joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b650
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4d1b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x67412c
call fcn.0048acf0
test eax, eax
jne 0x41b716
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xb0
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x41b6c3
mov ecx, dword [ebp - 0x1c]
call fcn.004c3630
mov dword [ebp - 0x20], eax
jmp 0x41b6ca
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x41b6f0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x41b708
push 0x6388b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x67412c
call fcn.0041bae0
mov ecx, 0x67412c
call fcn.0048acf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41b740
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f86bb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x674128
call fcn.0048acf0
test eax, eax
jne 0x41b803
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x70
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x41b7b0
mov ecx, dword [ebp - 0x1c]
call fcn.004c6ca0
mov dword [ebp - 0x20], eax
jmp 0x41b7b7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x41b7dd
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x41b7f5
push 0x6388d0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x674128
call fcn.0041bae0
mov ecx, 0x674128
call fcn.0048acf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b820
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2fbb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x674124
call fcn.0048acf0
test eax, eax
jne 0x41b8e3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x40
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x41b890
mov ecx, dword [ebp - 0x1c]
call fcn.004f3d30
mov dword [ebp - 0x20], eax
jmp 0x41b897
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x41b8bd
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x41b8d5
push 0x6388e8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x674124
call fcn.0041bae0
mov ecx, 0x674124
call fcn.0048acf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41b900
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e8bdb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x674120
call fcn.0048acf0
test eax, eax
jne 0x41b9c6
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x190
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x41b973
mov ecx, dword [ebp - 0x1c]
call fcn.004b0130
mov dword [ebp - 0x20], eax
jmp 0x41b97a
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x41b9a0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x41b9b8
push 0x638900
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
push edx
mov ecx, 0x674120
call fcn.0041bae0
mov ecx, 0x674120
call fcn.0048acf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425590
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e8acb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x673fd8], 0
jne 0x42566a
mov ecx, 0x674258
call fcn.00407e60
cmp dword [0x673fd8], 0
jne 0x425660
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x24
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x425612
mov ecx, dword [ebp - 0x1c]
call fcn.0042f7c0
mov dword [ebp - 0x20], eax
jmp 0x425619
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x42563f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x425657
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x673fd8], edx
mov ecx, 0x674258
call fcn.00407e20
mov eax, dword [0x673fd8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4344c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e3ebb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x673fe0], 0
jne 0x43459a
mov ecx, 0x674274
call fcn.00407e60
cmp dword [0x673fe0], 0
jne 0x434590
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x18
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x434542
mov ecx, dword [ebp - 0x1c]
call fcn.00432db0
mov dword [ebp - 0x20], eax
jmp 0x434549
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43456f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x434587
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x673fe0], edx
mov ecx, 0x674274
call fcn.00407e20
mov eax, dword [0x673fe0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x436b30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e3e8b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x673fe4], 0
jne 0x436c0a
mov ecx, 0x6742c8
call fcn.00407e60
cmp dword [0x673fe4], 0
jne 0x436c00
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x18
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x436bb2
mov ecx, dword [ebp - 0x1c]
call fcn.00436620
mov dword [ebp - 0x20], eax
jmp 0x436bb9
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x436bdf
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x436bf7
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x673fe4], edx
mov ecx, 0x6742c8
call fcn.00407e20
mov eax, dword [0x673fe4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436c30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e3e5b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x673fe8], 0
jne 0x436d0a
mov ecx, 0x6742ac
call fcn.00407e60
cmp dword [0x673fe8], 0
jne 0x436d00
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x18
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x436cb2
mov ecx, dword [ebp - 0x1c]
call fcn.004366a0
mov dword [ebp - 0x20], eax
jmp 0x436cb9
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x436cdf
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x436cf7
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x673fe8], edx
mov ecx, 0x6742ac
call fcn.00407e20
mov eax, dword [0x673fe8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x436d30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e770b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x673fec], 0
jne 0x436e0a
mov ecx, 0x674290
call fcn.00407e60
cmp dword [0x673fec], 0
jne 0x436e00
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x58
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x436db2
mov ecx, dword [ebp - 0x1c]
call fcn.004dac10
mov dword [ebp - 0x20], eax
jmp 0x436db9
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x436ddf
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x436df7
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x673fec], edx
mov ecx, 0x674290
call fcn.00407e20
mov eax, dword [0x673fec]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ad40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e76db
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x673ff0], 0
jne 0x43ae1d
mov ecx, 0x674300
call fcn.00407e60
cmp dword [0x673ff0], 0
jne 0x43ae13
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x98
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x43adc5
mov ecx, dword [ebp - 0x1c]
call fcn.004010e0
mov dword [ebp - 0x20], eax
jmp 0x43adcc
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43adf2
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x43ae0a
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x673ff0], edx
mov ecx, 0x674300
call fcn.00407e20
mov eax, dword [0x673ff0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43aec0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ed63b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x673ff4], 0
jne 0x43af9d
mov ecx, 0x6742e4
call fcn.00407e60
cmp dword [0x673ff4], 0
jne 0x43af93
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x90
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x43af45
mov ecx, dword [ebp - 0x1c]
call fcn.004391e0
mov dword [ebp - 0x20], eax
jmp 0x43af4c
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43af72
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x43af8a
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x673ff4], edx
mov ecx, 0x6742e4
call fcn.00407e20
mov eax, dword [0x673ff4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b3c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e663b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x673ff8], 0
jne 0x43b49a
mov ecx, 0x67431c
call fcn.00407e60
cmp dword [0x673ff8], 0
jne 0x43b490
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x50
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x43b442
mov ecx, dword [ebp - 0x1c]
call fcn.004dedb0
mov dword [ebp - 0x20], eax
jmp 0x43b449
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43b46f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x43b487
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x673ff8], edx
mov ecx, 0x67431c
call fcn.00407e20
mov eax, dword [0x673ff8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43f3e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e5aeb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x673ffc], 0
jne 0x43f4ba
mov ecx, 0x674338
call fcn.00407e60
cmp dword [0x673ffc], 0
jne 0x43f4b0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x68
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x43f462
mov ecx, dword [ebp - 0x1c]
call fcn.0043ef10
mov dword [ebp - 0x20], eax
jmp 0x43f469
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x43f48f
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x43f4a7
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x673ffc], edx
mov ecx, 0x674338
call fcn.00407e20
mov eax, dword [0x673ffc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4441d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e767b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x674000], 0
jne 0x4442ad
mov ecx, 0x674354
call fcn.00407e60
cmp dword [0x674000], 0
jne 0x4442a3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xa0
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x444255
mov ecx, dword [ebp - 0x1c]
call fcn.004df380
mov dword [ebp - 0x20], eax
jmp 0x44425c
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x444282
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x44429a
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x674000], edx
mov ecx, 0x674354
call fcn.00407e20
mov eax, dword [0x674000]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a9a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2c3b
mov eax, dword fs:[0]
push eax
mov eax, 0x1020
call fcn.005c2160
mov eax, dword [0x66d4f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x102c], ecx
push str._YWSMP_
push str.__xml_stylesheet_type_text_xsl__href_..XSLUserLog.xsl___
push str.__xml_version_1.0__encoding_gb2312____
push str._s_r_n_s_r_n_s_r_n
lea eax, [ebp - 0x1014]
push eax
call fcn.005bd49b
add esp, 0x14
lea ecx, [ebp - 0x1014]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00514290
add esp, 8
mov dword [ebp - 0x1018], 0
push 0x6318e0
mov eax, dword [ebp + 0xc]
push eax
call fcn.005bd438
add esp, 8
push eax
lea ecx, [ebp - 0x101c]
call fcn.00445e90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x101c]
call fcn.0048acf0
test eax, eax
je 0x44aad8
lea ecx, [ebp - 0x101c]
call fcn.0048acf0
push eax
call fcn.005bf210
add esp, 4
test eax, eax
jne 0x44aad8
lea ecx, [ebp - 0x101c]
call fcn.0048acf0
push eax
push 0x1000
push 1
lea ecx, [ebp - 0x1014]
push ecx
call fcn.005be7ff
add esp, 0x10
mov dword [ebp - 0x1020], eax
cmp dword [ebp - 0x1020], 0
jne 0x44aab9
mov dword [ebp - 0x1024], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x101c]
call fcn.00412e10
mov eax, dword [ebp - 0x1024]
jmp 0x44ab26
mov edx, dword [ebp - 0x1020]
push edx
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005141f0
add esp, 0xc
jmp 0x44aa4c
push str.__YWSMP_
push str._s_r_n
lea edx, [ebp - 0x1014]
push edx
call fcn.005bd49b
add esp, 0xc
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00514290
add esp, 8
mov dword [ebp - 0x1028], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x101c]
call fcn.00412e10
mov eax, dword [ebp - 0x1028]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bd2d7
mov esp, ebp
pop ebp
ret 8
Function at 0x454630
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f696b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66d4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x674004], 0
jne 0x45470a
mov ecx, 0x674370
call fcn.00407e60
cmp dword [0x674004], 0
jne 0x454700
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x70
call fcn.005a1aed
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4546b2
mov ecx, dword [ebp - 0x1c]
call fcn.004544e0
mov dword [ebp - 0x20], eax
jmp 0x4546b9
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jmp 0x4546df
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x4546f7
push 0x639e58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x14]
mov dword [0x674004], edx
mov ecx, 0x674370
call fcn.00407e20
mov eax, dword [0x674004]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e48f3
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x66d4f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0xb4]
push eax
call fcn.00508960
add esp, 4
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0xc0], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xc0]
call fcn.0040b520
push eax
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
push 0x62f0cc
push 0x80
lea edx, [ebp - 0x94]
push edx
call fcn.005bd516
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb4]
call fcn.0040b640
push 0x62f0e4
mov ecx, dword [ebp - 0xb8]
add ecx, 0x94
call fcn.0040b520
push eax
call fcn.005bd438
add esp, 8
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x4583a0
lea eax, [ebp - 0x94]
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp - 0xc4]
add ecx, 1
mov dword [ebp - 0xc8], ecx
mov edx, dword [ebp - 0xc4]
mov al, byte [edx]
mov byte [ebp - 0xc9], al
add dword [ebp - 0xc4], 1
cmp byte [ebp - 0xc9], 0
jne 0x4582e4
mov ecx, dword [ebp - 0xc4]
sub ecx, dword [ebp - 0xc8]
mov dword [ebp - 0xd0], ecx
mov edx, dword [ebp - 0x98]
push edx
push 1
mov eax, dword [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.005bd6b0
add esp, 0x10
mov edx, dword [ebp - 0x98]
push edx
push 1
mov ecx, dword [ebp + 8]
call fcn.0041e9f0
push eax
mov ecx, dword [ebp + 8]
call fcn.0040b520
push eax
call fcn.005bd6b0
add esp, 0x10
mov eax, dword [ebp - 0x98]
push eax
push 1
lea ecx, [ebp + 0xc]
call fcn.0041e9f0
push eax
lea ecx, [ebp + 0xc]
call fcn.0040b520
push eax
call fcn.005bd6b0
add esp, 0x10
mov ecx, dword [ebp - 0x98]
push ecx
push 1
push 2
push 0x62f0e8
call fcn.005bd6b0
add esp, 0x10
mov edx, dword [ebp - 0x98]
push edx
call fcn.005bd8f3
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040b640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bd2d7
mov esp, ebp
pop ebp
ret 0x20