joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415f60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [0x5eae84]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push esi
push edi
sub esp, 0x10
mov eax, esp
mov dword [esp + 0x20], 0x4163c0
mov dword [esp + 0x24], 0x416550
movq xmm0, qword [esp + 0x20]
movq qword [eax], xmm0
lea esi, [ecx + 0x20]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x4165a0
movq xmm0, qword [esp + 0x28]
push 0
push 0
mov edx, esi
mov dword [esp + 0x38], ecx
movq qword [eax + 8], xmm0
call fcn.004035a0
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x416013
cmp dword [esi + 0x58], 1
je 0x415fdf
mov edi, 0xffffff7d
jmp 0x416011
cmp dword [esi + 4], 0
mov dword [esi + 0x58], 2
je 0x416008
mov ecx, esi
call fcn.00403030
mov edi, eax
test edi, edi
je 0x416013
mov ecx, esi
mov dword [esi], 0
call fcn.00403780
jmp 0x416011
mov dword [esi + 0x58], 3
xor edi, edi
test edi, edi
jns 0x416070
push str._warn_
lea eax, [esp + 0x2c]
push 0x80
push eax
call dword [sym.imp.MSVCR110.dll_strcpy_s]
add esp, 0xc
lea eax, [esp + 0x2e]
push str.ov_open_callbacks_failed__
push 0x7a
push eax
call dword [sym.imp.MSVCR110.dll_sprintf_s]
add esp, 0xc
mov word [esp + eax + 0x2e], 0xa
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.0057d22e
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp + 8]
xor eax, eax
test ebx, ebx
je 0x416136
mov edi, dword [esp + 0x20]
mov dword [esp + 0x20], 0x2c0020
mov edi, dword [edi + 8]
mov dword [esp + 0x24], 0x440044
cmp dword [edi], 0x20424b41
jne 0x4160b8
movzx eax, word [edi + 4]
cmp eax, 4
jae 0x4160b8
mov ecx, eax
mov ax, word [edi + 6]
cmp ax, word [esp + ecx*2 + 0x20]
jne 0x4160b8
movzx eax, word [edi + 0xe]
jmp 0x4160bc
movzx eax, word [edi + 6]
movzx eax, ax
push 0
cdq
push ebx
push edx
push eax
call fcn.0057d2a0
push 0
push 0x3e8
push edx
push eax
call fcn.0057d640
mov ecx, edi
mov ebx, eax
mov dword [esp + 0x20], edx
call fcn.004057a0
mov ecx, edi
test al, al
je 0x41614d
call fcn.004058d0
mov ecx, dword [esp + 0x20]
test ecx, ecx
jl 0x416128
jg 0x4160fe
cmp ebx, eax
jb 0x416128
mov ecx, edi
call fcn.004058d0
push 0
push eax
push dword [esp + 0x28]
push ebx
call fcn.0057e3e0
mov ecx, edi
mov ebx, eax
mov dword [esp + 0x20], edx
call fcn.00405870
mov ecx, dword [esp + 0x20]
add ebx, eax
adc ecx, 0
push ecx
push ebx
mov ecx, esi
call fcn.00404810
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.0057d22e
mov esp, ebp
pop ebp
ret 4
call fcn.00405810
mov ecx, dword [esp + 0x20]
test ecx, ecx
jl 0x416128
jg 0x416160
cmp ebx, eax
jb 0x416128
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 3
call fcn.0057d22e
mov esp, ebp
pop ebp
ret 4
Function at 0x4165c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586fbb
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x5eae84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x9c], edi
mov byte [edi + 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push 0x298
mov dword [edi + 0x18], eax
lea eax, [edi + 0x20]
push 0
push eax
mov dword [edi], vtable.SQEX::TransferVorbisStreaming.0
mov byte [edi + 0x10], 0
mov dword [edi + 0x14], 0
call sub.MSVCR110.dll_memset
mov eax, dword [edi + 0x18]
mov dword [edi + 0x2b8], 0
mov edx, dword [eax + 8]
add esp, 0xc
cmp dword [edx], 0x20424b41
mov dword [ebp - 0x18], 0x2c0020
mov eax, 0x44
mov dword [ebp - 0x14], 0x440044
jne 0x416671
movzx eax, word [edx + 4]
cmp eax, 4
jae 0x416671
mov ecx, eax
mov ax, word [edx + 6]
cmp ax, word [ebp + ecx*2 - 0x18]
jne 0x416671
mov al, byte [edx + 0xd]
jmp 0x416674
mov al, byte [edx + 2]
movzx eax, al
shl eax, 0xc
mov dword [edi + 0x14], eax
lea esi, [edi + 8]
mov ebx, 2
push dword [edi + 0x14]
call dword [sym.imp.MSVCR110.dll_malloc]
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x4166dc
push str._warn_
lea eax, [ebp - 0x98]
push 0x80
push eax
call dword [sym.imp.MSVCR110.dll_strcpy_s]
push str.create_vorbis_stream_transfer_buffer_failed__heap_memory_insufficient
lea eax, [ebp - 0x92]
push 0x7a
push eax
call dword [sym.imp.MSVCR110.dll_sprintf_s]
add esp, 0x18
mov word [ebp + eax - 0x92], 0xa
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esi, 4
dec ebx
jne 0x416685
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057d22e
mov esp, ebp
pop ebp
ret 4
Function at 0x4167a0
Capabilities:
Encode data using xor
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x5eae84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x90], edi
mov eax, dword [edi + 0x18]
mov dword [ebp - 0xa0], 0x416c00
mov esi, dword [eax + 8]
mov eax, dword [eax + 4]
mov ecx, eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
call fcn.0040f200
mov ecx, dword [ebp - 0x88]
push 0
mov ebx, eax
call fcn.0040f080
mov ecx, esi
mov dword [ebp - 0x8c], eax
call fcn.00406030
cmp al, 1
jne 0x41686b
cmp dword [edi + 0x14], ebx
mov ecx, dword [ebp - 0x88]
cmovl ebx, dword [edi + 0x14]
push 0
call fcn.0040f080
mov ecx, dword [ebp - 0x90]
xor dl, dl
mov ecx, dword [ecx + 8]
mov edi, eax
test ebx, ebx
je 0x41685c
sub edi, ecx
mov esi, ebx
movzx eax, dl
inc dl
mov al, byte [eax + str.:222]
xor al, byte [edi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
dec esi
jne 0x416845
mov edi, dword [ebp - 0x90]
mov eax, dword [edi + 8]
mov dword [ebp - 0x8c], eax
movq xmm0, qword [ebp - 0xa0]
sub esp, 0x10
mov eax, esp
push ebx
push dword [ebp - 0x8c]
movq qword [eax], xmm0
movq xmm0, qword [ebp - 0x98]
lea esi, [edi + 0x20]
mov edx, esi
mov ecx, edi
movq qword [eax + 8], xmm0
call fcn.004035a0
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x4168e6
cmp dword [esi + 0x58], 1
je 0x4168b2
mov edi, 0xffffff7d
jmp 0x4168e4
cmp dword [esi + 4], 0
mov dword [esi + 0x58], 2
je 0x4168db
mov ecx, esi
call fcn.00403030
mov edi, eax
test edi, edi
je 0x4168e6
mov ecx, esi
mov dword [esi], 0
call fcn.00403780
jmp 0x4168e4
mov dword [esi + 0x58], 3
xor edi, edi
test edi, edi
jns 0x41693f
push str._warn_
lea eax, [ebp - 0x84]
push 0x80
push eax
call dword [sym.imp.MSVCR110.dll_strcpy_s]
push str.ov_open_callbacks_failed__
lea eax, [ebp - 0x7e]
push 0x7a
push eax
call dword [sym.imp.MSVCR110.dll_sprintf_s]
add esp, 0x18
mov word [ebp + eax - 0x7e], 0xa
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057d22e
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x88]
push ebx
call fcn.0040f3c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0057d22e
mov esp, ebp
pop ebp
ret 4
Function at 0x4244b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e978
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5eae84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x30], edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push str.._EXTRACTED_DATA_
push eax
mov dword [ebp - 4], 0
call fcn.004235b0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0x5bb068
push eax
call dword [sym.imp.MSVCR110.dll_fopen]
mov ebx, eax
add esp, 0x14
mov dword [ebp - 0x2c], ebx
test ebx, ebx
je 0x424577
mov esi, dword [sym.imp.MSVCR110.dll_fseek]
push 2
push 0
push ebx
call esi
push ebx
call dword [sym.imp.MSVCR110.dll_ftell]
push 0
push 0
push ebx
mov dword [edi], eax
call esi
mov esi, dword [edi]
push esi
call dword [sym.imp.MSVCR110.dll_malloc]
add esp, 0x20
xor edi, edi
mov ebx, eax
test esi, esi
jle 0x42456b
mov esi, dword [ebp - 0x30]
push dword [ebp - 0x2c]
mov eax, dword [esi]
sub eax, edi
push eax
push 1
push ebx
call dword [sym.imp.MSVCR110.dll_fread]
add edi, eax
add esp, 0x10
cmp edi, dword [esi]
jl 0x424551
push dword [ebp - 0x2c]
call dword [sym.imp.MSVCR110.dll_fclose]
add esp, 4
cmp dword [ebp - 0x14], 0x10
jb 0x424588
push dword [ebp - 0x28]
call fcn.004257e0
add esp, 4
cmp dword [ebp + 0x1c], 0x10
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
jb 0x4245b2
push dword [ebp + 8]
call fcn.004257e0
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057d22e
mov esp, ebp
pop ebp
ret
Function at 0x425cb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004278d0

Function at 0x426f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push dword [ebp + 0x10]
lea eax, [eax + 0x5eb900]
push dword [ebp + 8]
push eax
call sub.MSVCR110.dll_memcpy
cmp dword [0x5e1a24], 0x10
mov eax, 0x5e1a10
cmovae eax, dword [0x5e1a10]
push 0x58c83c
push eax
call dword [sym.imp.MSVCR110.dll_fopen]
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x426f66
xor al, al
pop esi
pop ebp
ret
push esi
push 0x10000
push 1
push 0x5eb900
call dword [sym.imp.MSVCR110.dll_fwrite]
push esi
call dword [sym.imp.MSVCR110.dll_fclose]
add esp, 0x14
mov al, 1
pop esi
pop ebp
ret
Function at 0x427cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57eb18
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5eae84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x427e24
cmp byte [edi + 0x45], 0
je 0x427e24
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x427d44
xor al, al
jmp 0x427e26
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
cmp ecx, 0x10
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 8
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x48]
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
cmp ebx, 0x10
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
push esi
call dword [sym.imp.MSVCP110.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x427db1
dec eax
je 0x427db5
sub eax, 2
je 0x427e06
xor bl, bl
jmp 0x427e08
mov byte [edi + 0x45], 0
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
cmp ebx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, ecx
sub esi, eax
je 0x427de8
push dword [edi + 0x50]
lea eax, [ebp - 0x28]
push esi
cmp ebx, 0x10
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR110.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x427dad
cmp byte [edi + 0x45], 0
je 0x427e06
test esi, esi
lea esi, [edi + 0x48]
jne 0x427d77
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00427f40
jmp 0x427d74
mov bl, 1
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 4], 0xffffffff
jb 0x427e20
push dword [ebp - 0x28]
call fcn.004257e0
add esp, 4
mov al, bl
jmp 0x427e26
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057d22e
mov esp, ebp
pop ebp
ret
Function at 0x42a9c0
Capabilities:
Terminate process

Disassembly:
cmp byte [0x5eb898], 0
jne 0x42a9eb
call fcn.0043d730
test al, al
jne 0x42a9eb
push dword [0x5fb92c]
push dword [0x5eb89c]
call sub.SDL2.dll_SDL_GL_MakeCurrent
add esp, 8
call fcn.00425cf0
cmp byte [0x5e1869], 0
sete byte [0x5e1869]
cmp byte [0x5eb898], 0
je 0x42aa3a
mov eax, dword [0x5fb948]
test eax, eax
je 0x42aa1e
push eax
call sub.SDL2.dll_SDL_DestroyTexture
add esp, 4
mov dword [0x5fb948], 0
mov eax, dword [0x5fb94c]
test eax, eax
je 0x42aa3a
push eax
call sub.SDL2.dll_SDL_DestroyTexture
add esp, 4
mov dword [0x5fb94c], 0
cmp byte [0x5e1869], 0
push esi
push edi
mov eax, 0x1203
push 0x5fb930
mov esi, 0x202
push 0
cmove esi, eax
call sub.SDL2.dll_SDL_GetCurrentDisplayMode
mov cl, byte [0x5e1869]
mov eax, dword [0x5fb938]
mov edx, dword [0x5fb934]
test cl, cl
cmovne eax, dword [0x5e1884]
cmovne edx, dword [0x5e1880]
push eax
push edx
push str.Resolution_is_now__ix_i_n
mov dword [0x5e1878], edx
mov dword [0x5e187c], eax
call dword [sym.imp.MSVCR110.dll_printf]
push dword [0x5e187c]
push dword [0x5e1878]
call fcn.0043df00
push esi
push dword [0x5eb89c]
call sub.SDL2.dll_SDL_SetWindowFullscreen
push dword [0x5e187c]
push dword [0x5e1878]
push dword [0x5eb89c]
call sub.SDL2.dll_SDL_SetWindowSize
push 0x2fff0000
push 0x2fff0000
push dword [0x5eb89c]
call sub.SDL2.dll_SDL_SetWindowPosition
movss xmm2, dword [0x5eb8b8]
mov edx, dword [0x5e1878]
mov edi, dword [0x5e187c]
add esp, 0x3c
ucomiss xmm2, dword [0x58bc68]
mov ecx, edx
lahf
mov esi, edi
mov dword [0x5e1888], ecx
mov dword [0x5e188c], esi
test ah, 0x44
jp 0x42ab22
movss xmm2, dword [0x58cec8]
movss dword [0x5eb8b8], xmm2
movd xmm0, edx
cvtdq2ps xmm0, xmm0
movd xmm1, edi
cvtdq2ps xmm1, xmm1
movaps xmm3, xmm0
divss xmm3, xmm1
comiss xmm3, xmm2
jbe 0x42ab50
mulss xmm0, xmm2
divss xmm0, xmm3
cvttss2si ecx, xmm0
mov dword [0x5e1888], ecx
jmp 0x42ab67
comiss xmm2, xmm3
jbe 0x42ab67
mulss xmm1, xmm3
divss xmm1, xmm2
cvttss2si esi, xmm1
mov dword [0x5e188c], esi
push dword [0x5fb92c]
sub edx, ecx
push dword [0x5eb89c]
mov eax, edx
cdq
sub eax, edx
sar eax, 1
mov dword [0x5eb8b0], eax
sub edi, esi
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [0x5eb8b4], eax
call sub.SDL2.dll_SDL_GL_MakeCurrent
add esp, 8
push dword [0x5e188c]
push dword [0x5e1888]
push dword [0x5eb8b4]
push dword [0x5eb8b0]
call dword [sym.imp.OPENGL32.dll_glViewport]
cmp byte [0x5eb898], 0
pop edi
pop esi
jne 0x42abcd
call fcn.0043d730
test al, al
je fcn.00425f90
push dword [0x5fb928]
push dword [0x5eb89c]
call sub.SDL2.dll_SDL_GL_MakeCurrent
add esp, 8
cmp byte [0x5eb898], 0
jne fcn.00428690
ret
Function at 0x42bef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR110.dll_memset
add esp, 0xc
push 0x5bb068
call fcn.00425810
mov edi, dword [sym.imp.MSVCR110.dll_fopen]
push eax
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x42bf4a
push 0x58c83c
call fcn.00425810
push eax
call edi
push eax
call dword [sym.imp.MSVCR110.dll_fclose]
add esp, 0xc
push 0x5bb068
call fcn.00425810
push eax
call edi
add esp, 8
mov esi, eax
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.MSVCR110.dll_fseek]
push esi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR110.dll_fread]
push esi
call dword [sym.imp.MSVCR110.dll_fclose]
add esp, 0x20
mov eax, 1
pop edi
pop esi
pop ebp
ret

Function at 0x42bfa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x5bb068
call fcn.00425810
push eax
call dword [sym.imp.MSVCR110.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x42bfe9
push 2
push 0
push edi
call dword [sym.imp.MSVCR110.dll_fseek]
push edi
call dword [sym.imp.MSVCR110.dll_ftell]
push edi
mov edi, dword [sym.imp.MSVCR110.dll_fclose]
mov esi, eax
call edi
add esp, 0x14
cmp esi, 0x10000
je 0x42c000
jmp 0x42bfef
mov edi, dword [sym.imp.MSVCR110.dll_fclose]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00426f20
add esp, 0xc
push 0x58cf40
call fcn.00425810
push eax
call dword [sym.imp.MSVCR110.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x42c01e
pop edi
pop esi
pop ebp
ret
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.MSVCR110.dll_fseek]
push esi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR110.dll_fwrite]
push esi
call edi
add esp, 0x20
mov eax, 1
pop edi
pop esi
pop ebp
ret
Function at 0x43abc0
Capabilities:
Print debug messages

Disassembly:
jmp fcn.004014b0
call fcn.0043b4a0
jmp 0x401d80
Function at 0x441450
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ed48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov byte [esi + 0xc], 0
xor eax, eax
mov dword [esi], vtable.dgs::DGSMessage.0
mov dword [esi + 0xcc], 0
mov dword [ebp - 4], 0
mov dword [esi + 0xcc], 0
mov dword [esi + 0x4c], 0xffffffff
mov dword [esi + 0x22], eax
mov dword [esi + 0x1a], eax
mov dword [esi + 0x1e], eax
mov dword [esi + 0x26], eax
mov dword [esi + 0x2a], eax
mov word [esi + 0x48], ax
mov dword [esi + 0x30], 9
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov byte [esi + 0x4a], 1
mov dword [esi + 0x3c], 6
mov dword [esi + 0x40], 6
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], eax
mov word [esi + 0x18], 0x101
call fcn.00443c30
mov eax, dword [ebp + 0xc]
push 0
add eax, 8
push 0
push eax
mov eax, dword [ebp + 8]
add eax, 8
push eax
lea eax, [esi + 0x54]
push eax
call fcn.004378d0
add esp, 0x14
cmp byte [esi + 0xc], 0
jne 0x441532
push esi
push 0x5e214c
mov byte [esi + 0xc], 1
call fcn.00435590
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x446f50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ee01
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi], 0
jne 0x446fc9
push 0xa0
call fcn.0045c5c0
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x446fab
push str.Failed_Archiver_ctor.
push 0x161
push str.systemdsdeviceds_archiver.cpp
call fcn.004301a0
add esp, 0xc
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x446fc0
mov ecx, esi
call fcn.00446880
mov dword [ebp - 4], 0xffffffff
mov dword [edi], esi
lea ecx, [edi + 0x20]
call fcn.0045d290
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, dword [edi]
push esi
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.00446cc0
movq xmm0, qword [esi]
movq qword [edi + 4], xmm0
movq xmm0, qword [esi + 8]
movq qword [edi + 0xc], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x447020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ee01
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi], 0
jne 0x447099
push 0xa0
call fcn.0045c5c0
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x44707b
push str.Failed_Archiver_ctor.
push 0x161
push str.systemdsdeviceds_archiver.cpp
call fcn.004301a0
add esp, 0xc
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x447090
mov ecx, esi
call fcn.00446880
mov dword [ebp - 4], 0xffffffff
mov dword [edi], esi
lea ecx, [edi + 0x20]
call fcn.0045d290
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, dword [edi]
push esi
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.00446e40
movq xmm0, qword [esi]
movq qword [edi + 4], xmm0
movq xmm0, qword [esi + 8]
movq qword [edi + 0xc], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x44afb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57eee8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [esi + 0x24]
push 0
push eax
mov dword [esi], vtable.ds::fs::CMassFile.0
mov dword [esi + 0x50], 0
call fcn.00435570
lea eax, [esi + 0xc]
push eax
call fcn.0042c390
mov byte [esi + 0x30], 0
mov dword [esi + 0x1c], fcn.0045c4e0
mov dword [esi + 0x20], fcn.0045c710
lea eax, [esi + 0x54]
push eax
mov dword [ebp - 4], 0
mov dword [esi], vtable.ds::fs::CMassFileEx.0
call fcn.0042c390
add esp, 0x10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x454bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x5eae84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
movzx eax, word [esi + 0x8c]
push eax
mov dword [ebp - 0x80], esi
call fcn.0042c770
movzx eax, ax
mov dword [ebp - 0x84], eax
movzx eax, word [esi + 0x8c]
push eax
call fcn.0042c660
movzx edi, ax
movzx eax, word [esi + 0x8e]
push eax
call fcn.0042c770
movzx ebx, ax
movzx eax, word [esi + 0x8e]
push eax
call fcn.0042c660
movzx esi, ax
movsx eax, di
push eax
mov eax, dword [ebp - 0x84]
cwde
push eax
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xfffff000
call fcn.0042fb60
movsx eax, si
push eax
movsx eax, bx
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0042fc00
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0042e4a0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0042f850
mov ebx, dword [ebp - 0x80]
add esp, 0x40
mov esi, dword [ebx + 0x78]
mov eax, dword [ebx + 0x24]
mov edx, esi
imul edx, dword [ebp - 0x10]
mov ecx, esi
imul esi, dword [ebp - 8]
imul ecx, dword [ebp - 0xc]
sar edx, 0xc
add eax, edx
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x28]
sar ecx, 0xc
add eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x2c]
sar esi, 0xc
pop edi
add eax, esi
pop esi
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0x1000
mov dword [ebx + 0x44], 0
pop ebx
xor ecx, ebp
call fcn.0057d22e
mov esp, ebp
pop ebp
ret

Function at 0x45ba00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f2c3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 8], esi
mov dword [esi + 0xc], eax
mov dword [esi], vtable.ds::sys3d::LargeParticleElement.0
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x18], vtable.ds::BasicTextureObject.0
mov dword [esi + 0x1c], 0
lea eax, [esi + 0x44]
push eax
mov byte [ebp - 4], 1
mov byte [esi + 0x74], 1
call fcn.0042f260
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x2c], 0x1000
mov dword [esi + 0x30], 0x1000
mov dword [esi + 0x34], 0x1000
add esp, 4
mov dword [esi + 0x38], 0x1000
mov dword [esi + 0x3c], 0x1000
mov dword [esi + 0x40], 0x1000
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4