joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419076
Capabilities:
Access peb ldr_data
Encode data using xor
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
lea ebp, [esp - 0x64]
sub esp, 0x64
push 0xffffffffffffffff
push 0x49b217
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4c7080]
xor eax, ebp
mov dword [ebp + 0x60], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
push ecx
mov edx, str.cmd__c_cd_Env_DX
lea ecx, [ebp + 0x18]
xor edi, edi
call fcn.0041b5e7
pop ecx
push 0x20
push str.__start_Conquer.exe_blacknull
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.0041531c
push eax
lea ecx, [ebp + 0x30]
call fcn.0041431e
push esi
lea ecx, [ebp + 0x30]
mov byte [ebp - 4], 1
call fcn.004142a7
push eax
lea ecx, [ebp + 0x48]
call fcn.0041431e
lea ecx, [ebp + 0x30]
call fcn.004151f6
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 4
call fcn.004151f6
push 0x44
pop esi
push esi
lea eax, [ebp - 0x50]
push edi
push eax
call fcn.0046e020
add esp, 0xc
mov dword [ebp - 0x50], esi
xor eax, eax
mov dword [ebp - 0x24], 1
mov word [ebp - 0x20], ax
lea edi, [ebp]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp + 0x10], ecx
cmp ecx, edx
je 0x419192
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x419192
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
lea ebx, [ebx - 4]
mov ecx, 0x5c8778ba
mov esi, dword [ebx]
dec edi
add esi, edx
mov dword [ebp + 0x14], ecx
mov cl, byte [esi]
inc esi
test cl, cl
je 0x41918e
mov edx, dword [ebp + 0x14]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x41916d
mov dword [ebp + 0x14], edx
cmp dword [ebp + 0x14], 0xc67489a6
mov edx, dword [eax + 0x18]
je 0x419196
test edi, edi
jne 0x419153
mov eax, dword [eax]
jmp 0x419131
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + edx]
lea eax, [ebp + 0x48]
add ecx, edx
cmp dword [ebp + 0x5c], 0xf
lea edx, [ebp]
cmova eax, dword [ebp + 0x48]
push edx
lea edx, [ebp - 0x50]
push edx
xor edx, edx
push edx
push edx
push 0x8000000
push edx
push edx
push edx
push eax
push edx
call ecx
test eax, eax
je 0x4191e7
push dword [ebp]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 4]
call esi
jmp 0x4191ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 0x48]
call fcn.004151f6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x60]
xor ecx, ebp
call fcn.0046be79
add ebp, 0x64
leave
ret
Function at 0x41b3b1
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ecx
push ecx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
jne 0x41b3c7
mov byte [esi], 1
call fcn.00416c7f
mov dword [esi + 8], eax
cmp byte [esi], 1
jne 0x41b3e7
push dword [esp + 0x14]
mov ecx, dword [esi + 8]
lea eax, [esp + 0xc]
push eax
call fcn.0041ba5b
mov eax, dword [eax]
add eax, 0x28
jmp 0x41b487
mov eax, dword [0x4ca4d0]
test eax, eax
jne 0x41b485
mov eax, dword fs:[0x30]
push ebx
push ebp
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x41b465
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x41b465
mov ecx, dword [ebx + 0x20]
lea ebp, [ecx + esi*4]
add ebp, edx
lea ebp, [ebp - 4]
mov ecx, 0x4230ea97
mov edi, dword [ebp]
dec esi
add edi, edx
mov dword [esp + 0x1c], ecx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x41b461
mov edx, dword [esp + 0x1c]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x41b43e
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x1c], 0x32d360eb
mov edx, dword [eax + 0x18]
je 0x41b469
test esi, esi
jne 0x41b421
mov eax, dword [eax]
jmp 0x41b402
mov eax, dword [ebx + 0x24]
pop ebp
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4ca4d0], eax
call eax
pop edi
pop esi
pop ecx
pop ecx
ret 4

Function at 0x41db4e
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ecx
cmp byte [ecx + 0x60], 0
mov byte [ecx + 0x34], 1
je 0x41dc01
mov eax, dword [0x4ca4cc]
test eax, eax
jne 0x41dbff
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x41dbdd
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x41dbdd
mov ecx, dword [ebx + 0x20]
lea ebp, [ecx + esi*4]
add ebp, edx
lea ebp, [ebp - 4]
mov ecx, 0xc121b087
mov edi, dword [ebp]
dec esi
add edi, edx
mov dword [esp + 0x10], ecx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x41dbd9
mov edx, dword [esp + 0x10]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x41dbb6
mov dword [esp + 0x10], edx
cmp dword [esp + 0x10], 0xda2d5bfb
mov edx, dword [eax + 0x18]
je 0x41dbe1
test esi, esi
jne 0x41db99
mov eax, dword [eax]
jmp 0x41db7a
mov eax, dword [ebx + 0x24]
pop edi
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop esi
pop ebp
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4ca4cc], eax
call eax
xor al, al
pop ecx
ret 0xc
Function at 0x41e2b5
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ecx
cmp byte [ecx + 0x15], 0
mov byte [ecx + 0x14], 1
je 0x41e368
mov eax, dword [0x4ca4bc]
test eax, eax
jne 0x41e366
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x41e344
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x41e344
mov ecx, dword [ebx + 0x20]
lea ebp, [ecx + esi*4]
add ebp, edx
lea ebp, [ebp - 4]
mov ecx, 0x9ddb7863
mov edi, dword [ebp]
dec esi
add edi, edx
mov dword [esp + 0x10], ecx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x41e340
mov edx, dword [esp + 0x10]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x41e31d
mov dword [esp + 0x10], edx
cmp dword [esp + 0x10], 0xf6e76a9f
mov edx, dword [eax + 0x18]
je 0x41e348
test esi, esi
jne 0x41e300
mov eax, dword [eax]
jmp 0x41e2e1
mov eax, dword [ebx + 0x24]
pop edi
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop esi
pop ebp
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4ca4bc], eax
call eax
xor al, al
pop ecx
ret 0xc

Function at 0x41e767
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [ecx]
movzx edx, byte [eax]
sub edx, 1
je 0x41e835
sub edx, 1
je 0x41e830
cmp dword [ecx + 0xc], 0
je 0x41e83b
mov eax, dword [0x4ca4e4]
test eax, eax
jne 0x41e82b
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x41e809
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x41e809
mov ecx, dword [ebx + 0x20]
lea ebp, [ecx + esi*4]
add ebp, edx
lea ebp, [ebp - 4]
mov ecx, 0xe1dfef8e
mov edi, dword [ebp]
dec esi
add edi, edx
mov dword [esp + 0x10], ecx
mov cl, byte [edi]
inc edi
test cl, cl
je 0x41e805
mov edx, dword [esp + 0x10]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x41e7e2
mov dword [esp + 0x10], edx
cmp dword [esp + 0x10], 0xb05506f8
mov edx, dword [eax + 0x18]
je 0x41e80d
test esi, esi
jne 0x41e7c5
mov eax, dword [eax]
jmp 0x41e7a6
mov eax, dword [ebx + 0x24]
pop edi
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop esi
pop ebp
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4ca4e4], eax
add esp, 4
jmp eax
mov eax, dword [ecx + 8]
pop ecx
ret
mov eax, dword [ecx + 4]
add eax, 0x28
pop ecx
ret
Function at 0x41eb0b
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, dword [ebx]
je 0x41ebd7
mov eax, dword [0x4ca4b4]
test eax, eax
jne 0x41ebd5
mov eax, dword fs:[0x30]
push ebp
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [esp + 0x1c], ecx
cmp ecx, edx
je 0x41ebb1
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x41ebb1
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, edx
sub ecx, 4
mov dword [esp + 0x14], 0x87aa75a2
dec edi
mov dword [esp + 0x18], ecx
mov ebp, dword [ecx]
add ebp, edx
mov bl, byte [ebp]
inc ebp
mov byte [esp + 0x13], bl
test bl, bl
je 0x41ebad
mov cl, bl
mov ebx, dword [esp + 0x14]
movsx ecx, cl
xor ecx, ebx
imul ebx, ecx, 0x1000193
mov cl, byte [ebp]
inc ebp
test cl, cl
jne 0x41eb84
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0x6223acb4
mov ebx, dword [esp + 0x24]
je 0x41ebb5
mov ecx, dword [esp + 0x18]
test edi, edi
jne 0x41eb5e
mov eax, dword [eax]
jmp 0x41eb3b
mov ebp, dword [esp + 0x1c]
mov eax, dword [ebp + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebp + 0x1c]
pop edi
pop ebp
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4ca4b4], eax
call eax
mov eax, dword [esi]
movzx eax, byte [eax]
sub eax, 1
je 0x41ebf6
sub eax, 1
je 0x41ebee
mov eax, dword [esi + 0xc]
cmp eax, dword [ebx + 0xc]
jmp 0x41ebfc
mov eax, dword [esi + 8]
cmp eax, dword [ebx + 8]
jmp 0x41ebfc
mov eax, dword [esi + 4]
cmp eax, dword [ebx + 4]
pop esi
sete al
pop ebx
add esp, 0x10
ret 4
Function at 0x420172
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
mov bl, byte [ecx]
movzx eax, bl
sub eax, 4
je 0x42027f
sub eax, 1
je 0x420263
sub eax, 1
je 0x420254
sub eax, 1
je 0x420243
mov eax, dword [0x4ca4d4]
test eax, eax
jne 0x42023d
mov eax, dword fs:[0x30]
push ebp
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov edi, dword [ecx + edx + 0x78]
add edi, edx
cmp edi, edx
je 0x42021c
mov esi, dword [edi + 0x18]
test esi, esi
je 0x42021c
mov ecx, dword [edi + 0x20]
lea ebp, [ecx + esi*4]
add ebp, edx
lea ebp, [ebp - 4]
mov ecx, 0x5d3f954f
mov ebx, dword [ebp]
dec esi
add ebx, edx
mov dword [esp + 0x10], ecx
mov cl, byte [ebx]
inc ebx
test cl, cl
je 0x420218
mov edx, dword [esp + 0x10]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [ebx]
inc ebx
test cl, cl
jne 0x4201f5
mov dword [esp + 0x10], edx
cmp dword [esp + 0x10], 0xd0a4543
mov edx, dword [eax + 0x18]
je 0x420220
test esi, esi
jne 0x4201d8
mov eax, dword [eax]
jmp 0x4201b9
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [edi + 0x1c]
pop edi
pop esi
pop ebp
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4ca4d4], eax
pop ebx
add esp, 4
jmp eax
lea eax, [ecx + 8]
xor ecx, ecx
cmp bl, 7
cmove ecx, eax
cvttsd2si eax, qword [ecx]
jmp 0x42028d
lea eax, [ecx + 8]
xor ecx, ecx
cmp bl, 6
cmove ecx, eax
mov eax, dword [ecx]
jmp 0x42028d
cmp bl, 5
je 0x420271
cmp bl, 6
je 0x420271
xor bl, bl
jmp 0x420273
mov bl, 1
lea eax, [ecx + 8]
xor ecx, ecx
test bl, bl
cmovne ecx, eax
jmp 0x42025f
lea eax, [ecx + 8]
xor ecx, ecx
cmp bl, 4
cmove ecx, eax
movzx eax, byte [ecx]
mov dword [edx], eax
pop ebx
pop ecx
ret
Function at 0x420292
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, ecx
mov ebx, edx
mov dword [esp + 0x14], ebx
cmp byte [ebp], 3
je 0x420368
mov eax, dword [0x4ca4e0]
test eax, eax
jne 0x42035c
mov eax, dword fs:[0x30]
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x420338
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x420338
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [esp + 0x14], 0x43418d0b
dec esi
mov dword [esp + 0x18], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [esp + 0x13], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x420334
mov cl, byte [esp + 0x13]
mov edx, dword [esp + 0x14]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x42030d
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], 0x8253a1c7
mov edx, dword [eax + 0x18]
je 0x42033c
mov ecx, dword [esp + 0x18]
test esi, esi
jne 0x4202e3
mov eax, dword [eax]
jmp 0x4202c4
mov eax, dword [ebx + 0x24]
pop edi
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
mov ebx, dword [esp + 0x18]
pop esi
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4ca4e0], eax
call eax
cmp byte [ebp], 3
je 0x420368
xor eax, eax
jmp 0x42036b
mov eax, dword [ebp + 8]
push eax
mov ecx, ebx
call fcn.004142c0
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x4226e4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
mov edx, dword [esp + 8]
push edi
mov edi, ecx
not edx
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4a71c8]
inc edi
sub esi, 1
jne 0x4226f0
pop edi
not edx
pop esi
mov eax, edx
ret

Function at 0x42270f
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov edx, ebx
test edi, edi
je 0x422771
mov al, byte [esi]
dec edi
inc esi
cmp al, 0x23
jne 0x422739
cmp edi, 2
jb 0x422739
cmp byte [esi], al
jne 0x422739
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4a71c8]
test edi, edi
jne 0x422722
jmp 0x422778
cmp al, 0x23
jne 0x42275f
cmp byte [esi], al
jne 0x42275f
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4a71c8]
mov al, byte [esi]
inc esi
test al, al
jne 0x422751
pop edi
not edx
pop esi
mov eax, edx
pop ebx
ret
Function at 0x4228a6
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x4228c5
push 0x8e6
push str.D:_berserkde_berserkcsgoconquerLauncherloader_v1_v1imguiimgui.cpp
push str.filename__mode
call fcn.0047d739
add esp, 0xc
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4228d0
and dword [edi], 0
mov edx, 0x4a6c48
mov ecx, esi
call fcn.00422780
mov esi, eax
test esi, esi
je 0x42296e
push ebx
push ebp
push esi
call fcn.00479775
mov ebp, eax
pop ecx
cmp ebp, 0xffffffff
je 0x422963
push 2
push 0
push esi
call fcn.00478a7a
add esp, 0xc
test eax, eax
jne 0x422963
push esi
call fcn.00479775
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
je 0x422963
push 0
push ebp
push esi
call fcn.00478a7a
add esp, 0xc
test eax, eax
jne 0x422963
mov ecx, ebx
call fcn.00426614
mov ebp, eax
test ebp, ebp
je 0x422963
push esi
push ebx
push 1
push ebp
call fcn.0047861c
add esp, 0x10
push esi
cmp eax, ebx
je 0x422953
call fcn.00471580
pop ecx
mov ecx, ebp
call fcn.00426646
jmp 0x42296a
call fcn.00471580
pop ecx
test edi, edi
je 0x42295f
mov dword [edi], ebx
mov eax, ebp
jmp 0x42296c
push esi
call fcn.00471580
pop ecx
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x443272
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, str.D:_berserkde_berserkcsgoconquerLauncherloader_v1_v1imguiimgui_draw.cpp
push edi
cmp dword [esi + 0x2c], 0
jle 0x443288
cmp dword [esi + 0x30], 0
jg 0x44329b
push 0xa95
push ebx
push str.TexWidth___0__TexHeight___0
call fcn.0047d739
add esp, 0xc
mov edi, dword [esp + 0x10]
mov eax, 0xffff
cmp word [edi + 4], ax
jne 0x4432bd
push 0xa96
push ebx
push str.rect__IsPacked__
call fcn.0047d739
add esp, 0xc
movzx eax, word [edi + 4]
movd xmm1, eax
movzx eax, word [edi + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mulss xmm1, dword [esi + 0x34]
mov eax, dword [esp + 0x14]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [esi + 0x38]
movss dword [eax], xmm1
movss dword [eax + 4], xmm0
movzx eax, word [edi]
movzx ecx, word [edi + 4]
add ecx, eax
movzx eax, word [edi + 6]
movd xmm1, ecx
movzx ecx, word [edi + 2]
add ecx, eax
mov eax, dword [esp + 0x18]
cvtdq2ps xmm1, xmm1
pop edi
movd xmm0, ecx
mulss xmm1, dword [esi + 0x34]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [esi + 0x38]
pop esi
movss dword [eax], xmm1
pop ebx
movss dword [eax + 4], xmm0
ret 0xc

Function at 0x447d58
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push esi
call fcn.00447d43
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x447d83
and dword [esi], eax
pop esi
ret
Function at 0x454d33
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x454d56
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x454d44
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x45fa34
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x29], 0
je 0x45faa3
push ebx
push edi
push 0xffffffffffffffe5
pop edi
push 0xa
pop ebx
lea eax, [edi - 1]
movd xmm2, edi
lea edx, [edi - 3]
movd xmm0, eax
movd xmm3, edx
lea ecx, [edi - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [esi + edi + 0x1b]
punpcklbw xmm0, xmm0
movd xmm1, ecx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmmword [0x4b65b0]
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [esi + edi + 0x1b], xmm3
add edi, 4
sub ebx, 1
jne 0x45fa45
pop edi
pop ebx
mov byte [esi + 0x29], 0
pop esi
ret

Function at 0x45ff26
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0x38
mov eax, 0x49cc40
call fcn.0046c7ed
mov edi, ecx
cmp byte [edi], 0
mov ebx, dword [ebp + 8]
jne 0x45ff55
push 1
lea ecx, [ebp - 0x44]
mov byte [edi], 1
call fcn.004159ae
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
cmp byte [edi], 1
jne 0x45ff8b
mov esi, dword [edi + 8]
lea ecx, [ebp - 0x2c]
push ebx
call fcn.0041437c
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
call fcn.00460d63
lea ecx, [ebp - 0x2c]
mov esi, dword [eax]
call fcn.004151f6
lea eax, [esi + 0x28]
jmp 0x460030
mov eax, dword [0x4cad34]
test eax, eax
jne 0x46002e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov ecx, dword [edx + 0x3c]
mov ebx, dword [ecx + edx + 0x78]
add ebx, edx
cmp ebx, edx
je 0x460010
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x460010
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + esi*4]
add ecx, edx
sub ecx, 4
mov dword [ebp - 0x34], 0xd321feb1
dec esi
mov dword [ebp - 0x40], ecx
mov edi, dword [ecx]
add edi, edx
mov dl, byte [edi]
inc edi
mov byte [ebp - 0x2d], dl
test dl, dl
mov edx, dword [eax + 0x18]
je 0x46000c
mov cl, byte [ebp - 0x2d]
mov edx, dword [ebp - 0x34]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x45ffe8
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0x92018acd
mov edx, dword [eax + 0x18]
je 0x460014
mov ecx, dword [ebp - 0x40]
test esi, esi
jne 0x45ffc3
mov eax, dword [eax]
jmp 0x45ffa4
mov eax, dword [ebx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x4cad34], eax
call eax
call fcn.0046c79c
ret 4
Function at 0x460a0a
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x34
mov eax, dword [0x4c7080]
xor eax, esp
mov dword [esp + 0x30], eax
movaps xmm0, xmmword [0x4b6be0]
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0x10], ecx
push edi
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x30], 0x838492b7
mov ecx, ebx
mov dword [esp + 0x34], 0xc6c8c487
mov dword [esp + 0x38], 0xdcc6d6
mov byte [esp + 0x3c], 1
lea eax, [ecx - 0x31]
xor byte [esp + ecx + 0x20], al
inc ecx
cmp ecx, 0x1b
jb 0x45f8c7
sub esp, 0x18
mov byte [esp + 0x54], bl
lea eax, [esp + 0x38]
mov ecx, esp
push eax
call fcn.0041437c
mov esi, 0x4c7b50
mov ecx, esi
call fcn.004672fb
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0xeae0a8fe
mov word [esp + 0x1c], 0x100
call fcn.004127dc
sub esp, 0x18
lea eax, [esp + 0x30]
mov ecx, esp
push eax
call fcn.0041437c
mov ecx, esi
call fcn.004672fb
mov ecx, dword [0x4c7b7c]
test ecx, ecx
je 0x45f9f8
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, eax
mov dword [esp + 0x10], eax
mov ecx, eax
mov edx, dword [ebx + 0x18]
mov eax, dword [edx + 0x3c]
mov edi, dword [eax + edx + 0x78]
add edi, edx
cmp edi, edx
je 0x45f9b1
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x45f9ad
mov eax, dword [edi + 0x20]
lea ebp, [eax + ecx*4]
add ebp, edx
lea ebp, [ebp - 4]
mov eax, 0x712ab5ae
mov esi, dword [ebp]
dec ecx
add esi, edx
mov dword [esp + 0x18], eax
mov al, byte [esi]
inc esi
test al, al
je 0x45f9a9
mov edx, dword [esp + 0x18]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [esi]
inc esi
test al, al
jne 0x45f986
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], 0xaa5fb876
mov edx, dword [ebx + 0x18]
je 0x45f9e1
test ecx, ecx
jne 0x45f969
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx]
mov ebx, eax
cmp eax, ecx
je 0x45f9bf
cmp dword [ebx + 0x18], 0
jne 0x45f94a
xor eax, eax
push 0
call eax
mov eax, dword [esp + 0x18]
pop ecx
mov ecx, dword [esp + 0x40]
pop edi
mov eax, dword [eax]
pop esi
pop ebp
pop ebx
mov eax, dword [eax]
xor ecx, esp
call fcn.0046be79
add esp, 0x34
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x45f9c1
call fcn.0046aec5
int3
add ecx, 4
jmp 0x45f884