
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d652b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x663f78
call fcn.0043ead0
test eax, eax
jne 0x41b7f3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x48
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x41b7a0
mov ecx, dword [ebp - 0x1c]
call fcn.0042bdf0
mov dword [ebp - 0x20], eax
jmp 0x41b7a7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x41b7cd
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x41b7e5
push 0x629534
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x663f78
call fcn.0041bd20
mov ecx, 0x663f78
call fcn.0043ead0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41b810
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d715b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x663f74
call fcn.0043ead0
test eax, eax
jne 0x41b8d3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x78
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x41b880
mov ecx, dword [ebp - 0x1c]
call fcn.0042cee0
mov dword [ebp - 0x20], eax
jmp 0x41b887
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x41b8ad
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x41b8c5
push 0x62954c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x663f74
call fcn.0041bd20
mov ecx, 0x663f74
call fcn.0043ead0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b8f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e8e1b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x663f70
call fcn.0043ead0
test eax, eax
jne 0x41b9b6
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xb0
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x41b963
mov ecx, dword [ebp - 0x1c]
call fcn.004bdc10
mov dword [ebp - 0x20], eax
jmp 0x41b96a
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x41b990
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x41b9a8
push 0x62957c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x663f70
call fcn.0041bd20
mov ecx, 0x663f70
call fcn.0043ead0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41b9e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e8deb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x663f6c
call fcn.0043ead0
test eax, eax
jne 0x41baa3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x70
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x41ba50
mov ecx, dword [ebp - 0x1c]
call fcn.004c1080
mov dword [ebp - 0x20], eax
jmp 0x41ba57
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x41ba7d
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x41ba95
push 0x629594
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x663f6c
call fcn.0041bd20
mov ecx, 0x663f6c
call fcn.0043ead0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bac0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d712b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x663f68
call fcn.0043ead0
test eax, eax
jne 0x41bb83
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x40
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x41bb30
mov ecx, dword [ebp - 0x1c]
call fcn.004ead70
mov dword [ebp - 0x20], eax
jmp 0x41bb37
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x41bb5d
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x41bb75
push 0x6295ac
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x663f68
call fcn.0041bd20
mov ecx, 0x663f68
call fcn.0043ead0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4260e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc93b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e20], 0
jne 0x4261ba
mov ecx, 0x66409c
call fcn.004087a0
cmp dword [0x663e20], 0
jne 0x4261b0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x24
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x426162
mov ecx, dword [ebp - 0x1c]
call fcn.0042f520
mov dword [ebp - 0x20], eax
jmp 0x426169
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x42618f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x4261a7
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e20], edx
mov ecx, 0x66409c
call fcn.00408760
mov eax, dword [0x663e20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434110
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d80eb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e28], 0
jne 0x4341ea
mov ecx, 0x6640b8
call fcn.004087a0
cmp dword [0x663e28], 0
jne 0x4341e0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x18
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x434192
mov ecx, dword [ebp - 0x1c]
call fcn.00432a30
mov dword [ebp - 0x20], eax
jmp 0x434199
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x4341bf
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x4341d7
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e28], edx
mov ecx, 0x6640b8
call fcn.00408760
mov eax, dword [0x663e28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x436780
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d80bb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e2c], 0
jne 0x43685a
mov ecx, 0x66410c
call fcn.004087a0
cmp dword [0x663e2c], 0
jne 0x436850
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x18
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x436802
mov ecx, dword [ebp - 0x1c]
call fcn.004361c0
mov dword [ebp - 0x20], eax
jmp 0x436809
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43682f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x436847
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e2c], edx
mov ecx, 0x66410c
call fcn.00408760
mov eax, dword [0x663e2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436880
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d808b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e30], 0
jne 0x43695a
mov ecx, 0x6640f0
call fcn.004087a0
cmp dword [0x663e30], 0
jne 0x436950
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x18
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x436902
mov ecx, dword [ebp - 0x1c]
call fcn.004362f0
mov dword [ebp - 0x20], eax
jmp 0x436909
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43692f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x436947
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e30], edx
mov ecx, 0x6640f0
call fcn.00408760
mov eax, dword [0x663e30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x436980
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db4bb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e34], 0
jne 0x436a5a
mov ecx, 0x6640d4
call fcn.004087a0
cmp dword [0x663e34], 0
jne 0x436a50
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x58
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x436a02
mov ecx, dword [ebp - 0x1c]
call fcn.004d5840
mov dword [ebp - 0x20], eax
jmp 0x436a09
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x436a2f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x436a47
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e34], edx
mov ecx, 0x6640d4
call fcn.00408760
mov eax, dword [0x663e34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43aa00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db48b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e38], 0
jne 0x43aadd
mov ecx, 0x664144
call fcn.004087a0
cmp dword [0x663e38], 0
jne 0x43aad3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x98
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x43aa85
mov ecx, dword [ebp - 0x1c]
call fcn.004010e0
mov dword [ebp - 0x20], eax
jmp 0x43aa8c
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43aab2
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x43aaca
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e38], edx
mov ecx, 0x664144
call fcn.00408760
mov eax, dword [0x663e38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43ab80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e3f1b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e3c], 0
jne 0x43ac5d
mov ecx, 0x664128
call fcn.004087a0
cmp dword [0x663e3c], 0
jne 0x43ac53
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x90
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x43ac05
mov ecx, dword [ebp - 0x1c]
call fcn.00438fc0
mov dword [ebp - 0x20], eax
jmp 0x43ac0c
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43ac32
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x43ac4a
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e3c], edx
mov ecx, 0x664128
call fcn.00408760
mov eax, dword [0x663e3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b0f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da4ab
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e40], 0
jne 0x43b1ca
mov ecx, 0x664160
call fcn.004087a0
cmp dword [0x663e40], 0
jne 0x43b1c0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x50
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x43b172
mov ecx, dword [ebp - 0x1c]
call fcn.004d83c0
mov dword [ebp - 0x20], eax
jmp 0x43b179
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43b19f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x43b1b7
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e40], edx
mov ecx, 0x664160
call fcn.00408760
mov eax, dword [0x663e40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43f0c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d999b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e44], 0
jne 0x43f19a
mov ecx, 0x66417c
call fcn.004087a0
cmp dword [0x663e44], 0
jne 0x43f190
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x68
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x43f142
mov ecx, dword [ebp - 0x1c]
call fcn.0043ebf0
mov dword [ebp - 0x20], eax
jmp 0x43f149
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43f16f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x43f187
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e44], edx
mov ecx, 0x66417c
call fcn.00408760
mov eax, dword [0x663e44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443f10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db42b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e48], 0
jne 0x443fed
mov ecx, 0x664198
call fcn.004087a0
cmp dword [0x663e48], 0
jne 0x443fe3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xa0
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x443f95
mov ecx, dword [ebp - 0x1c]
call fcn.004d8990
mov dword [ebp - 0x20], eax
jmp 0x443f9c
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x443fc2
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x443fda
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e48], edx
mov ecx, 0x664198
call fcn.00408760
mov eax, dword [0x663e48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x449e00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6d4b
mov eax, dword fs:[0]
push eax
mov eax, 0x1020
call fcn.005b6f10
mov eax, dword [0x65d4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x102c], ecx
push str._YWSMP_
push str.__xml_stylesheet_type_text_xsl__href_..XSLUserLog.xsl___
push str.__xml_version_1.0__encoding_gb2312____
push str._s_r_n_s_r_n_s_r_n
lea eax, [ebp - 0x1014]
push eax
call fcn.005b1b4c
add esp, 0x14
lea ecx, [ebp - 0x1014]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0051af30
add esp, 8
mov dword [ebp - 0x1018], 0
push 0x6228d8
mov eax, dword [ebp + 0xc]
push eax
call fcn.005b1ae9
add esp, 8
push eax
lea ecx, [ebp - 0x101c]
call fcn.0041bd90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x101c]
call fcn.0043ead0
test eax, eax
je 0x449f38
lea ecx, [ebp - 0x101c]
call fcn.0043ead0
push eax
call fcn.005b35b0
add esp, 4
test eax, eax
jne 0x449f38
lea ecx, [ebp - 0x101c]
call fcn.0043ead0
push eax
push 0x1000
push 1
lea ecx, [ebp - 0x1014]
push ecx
call fcn.005b2836
add esp, 0x10
mov dword [ebp - 0x1020], eax
cmp dword [ebp - 0x1020], 0
jne 0x449f19
mov dword [ebp - 0x1024], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x101c]
call fcn.004133b0
mov eax, dword [ebp - 0x1024]
jmp 0x449f86
mov edx, dword [ebp - 0x1020]
push edx
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0051ae90
add esp, 0xc
jmp 0x449eac
push str.__YWSMP_
push str._s_r_n
lea edx, [ebp - 0x1014]
push edx
call fcn.005b1b4c
add esp, 0xc
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0051af30
add esp, 8
mov dword [ebp - 0x1028], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x101c]
call fcn.004133b0
mov eax, dword [ebp - 0x1028]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b1988
mov esp, ebp
pop ebp
ret 8
Function at 0x453a00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e214b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x663e4c], 0
jne 0x453ada
mov ecx, 0x6641b4
call fcn.004087a0
cmp dword [0x663e4c], 0
jne 0x453ad0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x70
call fcn.00595e8d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x453a82
mov ecx, dword [ebp - 0x1c]
call fcn.004538b0
mov dword [ebp - 0x20], eax
jmp 0x453a89
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x453aaf
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x453ac7
push 0x62aadc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x663e4c], edx
mov ecx, 0x6641b4
call fcn.00408760
mov eax, dword [0x663e4c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d8a53
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x65d4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0xb4]
push eax
call fcn.00500fe0
add esp, 4
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0xc0], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xc0]
call fcn.0040be10
push eax
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
push 0x6200fc
push 0x80
lea edx, [ebp - 0x94]
push edx
call fcn.005b1bc7
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb4]
call fcn.0040bf30
push 0x620114
mov ecx, dword [ebp - 0xb8]
add ecx, 0x94
call fcn.0040be10
push eax
call fcn.005b1ae9
add esp, 8
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x457730
lea eax, [ebp - 0x94]
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp - 0xc4]
add ecx, 1
mov dword [ebp - 0xc8], ecx
mov edx, dword [ebp - 0xc4]
mov al, byte [edx]
mov byte [ebp - 0xc9], al
add dword [ebp - 0xc4], 1
cmp byte [ebp - 0xc9], 0
jne 0x457674
mov ecx, dword [ebp - 0xc4]
sub ecx, dword [ebp - 0xc8]
mov dword [ebp - 0xd0], ecx
mov edx, dword [ebp - 0x98]
push edx
push 1
mov eax, dword [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.005b1d61
add esp, 0x10
mov edx, dword [ebp - 0x98]
push edx
push 1
mov ecx, dword [ebp + 8]
call fcn.0041ec70
push eax
mov ecx, dword [ebp + 8]
call fcn.0040be10
push eax
call fcn.005b1d61
add esp, 0x10
mov eax, dword [ebp - 0x98]
push eax
push 1
lea ecx, [ebp + 0xc]
call fcn.0041ec70
push eax
lea ecx, [ebp + 0xc]
call fcn.0040be10
push eax
call fcn.005b1d61
add esp, 0x10
mov ecx, dword [ebp - 0x98]
push ecx
push 1
push 2
push 0x620118
call fcn.005b1d61
add esp, 0x10
mov edx, dword [ebp - 0x98]
push edx
call fcn.005b1fa4
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040bf30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b1988
mov esp, ebp
pop ebp
ret 0x20