joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455edd
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x467978], ebx
push esi
push edi
jne 0x455f5d
push str.user32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x455f98
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x467978], eax
je 0x455f98
push 0x45c42c
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x46797c], eax
call esi
cmp dword [0x4673cc], 2
mov dword [0x467980], eax
jne 0x455f5d
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x467988], eax
je 0x455f5d
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x467984], eax
mov eax, dword [0x467984]
test eax, eax
je 0x455fa2
call eax
test eax, eax
je 0x455f89
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x467988]
test eax, eax
je 0x455f89
test byte [ebp - 8], 1
jne 0x455fa2
cmp dword [0x4673d8], 4
jb 0x455f9c
or byte [ebp + 0x12], 0x20
jmp 0x455fc1
xor eax, eax
jmp 0x455fd1
or byte [ebp + 0x12], 4
jmp 0x455fc1
mov eax, dword [0x46797c]
test eax, eax
je 0x455fc1
call eax
mov ebx, eax
test ebx, ebx
je 0x455fc1
mov eax, dword [0x467980]
test eax, eax
je 0x455fc1
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x467978]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45705f
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0044c070
mov eax, dword [0x465718]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0044f7f5
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x457194
push 2
push esi
push dword [ebp + 8]
call fcn.0044f7f5
add esp, 0xc
cmp eax, ebx
je 0x457194
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x457134
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00449660
push 0x8000
push dword [ebp + 8]
call fcn.0044b20c
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x4570ea
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.0044faf0
add esp, 0xc
cmp eax, 0xffffffff
je 0x45710a
sub edi, eax
test edi, edi
jg 0x4570e2
jmp 0x457122
call fcn.0044d91e
cmp dword [eax], 5
jne 0x45711f
call fcn.0044d915
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.0044b20c
pop ecx
pop ecx
jmp 0x45717c
jge 0x45717c
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044f7f5
push dword [ebp + 8]
call fcn.0045089f
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x45717c
call fcn.0044d915
mov dword [eax], 0xd
call fcn.0044d91e
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.0044f7f5
add esp, 0xc
mov eax, esi
pop edi
jmp 0x457196
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044c969
leave
ret
Function at 0x457e67
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x457e80
or eax, 0xffffffff
jmp 0x457ee1
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x457edd
push 0x3d
push esi
call fcn.00458068
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x457edd
cmp esi, eax
je 0x457edd
xor ecx, ecx
cmp byte [eax + 1], cl
mov eax, dword [0x4673ec]
sete cl
cmp eax, dword [0x4673f0]
mov dword [ebp - 4], ecx
jne 0x457ec3
mov edi, eax
call fcn.00457e06
mov dword [0x4673ec], eax
cmp eax, ebx
jne 0x457f1c
cmp dword [ebp + 0xc], ebx
je 0x457ee5
cmp dword [0x4673f4], ebx
je 0x457ee5
call fcn.004571f2
test eax, eax
je 0x457f1c
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
je 0x457eee
xor eax, eax
jmp 0x457ee0
push 4
call fcn.00449adf
cmp eax, ebx
pop ecx
mov dword [0x4673ec], eax
je 0x457edd
mov dword [eax], ebx
cmp dword [0x4673f4], ebx
jne 0x457f1c
push 4
call fcn.00449adf
cmp eax, ebx
pop ecx
mov dword [0x4673f4], eax
je 0x457edd
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
mov ebx, dword [0x4673ec]
sub edi, esi
push esi
call fcn.00457db9
mov edi, eax
test edi, edi
pop ecx
jl 0x457f83
cmp dword [ebx], 0
je 0x457f83
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.00449c88
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x457f63
mov ecx, dword [ebp - 8]
mov dword [esi], ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x457fc4
mov ecx, dword [esi + 4]
inc edi
mov dword [esi], ecx
lea esi, [ebx + edi*4]
cmp dword [esi], eax
jne 0x457f5a
mov eax, edi
shl eax, 2
push eax
push dword [0x4673ec]
call fcn.0044d560
test eax, eax
mov esi, dword [ebp - 8]
pop ecx
pop ecx
je 0x457fc4
jmp 0x457fbf
cmp dword [ebp - 4], 0
jne 0x45802b
test edi, edi
jge 0x457f93
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x4673ec]
call fcn.0044d560
test eax, eax
pop ecx
pop ecx
je 0x457edd
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov ecx, dword [ebp + 8]
and dword [ecx], 0
mov dword [0x4673ec], eax
cmp dword [ebp + 0xc], 0
je 0x458016
push esi
call fcn.00449b00
inc eax
inc eax
push eax
call fcn.00449adf
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x458016
push esi
push edi
call fcn.00449b90
mov eax, edi
sub eax, esi
add eax, dword [ebp - 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov byte [eax], 0
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
test eax, eax
jne 0x45800f
or dword [ebp - 0x10], 0xffffffff
push edi
call fcn.00449c88
pop ecx
cmp dword [ebp - 4], 0
je 0x458023
push esi
call fcn.00449c88
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x457ee0
push esi
call fcn.00449c88
mov eax, dword [ebp + 8]
and dword [eax], 0
pop ecx
jmp 0x457eea
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x7cd60e97
nop
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x2dc15ce5
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x1000cfd0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x1000d029
test esi, esi
je 0x1000cffa
mov edx, dword [esp + 0x14]
test edx, edx
je 0x1000cffa
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x1000cffa
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x1000d045
pop edi
pop esi
mov dword [esp + 0x14], 0x4d
mov dword [esp + 0x10], str..cxarray.cpp
mov dword [esp + 0xc], 0x100b1398
mov dword [esp + 8], str.cvSetIPLAllocators
mov dword [esp + 4], 0xfffffffb
jmp sym.cxcore099.dll_cvError
test esi, esi
jne 0x1000cffa
mov edx, dword [esp + 0x14]
test edx, edx
jne 0x1000cffa
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x1000cffa
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x1000cffa
mov dword [0x100da688], edi
pop edi
mov dword [0x100da68c], esi
mov dword [0x100da690], edx
mov dword [0x100da694], ecx
mov dword [0x100da698], eax
pop esi
ret
Function at 0x10037a80
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 0x10]
test eax, eax
push edi
je 0x10037af1
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10037af1
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
push eax
mov eax, dword [esp + 0x18]
push eax
push ecx
push edx
call sym.cxcore099.dll_cvCreateSeq
add esp, 0x10
mov esi, eax
call sym.cxcore099.dll_cvGetErrStatus
test eax, eax
jge 0x10037ae4
pop esi
pop edi
mov dword [esp + 0x14], 0x3c8
mov dword [esp + 0x10], str..cxdatastructs.cpp
mov dword [esp + 0xc], str.Inner_function_failed.
mov dword [esp + 8], str.cvStartWriteSeq
mov dword [esp + 4], 0xffffffff
jmp sym.cxcore099.dll_cvError
push edi
push esi
call sym.cxcore099.dll_cvStartAppendToSeq
add esp, 8
pop esi
pop edi
ret
pop edi
mov dword [esp + 0x14], 0x3c6
mov dword [esp + 0x10], str..cxdatastructs.cpp
mov dword [esp + 0xc], 0x100b124f
mov dword [esp + 8], str.cvStartWriteSeq
mov dword [esp + 4], 0xffffffe5
jmp sym.cxcore099.dll_cvError
Function at 0x10039330
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push esi
or esi, 0xffffffff
test ebp, ebp
je 0x10039544
cmp dword [ebp + 0x10], 0
je 0x10039544
mov esi, dword [ebp + 8]
push ebx
mov ebx, dword [ebp]
push edi
mov edi, dword [ebp + 4]
lea esp, [esp]
test edi, edi
je 0x10039384
test dword [edi], 0x40000000
jne 0x10039384
mov dword [ebp], edi
or dword [edi], 0x40000000
test byte [ebp + 0x18], 1
mov esi, dword [edi + 4]
mov ebx, edi
jne 0x1003951c
test esi, esi
je 0x1003942e
lea esp, [esp]
mov eax, dword [esi + 0x10]
xor ecx, ecx
cmp ebx, eax
sete cl
mov edi, dword [esi + ecx*4 + 0x10]
mov ecx, dword [esi]
test ecx, 0x40000000
jne 0x1003941a
mov edx, dword [ebp + 0xc]
test dword [edx], 0x1000
je 0x100393cf
cmp edi, eax
jne 0x100393cf
mov eax, dword [edi]
and eax, 0x60000000
cmp eax, 0x60000000
jne 0x1003941a
or ecx, 0x10000000
mov dword [esi], ecx
jmp 0x1003941a
or ecx, 0x40000000
mov dword [esi], ecx
mov eax, dword [edi]
test eax, 0x40000000
je 0x10039485
test byte [ebp + 0x18], 0x1c
je 0x1003941a
test eax, 0x20000000
je 0x100393f8
mov eax, 4
jmp 0x10039409
mov eax, ecx
and eax, 0x10000000
neg eax
sbb eax, eax
and eax, 0xfffffff8
add eax, 0x10
and ecx, 0xefffffff
mov dword [esi], ecx
test dword [ebp + 0x18], eax
jne 0x100394b3
xor ecx, ecx
cmp dword [esi + 0x14], ebx
sete cl
mov esi, dword [esi + ecx*4 + 8]
test esi, esi
jne 0x10039390
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x18], 0
je 0x100394c4
lea ecx, [esp + 0x10]
push ecx
push eax
call sym.cxcore099.dll_cvSeqPop
mov eax, dword [esp + 0x18]
and dword [eax], 0xdfffffff
mov esi, dword [esp + 0x1c]
add esp, 8
xor edi, edi
test byte [ebp + 0x18], 0x40
mov ebx, eax
je 0x10039360
mov dword [ebp], eax
mov dword [ebp + 8], esi
xor ecx, ecx
cmp eax, dword [esi + 0x10]
lea eax, [edi + 0x40]
sete cl
pop edi
pop ebx
mov edx, dword [esi + ecx*4 + 0x10]
pop esi
mov dword [ebp + 4], edx
pop ebp
add esp, 8
ret
or dword [ebx], 0x20000000
mov eax, dword [ebp + 0x10]
lea edx, [esp + 0x10]
push edx
push eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
call sym.cxcore099.dll_cvSeqPush
add esp, 8
test byte [ebp + 0x18], 2
je 0x10039360
mov eax, 2
mov dword [ebp + 4], edi
pop edi
mov dword [ebp], ebx
pop ebx
mov dword [ebp + 8], esi
pop esi
pop ebp
add esp, 8
ret
cmp dword [ebp + 0x14], 0
lea eax, [ebp + 0x14]
jge 0x100394d7
test ebx, ebx
mov dword [eax], 0
jne 0x100394f2
mov ecx, dword [ebp + 0xc]
push eax
push 0
push 0xc0000000
push 0
call fcn.10036da0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10039539
test byte [ebp + 0x18], 0x20
mov edi, ebx
je 0x10039360
pop edi
mov dword [ebp + 4], ebx
pop ebx
pop esi
mov dword [ebp + 8], 0
mov dword [ebp], 0
mov eax, 0x20
pop ebp
add esp, 8
ret
mov dword [ebp], edi
mov edx, dword [edi + 4]
pop edi
pop ebx
pop esi
mov dword [ebp + 8], edx
mov dword [ebp + 4], 0
mov eax, 1
pop ebp
add esp, 8
ret
pop edi
pop ebx
pop esi
or eax, 0xffffffff
pop ebp
add esp, 8
ret
push 0xdbe
push str..cxdatastructs.cpp
push str.Null_graph_scanner
push str.cvNextGraphItem
push 0xffffffffffffffe5
call sym.cxcore099.dll_cvError
add esp, 0x14
mov eax, esi
pop esi
pop ebp
add esp, 8
ret
Function at 0x10046df0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
cmp ebp, esi
jne 0x10046e08
push esi
call sym.cxcore099.dll_cvSetErrStatus
add esp, 4
pop esi
pop ebp
ret
mov edx, dword [0x100dcc40]
cmp edx, esi
jne 0x10046e37
push 0x1018
call dword [sym.imp.MSVCR80.dll_malloc]
mov edx, eax
add esp, 4
mov dword [eax + 4], esi
mov dword [eax], esi
mov dword [eax + 8], sym.cxcore099.dll_cvGuiBoxReport
mov dword [eax + 0xc], esi
mov dword [0x100dcc40], edx
cmp ebp, 0xffffffff
push ebx
mov ebx, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x1c]
je 0x10046e70
cmp ebp, 0xfffffff8
je 0x10046e70
lea esi, [edx + 0x10]
mov dword [edx], ebp
mov eax, edi
sub esi, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
add eax, 1
test cl, cl
jne 0x10046e54
mov eax, dword [esp + 0x20]
mov dword [edx + 0x1010], eax
mov dword [edx + 0x1014], ebx
cmp dword [edx + 4], 2
je 0x10046ea1
mov ecx, dword [edx + 0xc]
mov eax, dword [esp + 0x20]
mov edx, dword [edx + 8]
push ecx
mov ecx, dword [esp + 0x1c]
push ebx
push eax
push edi
push ecx
push ebp
call edx
add esp, 0x18
test eax, eax
je 0x10046ea1
cdq
xor eax, edx
sub eax, edx
neg eax
push eax
call dword [sym.imp.MSVCR80.dll_exit]
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x10046eb0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 3
push esi
ja case.default.0x10046ebe
jmp dword [eax*4 + 0x10046f70]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
mov dword [0x100d4d20], esi
jne 0x10046ee4
xor eax, eax
pop esi
ret 0xc
mov esi, dword [0x100d4d20]
push 0x1018
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
xor ecx, ecx
push eax
push esi
mov dword [eax + 4], ecx
mov dword [eax], ecx
mov dword [eax + 8], sym.cxcore099.dll_cvGuiBoxReport
mov dword [eax + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 1
pop esi
ret 0xc
mov eax, dword [0x100d4d20]
cmp eax, 0xffffffff
je case.default.0x10046ebe
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je case.default.0x10046ebe
push eax
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov eax, 1
pop esi
ret 0xc
mov eax, dword [0x100d4d20]
cmp eax, 0xffffffff
je 0x10046f5b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10046f5b
push eax
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov eax, dword [0x100d4d20]
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, 1
pop esi
ret 0xc
Function at 0x100ad5e0
Capabilities:
Get cpu information
Get system information on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, dword [esp + 0x54]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
push edi
lea eax, [esp + 0x30]
xor ebp, ebp
push eax
mov dword [esi], ebp
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [esp + 0x30], bp
jne 0x100ad73a
cmp dword [esp + 0x48], 0x24a
jne 0x100ad73a
cmp word [esp + 0x50], 6
jb 0x100ad73a
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x10]
push edx
push 1
push ebp
push str.HARDWAREDESCRIPTIONSYSTEMCentralProcessor0_
push 0x80000002
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x24], ebp
mov dword [esi + 4], ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jl 0x100ad6a5
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebp
push ebp
push str.MHz
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jl 0x100ad69a
mov eax, dword [esp + 0x14]
fild dword [esp + 0x14]
test eax, eax
jge 0x100ad697
fadd qword [0x100cdd28]
fstp qword [esi + 8]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pushfd
mov eax, 1
push ebx
push esi
push edi
cpuid
pop edi
pop esi
pop ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
popfd
mov edx, dword [esp + 0x1c]
and edx, 0xf00
cmp edx, 0x600
jl 0x100ad716
mov eax, dword [esp + 0x20]
test eax, 0x808000
je 0x100ad716
and eax, 0x6808000
mov ebp, eax
cmp ebp, 0x6808000
jne 0x100ad6fb
mov eax, dword [esp + 0x58]
mov ebp, 0x1001
mov dword [eax], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
cmp ebp, 0x2808000
jne 0x100ad716
mov eax, dword [esp + 0x58]
mov ebp, 0xc01
mov dword [eax], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
mov eax, dword [esp + 0x58]
sub ebp, 0x808000
neg ebp
sbb ebp, ebp
and ebp, 0xfffff800
add ebp, 0x801
mov dword [eax], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x100ad750
fild qword [esp + 0x28]
fstp qword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x100afbb0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100da550]
jne 0x100afbba
repz ret
jmp fcn.100b01fa
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x436008]
jne 0x40100a
repz ret
jmp fcn.0040188c

Function at 0x404deb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403335
and dword [ebp - 4], 0
cmp dword [0x4380f0], 0
mov ebx, eax
jne 0x404e9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404f4d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x404f4d
push eax
call fcn.004032c3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4380f0], eax
call esi
push eax
call fcn.004032c3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4380f4], eax
call esi
push eax
call fcn.004032c3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4380f8], eax
call esi
push eax
call fcn.004032c3
pop ecx
mov dword [0x438100], eax
test eax, eax
je 0x404e9c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004032c3
pop ecx
mov dword [0x4380fc], eax
mov eax, dword [0x4380fc]
cmp eax, ebx
je 0x404ef4
cmp dword [0x438100], ebx
je 0x404ef4
push eax
call fcn.0040333e
push dword [0x438100]
mov esi, eax
call fcn.0040333e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404ef4
test edi, edi
je 0x404ef4
call esi
test eax, eax
je 0x404eeb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404eeb
test byte [ebp - 0xc], 1
jne 0x404ef4
or dword [ebp + 0x10], 0x200000
jmp 0x404f2d
mov eax, dword [0x4380f4]
cmp eax, ebx
je 0x404f2d
push eax
call fcn.0040333e
pop ecx
test eax, eax
je 0x404f2d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404f2d
mov eax, dword [0x4380f8]
cmp eax, ebx
je 0x404f2d
push eax
call fcn.0040333e
pop ecx
test eax, eax
je 0x404f2d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4380f0]
call fcn.0040333e
pop ecx
test eax, eax
je 0x404f4d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404f4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x182
jne 0x4328af
lea eax, [ebp - 0x20]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
xor edi, edi
test esi, esi
jle 0x4328de
jmp 0x4328c0
lea esi, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.00432880
mov cl, byte [ebp - 4]
xor byte [edi + ebx], cl
inc edi
cmp edi, dword [ebp + 8]
jl 0x4328c0
mov esi, dword [ebp + 8]
pop edi
cmp esi, 0x2d
pop esi
jne 0x4328f9
mov dword [0x52de18], 0xa62e7790
mov dword [0x52de1c], 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x432900
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x436008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x52dce4]
push ebx
mov ebx, dword [0x52db2c]
push esi
mov esi, eax
cmp eax, 0x5dd
jne 0x43293a
push 0
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov eax, dword [0x436ee0]
call fcn.00432850
cmp dword [0x52dce4], 0x2f
jne 0x432955
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call fcn.00432890
add esp, 4
cmp dword [0x52dce4], 0x568
pop esi
pop ebx
jne 0x432983
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov ecx, dword [ebp - 0x408]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x4010b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
call sub.storm.dll_Ordinal_463
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
call fcn.00401230
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
push ecx
push str.blizzard.ax
mov byte [ebp - 0x14], 0xad
mov byte [ebp - 0x13], 0x90
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0x11], 0x77
mov byte [ebp - 0x10], 0x4c
mov byte [ebp - 0xf], 0xd
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0x5c
mov byte [ebp - 0xc], 0xf2
mov byte [ebp - 0xb], 0xf3
mov byte [ebp - 0xa], 0x3b
mov byte [ebp - 9], 0xd7
mov byte [ebp - 8], 0xc9
mov byte [ebp - 7], 0xd3
mov byte [ebp - 6], 0x25
mov byte [ebp - 5], 0xe8
mov byte [ebp - 4], 0x6a
mov byte [ebp - 3], 0xfc
mov byte [ebp - 2], 0xee
mov byte [ebp - 1], 0xde
mov dword [ebp - 0x18], ebx
call sub.storm.dll_Ordinal_279
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x94]
call fcn.00401a80
push esi
push edi
lea ecx, [ebp - 0x94]
call fcn.00401ac0
lea edx, [ebp - 0x34]
push edx
lea ecx, [ebp - 0x94]
call fcn.00401b70
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x401177
push ebx
push 0x8a
push str.E:Drive1_temp_buildwar3xWar3SourceEXEWar3EXE.cpp
push eax
call sub.storm.dll_Ordinal_403
mov ebx, dword [sym.imp.kernel32.dll_GetProcAddress]
mov ecx, 5
lea edi, [ebp - 0x34]
lea esi, [ebp - 0x14]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryA]
jne 0x4011b6
push str.blizzard.ax
call edi
mov esi, eax
test esi, esi
je 0x4011b6
push str.DllRegisterServer
push esi
call ebx
test eax, eax
je 0x4011af
call eax
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
push str.Game.dll
call edi
mov esi, eax
test esi, esi
jne 0x4011e2
push 0x10
push str.Error
push str.Couldnt_open_Game.dll.
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.GameMain
push esi
call ebx
test eax, eax
jne 0x401216
push 0x10
push str.Error
push str.Game.dll_is_corrupt.
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
mov edi, dword [ebp - 0x1c]
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
call eax
push esi
mov edi, eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401230
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401255
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x104]
push 0x5c
push ecx
call dword [sym.imp.msvcrt.dll_strrchr]
add esp, 8
test eax, eax
jne 0x40126f
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x104]
push edx
mov byte [eax], 0
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov esp, ebp
pop ebp
ret