joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441be0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, eax
mov eax, dword [esi + 8]
test eax, eax
je 0x441c2b
add dword [esi + 0x10], edi
mov ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0xc]
jbe 0x441c18
lea ecx, [esp + 4]
call fcn.0061bef1
push 0x68669c
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x658588
call fcn.006217cb
push edi
push eax
push edx
call fcn.00624510
add esp, 0xc
add dword [esi + 8], edi
pop esi
add esp, 0xc
ret
mov esi, dword [esi + 4]
test esi, esi
jne 0x441c52
lea ecx, [esp + 4]
call fcn.0061bef1
push 0x68669c
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x658588
call fcn.006217cb
push esi
push edi
push 1
push edx
call fcn.0061d24e
add esp, 0x10
cmp eax, edi
je 0x441c26
lea ecx, [esp + 4]
call fcn.0061bef1
push 0x68669c
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x658588
call fcn.006217cb
int3

Function at 0x443770
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 8], 0
je 0x443798
mov ecx, dword [esi + 0xc]
add ecx, 4
call fcn.00443730
mov eax, dword [esi + 0xc]
add eax, dword [esi + 8]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
add dword [esi + 0xc], 4
pop esi
ret 4
mov esi, dword [esi + 4]
test esi, esi
je 0x4437b1
push esi
push 4
lea edx, [esp + 0x10]
push 1
push edx
call fcn.0061d3c8
add esp, 0x10
pop esi
ret 4

Function at 0x4437c0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 8], 0
je 0x4437ea
mov ecx, dword [esi + 0xc]
add ecx, 2
call fcn.00443730
mov eax, dword [esi + 0xc]
add eax, dword [esi + 8]
mov cx, word [esp + 8]
mov word [eax], cx
add dword [esi + 0xc], 2
pop esi
ret 4
mov esi, dword [esi + 4]
test esi, esi
je 0x443803
push esi
push 2
lea edx, [esp + 0x10]
push 1
push edx
call fcn.0061d3c8
add esp, 0x10
pop esi
ret 4

Function at 0x443810
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, eax
movzx eax, word [edi + 0x14]
mov esi, ecx
cmp dword [esi + 8], 0
mov dword [esp + 0xc], eax
je 0x443845
mov ecx, dword [esi + 0xc]
add ecx, 2
call fcn.00443730
mov ecx, dword [esi + 0xc]
add ecx, dword [esi + 8]
mov dx, word [esp + 0xc]
mov word [ecx], dx
add dword [esi + 0xc], 2
jmp 0x44385e
mov eax, dword [esi + 4]
test eax, eax
je 0x44385e
push eax
push 2
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0061d3c8
add esp, 0x10
cmp dword [edi + 0x18], 0x10
mov eax, dword [edi + 0x14]
jb 0x44386c
mov ebx, dword [edi + 4]
jmp 0x44386f
lea ebx, [edi + 4]
cmp dword [esi + 8], 0
movzx edi, ax
je 0x44389b
mov ecx, dword [esi + 0xc]
add ecx, edi
call fcn.00443730
mov ecx, dword [esi + 0xc]
add ecx, dword [esi + 8]
push edi
push ebx
push ecx
call fcn.00624510
add esp, 0xc
add dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ecx
ret
mov esi, dword [esi + 4]
test esi, esi
je 0x4438af
push esi
push edi
push 1
push ebx
call fcn.0061d3c8
add esp, 0x10
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x443920
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x100
cmp dword [0x6a9eb0], 0
jne 0x443981
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 4]
push str.gPakInterfaceP__d
push eax
call fcn.0061d4e6
add esp, 0xc
lea ecx, [esp]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x6a9eb0], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x6a9eb4], eax
mov eax, dword [eax]
add esp, 0x100
ret
mov edx, dword [0x6a9eb4]
mov eax, dword [edx]
add esp, 0x100
ret

Function at 0x443f60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x643b10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
lea eax, [esp + 0x34]
push eax
lea esi, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.005afc50
add esp, 4
mov byte [esp + 0x2c], 1
mov ecx, dword [0x6a9f38]
mov edx, dword [ecx + 0x634]
push edx
mov ecx, eax
call fcn.005b7c00
mov esi, 0x10
cmp dword [esp + 0x20], esi
mov dword [edi], eax
jb 0x443fc5
mov eax, dword [esp + 0xc]
push eax
call fcn.0061c19a
add esp, 4
cmp dword [edi], 0
jne 0x443fef
cmp dword [esp + 0x4c], esi
jb 0x443fdd
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0061c19a
add esp, 4
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop esi
add esp, 0x2c
ret
cmp dword [esp + 0x4c], esi
jb 0x444002
mov edx, dword [esp + 0x38]
push edx
call fcn.0061c19a
add esp, 4
mov ecx, dword [esp + 0x24]
mov al, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x2c
ret
Function at 0x444560
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, eax
push edi
lea eax, [esp + 0x20]
call fcn.005a9230
call fcn.005a9290
cmp dword [esi + 0x18], 0x10
jb 0x444582
mov eax, dword [esi + 4]
jmp 0x444585
lea eax, [esi + 4]
call fcn.00443990
mov edi, eax
test edi, edi
je 0x444697
call fcn.00443920
test eax, eax
push 2
push 0
je 0x4445b2
mov eax, dword [0x6a9eb4]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push edi
call eax
jmp 0x4445be
mov ecx, dword [edi + 8]
push ecx
call fcn.0061d72b
add esp, 0xc
call fcn.00443920
test eax, eax
je 0x4445d9
mov edx, dword [0x6a9eb4]
mov ecx, dword [edx]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push edi
call edx
jmp 0x4445e5
mov eax, dword [edi + 8]
push eax
call fcn.0061d948
add esp, 4
mov ebp, eax
call fcn.00443920
test eax, eax
push 0
push 0
je 0x444606
mov ecx, dword [0x6a9eb4]
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push edi
call eax
jmp 0x444612
mov ecx, dword [edi + 8]
push ecx
call fcn.0061d72b
add esp, 0xc
push ebp
call fcn.0060ae9b
add esp, 4
push ebp
mov esi, eax
push 0
push esi
call fcn.00626020
add esp, 0xc
call fcn.00443920
test eax, eax
je 0x444648
mov edx, dword [0x6a9eb4]
mov ecx, dword [edx]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push edi
push ebp
push 1
push esi
call edx
jmp 0x444658
mov eax, dword [edi + 8]
push eax
push ebp
push 1
push esi
call fcn.0061d24e
add esp, 0x10
mov ebx, eax
call fcn.00443920
test eax, eax
je 0x444675
mov ecx, dword [0x6a9eb4]
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push edi
call eax
jmp 0x44468a
mov ecx, dword [edi + 8]
push ecx
call fcn.0061cf36
add esp, 4
push edi
call fcn.0061c19a
add esp, 4
cmp ebx, ebp
je 0x4446a1
push esi
call fcn.0061c19f
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
cmp ebp, 8
jae 0x4446aa
xor ebp, ebp
jmp 0x4446ba
lea edx, [esp + 0x14]
push edx
push ebp
call fcn.00444500
add esp, 8
mov ebp, eax
push esi
call fcn.0061c19f
add esp, 4
test ebp, ebp
je 0x444697
mov esi, dword [esp + 0x40]
push esi
mov dword [esp + 0x14], ebp
call fcn.00444490
mov ebx, dword [esi + 4]
mov dword [esp + 0x1c], eax
lea eax, [ebx + 4]
add esp, 4
cmp dword [esp + 0x14], eax
jae 0x4446fb
push ebp
call fcn.0061c19f
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov edi, 4
lea ecx, [esp + 0x1c]
lea esi, [esp + 0x10]
call fcn.005bafe0
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x1c], ecx
jne 0x4446e8
mov edi, ebx
mov ebx, dword [esp + 0x44]
mov ecx, ebx
call fcn.005bafe0
mov edx, dword [esp + 0x40]
push ebx
push edx
mov eax, esi
push eax
call fcn.004442c0
mov esi, dword [esp + 0x1c]
add esp, 0xc
mov bl, al
push ebp
mov byte [esp + 0x20], bl
sub esi, ebp
call fcn.0061c19f
add esp, 4
test bl, bl
je 0x444697
cmp esi, dword [esp + 0x14]
pop edi
setne al
sub al, 1
pop esi
pop ebp
pop ebx
and eax, dword [esp + 0xc]
add esp, 0x2c
ret
Function at 0x444770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x643ae8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push esi
push edi
push eax
mov edi, str.compiled_
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.00445160
push eax
mov edi, str..compiled
mov esi, ebx
mov dword [esp + 0x38], 0
call fcn.0041e290
add esp, 8
cmp dword [esp + 0x24], 0x10
pop edi
pop esi
jb 0x4447d3
mov ecx, dword [esp + 8]
push ecx
call fcn.0061c19a
add esp, 4
mov ecx, dword [esp + 0x20]
mov eax, ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x4447f0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x64d778
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword [esp + 0x4c]
push ebx
push esi
push eax
lea ebx, [esp + 0x10]
call fcn.00444770
add esp, 4
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x58]
push ecx
push edx
mov eax, ebx
mov dword [esp + 0x54], 0
call fcn.00444560
add esp, 8
test al, al
je 0x444862
cmp dword [esp + 0x24], 0x10
jb 0x44484f
mov eax, dword [esp + 0x10]
push eax
call fcn.0061c19a
add esp, 4
mov ecx, dword [esp + 0x44]
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x48
ret
cmp dword [esp + 0x24], 0x10
mov eax, dword [esp + 0x10]
jae 0x444871
lea eax, [esp + 0x10]
push eax
push str.missing_resource__s
lea esi, [esp + 0x30]
call fcn.005b0ca0
add esp, 8
cmp dword [eax + 0x18], 0x10
jb 0x44488e
mov esi, dword [eax + 4]
jmp 0x444891
lea esi, [eax + 4]
mov eax, dword [0x6a9f38]
test eax, eax
je 0x4448a4
mov eax, dword [eax + 0x350]
test eax, eax
jne 0x4448aa
call dword [sym.imp.USER32.dll_GetActiveWindow]
push 0x30
push str.Error
push esi
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 0x40], 0x10
jb 0x4448cd
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0061c19a
add esp, 4
push 0
call fcn.0061dd92
int3
Function at 0x44f5f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64f21b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
call fcn.0044f380
push 0x57b0
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44f635
push eax
mov ecx, edi
call fcn.00407b50
jmp 0x44f637
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [edi + 0xc4]
push ecx
mov ecx, dword [edi + 0xc0]
push ecx
mov dword [edi + 0x768], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x768]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
mov eax, dword [edi + 0x768]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x768]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
add esp, 0x10
ret

Function at 0x44f8e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64f1fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
call fcn.0044f380
mov eax, dword [edi + 0x770]
test eax, eax
je 0x44f929
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x10]
call eax
mov edx, dword [edi]
mov eax, dword [edi + 0x770]
mov edx, dword [edx + 0x88]
push eax
mov ecx, edi
call edx
push 0x130
mov dword [edi + 0x7fc], 1
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44f959
push edi
push eax
call fcn.00448cb0
jmp 0x44f95b
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [edi + 0xc4]
push ecx
mov ecx, dword [edi + 0xc0]
push ecx
mov dword [edi + 0x770], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x770]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
mov eax, dword [edi + 0x770]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x770]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
add esp, 0x10
ret
Function at 0x44fa20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64ba7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push 0x9c
mov dword [esi + 0x7fc], 5
call fcn.0061c130
add esp, 4
mov dword [esp], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x44fa6b
mov ecx, dword [esp + 0x14]
push ecx
push eax
mov ecx, esi
call fcn.00405780
jmp 0x44fa6d
xor eax, eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x778], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x778]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x778]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x778]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x44fb30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64ba5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push pe_nt_image_headers32
mov dword [esi + 0x7fc], 6
call fcn.0061c130
add esp, 4
mov dword [esp], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x44fb76
push eax
mov ecx, esi
call fcn.00433a70
jmp 0x44fb78
xor eax, eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x77c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x77c]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x77c]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x77c]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x44fc30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64ba3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push 0x1e4
mov dword [esi + 0x7fc], 7
call fcn.0061c130
add esp, 4
mov dword [esp], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x44fc7a
mov ecx, dword [esp + 0x14]
push ecx
push esi
push eax
call fcn.0042dae0
jmp 0x44fc7c
xor eax, eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x780], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x780]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x780]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x780]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x44fdc0
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
push 0xffffffffffffffff
push 0x64997b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push 0xd40
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44fdfd
push eax
call fcn.00483380
jmp 0x44fdff
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
jmp 0x7998aa

Function at 0x459010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64e2b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push edi
lea edi, [esp + 0xc]
mov ebx, ecx
call fcn.00519520
mov dword [esp + 0x30], 0
cmp dword [esi + 0x290], 0xffffffff
je 0x4590a8
cmp dword [esi + 0x88], 0
jle 0x4590a8
mov edi, dword [esp + 0x24]
cmp edi, 0x10
mov dword [esi + 0x318], ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
jae 0x459068
lea ecx, [esp + 0x10]
lea edx, [esi + 0x298]
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x459070
mov eax, dword [esi + 0x294]
mov ecx, dword [esi + 0x88]
add eax, 0x65
cmp ecx, eax
jge 0x459093
mov eax, ecx
cmp edi, 0x10
mov dword [esi + 0x88], eax
jb 0x4591c8
push ebx
jmp 0x4591c0
mov edi, esi
call fcn.00458fc0
mov ecx, dword [esp + 0x10]
mov edi, 0x10
cmp dword [esp + 0x24], edi
jae 0x4590c2
lea ecx, [esp + 0x10]
lea edx, [esi + 4]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x4590c5
cmp ebx, 6
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x290], 0xffffffff
je 0x459190
cmp ebx, 0xc
je 0x459190
cmp ebx, 0x11
je 0x459190
cmp ebx, 0xb
je 0x459190
cmp ebx, 0xa
jne 0x45911b
mov dword [esi + 0x88], 0x1f4
jmp 0x45919a
cmp ebx, 7
je 0x45910c
cmp ebx, 9
je 0x45910c
cmp ebx, 0xd
je 0x45910c
cmp ebx, 1
je 0x45910c
cmp ebx, 3
je 0x45910c
cmp ebx, 4
je 0x45910c
cmp ebx, 8
je 0x459184
cmp ebx, 2
je 0x459184
cmp ebx, 5
je 0x459184
cmp ebx, 0xe
jne 0x459159
mov dword [esi + 0x88], 0xfa
jmp 0x45919a
cmp ebx, 0xf
jne 0x459174
mov dword [esi + 0x88], 0x2ee
mov dword [esi + 0x290], 0x62
jmp 0x45919a
cmp ebx, edi
jne 0x45919a
mov dword [esi + 0x88], 0x2ee
jmp 0x45919a
mov dword [esi + 0x88], 0x2710
jmp 0x45919a
mov dword [esi + 0x88], 0x5dc
cmp dword [esi + 0x290], 0xffffffff
je 0x4591a9
push esi
call fcn.004591e0
cmp dword [esp + 0x24], edi
mov eax, dword [esi + 0x88]
mov dword [esi + 0x84], eax
jb 0x4591c8
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0061c19a
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret
Function at 0x45a0c0
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x100
cmp dword [0x6a9ec8], 0
jne 0x45a121
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 4]
push str.gPakInterfaceP__d
push eax
call fcn.0061d4e6
add esp, 0xc
lea ecx, [esp]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x6a9ec8], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x6a9ecc], eax
mov eax, dword [eax]
add esp, 0x100
ret
mov edx, dword [0x6a9ecc]
mov eax, dword [edx]
add esp, 0x100
ret

Function at 0x45a230
Capabilities:
Read file on windows

Disassembly:
call fcn.0045a0c0
test eax, eax
je 0x45a24d
mov eax, dword [0x6a9ecc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push esi
push edi
push 1
push ebx
call eax
ret
mov ecx, dword [esi + 8]
push ecx
push edi
push 1
push ebx
call fcn.0061d24e
add esp, 0x10
ret
Function at 0x45f9a0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [edi + 0x144], 0
push esi
je 0x45fb64
mov edx, dword [edi]
mov ecx, dword [edx + 0x7f8]
cmp ecx, 0x2b
je 0x45fb64
cmp ecx, 0x32
je 0x45fb64
mov eax, edx
call fcn.004537d0
test al, al
jne 0x45fb64
cmp ecx, 0x47
je 0x45fb64
cmp ecx, 0x48
je 0x45fb64
mov ecx, dword [edi + 4]
mov eax, ecx
call fcn.00413a40
test al, al
jne 0x45fb64
cmp dword [edi + 0x24], 0x26
jne 0x45fa2f
mov eax, dword [ecx + 0x557c]
cmp eax, dword [ecx + 0x5564]
jne 0x45fa2f
mov eax, 0x2e
cmp dword [edi + 0x3c], eax
je 0x45fa25
mov dword [edi + 0x3c], eax
mov dword [edi + 0x54], 0x1770
jmp 0x45fa2f
cmp dword [edi + 0x54], 0
je 0x45fb64
cmp dword [edx + 0x7f8], 0x1f
jne 0x45fa48
mov ecx, dword [ecx + 0x160]
cmp dword [ecx + 0x54], 0xa
jne 0x45fb64
add dword [edi + 0x58], 0xffffffff
mov esi, dword [edi + 0x58]
cmp esi, 0x64
jg 0x45fa7b
push 1
xor ecx, ecx
push 0x64
push 0
mov eax, esi
lea edx, [ecx + 0x64]
call fcn.00511c40
mov ecx, dword [edi + 0xb8]
add esp, 0xc
cmp ecx, eax
jle 0x45fa75
mov eax, ecx
mov dword [edi + 0xb8], eax
test esi, esi
jg 0x45fb64
mov eax, dword [edi + 0x5c]
lea esi, [eax - 0x96]
sub eax, esi
add eax, 1
call fcn.005af400
add eax, esi
jmp 0x79823d
pop esi
ret
Function at 0x4635c0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
jmp fcn.007a9a8a

Function at 0x4665b0
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov edx, dword [ebp + 4]
push esi
push edi
lea esi, [esp + 0x24]
mov dword [esp + 0x24], 0
call fcn.0041c8f0
test al, al
je 0x466624
mov ebx, dword [esp + 0x24]
cmp byte [ebx + 0xec], 0
jne 0x466614
mov eax, dword [ebx + 0x28]
cmp eax, 1
je 0x466614
cmp eax, 2
je 0x466614
cmp eax, 3
je 0x466614
lea edi, [esp + 0x10]
call fcn.005320b0
mov eax, dword [ebx + 0x28]
cmp eax, 0x49
je 0x466608
cmp eax, 0x4a
jne 0x466614
cmp eax, 0x4a
je 0x466614
mov byte [ebx + 0xb9], 1
mov edx, dword [ebp + 4]
lea esi, [esp + 0x24]
jmp 0x7b616f
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [0x6a7970]
mov eax, dword [eax + 0xd8]
push edx
call eax
mov ecx, dword [ebp + 4]
pop edi
pop esi
pop ebp
mov dword [ecx + 0x5d4], 0xfa0
pop ebx
add esp, 0x10
ret 4
Function at 0x46ce80
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
mov edx, dword [ebp + 0x58]
cmp edx, 5
push esi
push edi
jne 0x46ce9d
cmp dword [ebp + 0x60], 0x4b
jge 0x46d047
fld dword [ebp + 0x30]
fcomp qword [0x7b0000]
fnstsw ax
test ah, 0x41
je 0x46d047
fild dword [ebp + 0x10]
fadd dword [ebp + 0x30]
fcomp qword [0x679298]
fnstsw ax
test ah, 5
jnp 0x46d047
cmp edx, 9
jno 0x46cf6c
mov ecx, dword [ebp + 0x88]
mov edx, dword [ebp + 4]
call fcn.0041c7f0
mov ebx, eax
test ebx, ebx
je 0x46d04e
mov eax, dword [ebp + 0x74]
push eax
mov esi, ebx
call fcn.00531a80
test al, al
je 0x46d04e
lea ecx, [esp + 0x20]
mov esi, ebp
call fcn.0046ebc0
lea edi, [esp + 0x10]
call fcn.005320b0
mov ecx, edi
lea edi, [esp + 0x20]
call fcn.0041c820
test eax, eax
jl 0x46d04e
fld dword [ebp + 0x34]
fild dword [esp + 0x14]
fcompp
fnstsw ax
test ah, 5
jp 0x46d04e
mov ecx, dword [esp + 0x14]
fld dword [ebp + 0x34]
mov edx, dword [esp + 0x1c]
add edx, ecx
mov dword [esp + 0x34], edx
fild dword [esp + 0x34]
fcompp
fnstsw ax
test ah, 0x41
jne 0x46d04e
mov eax, ebx
mov ecx, ebp
call fcn.0046e000
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
mov ecx, dword [ebp + 0x5c]
cmp ecx, 7
jne 0x46cf9c
fld dword [0x679fe4]
fcomp dword [ebp + 0x34]
fnstsw ax
test ah, 5
jnp 0x46d047
fld dword [0x67959c]
fcomp dword [ebp + 0x34]
fnstsw ax
test ah, 0x41
je 0x46d047
test ecx, ecx
je 0x46cfa5
cmp ecx, 7
jne 0x46cfbc
fld dword [ebp + 0x4c]
fsub dword [ebp + 0x34]
fcomp qword [0x679b48]
fnstsw ax
test ah, 0x41
je 0x46d04e
cmp edx, 8
je 0x46d04e
cmp ecx, 0xd
push ebp
jne 0x46d058
call fcn.0046caa0
test eax, eax
je 0x46d04e
mov ecx, dword [ebp + 0x5c]
lea ecx, [ecx + ecx*2]
mov edx, dword [ecx*4 + 0x69f1c8]
mov ecx, dword [eax + 0xb8]
jmp 0x7a57b4
mov eax, ebp
call fcn.0046eb20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
call fcn.0046cd40
mov edx, eax
test edx, edx
je 0x46d04e
cmp byte [edx + 0xbe], 0
je 0x46d077
mov ecx, ebp
call fcn.0046d090
test al, al
jne 0x46d04e
mov eax, edx
mov ecx, ebp
call fcn.0046e000
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4