joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ae60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e7e0b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x661f70
call fcn.0041b290
test eax, eax
jne 0x41af26
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xb0
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x41aed3
mov ecx, dword [ebp - 0x1c]
call fcn.004bdd90
mov dword [ebp - 0x20], eax
jmp 0x41aeda
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x41af00
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x41af18
push 0x62841c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x661f70
call fcn.0041b2e0
mov ecx, 0x661f70
call fcn.0041b290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41af50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e7ddb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x661f6c
call fcn.0041b290
test eax, eax
jne 0x41b013
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x70
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x41afc0
mov ecx, dword [ebp - 0x1c]
call fcn.004c1260
mov dword [ebp - 0x20], eax
jmp 0x41afc7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x41afed
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x41b005
push 0x628434
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x661f6c
call fcn.0041b2e0
mov ecx, 0x661f6c
call fcn.0041b290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b030
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d61db
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x661f68
call fcn.0041b290
test eax, eax
jne 0x41b0f3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x40
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x41b0a0
mov ecx, dword [ebp - 0x1c]
call fcn.004e9c70
mov dword [ebp - 0x20], eax
jmp 0x41b0a7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x41b0cd
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x41b0e5
push 0x62844c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x661f68
call fcn.0041b2e0
mov ecx, 0x661f68
call fcn.0041b290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4255d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db90b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e20], 0
jne 0x4256aa
mov ecx, 0x66209c
call fcn.00408890
cmp dword [0x661e20], 0
jne 0x4256a0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x24
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x425652
mov ecx, dword [ebp - 0x1c]
call fcn.0042e350
mov dword [ebp - 0x20], eax
jmp 0x425659
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x42567f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x425697
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e20], edx
mov ecx, 0x66209c
call fcn.00408850
mov eax, dword [0x661e20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432f80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d715b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e28], 0
jne 0x43305a
mov ecx, 0x6620b8
call fcn.00408890
cmp dword [0x661e28], 0
jne 0x433050
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x18
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x433002
mov ecx, dword [ebp - 0x1c]
call fcn.004318a0
mov dword [ebp - 0x20], eax
jmp 0x433009
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43302f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x433047
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e28], edx
mov ecx, 0x6620b8
call fcn.00408850
mov eax, dword [0x661e28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x435680
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d712b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e2c], 0
jne 0x43575a
mov ecx, 0x66210c
call fcn.00408890
cmp dword [0x661e2c], 0
jne 0x435750
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x18
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x435702
mov ecx, dword [ebp - 0x1c]
call fcn.004350c0
mov dword [ebp - 0x20], eax
jmp 0x435709
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43572f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x435747
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e2c], edx
mov ecx, 0x66210c
call fcn.00408850
mov eax, dword [0x661e2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435780
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d70fb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e30], 0
jne 0x43585a
mov ecx, 0x6620f0
call fcn.00408890
cmp dword [0x661e30], 0
jne 0x435850
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x18
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x435802
mov ecx, dword [ebp - 0x1c]
call fcn.00435140
mov dword [ebp - 0x20], eax
jmp 0x435809
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43582f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x435847
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e30], edx
mov ecx, 0x6620f0
call fcn.00408850
mov eax, dword [0x661e30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x435880
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da46b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e34], 0
jne 0x43595a
mov ecx, 0x6620d4
call fcn.00408890
cmp dword [0x661e34], 0
jne 0x435950
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x58
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x435902
mov ecx, dword [ebp - 0x1c]
call fcn.004d46e0
mov dword [ebp - 0x20], eax
jmp 0x435909
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43592f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x435947
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e34], edx
mov ecx, 0x6620d4
call fcn.00408850
mov eax, dword [0x661e34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439930
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da43b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e38], 0
jne 0x439a0d
mov ecx, 0x662144
call fcn.00408890
cmp dword [0x661e38], 0
jne 0x439a03
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x98
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4399b5
mov ecx, dword [ebp - 0x1c]
call fcn.004010e0
mov dword [ebp - 0x20], eax
jmp 0x4399bc
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x4399e2
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x4399fa
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e38], edx
mov ecx, 0x662144
call fcn.00408850
mov eax, dword [0x661e38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x439ab0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2f5b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e3c], 0
jne 0x439b8d
mov ecx, 0x662128
call fcn.00408890
cmp dword [0x661e3c], 0
jne 0x439b83
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x90
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x439b35
mov ecx, dword [ebp - 0x1c]
call fcn.00437ef0
mov dword [ebp - 0x20], eax
jmp 0x439b3c
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x439b62
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x439b7a
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e3c], edx
mov ecx, 0x662128
call fcn.00408850
mov eax, dword [0x661e3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a040
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d94bb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e40], 0
jne 0x43a11a
mov ecx, 0x662160
call fcn.00408890
cmp dword [0x661e40], 0
jne 0x43a110
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x50
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x43a0c2
mov ecx, dword [ebp - 0x1c]
call fcn.004d72a0
mov dword [ebp - 0x20], eax
jmp 0x43a0c9
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43a0ef
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x43a107
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e40], edx
mov ecx, 0x662160
call fcn.00408850
mov eax, dword [0x661e40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43e050
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d8acb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e44], 0
jne 0x43e12a
mov ecx, 0x66217c
call fcn.00408890
cmp dword [0x661e44], 0
jne 0x43e120
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x68
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x43e0d2
mov ecx, dword [ebp - 0x1c]
call fcn.0043db80
mov dword [ebp - 0x20], eax
jmp 0x43e0d9
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43e0ff
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x43e117
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e44], edx
mov ecx, 0x66217c
call fcn.00408850
mov eax, dword [0x661e44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442fd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da40b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e48], 0
jne 0x4430ad
mov ecx, 0x662198
call fcn.00408890
cmp dword [0x661e48], 0
jne 0x4430a3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xa0
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x443055
mov ecx, dword [ebp - 0x1c]
call fcn.004d7870
mov dword [ebp - 0x20], eax
jmp 0x44305c
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x443082
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x44309a
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e48], edx
mov ecx, 0x662198
call fcn.00408850
mov eax, dword [0x661e48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5dab
mov eax, dword fs:[0]
push eax
mov eax, 0x1020
call fcn.005b5ef0
mov eax, dword [0x65b4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x102c], ecx
push str._YWSMP_
push str.__xml_stylesheet_type_text_xsl__href_..XSLUserLog.xsl___
push str.__xml_version_1.0__encoding_gb2312____
push str._s_r_n_s_r_n_s_r_n
lea eax, [ebp - 0x1014]
push eax
call fcn.005b0b2c
add esp, 0x14
lea ecx, [ebp - 0x1014]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00519fa0
add esp, 8
mov dword [ebp - 0x1018], 0
push 0x621778
mov eax, dword [ebp + 0xc]
push eax
call fcn.005b0ac9
add esp, 8
push eax
lea ecx, [ebp - 0x101c]
call fcn.00487ae0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x101c]
call fcn.0041b290
test eax, eax
je 0x448ff8
lea ecx, [ebp - 0x101c]
call fcn.0041b290
push eax
call fcn.005b2590
add esp, 4
test eax, eax
jne 0x448ff8
lea ecx, [ebp - 0x101c]
call fcn.0041b290
push eax
push 0x1000
push 1
lea ecx, [ebp - 0x1014]
push ecx
call fcn.005b1816
add esp, 0x10
mov dword [ebp - 0x1020], eax
cmp dword [ebp - 0x1020], 0
jne 0x448fd9
mov dword [ebp - 0x1024], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x101c]
call fcn.00413420
mov eax, dword [ebp - 0x1024]
jmp 0x449046
mov edx, dword [ebp - 0x1020]
push edx
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00519f00
add esp, 0xc
jmp 0x448f6c
push str.__YWSMP_
push str._s_r_n
lea edx, [ebp - 0x1014]
push edx
call fcn.005b0b2c
add esp, 0xc
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00519fa0
add esp, 8
mov dword [ebp - 0x1028], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x101c]
call fcn.00413420
mov eax, dword [ebp - 0x1028]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b0968
mov esp, ebp
pop ebp
ret 8
Function at 0x452ac0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e10eb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e4c], 0
jne 0x452b9a
mov ecx, 0x6621b4
call fcn.00408890
cmp dword [0x661e4c], 0
jne 0x452b90
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x70
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x452b42
mov ecx, dword [ebp - 0x1c]
call fcn.00452970
mov dword [ebp - 0x20], eax
jmp 0x452b49
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x452b6f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x452b87
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e4c], edx
mov ecx, 0x6621b4
call fcn.00408850
mov eax, dword [0x661e4c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7a83
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x65b4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0xb4]
push eax
call fcn.004fffc0
add esp, 4
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0xc0], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xc0]
call fcn.0040bf30
push eax
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
push 0x61ef9c
push 0x80
lea edx, [ebp - 0x94]
push edx
call fcn.005b0ba7
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb4]
call fcn.0040c050
push 0x61efb4
mov ecx, dword [ebp - 0xb8]
add ecx, 0x94
call fcn.0040bf30
push eax
call fcn.005b0ac9
add esp, 8
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x456a10
lea eax, [ebp - 0x94]
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp - 0xc4]
add ecx, 1
mov dword [ebp - 0xc8], ecx
mov edx, dword [ebp - 0xc4]
mov al, byte [edx]
mov byte [ebp - 0xc9], al
add dword [ebp - 0xc4], 1
cmp byte [ebp - 0xc9], 0
jne 0x456954
mov ecx, dword [ebp - 0xc4]
sub ecx, dword [ebp - 0xc8]
mov dword [ebp - 0xd0], ecx
mov edx, dword [ebp - 0x98]
push edx
push 1
mov eax, dword [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.005b0d41
add esp, 0x10
mov edx, dword [ebp - 0x98]
push edx
push 1
mov ecx, dword [ebp + 8]
call fcn.004068e0
push eax
mov ecx, dword [ebp + 8]
call fcn.0040bf30
push eax
call fcn.005b0d41
add esp, 0x10
mov eax, dword [ebp - 0x98]
push eax
push 1
lea ecx, [ebp + 0xc]
call fcn.004068e0
push eax
lea ecx, [ebp + 0xc]
call fcn.0040bf30
push eax
call fcn.005b0d41
add esp, 0x10
mov ecx, dword [ebp - 0x98]
push ecx
push 1
push 2
push 0x61efb8
call fcn.005b0d41
add esp, 0x10
mov edx, dword [ebp - 0x98]
push edx
call fcn.005b0f84
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040c050
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b0968
mov esp, ebp
pop ebp
ret 0x20
Function at 0x459590
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc91b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e54], 0
jne 0x45966a
mov ecx, 0x6621ec
call fcn.00408890
cmp dword [0x661e54], 0
jne 0x459660
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x64
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x459612
mov ecx, dword [ebp - 0x1c]
call fcn.004555e0
mov dword [ebp - 0x20], eax
jmp 0x459619
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x45963f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x459657
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e54], edx
mov ecx, 0x6621ec
call fcn.00408850
mov eax, dword [0x661e54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45a150
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e751b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x661e58], 0
jne 0x45a22d
mov ecx, 0x6621d0
call fcn.00408890
cmp dword [0x661e58], 0
jne 0x45a223
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xe0
call fcn.00594e6d
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x45a1d5
mov ecx, dword [ebp - 0x1c]
call fcn.004b1140
mov dword [ebp - 0x20], eax
jmp 0x45a1dc
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x45a202
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x45a21a
push 0x62997c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x661e58], edx
mov ecx, 0x6621d0
call fcn.00408850
mov eax, dword [0x661e58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret