joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e8b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x506054]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 0x20219
push 0
push str.SoftwareRazer_Chroma_SDK
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e94e
mov dword [esp + 0x24], eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], 4
push eax
push 0
push 0
push str.Update
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41e944
cmp dword [esp + 0x24], 1
jne 0x41e944
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 6
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004364d3
mov esp, ebp
pop ebp
ret
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x50f204]
cmp ecx, 3
ja case.default.0x41e959
jmp dword [ecx*4 + 0x41ea9c]
mov eax, dword [0x50ee48]
or eax, dword [0x50ee4c]
je case.0x41e959.0
call dword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
push 0
push 0x989680
mov esi, edx
mov edi, eax
push esi
push edi
call fcn.00436fa0
push 0
push 0x989680
push edx
push eax
mov dword [esp + 0x24], eax
call fcn.00487700
sub edi, eax
push 0
push 0xa
sbb esi, edx
push esi
push edi
call fcn.00436fa0
cdq
mov ebx, 0x1a9fbe77
mov edi, eax
mov ecx, edx
mul ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x28], eax
mov esi, edx
mov eax, edi
mov dword [esp + 0x24], ecx
mov edx, 0x624dd2f
mul edx
mov edi, eax
mov dword [esp + 0x28], edx
mov eax, ecx
mul ebx
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 0x24]
mov edx, 0x624dd2f
mul edx
add ecx, esi
mov esi, 0x3e8
mov dword [esp + 0x20], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [esp + 0x28]
adc ecx, 0
mov dword [esp + 0x18], edi
mov edi, dword [esp + 0x10]
xor eax, eax
add ebx, ecx
mov ecx, dword [esp + 0x20]
adc eax, eax
add ecx, ebx
mov ebx, dword [esp + 0x24]
adc edx, eax
mov eax, dword [esp + 0x14]
sub edi, ecx
sbb ebx, edx
shrd edi, ebx, 1
shr ebx, 1
add edi, ecx
adc ebx, edx
cdq
mov ecx, eax
mov eax, edx
mul esi
shrd edi, ebx, 9
mov esi, eax
mov eax, ecx
mov ecx, 0x3e8
shr ebx, 9
mul ecx
add esi, edx
add edi, eax
adc ebx, esi
cmp dword [0x50ee4c], ebx
ja 0x41ea81
jb 0x41ea5a
cmp dword [0x50ee48], edi
jae 0x41ea81
xor ecx, ecx
xorps xmm0, xmm0
mov dword [0x50f204], ecx
mov eax, ecx
movlpd qword [0x50ee48], xmm0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004364d3
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x50f204]
pop edi
mov eax, ecx
mov ecx, dword [esp + 0x30]
pop esi
pop ebx
xor ecx, esp
call fcn.004364d3
mov esp, ebp
pop ebp
ret
Function at 0x42d000
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x50f2bc]
test eax, eax
je 0x42d099
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x42d027
mov dword [0x50f2bc], 0
xor eax, eax
ret
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x50e588]
cmp eax, dword [ecx + 4]
jle 0x42d082
push 0x50e588
call fcn.00436657
add esp, 4
cmp dword [0x50e588], 0xffffffff
jne 0x42d082
push 0x210
push 0
push 0x50e378
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call fcn.0040a390
push 0x4be580
call fcn.00436969
push 0x50e588
call fcn.0043660d
add esp, 8
push 0x10e
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, 0x50e378
call fcn.0040aab0
xor eax, eax
ret
Function at 0x435460
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x43546c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00435480

Function at 0x435750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x435775
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x43578d
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x4357bc
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x4357fe
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x4358d2
sub edx, 0x10000
js 0x4358d2
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x4357e4
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x4357e4
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x435855
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x435852
add edx, 8
jne 0x435839
jmp 0x4358c3
add edx, 4
test eax, 0xffff
jne 0x435862
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x4358c3
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x435896
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x4357e4
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x4358d2
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x4357e4
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x4358e3
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4371d3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x437212
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x437212
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x437212
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x437212
cmp dword [ecx + 0x74], 0xe
jbe 0x437212
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x448110
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x448124
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push 0xd8
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov ecx, dword [esi + 8]
add esp, 8
mov dword [esi + 4], eax
mov dword [eax + 0x50], ecx
mov ecx, dword [esi + 8]
pop esi
cmp ecx, 0xe0
jne 0x448182
mov dword [eax + 0x10], 0xc1059ed8
mov dword [eax + 0x14], 0x367cd507
mov dword [eax + 0x18], 0x3070dd17
mov dword [eax + 0x1c], 0xf70e5939
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x68581511
mov dword [eax + 0x28], 0x64f98fa7
mov dword [eax + 0x2c], 0xbefa4fa4
ret
cmp ecx, 0x100
jne 0x4481c3
mov dword [eax + 0x10], 0x6a09e667
mov dword [eax + 0x14], 0xbb67ae85
mov dword [eax + 0x18], 0x3c6ef372
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0x510e527f
mov dword [eax + 0x24], 0x9b05688c
mov dword [eax + 0x28], 0x1f83d9ab
mov dword [eax + 0x2c], 0x5be0cd19
ret
cmp ecx, 0x180
jne 0x44823c
mov dword [eax + 0x10], 0xc1059ed8
mov dword [eax + 0x14], 0xcbbb9d5d
mov dword [eax + 0x18], 0x367cd507
mov dword [eax + 0x1c], 0x629a292a
mov dword [eax + 0x20], 0x3070dd17
mov dword [eax + 0x24], 0x9159015a
mov dword [eax + 0x28], 0xf70e5939
mov dword [eax + 0x2c], 0x152fecd8
mov dword [eax + 0x30], 0xffc00b31
mov dword [eax + 0x34], 0x67332667
mov dword [eax + 0x38], 0x68581511
mov dword [eax + 0x3c], 0x8eb44a87
mov dword [eax + 0x40], 0x64f98fa7
mov dword [eax + 0x44], 0xdb0c2e0d
mov dword [eax + 0x48], 0xbefa4fa4
mov dword [eax + 0x4c], 0x47b5481d
ret
mov dword [eax + 0x10], 0xf3bcc908
mov dword [eax + 0x14], 0x6a09e667
mov dword [eax + 0x18], 0x84caa73b
mov dword [eax + 0x1c], 0xbb67ae85
mov dword [eax + 0x20], 0xfe94f82b
mov dword [eax + 0x24], 0x3c6ef372
mov dword [eax + 0x28], 0x5f1d36f1
mov dword [eax + 0x2c], 0xa54ff53a
mov dword [eax + 0x30], 0xade682d1
mov dword [eax + 0x34], 0x510e527f
mov dword [eax + 0x38], 0x2b3e6c1f
mov dword [eax + 0x3c], 0x9b05688c
mov dword [eax + 0x40], 0xfb41bd6b
mov dword [eax + 0x44], 0x1f83d9ab
mov dword [eax + 0x48], 0x137e2179
mov dword [eax + 0x4c], 0x5be0cd19
ret
Function at 0x448400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b96b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0x100
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x100
mov dword [esi + 0x3c], 0
call fcn.004369a1
mov dword [esi + 0x40], eax
add esp, 4
mov dword [esi + 0x44], 2
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [esi + 0x48], eax
mov eax, esi
mov dword [esi], vtable.Poco::DigestBuf.0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x452200
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x452210
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x45222f
push 0
push 0x5e
push str.c:users_fandredocumentsgitpoco_1.10_foundation_src_file_win32u.cpp
push str.__path.empty__
call fcn.004418f0
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x45223a
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x452266
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0x13
ja case.0x45225b.4
movzx eax, byte [eax + 0x45227c]
jmp dword [eax*4 + 0x452274]
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.00452390
nop
bound esp, qword [edx]
inc ebp
add byte [edx + 0x22], ch
inc ebp
add byte [eax], al
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add bh, bh
invalid
je 0x4522b7
add al, 0xe8
pop es
add byte [eax], al
add byte [ebx - 0x3dfbdbbc], cl
add al, 0
add byte [eax + 0x38], ch
fmul dword [eax + eax - 0x18]
idiv dh
inc dword [ebx + 0x7e8310c4]
xor byte [eax], cl
Function at 0x452390
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b9a78
push eax
mov dword fs:[0], esp
sub esp, 0x84
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x10b
ja 0x452568
je case.0x4523de.123
lea eax, [esi - 2]
cmp eax, 0xcc
ja case.0x4523de.4
movzx eax, byte [eax + 0x452604]
jmp dword [eax*4 + 0x4525c8]
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00437e30
push 0x4fa298
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00437d10
push 0x4fa370
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00437de0
push 0x4fa250
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.004379a0
push 0x4fa3b8
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00437ad0
push 0x4fa4d8
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.004388f0
push 0x4fa448
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00438570
push 0x4fa490
lea eax, [ebp - 0x38]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.sharing_violation
lea ecx, [ebp - 0x24]
call fcn.0040c140
mov dword [ebp - 4], 0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x64]
call fcn.00437d60
push 0x4fa20c
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.lock_violation
lea ecx, [ebp - 0x24]
call fcn.0040c140
mov dword [ebp - 4], 1
jmp 0x4524af
push str.EOF_reached
lea ecx, [ebp - 0x24]
call fcn.0040c140
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x64]
call fcn.00438540
push 0x4fa490
jmp 0x4524c4
push str.disk_is_full
lea ecx, [ebp - 0x24]
call fcn.0040c140
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x64]
call fcn.004388c0
push 0x4fa448
jmp 0x4524c4
push str.negative_seek
lea ecx, [ebp - 0x24]
call fcn.0040c140
mov dword [ebp - 4], 4
jmp 0x4524af
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.00438480
push 0x4fa184
jmp 0x4524c4
cmp esi, 0x781
je case.0x4523de.3
cmp esi, 0x1779
je 0x452597
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x90]
call fcn.00437d90
push 0x4fa20c
lea eax, [ebp - 0x90]
jmp 0x4524c7
push 0x1779
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.00437e80
push 0x4fa328
jmp 0x4524c4
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.00438430
push 0x4fa2e0
jmp 0x4524c4
Function at 0x457630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9bf2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xd]
push esi
push edi
mov edi, ecx
push eax
mov dword [ebp - 0x14], edi
push ebx
mov dword [ebp - 0x18], 0
call fcn.0043e870
lea esi, [edi + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], esi
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.004364e1
mov dword [esi], eax
add esp, 4
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
movzx eax, byte [ebx + 0x1c]
mov byte [edi + 0x1c], al
movzx eax, byte [ebx + 0x1d]
mov byte [edi + 0x1d], al
cmp byte [ebx + 0x30], 0
mov byte [ebp - 4], 1
jne 0x4576ee
mov ecx, dword [ebx + 0x20]
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
test ecx, ecx
je 0x4576e4
mov eax, 1
lock xadd dword [ecx], eax
lea edx, [ebp - 0x20]
mov ebx, 1
jmp 0x457701
push 0
lea ecx, [ebp - 0x28]
call fcn.004510b0
mov edx, eax
mov ebx, 2
mov ecx, dword [edx]
mov dword [edi + 0x20], ecx
mov eax, dword [edx + 4]
mov dword [edi + 0x24], eax
mov dword [edx], 0
mov dword [edx + 4], 0
or eax, 0xffffffff
mov dword [ebp - 4], 3
test bl, 2
je 0x457770
mov ecx, dword [ebp - 0x28]
and ebx, 0xfffffffd
test ecx, ecx
je 0x457770
lock xadd dword [ecx], eax
add eax, 0xffffffff
jne 0x45776d
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x457746
mov eax, dword [ecx]
push 1
call dword [eax]
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x24], 0
test esi, esi
je 0x457766
mov ecx, esi
call fcn.00437810
push 4
push esi
call fcn.00436511
add esp, 8
mov dword [ebp - 0x28], 0
or eax, 0xffffffff
test bl, 1
je 0x4577a4
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x4577a4
lock xadd dword [esi], eax
add eax, 0xffffffff
jne 0x4577a4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x457792
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, esi
call fcn.00437810
push 4
push esi
call fcn.00436511
add esp, 8
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 5
mov al, byte [ecx + 0x30]
mov byte [edi + 0x30], al
lea eax, [ecx + 8]
push eax
mov ecx, edi
call fcn.00458010
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4577e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9c08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.0043f960
mov dword [edi], eax
lea esi, [edi + 8]
mov dword [ebp - 4], 0
push 8
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.004364e1
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [esi], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov al, cl
and al, 1
shr ecx, 1
mov byte [edi + 0x1c], al
and cl, 1
mov byte [edi + 0x1d], cl
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov byte [edi + 0x30], 0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x459310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9d5e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.0045c2f0
lea esi, [edi + 4]
mov dword [edi], vtable.Poco::JSON::ParseHandler.0
push 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.004364e1
mov dword [esi], eax
add esp, 4
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov byte [edi + 0x18], 0
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 2
call fcn.00437800
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0x34], al
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x45dba0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba1c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
mov edi, dword [eax + 4]
cmp dword [eax + 8], edi
je 0x45dd82
push esi
mov esi, dword [ebp + 0x10]
push esi
cmp ecx, edi
jne 0x45dc1a
mov ecx, edi
mov dword [ebp - 0x18], edi
call fcn.0040ff90
lea eax, [esi + 0x18]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x18]
call fcn.0040ff90
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
pop esi
pop edi
add dword [eax + 4], 0x30
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x48]
call fcn.0040ff90
lea eax, [esi + 0x18]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x30]
call fcn.0040ff90
mov eax, dword [ebp - 0x14]
lea esi, [edi - 0x30]
push esi
push edi
push eax
call fcn.00444830
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov ecx, dword [ebp - 0x10]
add dword [eax + 4], 0x30
cmp ecx, esi
je 0x45dd51
lea esi, [edi - 4]
nop dword [eax + eax]
lea esi, [esi - 0x30]
lea eax, [esi - 0x2c]
lea edi, [esi + 4]
cmp edi, eax
je 0x45dcd7
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x45dca0
mov eax, dword [edi]
inc ecx
cmp ecx, 0x1000
jb 0x45dc96
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45dd7c
mov eax, edx
push ecx
push eax
call fcn.00436511
add esp, 8
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xf
mov byte [edi], 0
movups xmm0, xmmword [esi - 0x2c]
movups xmmword [edi], xmm0
movq xmm0, qword [esi - 0x1c]
movq qword [edi + 0x10], xmm0
mov dword [esi - 0x1c], 0
mov dword [esi - 0x18], 0xf
mov byte [esi - 0x2c], 0
lea edi, [esi + 0x1c]
lea eax, [esi - 0x14]
cmp edi, eax
je 0x45dd46
mov ecx, dword [esi + 0x30]
cmp ecx, 0x10
jb 0x45dd10
mov eax, dword [edi]
inc ecx
cmp ecx, 0x1000
jb 0x45dd06
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45dd7c
mov eax, edx
push ecx
push eax
call fcn.00436511
add esp, 8
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0xf
mov byte [edi], 0
movups xmm0, xmmword [esi - 0x14]
movups xmmword [edi], xmm0
movq xmm0, qword [esi - 4]
movq qword [edi + 0x10], xmm0
mov dword [esi - 4], 0
mov dword [esi], 0xf
mov byte [esi - 0x14], 0
lea eax, [esi - 0x2c]
cmp ecx, eax
jne 0x45dc60
lea eax, [ebp - 0x48]
push eax
call fcn.0045d8f0
lea ecx, [ebp - 0x48]
call fcn.0042c720
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
pop esi
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push dword [ebp + 0x10]
push ecx
mov ecx, eax
call fcn.0045d960
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], eax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x465ca0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bac98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push esi
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push edi
push 0
push esi
call fcn.0045c5a0
push 4
push 0
push 0
push 0x400
push 0x50d500
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0045cc90
push eax
lea ecx, [ebp - 0x10]
call fcn.0045c8b0
push eax
call dword [sym.imp.WS2_32.dll_getnameinfo]
mov edi, eax
test edi, edi
jne 0x465d5a
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x4c]
push eax
push edi
push 0x50d500
movups xmmword [ebp - 0x3c], xmm0
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
test edi, edi
jne 0x465d70
push dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
call fcn.00465300
push dword [ebp - 0x14]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
lea ecx, [ebp - 0x10]
call fcn.0040d450
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.00464a40
push eax
push edi
mov byte [ebp - 4], 2
call fcn.00465780
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.00464a40
push eax
push edi
mov byte [ebp - 4], 1
call fcn.00465780
int3

Function at 0x465d90
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x2c]
xorps xmm0, xmm0
push esi
mov esi, dword [esp + 0x2c]
movups xmmword [esp + 4], xmm0
mov dword [esp + 4], eax
mov eax, esi
movups xmmword [esp + 0x14], xmm0
cmp dword [esi + 0x14], 0x10
jb 0x465db7
mov eax, dword [esi]
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 8]
push ecx
push 0
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x465dee
push dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
call fcn.00465300
push dword [esp + 0x30]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, dword [esp + 0x28]
pop esi
add esp, 0x20
ret
push esi
push eax
call fcn.00465780
int3

Function at 0x468130
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x468166
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x468166
jne 0x46815d
cmp dword [esp + 8], 2
jb 0x468166
xor al, al
add esp, 0x94
ret
mov al, 1
add esp, 0x94
ret