joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x438860
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22000]
push edi
or ebp, 0xffffffff
jmp 0x438882
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x438889
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x438878
mov eax, 1
add ebx, ebx
jne 0x43889b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x438890
jne 0x4388ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x438890
xor ecx, ecx
sub eax, 3
jb 0x4388c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x438932
mov ebp, eax
add ebx, ebx
jne 0x4388cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4388d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4388fc
inc ecx
add ebx, ebx
jne 0x4388e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4388dd
jne 0x4388f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4388dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43891c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43890d
jmp 0x43887e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43891c
add edi, ecx
jmp 0x43887e
pop esi
mov edi, esi
mov ecx, 0xe0e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43893a
cmp byte [edi], 0xa
jne 0x43893a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x43893f
lea edi, [esi + 0x36000]
mov eax, dword [edi]
or eax, eax
je 0x4389b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3820c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x382ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43896c
mov ecx, edi
jns 0x43899b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x382b0]
or eax, eax
je 0x4389b1
mov dword [ebx], eax
add ebx, 4
jmp 0x438989
call dword [esi + 0x382b4]
popal
jmp 0x41be59
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4033d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4e32e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x210]
push ecx
push eax
mov dword [ebp - 0x214], eax
call fcn.004072b0
add esp, 8
mov esi, 0x200
jmp 0x403410
lea edx, [ebp - 0x210]
push edx
call fcn.00407130
add esp, 4
cmp esi, edi
jbe 0x403425
mov esi, edi
push ebx
push esi
push 1
push eax
call fcn.0046cc7d
add dword [ebp - 0x210], eax
add esp, 0x10
sub edi, eax
je 0x403440
cmp eax, esi
je 0x403410
lea eax, [ebp - 0x210]
push eax
call fcn.004071d0
add esp, 4
test edi, edi
pop edi
pop esi
je 0x403478
mov ecx, dword [ebp - 0x214]
push 0xffffffffffffffff
push ecx
call fcn.00407e70
add esp, 8
test eax, eax
jne 0x403478
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004670fe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.004670fe
mov esp, ebp
pop ebp
ret

Function at 0x403790
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push esi
mov ebx, eax
call fcn.00407ae0
add esp, 4
dec eax
mov edi, 1
je 0x4037f6
jmp 0x4037b3
mov eax, dword [ebp - 8]
dec eax
push ebx
push esi
mov dword [ebp - 8], eax
call fcn.00407c40
add esp, 8
cmp eax, 3
jne 0x40380c
test edi, edi
je 0x4037e9
push ebx
push esi
call fcn.00407da0
fstp qword [esp]
mov eax, dword [ebp + 8]
push str._.14g
push eax
call fcn.0046aa7d
add esp, 0x10
test eax, eax
jg 0x403836
xor edi, edi
inc ebx
cmp dword [ebp - 8], 0
jne 0x4037b0
test edi, edi
je 0x40383d
push 1
push esi
call fcn.00408160
add esp, 8
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
push ecx
push ebx
push esi
call fcn.004077b0
add esp, 0xc
test edi, edi
je 0x4037e9
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push edx
push ecx
push 1
push eax
call fcn.00468e41
add esp, 0x10
cmp eax, dword [ebp - 4]
jne 0x4037e9
mov edi, 1
jmp 0x4037eb
push esi
call fcn.00407f70
call fcn.0046af70
mov edx, dword [eax]
push edx
call fcn.0046c446
push eax
push 0x4b4fa4
push esi
call fcn.004080a0
call fcn.0046af70
fild dword [eax]
add esp, 0xc
fstp qword [esp]
push esi
call fcn.00407f90
add esp, 0xc
pop edi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x58]
test ecx, ecx
je 0x409881
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x44], edx
mov eax, dword [eax + 0x58]
push 1
add eax, 4
push eax
call fcn.0046e930
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x28]
push eax
call edx
add esp, 4
push 1
call fcn.0046d423
int3
Function at 0x40d9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, edi
shr eax, 5
inc eax
mov ebx, edi
mov ecx, edi
cmp edi, eax
jb 0x40d9fe
jmp 0x40d9e0
mov edx, dword [ebp + 0xc]
movzx edx, byte [edx + ecx - 1]
mov esi, ebx
shl esi, 5
add edx, esi
mov esi, ebx
shr esi, 2
add edx, esi
sub ecx, eax
xor ebx, edx
cmp ecx, eax
jae 0x40d9e0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [eax]
dec ecx
and ecx, ebx
mov eax, dword [edx + ecx*4]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x40da7f
cmp dword [eax + 0xc], edi
jne 0x40da76
mov esi, dword [ebp + 0xc]
mov ecx, edi
lea edx, [eax + 0x10]
cmp edi, 4
jb 0x40da3f
mov eax, dword [esi]
cmp eax, dword [edx]
jne 0x40da73
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x40da28
mov eax, dword [ebp + 0x10]
test ecx, ecx
je 0x40daf2
mov al, byte [edx]
cmp al, byte [esi]
jne 0x40da73
cmp ecx, 1
jbe 0x40daf7
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x40da73
cmp ecx, 2
jbe 0x40daf7
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x40daf7
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x40da16
mov eax, dword [ebp + 8]
lea edx, [edi + 0x11]
push edx
push 0
push 0
push eax
call fcn.0040f150
mov ecx, dword [ebp + 0xc]
mov esi, eax
push edi
push ecx
lea edx, [esi + 0x10]
push edx
mov dword [esi + 0xc], edi
mov dword [esi + 8], ebx
mov word [esi + 4], 4
mov byte [esi + 6], 0
call fcn.00467590
mov edx, dword [ebp + 8]
mov byte [esi + edi + 0x10], 0
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 8]
mov edi, dword [eax]
dec ecx
and ecx, ebx
mov edi, dword [edi + ecx*4]
mov dword [esi], edi
mov edi, dword [eax]
mov dword [edi + ecx*4], esi
inc dword [eax + 4]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
add esp, 0x1c
cmp ecx, eax
jle 0x40daf0
cmp eax, 0x3ffffffe
jg 0x40daf0
add eax, eax
push eax
push edx
call fcn.0040d920
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x417380
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48da9b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4e32e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov edx, 1
test eax, eax
mov dword [esi], vtable.dbc::PreAllocHeap_class_dbc::dstrbuf_.0
push 0x80000fa0
cmovne edx, eax
mov dword [esi + 4], 0
lea eax, [esi + 0x18]
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
push eax
mov byte [esi + 0x10], 0
mov dword [esi + 0x14], 0xfa0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [esi + 0x10], 1
mov dword [esi + 0x30], 0
lea ecx, [esi + 0x38]
push 0
mov dword [ebp - 4], 0
mov dword [esi + 0x34], 0
call fcn.00448a60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x417420
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e29b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4e32e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 0xc]
mov esi, 1
test eax, eax
mov dword [edi], vtable.dbc::PreAllocHeap_class_dbc::dstrbuf_.0
mov edx, esi
cmovne edx, eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [edi + 4], edx
push 0x80000fa0
cmovne esi, eax
lea eax, [edi + 0x18]
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
push eax
mov byte [edi + 0x10], 0
mov dword [edi + 0x14], 0xfa0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [edi + 0x10], 1
mov dword [edi + 0x30], 0
lea ecx, [edi + 0x38]
push 0
mov dword [ebp - 4], 0
mov dword [edi + 0x34], 0
call fcn.00448a60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x42f2d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c10e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4e32e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
lea ecx, [edi + 4]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.004372f0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
lea ecx, [edi + 0x24]
mov dword [ebp - 0x10], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.004372f0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
mov byte [ebp - 4], 2
je 0x42f3e4
test dl, 0x10
jne 0x42f3e4
mov eax, 1
jmp 0x42f3e6
xor eax, eax
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
push dword [esi + 0x18]
call fcn.00439ce0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4394b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x4394e1
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4394d0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x43cf10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d14b
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x4e32e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x814], 0xf
mov dword [ebp - 0x818], 0
mov byte [ebp - 0x828], 0
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 0
push eax
call fcn.00460430
add esp, 4
lea ecx, [ebp - 0x828]
push 0xe
push str.exception.txt
call fcn.0041eb10
cmp dword [ebp - 0x814], 0x10
lea eax, [ebp - 0x828]
push 0x4b2dcc
cmovae eax, dword [ebp - 0x828]
push eax
lea eax, [ebp - 0x82c]
mov dword [ebp - 0x82c], 0
push eax
call fcn.00468ca3
add esp, 0xc
test eax, eax
jne 0x43d03e
cmp dword [ebp - 0x82c], eax
je 0x43d03e
push 0x7ff
push eax
mov byte [ebp - 0x810], al
lea eax, [ebp - 0x80f]
push eax
call fcn.00467be0
push esi
push ebx
push edi
push str.02:16:16
push str.Oct__5_2023
push str._s__s_file:__s__func:__s__error:__s_r_n
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.00467014
lea ecx, [ebp - 0x810]
add esp, 0x30
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43d012
push dword [ebp - 0x82c]
sub ecx, edx
lea eax, [ebp - 0x810]
push 1
push ecx
push eax
call fcn.00468e41
push dword [ebp - 0x82c]
call fcn.00468b53
add esp, 0x14
cmp dword [ebp - 0x814], 0x10
jb 0x43d055
push dword [ebp - 0x828]
call fcn.004664c4
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004670fe
mov esp, ebp
pop ebp
ret

Function at 0x43e0d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48da9b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4e32e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov edx, 1
test eax, eax
mov dword [esi], vtable.dbc::PreAllocHeap_class_Invited_.0
push 0x80000fa0
cmovne edx, eax
mov dword [esi + 4], 0
lea eax, [esi + 0x18]
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
push eax
mov byte [esi + 0x10], 0
mov dword [esi + 0x14], 0xfa0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [esi + 0x10], 1
mov dword [esi + 0x30], 0
lea ecx, [esi + 0x38]
push 0
mov dword [ebp - 4], 0
mov dword [esi + 0x34], 0
call fcn.00448a60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43e170
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e29b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4e32e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 0xc]
mov esi, 1
test eax, eax
mov dword [edi], vtable.dbc::PreAllocHeap_class_Invited_.0
mov edx, esi
cmovne edx, eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [edi + 4], edx
push 0x80000fa0
cmovne esi, eax
lea eax, [edi + 0x18]
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
push eax
mov byte [edi + 0x10], 0
mov dword [edi + 0x14], 0xfa0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [edi + 0x10], 1
mov dword [edi + 0x30], 0
lea ecx, [edi + 0x38]
push 0
mov dword [ebp - 4], 0
mov dword [edi + 0x34], 0
call fcn.00448a60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x43e410
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d2f3
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4e32e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.dbc::Task.0
lea eax, [esi + 0x18]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 0
push 0x80000fa0
push eax
mov dword [ebp - 0x40], esi
mov byte [esi + 0x10], 0
mov dword [esi + 0x14], 0xfa0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [esi + 0x10], 1
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
cmp byte [esi + 0x10], 0
mov dword [ebp - 4], 0
jne 0x43e4a6
mov eax, dword [esi + 0x14]
sub eax, 0x80000000
push eax
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [esi + 0x10], 1
mov al, byte [esi + 0x10]
test al, al
jne 0x43e53e
push str.File:
lea ecx, [ebp - 0x58]
call fcn.00417840
push 0x4b2fd8
push eax
mov byte [ebp - 4], 1
call fcn.00418690
push str._Line:
push eax
call fcn.00418690
mov esi, eax
lea eax, [ebp - 0x3c]
push 0xa
push eax
push 0
push 0xd7
call fcn.00466d31
lea eax, [ebp - 0x3c]
push eax
push esi
call fcn.00418690
push str._desc:
push eax
call fcn.00418690
push 0x4b2fb0
push eax
call fcn.00418690
add esp, 0x38
cmp dword [eax], 0
jne 0x43e51b
mov eax, 0x491578
jmp 0x43e520
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
push eax
lea ecx, [ebp - 0x50]
call fcn.00417930
push 0x4dc63c
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], vtable.dbc::excpSync.0
push eax
call fcn.0046710d
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004670fe
mov esp, ebp
pop ebp
ret
Function at 0x443050
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48da9b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4e32e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov edx, 1
test eax, eax
mov dword [esi], vtable.dbc::PreAllocHeap_class_Chat_Player_.0
push 0x80000fa0
cmovne edx, eax
mov dword [esi + 4], 0
lea eax, [esi + 0x18]
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
push eax
mov byte [esi + 0x10], 0
mov dword [esi + 0x14], 0xfa0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [esi + 0x10], 1
mov dword [esi + 0x30], 0
lea ecx, [esi + 0x38]
push 0
mov dword [ebp - 4], 0
mov dword [esi + 0x34], 0
call fcn.00448a60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4430f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e29b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4e32e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 0xc]
mov esi, 1
test eax, eax
mov dword [edi], vtable.dbc::PreAllocHeap_class_Chat_Player_.0
mov edx, esi
cmovne edx, eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [edi + 4], edx
push 0x80000fa0
cmovne esi, eax
lea eax, [edi + 0x18]
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
push eax
mov byte [edi + 0x10], 0
mov dword [edi + 0x14], 0xfa0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [edi + 0x10], 1
mov dword [edi + 0x30], 0
lea ecx, [edi + 0x38]
push 0
mov dword [ebp - 4], 0
mov dword [edi + 0x34], 0
call fcn.00448a60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4431a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48da9b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4e32e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov edx, 1
test eax, eax
mov dword [esi], vtable.dbc::PreAllocHeap_class_Chat_Session_.0
push 0x80000fa0
cmovne edx, eax
mov dword [esi + 4], 0
lea eax, [esi + 0x18]
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
push eax
mov byte [esi + 0x10], 0
mov dword [esi + 0x14], 0xfa0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [esi + 0x10], 1
mov dword [esi + 0x30], 0
lea ecx, [esi + 0x38]
push 0
mov dword [ebp - 4], 0
mov dword [esi + 0x34], 0
call fcn.00448a60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x443240
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e29b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4e32e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 0xc]
mov esi, 1
test eax, eax
mov dword [edi], vtable.dbc::PreAllocHeap_class_Chat_Session_.0
mov edx, esi
cmovne edx, eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [edi + 4], edx
push 0x80000fa0
cmovne esi, eax
lea eax, [edi + 0x18]
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
push eax
mov byte [edi + 0x10], 0
mov dword [edi + 0x14], 0xfa0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [edi + 0x10], 1
mov dword [edi + 0x30], 0
lea ecx, [edi + 0x38]
push 0
mov dword [ebp - 4], 0
mov dword [edi + 0x34], 0
call fcn.00448a60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x446660
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48de97
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4e32e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x4466b4
mov dword [edi], 0x4b3940
mov dword [edi + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [edi]
lea esi, [edi + 4]
push 0
push esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.004475a0
mov eax, dword [edi]
mov dword [ebp - 4], 2
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::ostrstream.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.004464d0
lea eax, [esi + 4]
mov dword [esi], vtable.std::strstreambuf.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov dword [esi + 0x38], 0x20
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x44], 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4