joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ba20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bc649
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x1c], 1
call fcn.0040acd0
push eax
sub esp, 0xc
mov edi, esp
lea ecx, [esp + 0x34]
mov dword [esp + 0x40], esp
push ecx
mov ecx, edi
call fcn.0040a700
mov edx, dword [esp + 0x3c]
mov dword [edi + 8], edx
mov edi, dword [esp + 0x30]
push edi
mov ecx, esi
call fcn.0040b490
push 3
lea ecx, [esp + 0x34]
mov dword [esp + 0x10], 1
mov byte [esp + 0x1c], 0
call fcn.00585060
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 2
call fcn.0040a330
lea ecx, [esp + 0x30]
mov byte [esp + 0x18], 0
call fcn.005850a0
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14

Function at 0x40c8c0
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
push 0x40c840
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x70bdd4], eax
ret 4
Function at 0x40ccf0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x35c
mov eax, dword [0x70a108]
xor eax, esp
mov dword [esp + 0x358], eax
push ebx
push ebp
push 0x104
lea eax, [esp + 0x260]
push eax
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x25c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40cd26
mov ecx, dword [str.mfl.dat]
mov edx, dword [0x5d06bc]
mov dword [eax], ecx
mov cl, byte [0x5d06c0]
mov dword [eax + 4], edx
lea edx, [esp + 0x25c]
push 0x5d0660
push edx
mov byte [eax + 8], cl
call fcn.00586a80
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40cd85
push eax
call fcn.00586180
add esp, 4
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x358]
xor ecx, esp
call fcn.00586d40
add esp, 0x35c
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x160]
push eax
push 0x104
call edi
lea eax, [esp + 0x160]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40cda4
mov ecx, dword [str.Resource.bin]
mov edx, dword [0x5d06ac]
mov dword [eax], ecx
mov ecx, dword [0x5d06b0]
mov dword [eax + 4], edx
mov edx, dword [0x5d06b4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push str._d__s_t
push ebx
call fcn.00588c20
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x26]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.00588c20
add esp, 0x2c
lea ecx, [esp + 0x20]
push ecx
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40cde4
lea edx, [esp + 0x160]
push edx
push 0x104
call edi
lea edi, [esp + 0x160]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ce60
mov ecx, 6
mov esi, str.ResourceSkillArea.bsad
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea esp, [esp]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push str._d__s_t
push ebx
call fcn.00588c20
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x26]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.00588c20
add esp, 0x2c
lea ecx, [esp + 0x20]
push ecx
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40ce90
push ebx
call fcn.00586180
mov ecx, dword [esp + 0x36c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00586d40
add esp, 0x35c
ret
Function at 0x40cf20
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
mov ecx, 0x70db88
call fcn.00426ce0
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
mov dword [0x70bdc8], ebp
call ebx
mov edi, eax
push 7
add edi, edi
call ebx
mov esi, eax
push 4
add esi, esi
call ebx
lea ecx, [esi + eax]
mov esi, dword [0x74516c]
xor edx, edx
mov eax, esi
div dword [0x7446f8]
mov eax, dword [0x7446fc]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x40cf7d
cmp dword [edx], esi
je 0x40cfc1
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x40cf72
push 0
push ebp
push 0
push 0
add ecx, 0x300
push ecx
add edi, 0x400
push edi
push 0
push 0x80000000
push 0x2ca0000
push 0x70bbc8
push 0x70b9c8
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x70bdcc], esi
test esi, esi
jne 0x40cfdd
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [edx + 4]
test edx, edx
je 0x40cf7d
mov eax, dword [edx + 8]
push 0
push ebp
push 0
add eax, ecx
mov ecx, dword [edx + 4]
push 0
push eax
add ecx, edi
push ecx
jmp 0x40cf92
mov edx, dword [esp + 0x18]
push edx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x70be00
call fcn.0040e600
cmp dword [0x71c198], 0
push 0
mov ecx, 0x70be00
push 0
jne 0x40d02e
push 1
call fcn.0040e470
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
push 2
call fcn.0040e470
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x40d830
Capabilities:
Create directory
Delete file

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push esi
call fcn.0040c8c0
mov eax, dword [esp + 0x2c]
mov dword [0x70b880], 0
mov ecx, str.gvkc9jw0ot0Ut
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40d871
test dl, dl
je 0x40d86d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40d871
add eax, 2
add ecx, 2
test dl, dl
jne 0x40d851
xor eax, eax
jmp 0x40d876
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40d897
push 0
push str.Error__
push 0x5d07ec
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
call fcn.0040cb70
test eax, eax
je 0x40d88e
push esi
call fcn.0040c8c0
push str.._Log_Debug.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x5d07d8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str._______________________________________________________
push 0x729900
call fcn.005226b0
push str._____________________Client_Start______________________
push 0x729900
call fcn.005226b0
push str._______________________________________________________
push 0x729900
call fcn.005226b0
add esp, 0x18
call fcn.0040caa0
mov ecx, 0x72b170
call fcn.0052ec70
push 0x7445ca
push 0x70bbc8
call fcn.00586b40
push 0x7445ca
push 0x70b9c8
call fcn.00586b40
push esi
call fcn.0040d7c0
add esp, 0x14
mov ecx, 0x72b170
call fcn.00530730
push str.._Resource_QuestScript_QuestString.bin
mov ecx, 0x727b58
call fcn.004f2000
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x727b58
call fcn.004f2c30
push str.._Resource_QuestScript_NewbieGuide.bin
mov ecx, 0x727b58
call fcn.004f0c50
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x727b58
call fcn.004f21e0
mov ecx, 0x7197e8
call fcn.00436040
mov eax, dword [esp + 0x30]
push eax
push esi
call fcn.0040cf20
add esp, 8
test eax, eax
jne 0x40d994
call fcn.0040cb80
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
call esi
test eax, eax
je 0x40d9cb
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esp + 0xc]
push eax
call ebx
jmp 0x40d9a8
mov ecx, 0x70be00
call fcn.0040ea10
cmp eax, 0xffffffff
jne 0x40d9a8
call fcn.0040cb80
mov eax, dword [esp + 0x14]
pop edi
pop ebx
pop esi
add esp, 0x1c
ret 0x10
Function at 0x4213c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x130
mov eax, dword [0x70a108]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
mov esi, dword [esp + 0x13c]
xor ebx, ebx
mov dword [esp + 0x24], esi
cmp esi, ebx
je 0x421572
cmp byte [esi], bl
je 0x421572
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x421572
mov edx, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x421444
mov dword [esp + 0xc], 0x64
push edi
xor edi, edi
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x10], ebx
jbe 0x421560
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea esp, [esp]
xor eax, eax
push edi
push str._04u
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], al
lea eax, [esp + 0x38]
push 5
push eax
call fcn.00421900
mov eax, dword [esp + 0x28]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x3c]
push edx
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x421539
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 0x104
call ebp
test eax, eax
je 0x4214df
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x421539
push esi
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4214fc
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x421539
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push str.Characteristics
push edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], 4
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x421557
mov esi, dword [esp + 0x2c]
inc edi
cmp edi, dword [esp + 0x14]
jb 0x421460
mov edx, dword [esp + 0x18]
pop ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x421574
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
pop ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x421574
xor eax, eax
mov ecx, dword [esp + 0x134]
pop esi
pop ebx
xor ecx, esp
call fcn.00586d40
add esp, 0x130
ret 4
Function at 0x421590
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 8
push ebp
push edi
lea eax, [esp + 8]
xor edi, edi
push eax
push edi
mov ebp, ecx
mov dword [esp + 0x10], edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x4215d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push ecx
call fcn.00421900
add esp, 0x10
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
mov edx, dword [esp + 8]
push esi
push edx
call fcn.00589d90
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
cmp esi, edi
jne 0x421605
mov eax, dword [esp + 0x18]
push str.GetMAC_Failed__Because_malloc_failed_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x421640
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x18]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push edx
call fcn.00421900
push esi
call fcn.00589d70
add esp, 0x14
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [esi + 0x190]
cmp eax, 6
jb 0x42167b
cmp eax, 8
ja 0x42167b
push eax
lea eax, [esi + 0x194]
push eax
push ebx
call fcn.005894d0
mov edi, dword [esi + 0x190]
add esp, 0xc
lea ecx, [esi + 8]
push ecx
mov ecx, ebp
call fcn.004213c0
test al, 4
jne 0x421681
mov esi, dword [esi]
test esi, esi
jne 0x421645
mov edx, dword [esp + 0x14]
push edx
call fcn.00589d70
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
add esp, 8
ret 4

Function at 0x4254b5
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x70be08]
push esi
mov esi, ecx
mov ecx, dword [eax + 8]
mov dword [ecx + 0xc], 1
cmp dword [esi + 0x10], 0
push 0
mov ecx, 0x70be00
push 0
je 0x4254eb
push 3
mov dword [0x70c038], 1
call fcn.0040e470
mov dword [esi + 0x10], 0
jmp 0x4254f2
push 2
call fcn.0040e470
cmp dword [0x71c198], 0
pop esi
jne 0x425510
mov dword [0x71c198], 1
mov ecx, 0x71c100
jmp fcn.004d20e0
ret
Function at 0x442460
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5bee63
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.00434ca0
xor edi, edi
lea ecx, [esi + 0x50]
mov dword [esp + 0x1c], edi
mov dword [esi], vtable.cWindow.0
call fcn.00433fa0
mov ebx, 1
lea ecx, [esi + 0x194]
mov byte [esp + 0x1c], bl
call fcn.00430640
fldz
fst dword [esi + 0x1e4]
xor eax, eax
fstp dword [esi + 0x1e8]
mov ecx, ebx
fld1
xor edx, edx
fst dword [esi + 0x1f0]
mov word [esi + 0x1c], ax
fstp dword [esi + 0x1f4]
mov dword [esi + 8], edi
mov word [esi + 0xc], cx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edi
mov dword [esi + 0x1ec], edx
mov dword [esi + 0x1b4], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 4], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x1b8], 0xffffff
mov dword [esi + 0x1bc], 0xff
mov dword [esi + 0x1c0], 0x64
mov dword [esi + 0x18], 0x442450
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x444020
Capabilities:
Delete file

Disassembly:
push esi
push edi
push 0x5cf6c0
push str.._image_InterfaceScript_AdvancedSetDlg.bin
mov edi, ecx
call fcn.00443af0
mov esi, eax
push esi
mov ecx, edi
call fcn.004054d0
mov ecx, esi
call fcn.005113f0
pop edi
mov dword [0x70c67c], esi
mov ecx, esi
pop esi
jmp 0x511be0
sub esp, 0x2cc
mov eax, dword [0x70a108]
xor eax, esp
mov dword [esp + 0x2c8], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebp
push esi
push edi
push 0xff
lea eax, [esp + 0x1dc]
push eax
push 0
mov ebp, ecx
call ebx
lea ecx, [esp + 0x1d8]
push 0x5c
push ecx
call fcn.0058b2f0
lea edi, [esp + 0x1e0]
add esp, 8
mov byte [eax + 1], 0
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x511c30
mov ecx, 6
mov esi, str.._Ini_AdvancedSet_Cfg.ini
rep movsd dword es:[edi], dword [esi]
push 0xff
lea edx, [esp + 0xdc]
push edx
push 0
movsw word es:[edi], word [esi]
call ebx
lea eax, [esp + 0xd8]
push 0x5c
push eax
call fcn.0058b2f0
lea edi, [esp + 0xe0]
add esp, 8
mov byte [eax + 1], 0
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x511c75
mov ecx, 7
mov esi, str.._Ini_AdvancedSet_Config.ini
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xd8]
push ecx
lea edx, [esp + 0x1dc]
push str.admin
push edx
movsb byte es:[edi], byte [esi]
call fcn.00511260
push 0xc8
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00585ff0
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x2c]
push ecx
push str.Power
push str.AddPoint
call fcn.00518640
lea edx, [esp + 0x38]
push edx
call fcn.00587dd0
push 0xc8
mov dword [ebp + 0x24c], eax
lea eax, [esp + 0x40]
push 0
push eax
call fcn.00585ff0
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x4c]
push ecx
push 0x5e0970
push str.AddPoint
call fcn.00518640
lea edx, [esp + 0x58]
add esp, 0x48
push edx
call fcn.00587dd0
push 0xc8
mov dword [ebp + 0x250], eax
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00585ff0
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x24]
push ecx
push 0x5e096c
push str.AddPoint
call fcn.00518640
lea edx, [esp + 0x30]
push edx
call fcn.00587dd0
push 0xc8
mov dword [ebp + 0x254], eax
lea eax, [esp + 0x38]
push 0
push eax
call fcn.00585ff0
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x44]
push ecx
push 0x5e0968
push str.AddPoint
call fcn.00518640
lea edx, [esp + 0x50]
add esp, 0x40
push edx
call fcn.00587dd0
mov dword [ebp + 0x258], eax
add esp, 4
lea eax, [esp + 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x2d8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00586d40
add esp, 0x2cc
ret
Function at 0x44a810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bf12b
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x70a108]
xor eax, esp
mov dword [esp + 0xc0], eax
push esi
push edi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.00430640
push 0
lea eax, [esp + 0x10]
push eax
push 0x3f
mov ecx, 0x7197e8
mov dword [esp + 0xe4], 0
call fcn.00435b40
push 0x166
mov ecx, 0x719758
call fcn.00435280
lea edx, [esp + 0x4c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x44a887
mov ecx, dword [0x71c0ec]
imul ecx, ecx, 0x290
add ecx, 0x71b66c
push ecx
mov ecx, dword [0x70c3f8]
lea edx, [esp + 0x30]
push edx
call fcn.004ccb40
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x50]
push ecx
mov edx, ecx
push str._s__s_
push edx
call edi
add esp, 0x10
push 0x33517d
lea eax, [esp + 0x10]
push eax
push 0xffffff
lea ecx, [esp + 0x58]
push ecx
mov ecx, dword [esi + 0x21c]
call fcn.004427f0
push 0x168
mov ecx, 0x719758
call fcn.00435280
lea edx, [esp + 0x4c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x44a905
mov eax, dword [0x71c0ec]
mov ecx, dword [0x70c3f8]
imul eax, eax, 0x290
add eax, 0x71b6bc
push eax
lea edx, [esp + 0x30]
push edx
call fcn.004ccb40
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x50]
push ecx
mov edx, ecx
push str._s__s_
push edx
call edi
add esp, 0x10
push 0x33517d
lea eax, [esp + 0x10]
push eax
push 0xffffff
lea ecx, [esp + 0x58]
push ecx
mov ecx, dword [esi + 0x224]
call fcn.004427f0
lea ecx, [esp + 0xc]
mov dword [esp + 0xd8], 0xffffffff
call fcn.00430650
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.00586d40
add esp, 0xd0
ret
Function at 0x44c250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5bf2f3
mov eax, dword fs:[0]
push eax
sub esp, 0x104
mov eax, dword [0x70a108]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
movzx esi, word [esp + 0x128]
mov eax, 0x74
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov eax, 0x62
mov edi, ecx
xor ebp, ebp
mov ebx, 1
lea ecx, [esp + 0x38]
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ebp
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], 2
mov dword [esp + 0x9c], 3
mov dword [esp + 0xa0], 4
mov dword [esp + 0xa4], 5
mov dword [esp + 0xa8], 6
mov dword [esp + 0xac], 7
mov dword [esp + 0xb0], 8
mov dword [esp + 0xb4], 9
mov dword [esp + 0xb8], 0xa
mov dword [esp + 0xbc], 0xb
mov dword [esp + 0xc0], 0xc
mov dword [esp + 0xc4], 0xd
mov dword [esp + 0xc8], 0xe
mov dword [esp + 0xcc], 0xf
mov dword [esp + 0xd0], 0x10
mov dword [esp + 0xd4], 0x11
mov dword [esp + 0xd8], 0x12
mov dword [esp + 0xdc], 0x13
mov dword [esp + 0xe0], 0x14
mov dword [esp + 0xe4], 0x15
mov dword [esp + 0xe8], 0x16
mov dword [esp + 0xec], 0x17
mov dword [esp + 0xf0], 0x18
mov dword [esp + 0xf4], 0x19
mov dword [esp + 0xf8], 0x1a
mov dword [esp + 0xfc], 0x1b
mov dword [esp + 0x100], 0x1c
mov dword [esp + 0x104], 0x1d
mov dword [esp + 0x108], 0x4d
mov dword [esp + 0x10c], 0x4e
mov dword [esp + 0x110], 0x4f
call fcn.00430640
lea ecx, [esp + 0x18]
mov dword [esp + 0x120], ebp
call fcn.00430640
lea ecx, [esp + 0x58]
mov byte [esp + 0x120], bl
call fcn.00430640
mov eax, esi
lea esi, [eax + eax*2]
add esi, esi
push ebp
lea eax, [esp + 0x1c]
add esi, esi
mov ecx, dword [esp + esi + 0x7c]
push eax
push ecx
mov ecx, 0x7197e8
mov byte [esp + 0x12c], 2
call fcn.00435b40
mov eax, dword [esp + esi + 0x7c]
push ebp
lea edx, [esp + 0x5c]
push edx
push eax
mov ecx, 0x7197e8
call fcn.00435b40
mov edx, dword [esp + esi + 0x80]
push ebp
lea ecx, [esp + 0x3c]
push ecx
push edx
mov ecx, 0x7197e8
call fcn.00435b40
push 0x3d8
call fcn.00586f10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x120], 3
cmp eax, ebp
je 0x44c4d1
mov ecx, eax
call fcn.004483b0
mov esi, eax
jmp 0x44c4d3
xor esi, esi
mov ebp, dword [esi]
lea ecx, [edi + 0x284]
mov byte [esp + 0x120], 2
call fcn.00580d40
push eax
push 0
lea eax, [esp + 0x60]
push eax
movzx eax, word [edi + 0x23e]
lea ecx, [esp + 0x24]
push ecx
movzx ecx, word [edi + 0x23c]
lea edx, [esp + 0x48]
push edx
mov edx, dword [ebp + 0x40]
push eax
push ecx
push 0
push 0
mov ecx, esi
call edx
lea ecx, [esp + 0x58]
mov dword [esi + 0x24], ebx
mov byte [esp + 0x120], bl
call fcn.00430650
lea ecx, [esp + 0x18]
mov byte [esp + 0x120], 0
call fcn.00430650
lea ecx, [esp + 0x38]
mov dword [esp + 0x120], 0xffffffff
call fcn.00430650
mov eax, esi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00586d40
add esp, 0x110
ret 4
Function at 0x461a10
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5bfecb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.0042aba0
xor ebx, ebx
lea ecx, [esi + 0x218]
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.CBigMapDlg.0
call fcn.004645a0
mov dword [esi + 0x290], ebx
mov dword [esi + 0x294], ebx
mov dword [esi + 0x298], ebx
mov dword [esi + 0x29c], ebx
mov dword [esi + 0x2a0], ebx
mov dword [esi + 0x2a4], ebx
mov dword [esi + method.CMemoryPoolTempl_class_CMiniMapIcon_.virtual_0], vtable.CMemoryPoolTempl_class_CMiniMapIcon_.0
mov dword [esi + 0x2b8], ebx
mov dword [esi + 0x2bc], ebx
mov byte [esi + 0x2c4], bl
push 0x464710
push 0x426ed0
push 0x14
push 0xc
lea eax, [esi + 0x444]
push eax
mov byte [esp + 0x30], 3
call fcn.00589f40
lea ecx, [esi + 0x538]
mov byte [esp + 0x1c], 4
call fcn.0044ab00
lea ecx, [esi + 0x55c]
mov byte [esp + 0x1c], 5
call fcn.00430640
lea ecx, [esi + 0x57c]
mov byte [esp + 0x1c], 6
call fcn.00464730
push fcn.00430650
push fcn.00430640
push 6
push 0x20
lea ecx, [esi + 0x60c]
push ecx
mov byte [esp + 0x30], 7
call fcn.00589f40
push 0x40
lea ecx, [esi + 0x290]
mov byte [esp + 0x20], 8
call fcn.0053d2d0
push 0x80
lea edx, [esi + 0x2c4]
push 0x5d6b58
push edx
call fcn.00589a30
lea edi, [esi + 0x2b8]
add esp, 0xc
mov dword [esi + 0x2c0], 0xa
cmp dword [edi], ebx
jne 0x461b56
push 0x64
push edi
call fcn.00462190
mov eax, dword [edi]
add esp, 8
mov dword [esi + 0x2bc], eax
fldz
mov dword [esi + 0x1b8], 0x78ffffff
fst dword [esi + 0x5f4]
mov dword [esi + 0x5e8], 1
fstp dword [esi + 0x5f8]
mov dword [esi + 0x5ec], ebx
mov dword [esi + 0x5f0], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret