joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411479
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x98
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x78], esi
push edi
mov edi, ecx
jne 0x41149a
mov eax, 0x8876086c
jmp 0x41157c
cmp dword [ebp + 0x7c], esi
je 0x411514
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 2
je 0x4114f4
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov dword [ebp + 0x6c], eax
add eax, 3
and eax, 0xfffffffc
call fcn.004964d0
mov dword [ebp + 0x7c], esp
push esi
push esi
push dword [ebp + 0x6c]
push dword [ebp + 0x7c]
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x7c], esi
cmp dword [ebp + 0x7c], esi
je 0x411514
push esi
push 0x10000000
push 3
push esi
push 1
push closesocket
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x41152d
push esi
push 0x10000000
push 3
push esi
push 1
push closesocket
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x41156d
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x41156d
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
je 0x41156d
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
jne 0x41157a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x41157c
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8

Function at 0x41169f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4116f7
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4116f7
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x4116f7
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x411f30
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x411f5d
push esi
call fcn.00419982
cmp byte [esi + 0x40], 0
pop ecx
je 0x411f56
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x411fcc
mov eax, dword [esi + 0x18c]
cmp byte [eax + 0x10], 0
je 0x411fc1
mov eax, dword [esi + 8]
test eax, eax
je 0x411f7e
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x18c]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x411fbd
cmp eax, 2
je 0x411fc1
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x411f73
cmp eax, 3
je 0x411fa2
cmp eax, 1
jne 0x411f73
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x411f73
mov edx, dword [esi + 0x118]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x411f73
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x411fea
cmp eax, 0xcc
je 0x411fea
mov eax, dword [esi]
mov dword [eax + 0x14], 0x12
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.00411e03
pop esi
ret

Function at 0x41b28c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x41b29a
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x41b36e
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x4c0ff0]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x4c0ff0]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x4c0ff0]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x4c0ff0]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x4c0ff0]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x4c0ff0]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x4c0ff0]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x4c0ff0]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x41b2b7
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x41b38e
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x4c0ff0]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x41b374
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x42e920
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x404
mov eax, dword [0x4eac74]
xor eax, esp
mov dword [esp + 0x400], eax
lea eax, [esp + 0x40c]
push eax
push 0
push dword [esp + 0x410]
lea eax, [esp + 0xc]
push 0x400
push eax
call fcn.0042e8e0
add esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00495a90
add esp, 0x404
ret
Function at 0x432610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x43263b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00433020
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x43265d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x43265f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x4326e3
jg 0x432674
test esi, esi
je 0x4326e3
test ecx, ecx
jl 0x4326bd
jg 0x43267e
test eax, eax
je 0x4326bd
cmp edi, ecx
jg 0x432692
jl 0x432688
cmp esi, eax
jae 0x432692
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.00498860
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x4326c0
mov edx, dword [ebp + 8]
test edi, edi
jl 0x4326e3
jg 0x4326ca
test esi, esi
je 0x4326e3
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x4326e3
push eax
push esi
push 1
push edx
call fcn.004a476a
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x432700
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x43272b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00433100
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x43274d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x43274f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x4327ee
jg 0x43276c
test esi, esi
je 0x4327ee
test ecx, ecx
jl 0x4327b9
jg 0x432776
test eax, eax
je 0x4327b9
cmp ebx, ecx
jg 0x43278a
jl 0x432780
cmp esi, eax
jae 0x43278a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.00498860
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x4327c0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x4327ee
jg 0x4327ca
test esi, esi
je 0x4327ee
cmp dword [edi + 0x4c], 0
je 0x4327ee
mov ecx, edi
call fcn.00433690
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.004a4d44
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x432bf0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x4eac74]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x432c20
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00495a90
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x432c5d
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x432c5d
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00495a90
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
je 0x432d3b
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x432c85
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x432cb9
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004a40c2
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00495a90
add esp, 0x30
ret 4
mov al, bl
mov byte [esp + 0xf], al
mov edx, dword [ecx]
cmp edx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x432d52
lea ecx, [esp + 0xf]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], ecx
push dword [esi + 0x4c]
movsx eax, al
push eax
call fcn.004a40c2
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00495a90
add esp, 0x30
ret 4
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
sub edi, eax
je 0x432d29
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004a476a
add esp, 0x10
cmp edi, eax
jne 0x432d3b
lea eax, [esp + 0xf]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
jne 0x432c47
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00495a90
add esp, 0x30
ret 4
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x23]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x432d3b
cmp eax, 1
jle 0x432d0a
cmp eax, 3
jne 0x432d3b
mov al, byte [esp + 0xf]
jmp 0x432cdd
Function at 0x4336c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x4eac74]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x43375e
cmp byte [esi + 0x3d], 0
je 0x43375e
push 0xffffffffffffffff
call fcn.00432bf0
cmp eax, 0xffffffff
je 0x433714
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx]
cmp edx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x433771
lea edi, [esp + 0xc]
xor eax, eax
mov dword [esp + 8], edi
sub eax, 0
je 0x433727
sub eax, 1
je 0x43372b
sub eax, 2
je 0x43375e
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00495a90
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
lea eax, [esp + 0xc]
sub edi, eax
je 0x433746
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004a476a
add esp, 0x10
cmp edi, eax
jne 0x433714
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00495a90
add esp, 0x28
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.00495a90
add esp, 0x28
ret
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
mov edi, dword [esp + 8]
jmp 0x433705
Function at 0x4347e0
Capabilities:
Get mac address on windows
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4babe8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4eac74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
push 0x100
mov ecx, eax
call fcn.004349e0
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 0x10]
push eax
push 0
mov dword [ebp - 0x10], 0
call esi
push dword [ebp - 0x10]
call fcn.00495cdf
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push ebx
call esi
mov esi, ebx
test ebx, ebx
je 0x4348c5
cmp dword [esi + 0x1a0], 6
jne 0x4348bf
cmp dword [esi + 0x190], 6
jne 0x4348bf
movzx eax, byte [esi + 0x199]
mov ecx, dword [ebp - 0x24]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
mov eax, dword [ebp - 0x20]
push str._02X__02X__02X__02X__02X__02X
sub eax, ecx
push eax
push ecx
call fcn.0042e9c0
add esp, 0x24
mov esi, dword [esi]
test esi, esi
jne 0x434866
mov edi, dword [ebp - 0x24]
or ebx, 0xffffffff
mov ecx, edi
xor edx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4348d2
sub ecx, esi
je 0x43490d
nop dword [eax]
movzx ecx, byte [edi + edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
mov eax, edi
xor ebx, dword [ecx*4 + 0x4d1cc0]
inc edx
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x434900
sub eax, esi
cmp edx, eax
jb 0x4348e0
push dword [ebp - 0x14]
call fcn.00495c9c
mov ecx, dword [ebp - 0x24]
add esp, 4
test ecx, ecx
je 0x434948
mov edx, dword [ebp - 0x1c]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x43493e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43495c
push edx
push ecx
call fcn.00495cd1
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004a3cb0
int3
Function at 0x438590
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
xor edx, edx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
setne dl
mov edi, ecx
xor eax, eax
lea edx, [edx*2 - 1]
add edx, dword [0x501320]
mov dword [0x501320], edx
sete al
test esi, esi
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [edi + 0x2a38c], eax
je 0x4386be
cmp edx, 1
jne 0x4386be
cmp dword [edi + 0x2a390], 0
je 0x4386be
cmp dword [0x501350], 0
jne 0x438625
lea eax, [esp + 8]
mov dword [0x501350], edx
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, eax
mov dword [0x501360], edx
test edx, edx
je 0x43867a
mov ecx, dword [esp + 8]
mov dword [0x501328], ecx
mov ecx, dword [esp + 0xc]
mov dword [0x50132c], ecx
jmp 0x43862b
mov edx, dword [0x501360]
test edx, edx
je 0x43867a
mov ecx, dword [0x501340]
mov eax, ecx
mov esi, dword [0x501344]
or eax, esi
jne 0x43865a
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [0x501360]
mov dword [0x501344], esi
mov dword [0x50135c], esi
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x501340], ecx
mov dword [0x501358], ecx
jmp 0x4386c4
movsd xmm0, qword [0x501368]
ucomisd xmm0, qword [0x4dfe00]
lahf
test ah, 0x44
jp 0x4386b4
call esi
mov edx, dword [0x501360]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4e02c0]
mulsd xmm0, qword [0x4dfed8]
movsd qword [0x501368], xmm0
jmp 0x4386c4
mov edx, dword [0x501360]
cmp dword [0x501320], 0
jne 0x4387b8
cmp dword [edi + 0x2a390], 0
je 0x4387b8
cmp dword [0x501350], 0
jne 0x43871a
lea eax, [esp + 8]
mov dword [0x501350], 1
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, eax
mov dword [0x501360], edx
test edx, edx
je 0x43876c
mov eax, dword [esp + 8]
mov dword [0x501328], eax
mov eax, dword [esp + 0xc]
mov dword [0x50132c], eax
test edx, edx
je 0x43876c
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 8]
xorps xmm0, xmm0
mov edx, dword [esp + 0xc]
mov ecx, esi
sub ecx, dword [0x501340]
mov eax, edx
mov dword [0x501358], esi
sbb eax, dword [0x501344]
add dword [0x501338], ecx
movlpd qword [0x501340], xmm0
adc dword [0x50133c], eax
mov dword [0x50135c], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call esi
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x4e02c0]
mulsd xmm1, qword [0x4dfed8]
movaps xmm0, xmm1
movsd qword [0x501330], xmm1
subsd xmm0, qword [0x501368]
addsd xmm0, qword [0x501348]
movsd qword [0x501348], xmm0
xorps xmm0, xmm0
movsd qword [0x501368], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46bb00
Capabilities:
Read file on windows

Disassembly:
cmp dword [0x4ffd58], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x46bb3a
push 0x4d1c84
push 0x4d1c88
call fcn.004a3dcc
mov edi, eax
add esp, 8
test edi, edi
je 0x46bb3a
push str.GroundObjectTiles::Generate
push edi
call fcn.00430d20
push edi
call fcn.004a3ea0
add esp, 0xc
call fcn.004a5b0a
push 0x1c0000
mov dword [esi + 0x108], 0x100
mov dword [esi + 0x10c], 0x100
call fcn.00495cdf
mov ecx, dword [esi + 0x10c]
add esp, 4
xor ebx, ebx
mov dword [esi + 0x120], eax
test ecx, ecx
jle 0x46bc45
mov eax, dword [esi + 0x108]
xor edx, edx
test eax, eax
jle 0x46bc34
nop word [eax + eax]
xor edi, edi
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 1], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 2], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 3], 0
add edi, 4
cmp edi, 0x1c
jl 0x46bb92
mov eax, dword [esi + 0x108]
inc edx
cmp edx, eax
jl 0x46bb90
mov ecx, dword [esi + 0x10c]
inc ebx
cmp ebx, ecx
jl 0x46bb76
jmp 0x46bc4b
mov eax, dword [esi + 0x108]
imul eax, ecx
push eax
call fcn.00495cdf
mov dword [esi + 0x194], eax
add esp, 4
mov eax, dword [esi + 0x110]
test eax, eax
jne 0x46bc73
push 0x4d6c00
push str.dat_roads_256.raw
jmp 0x46bc82
cmp eax, 1
jne 0x46bcae
push 0x4d6c18
push str.dat_roads2_256.raw
call fcn.004a3dcc
mov ecx, dword [esi + 0x108]
mov edi, eax
imul ecx, dword [esi + 0x10c]
push edi
push ecx
push 1
push dword [esi + 0x194]
call fcn.004a4d44
push edi
call fcn.004a3ea0
add esp, 0x1c
cmp dword [0x4ffd58], 0
je 0x46bce3
push 0x4d1c84
push 0x4d1c88
call fcn.004a3dcc
mov esi, eax
add esp, 8
test esi, esi
je 0x46bce3
push 0x4d6c40
push esi
call fcn.00430d20
push esi
call fcn.004a3ea0
add esp, 0xc
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x47f370
Capabilities:
Check http status code

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [0x500c70]
push edi
call fcn.00443d00
mov edi, dword [esp + 0x2c]
xor ebx, ebx
cmp edi, 0xc8
mov byte [esp + 0x1c], 0x13
setne bl
lea ebx, [ebx*2 + 1]
cmp edi, 0xc9
jne 0x47f3ae
mov ebx, 2
jmp 0x47f3bc
cmp edi, 0xcb
mov eax, 4
cmove ebx, eax
mov ecx, dword [esi + 0x2b8]
push 0x19
add ecx, 0x140
call fcn.00434d00
test eax, eax
jne 0x47f4a0
cmp edi, 0xc8
jne 0x47f430
mov ecx, dword [esi + 0x2c0]
push 0x87
add ecx, 0x140
call fcn.00434d00
test eax, eax
jne 0x47f430
mov ecx, dword [0x4ffd78]
lea edx, [esp + 0x14]
push 0
push 0
push edx
mov eax, dword [ecx]
push 5
mov byte [esp + 0x24], 0x40
call dword [eax + 4]
mov ecx, dword [esi + 0x2c0]
push dword [esi + 0x2fc]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [esi + 0x2c0]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ebp, dword [esi + 0x2b8]
mov ecx, dword [esi + 0x2c0]
mov dword [esp + 0x2c], ecx
mov eax, dword [ebp]
mov eax, dword [eax + 0x14]
cmp eax, method.UIRectArtTextButton.virtual_20
jne 0x47f5e5
cmp dword [ebp + 0x14c], 0
je 0x47f46c
mov eax, dword [ebp + 0x144]
mov eax, dword [eax + 4]
cmp dword [eax + 8], 0
sete al
jmp 0x47f46e
mov al, 1
mov byte [ecx + 0x139], al
push ecx
lea ecx, [ebp + 0x140]
call fcn.00434c40
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x13c], ebp
mov ecx, dword [esi + 0x2b8]
jmp 0x47f53e
mov ecx, dword [esi + 0x2b8]
jmp 0x47f53e
mov ecx, dword [esi + 0x2c0]
add ecx, 0x140
cmp edi, dword [esi + 0x23bc]
je 0x47f577
push 0x87
call fcn.00434d00
cmp edi, 0xc8
je 0x47f523
test eax, eax
je 0x47f543
mov ecx, dword [esi + 0x2b8]
push 0x86
add ecx, 0x140
call fcn.00434d00
test eax, eax
je 0x47f50a
mov ecx, dword [esi + 0x2b8]
push dword [esi + 0x2c8]
add ecx, 0x140
call fcn.00434d50
mov ecx, dword [esi + 0x2b8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x2c0]
push dword [esi + 0x2fc]
add ecx, 0x140
call fcn.00434d50
jmp 0x47f538
test eax, eax
jne 0x47f543
mov ecx, dword [esi + 0x2c0]
push dword [esi + 0x2fc]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [esi + 0x2c0]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [0x4ffd78]
lea edx, [esp + 0x1c]
mov eax, dword [esi + 0x23a4]
push 0
push 0
mov byte [esp + 0x29], bl
mov dword [esp + 0x25], eax
mov eax, dword [ecx]
push edx
push 0xa
call dword [eax + 4]
mov dword [esi + 0x23bc], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
push dword [esi + 0x2fc]
call fcn.00434d50
mov ecx, dword [esi + 0x2c0]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x2b8]
push dword [esi + 0x2c0]
add ecx, 0x140
call fcn.00434d50
mov ecx, dword [esi + 0x2b8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x2b8]
push dword [esi + 0x2c8]
add ecx, 0x140
call fcn.00434d50
mov ecx, dword [esi + 0x2b8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
pop edi
mov dword [esi + 0x23bc], 0
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
push ecx
mov ecx, ebp
call eax
jmp 0x47f495
Function at 0x4ad4b3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ad332