joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4276a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 4], edi
jle 0x42789e
lea eax, [esp + 0x28]
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [0x6833d0]
push edx
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x38], edi
call fcn.00424890
mov eax, dword [0x6833d0]
mov edx, dword [esi + 8]
push edx
mov ecx, dword [eax + 0x424]
mov ebp, dword [ecx + 0x10]
mov ecx, dword [esp + 0x40]
add ebp, ecx
mov dword [esp + 0x14], 0xffffffff
call fcn.00614b45
mov ecx, dword [esi + 8]
mov ebx, eax
lea eax, [esp + 0x14]
push 4
push eax
push ecx
call fcn.0061467f
add esp, 0x10
cmp eax, edi
jle 0x4278a3
cmp dword [esp + 0x10], edi
je 0x427757
mov edx, dword [esi + 8]
push edi
push ebx
push edx
call fcn.00614b56
add esp, 0xc
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
mov ecx, esi
call fcn.00427150
cmp eax, 1
jne 0x4278a3
mov ecx, dword [esi + 8]
lea eax, [esp + 0x30]
push 4
push eax
push ecx
call fcn.0061467f
add esp, 0xc
cmp eax, edi
jle 0x4278a3
mov eax, dword [esi + 8]
lea edx, [esp + 0x14]
push 4
push edx
push eax
call fcn.0061467f
add esp, 0xc
cmp eax, edi
jle 0x4278a3
mov edx, dword [esi + 8]
lea ecx, [esp + 0x1c]
push 4
push ecx
push edx
call fcn.0061467f
add esp, 0xc
cmp eax, edi
jle 0x4278a3
mov ecx, dword [esi + 8]
lea eax, [esp + 0x24]
push 4
push eax
push ecx
call fcn.0061467f
add esp, 0xc
cmp eax, edi
jle 0x4278a3
mov eax, dword [esi + 8]
lea edx, [esp + 0x34]
push 4
push edx
push eax
call fcn.0061467f
add esp, 0xc
cmp eax, edi
jle 0x4278a3
mov edx, dword [esi + 8]
lea ecx, [esp + 0x2c]
push 4
push ecx
push edx
call fcn.0061467f
add esp, 0xc
cmp eax, edi
jle 0x4278a3
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
je 0x42782c
cmp dword [esi + 0x53c], edi
jne 0x42782c
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x28
ret 4
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp ecx, eax
je 0x42784f
cmp dword [esi + 0x53c], edi
jne 0x42784f
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x28
ret 4
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
cmp edx, eax
je 0x427872
cmp dword [esi + 0x53c], edi
jne 0x427872
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x28
ret 4
cmp dword [esp + 0x2c], ebp
je 0x42788f
cmp dword [esi + 0x53c], edi
jne 0x42788f
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x28
ret 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret 4
mov eax, 6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x427960
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
jle 0x427a1b
mov eax, dword [esi + 8]
mov dword [esp + 8], 0xffffffff
push eax
call fcn.00614b45
mov edx, dword [esi + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push edx
mov edi, eax
call fcn.0061467f
add esp, 0x10
test eax, eax
jle 0x427a20
cmp dword [esp + 8], 3
je 0x4279bf
mov eax, dword [esi + 8]
push 0
push edi
push eax
call fcn.00614b56
add esp, 0xc
mov eax, 4
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, esi
call fcn.00427150
cmp eax, 1
jne 0x427a20
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 8]
push 4
push ecx
push edx
call fcn.0061467f
add esp, 0xc
test eax, eax
jle 0x427a20
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 8]
push 4
push eax
push ecx
call fcn.0061467f
add esp, 0xc
test eax, eax
jle 0x427a20
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 8]
push 4
push edx
push eax
call fcn.0061467f
add esp, 0xc
test eax, eax
jle 0x427a20
pop edi
mov eax, 1
pop esi
pop ecx
ret 0xc
mov eax, 6
pop edi
pop esi
pop ecx
ret 0xc

Function at 0x427b10
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
jg 0x427b2b
pop edi
mov eax, 6
pop esi
add esp, 8
ret 8
mov eax, dword [esi + 8]
push eax
call fcn.00614b45
mov edx, dword [esi + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push edx
mov edi, eax
mov dword [esp + 0x18], 0xffffffff
call fcn.0061467f
add esp, 0x10
test eax, eax
jle 0x427bd1
cmp dword [esp + 8], 4
je 0x427b78
mov eax, dword [esi + 8]
push 0
push edi
push eax
call fcn.00614b56
add esp, 0xc
mov eax, 4
pop edi
pop esi
add esp, 8
ret 8
mov ecx, esi
call fcn.00427150
cmp eax, 1
jne 0x427bd1
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 8]
push 4
push ecx
push edx
call fcn.0061467f
add esp, 0xc
test eax, eax
jle 0x427bd1
mov ecx, dword [esi + 8]
lea eax, [esp + 0xc]
push 4
push eax
push ecx
call fcn.0061467f
add esp, 0xc
test eax, eax
jle 0x427bd1
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 8]
push edx
push eax
push ecx
call fcn.0061467f
add esp, 0xc
test eax, eax
jle 0x427bd1
mov eax, 1
pop edi
pop esi
add esp, 8
ret 8
Function at 0x434ec0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20c
push esi
push edi
mov edi, dword [esp + 0x218]
mov esi, ecx
mov eax, dword [esi + edi*4 + 0x1a68]
mov ecx, dword [esi + 0x1a58]
cmp eax, ecx
jb 0x434f1c
mov dword [esi + edi*4 + 0x1ab8], 6
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [esi + edi*4 + 0x1c1c], eax
mov eax, dword [esi + 0x1610]
push edi
push str.Done_sending_to_player__i
push 3
push eax
call fcn.005fa2b0
add esp, 0x10
pop edi
pop esi
add esp, 0x20c
ret 8
sub ecx, eax
cmp ecx, 0x200
ja 0x434fc9
mov edx, dword [esi + edi*4 + 0x1b84]
mov dword [esp + 0xc], ecx
add edx, ecx
push 0
mov dword [esi + edi*4 + 0x1b84], edx
mov ecx, dword [esi + 0x1a54]
push eax
push ecx
mov byte [esp + 0x14], 0x24
mov dword [esp + 0x1c], eax
call fcn.00614b56
mov edx, dword [esp + 0x18]
mov ecx, dword [esi + 0x1a54]
lea eax, [esp + 0x20]
push edx
push eax
push ecx
call fcn.0061467f
mov eax, dword [esi + edi*4 + 0x1e48]
add esp, 0x18
lea edx, [esp + 8]
mov ecx, esi
push 1
push 0
push 0
push 0x20c
push edx
push eax
call fcn.0042ab00
mov ecx, dword [esi + edi*4 + 0x1ae0]
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x1610]
push ecx
push edx
push str.Sending_Final_Packet_at_Pos__ld___Rate
push 3
push eax
call fcn.005fa2b0
mov ecx, dword [esi + 0x1a58]
add esp, 0x14
mov dword [esi + edi*4 + 0x1a68], ecx
pop edi
pop esi
add esp, 0x20c
ret 8
mov edx, dword [esi + edi*4 + 0x1b84]
mov dword [esp + 0x10], eax
add edx, 0x200
push 0
mov dword [esi + edi*4 + 0x1b84], edx
mov edx, dword [esi + edi*4 + 0x1a68]
mov eax, dword [esi + 0x1a54]
push edx
push eax
mov byte [esp + 0x14], 0x24
mov dword [esp + 0x18], 0x200
call fcn.00614b56
mov edx, dword [esi + 0x1a54]
lea ecx, [esp + 0x20]
push 0x200
push ecx
push edx
call fcn.0061467f
mov ecx, dword [esi + edi*4 + 0x1e48]
add esp, 0x18
lea eax, [esp + 8]
push 1
push 0
push 0
push 0x20c
push eax
push ecx
mov ecx, esi
call fcn.0042ab00
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x1610]
lea edx, [esi + 0x18c4]
push edx
push eax
push str.Sending_MAX_PACKET_at_Pos__ld____s
push 3
push ecx
call fcn.005fa2b0
mov edx, dword [esp + 0x20]
mov eax, dword [esi + edi*4 + 0x1a68]
add esp, 0x14
add eax, edx
mov dword [esi + edi*4 + 0x1a68], eax
pop edi
pop esi
add esp, 0x20c
ret 8
Function at 0x43d410
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x104
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xe54]
test eax, eax
jne 0x43d431
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret 8
mov ebx, dword [esp + 0x110]
push edi
push ebx
mov ecx, esi
call fcn.0043cfe0
mov edi, dword [esp + 0x118]
push 0x66e35c
push edi
call fcn.006134a0
add esp, 8
test eax, eax
jne 0x43d49f
mov ecx, dword [0x6833d0]
call fcn.00424210
test eax, eax
push edi
je 0x43d483
push 0x66d060
lea eax, [esp + 0x14]
push 0x66a7b8
push eax
call fcn.00613634
add esp, 0x10
jmp 0x43d4ad
mov ecx, esi
call fcn.0043d1e0
push eax
lea ecx, [esp + 0x14]
push 0x66a7b8
push ecx
call fcn.00613634
add esp, 0x10
jmp 0x43d4ad
lea edx, [esp + 0xc]
push edi
push edx
call fcn.00613634
add esp, 8
push 0x180
lea eax, [esp + 0x10]
push 0x8002
push eax
call fcn.00614875
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
pop edi
jne 0x43d4d9
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret 8
push 0
push 0
push esi
call fcn.00614b56
push 0xe48
push ebx
push esi
call fcn.0061467f
mov eax, dword [ebx + 0x10]
add esp, 0x18
cmp eax, 0x11
je 0x43d507
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret 8
push esi
call fcn.006145cc
add esp, 4
mov eax, 1
pop esi
pop ebx
add esp, 0x104
ret 8

Function at 0x43d640
Capabilities:
Delete file

Disassembly:
sub esp, 0x104
push esi
mov esi, ecx
mov ecx, dword [0x6833d0]
call fcn.00424210
test eax, eax
je 0x43d671
mov eax, dword [esp + 0x10c]
lea ecx, [esp + 4]
push eax
push 0x66d060
push 0x66a7b8
push ecx
jmp 0x43d68b
mov edx, dword [esp + 0x10c]
mov ecx, esi
push edx
call fcn.0043d1e0
push eax
lea eax, [esp + 0xc]
push 0x66a7b8
push eax
call fcn.00613634
add esp, 0x10
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, esi
call fcn.0043c9b0
pop esi
add esp, 0x104
ret 4

Function at 0x43d6b0
Capabilities:
Delete file

Disassembly:
sub esp, 0xf4c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, dword [esi + 0xe58]
test eax, eax
jle 0x43d77f
push ebp
mov ebp, dword [esp + 0xf5c]
push edi
xor edi, edi
mov eax, dword [esi + 0xe54]
push ebp
lea ecx, [edi + eax + 0x10]
push ecx
mov ecx, esi
call fcn.0043d2c0
test eax, eax
je 0x43d76b
mov edx, dword [esi + 0xe54]
lea ecx, [esp + 0x114]
mov eax, dword [edi + edx]
push eax
push ecx
mov ecx, esi
call fcn.0043d410
mov ecx, dword [0x6833d0]
call fcn.00424210
mov edx, dword [esi + 0xe54]
test eax, eax
mov eax, dword [edi + edx]
push eax
je 0x43d725
push 0x66d060
jmp 0x43d72d
mov ecx, esi
call fcn.0043d1e0
push eax
lea ecx, [esp + 0x18]
push 0x66a7b8
push ecx
call fcn.00613634
mov eax, dword [esp + 0x13c]
add esp, 0x10
test eax, eax
jne 0x43d76b
lea edx, [esp + 0x10]
push str.tempsave
push edx
call fcn.006134a0
add esp, 8
test eax, eax
je 0x43d76b
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 0xe58]
inc ebx
add edi, 0x20
cmp ebx, eax
jl 0x43d6d5
pop edi
pop ebp
mov ecx, esi
call fcn.0043c9b0
pop esi
pop ebx
add esp, 0xf4c
ret 4
Function at 0x44a680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x90
push esi
mov esi, dword [esp + 0x98]
lea eax, [esp + 0xc]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
jne 0x44a6d8
push 2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x44a6e7
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
add esp, 0x90
ret
push eax
call fcn.0044a7b0
mov esi, eax
add esp, 4
test esi, esi
jne 0x44a6f1
xor eax, eax
pop esi
add esp, 0x90
ret
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x14]
test eax, eax
mov dword [esp + 8], edx
jne 0x44a710
mov cx, word [esi + 0xe]
cmp cx, 8
ja 0x44a710
mov eax, 1
shl eax, cl
mov ecx, dword [esi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push ebp
push edi
lea edi, [ecx + eax*4]
push esi
add edi, edx
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push eax
call ebp
push 0
push edi
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x44a758
push esi
call ebx
push eax
call ebp
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
jmp 0x44a78a
mov edx, dword [eax + 0x20]
mov esi, eax
test edx, edx
jne 0x44a772
mov cx, word [eax + 0xe]
cmp cx, 8
ja 0x44a772
mov edx, 1
shl edx, cl
mov ebx, dword [eax]
mov ecx, dword [esp + 0x14]
lea edx, [eax + edx*4]
mov eax, dword [esp + 0x10]
add edx, ebx
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll__hread]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll__lclose]
pop edi
pop ebp
mov eax, esi
pop ebx
pop esi
add esp, 0x90
ret
Function at 0x4645f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd0
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x3c], 2
je 0x46460d
pop edi
pop esi
xor al, al
pop ebx
add esp, 0xd0
ret
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4646af
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4646af
mov edx, dword [ecx + 0x3c]
test edx, edx
je 0x4646af
mov ecx, dword [eax]
push eax
xor bl, bl
call dword [ecx + 0x60]
test eax, eax
je 0x4646f3
push eax
mov ecx, esi
call fcn.00464d60
push 0x6c
lea edx, [esp + 0x10]
push 0
push edx
call fcn.00614e40
mov eax, dword [esi + 0x18]
add esp, 0xc
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0x6c
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x46469a
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x2c]
cmp eax, ecx
jne 0x46468e
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 0x30]
cmp ecx, eax
jne 0x46468e
cmp dword [esp + 0x60], 8
je 0x46469a
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0xd0
ret
mov eax, dword [esi + 0x1c]
push eax
mov edx, dword [eax]
call dword [edx + 0x6c]
test eax, eax
je 0x4646bb
push eax
mov ecx, esi
call fcn.00464db0
pop edi
pop esi
mov al, 3
pop ebx
add esp, 0xd0
ret
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x78]
push edx
push 0x1000400
push 0
mov dword [esi + 0x4c], 1
mov dword [esp + 0x84], 0x64
mov dword [esp + 0xd4], 0
mov ecx, dword [eax]
push 0
push 0
push eax
mov bl, 2
call dword [ecx + 0x14]
mov edi, dword [esi + 0x14]
test edi, edi
je 0x464713
mov ecx, dword [edi]
mov eax, dword [esi + 0x10]
cmp ecx, eax
je 0x46470c
call fcn.004658f0
cmp al, 3
je 0x4646af
mov edi, dword [edi + 8]
test edi, edi
jne 0x4646fa
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0xd0
ret
Function at 0x466e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp edi, ebp
jne 0x466eaf
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
sub edx, eax
inc edx
push edx
push eax
push edi
call fcn.004670b0
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp ebx, esi
jne 0x466ed2
mov eax, dword [esp + 0x24]
sub ebp, edi
inc ebp
push eax
push ebp
push ebx
push edi
call fcn.00467020
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [ecx + 8]
test eax, eax
mov dword [esp + 0x18], eax
je 0x46700a
mov eax, dword [ecx + 0x28]
cmp edi, eax
jge 0x466eec
mov edi, eax
jmp 0x466ef5
mov edx, dword [ecx + 0x30]
cmp edi, edx
jle 0x466ef5
mov edi, edx
cmp ebp, eax
jl 0x466f00
mov eax, dword [ecx + 0x30]
cmp ebp, eax
jle 0x466f02
mov ebp, eax
mov eax, dword [ecx + 0x2c]
cmp ebx, eax
jge 0x466f0d
mov ebx, eax
jmp 0x466f16
mov edx, dword [ecx + 0x34]
cmp ebx, edx
jle 0x466f16
mov ebx, edx
cmp esi, eax
jl 0x466f21
mov eax, dword [ecx + 0x34]
cmp esi, eax
jle 0x466f23
mov esi, eax
cmp ebx, esi
jle 0x466f33
mov eax, ebx
mov ebx, esi
mov esi, eax
mov eax, edi
mov edi, ebp
mov ebp, eax
mov eax, ebp
sub esi, ebx
sub eax, edi
cdq
xor eax, edx
sub eax, edx
inc eax
inc esi
cmp eax, 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], esi
jl 0x46700a
cmp esi, 1
jl 0x46700a
cmp dword [ecx + 0x24], 1
jne 0x466f74
mov ecx, dword [ecx + 0x20]
mov edx, dword [esp + 0x18]
mov esi, ecx
imul esi, ebx
add esi, edx
mov ebx, ecx
add esi, edi
jmp 0x466f8c
mov esi, dword [ecx + 0x1c]
mov eax, dword [ecx + 0x20]
sub esi, ebx
mov ebx, dword [esp + 0x18]
dec esi
imul esi, eax
add esi, ebx
add esi, edi
neg eax
mov ebx, eax
fild dword [esp + 0x20]
mov dword [esp + 0x20], 0
fidiv dword [esp + 0x14]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fadd dword [0x634598]
call fcn.0061318c
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x466fbf
mov dword [esp + 0x1c], 1
cmp edi, ebp
jle 0x466fcd
fld dword [esp + 0x18]
fchs
fstp dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
test ebp, ebp
jle 0x46700a
mov edi, dword [esp + 0x24]
and edi, 0xff
mov ecx, dword [esp + 0x1c]
fld dword [esp + 0x20]
push ecx
push edi
call fcn.0061318c
add eax, esi
push eax
call fcn.00614e40
fld dword [esp + 0x2c]
fadd dword [esp + 0x24]
add esp, 0xc
add esi, ebx
dec ebp
fstp dword [esp + 0x20]
jne 0x466fdf
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x46b870
Capabilities:
Get file version info

Disassembly:
sub esp, 0x22c
mov ecx, dword [0x65f2bc]
mov edx, dword [0x65f2c0]
mov eax, dword [0x65f2b8]
push ebx
xor ebx, ebx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
lea ecx, [esp + 8]
mov dword [esp + 0x20], eax
mov eax, dword [0x65f2c4]
push ebx
lea edx, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x38], eax
call sub.DPLAYX.dll_Ordinal_1
test eax, eax
je 0x46b8c1
xor eax, eax
pop ebx
add esp, 0x22c
ret
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x46b8f0
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push str.0_nEG
push eax
call dword [ecx]
test eax, eax
je 0x46b8e6
xor eax, eax
pop ebx
add esp, 0x22c
ret
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
push esi
push str.dplayx
mov byte [esp + 0x10], 0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x46ba73
lea edx, [esp + 0x38]
push pe_nt_image_headers32
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x46ba73
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
cmp ebp, ebx
mov dword [esp + 0x24], ebp
je 0x46ba73
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
cmp edi, ebx
je 0x46ba6b
mov edx, dword [esp + 0x20]
push edi
push esi
lea eax, [esp + 0x44]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0x24]
lea edx, [esp + 0x18]
push ecx
push edx
push 0x66e35c
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x46ba60
mov eax, dword [esp + 0x18]
mov bx, word [eax + 0xc]
mov esi, dword [eax + 8]
mov bp, word [eax + 8]
mov edi, dword [eax + 0xc]
mov eax, ebx
mov edx, ebp
shr edi, 0x10
and eax, 0xffff
mov ecx, edi
shr esi, 0x10
push eax
and ecx, 0xffff
mov eax, esi
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x14c]
push str.DPlay_Version_found:__d._d._d._d._Version_Required:_4.7.0.177__DX7__or_5.0.2046.1__Win2k__or_4.6.3.516__DX6.1a__r_n
push ecx
call fcn.00613634
add esp, 0x18
cmp si, 5
mov eax, 1
jbe 0x46b9f1
mov byte [esp + 0x10], al
jne 0x46ba06
test bp, bp
ja 0x46ba5c
cmp di, 0x7fe
jae 0x46ba5c
mov byte [esp + 0x10], 0
jmp 0x46ba60
cmp si, 4
jne 0x46ba45
cmp bp, 7
jbe 0x46ba16
mov byte [esp + 0x10], al
jne 0x46ba2b
test di, di
ja 0x46ba5c
cmp bx, 0xb1
ja 0x46ba5c
mov byte [esp + 0x10], 0
jmp 0x46ba60
cmp bp, 6
jne 0x46ba60
cmp di, 3
jne 0x46ba22
cmp bx, 0x204
jae 0x46ba5c
mov byte [esp + 0x10], 0
jmp 0x46ba60
cmp si, ax
jne 0x46ba60
cmp bp, 2
jne 0x46ba60
cmp di, 3
jne 0x46ba60
cmp bx, 0xc
jne 0x46ba60
mov byte [esp + 0x10], al
mov ebp, dword [esp + 0x28]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, dword [esp + 0x18]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0xc]
pop esi
pop ebp
and eax, 0xff
pop ebx
add esp, 0x22c
ret
Function at 0x4831d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor edx, edx
push edi
cmp esi, edx
jge 0x4831e4
mov dword [esp + 0x14], edx
jmp 0x4831f0
mov eax, dword [ecx + 8]
dec eax
cmp esi, eax
jle 0x4831f4
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
cmp edi, edx
jge 0x483200
xor edi, edi
jmp 0x48320a
mov eax, dword [ecx + 0xc]
dec eax
cmp edi, eax
jle 0x48320a
mov edi, eax
mov ebx, dword [esp + 0x1c]
cmp ebx, edx
jge 0x483216
xor ebx, ebx
jmp 0x483220
mov eax, dword [ecx + 8]
dec eax
cmp ebx, eax
jle 0x483220
mov ebx, eax
mov ebp, dword [esp + 0x20]
cmp ebp, edx
jge 0x48322e
mov dword [esp + 0x20], edx
jmp 0x48323a
mov eax, dword [ecx + 0xc]
dec eax
cmp ebp, eax
jle 0x48323a
mov dword [esp + 0x20], eax
cmp edi, dword [esp + 0x20]
jg 0x4832c9
mov edx, esi
shl edx, 5
mov dword [esp + 0x18], edx
mov eax, dword [ecx + 0xa214]
mov eax, dword [eax + edi*4]
add eax, edx
cmp esi, ebx
jg 0x4832c0
lea edx, [edi + esi]
mov ebp, edi
imul dx, word [ecx + 0xa23c]
mov word [eax], dx
sub ebp, esi
movzx dx, byte [eax + 6]
imul bp, word [ecx + 0xa23a]
imul dx, word [ecx + 0xa23e]
sub ebp, edx
xor edx, edx
mov dl, byte [eax + 4]
mov word [eax + 2], bp
lea ebp, [edx - 2]
cmp ebp, 0xe
ja case.0x48329e.3
xor edx, edx
mov dl, byte [ebp + 0x4832d8]
jmp dword [edx*4 + 0x4832d0]
mov dx, word [ecx + 0xa23e]
sub word [eax + 2], dx
add eax, 0x20
inc esi
cmp esi, ebx
jle 0x48325c
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
inc edi
cmp edi, eax
jle 0x48324d
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x489440
Capabilities:
Access peb ldr_data
Get memory capacity

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x621e5b
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
push ecx
mov dword [esi + 0xa3bc], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [esi + 0xa414]
mov ecx, 0x11
xor ebp, ebp
mov dword [eax - 0x44], ebp
mov dword [eax], ebp
mov dword [eax + 0x44], ebp
add eax, 4
dec ecx
jne 0x48947f
mov edx, dword [esp + 0x14]
mov ecx, 0x190
mov dword [esi + 0xa3c0], ebp
mov dword [esi + 0xa3c8], ecx
lea eax, [edx + 0xdbba0]
shr eax, 0x14
cmp eax, 0x22
jg 0x4894c2
mov dword [esi + 0xa3c8], ebp
mov dword [esi + 0xa3c0], 1
jmp 0x4894e2
cmp eax, 0x28
jle 0x4894dc
xor ecx, ecx
cmp eax, 0x40
setg cl
dec ecx
and ecx, 0xfffffaec
add ecx, 0x9c4
mov dword [esi + 0xa3c8], ecx
mov eax, dword [esi + 0xa3c0]
mov dword [esi + 0xa3cc], ebp
cmp eax, ebp
je 0x48955c
push ebx
mov dword [esi + 0xa3c4], ebp
mov edi, 0x3ac
lea ebx, [esi + 0xa49c]
push 0x1c
call fcn.0061317d
add esp, 4
mov dword [esp + 0x40], eax
cmp eax, ebp
mov dword [esp + 0x38], ebp
je 0x48952d
mov edx, dword [esi + 0xa3bc]
mov ecx, dword [edi + edx]
push ecx
mov ecx, eax
call fcn.0052c460
jmp 0x48952f
xor eax, eax
mov dword [ebx], eax
add edi, 4
add ebx, 4
cmp edi, 0x3f0
mov dword [esp + 0x38], 0xffffffff
jl 0x489504
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
mov edx, dword [esi + 0xa3c8]
shl edx, 3
push edx
call fcn.0061317d
mov ecx, dword [esi + 0xa3c8]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0xa3c4], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea edi, [esi + 0xa49c]
mov ecx, 0x11
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret 4