joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402cc0
Capabilities:
Create directory
Write file on windows

Disassembly:
sub esp, 0x48
mov eax, dword [0x6a7564]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push 0
push str.data
mov edi, ecx
call esi
push 0
push str.data_aiconfig
call esi
mov ecx, 0x6b6da8
call fcn.00547dd0
mov ecx, eax
call fcn.00402d60
movzx eax, ax
push eax
lea ecx, [esp + 0x10]
push str.._data_aiconfig__d.dat
push ecx
call fcn.0055adac
push 0x57e618
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.0055ad59
mov eax, dword [esp + 0x20]
add esp, 0x18
test eax, eax
je 0x402d4e
push eax
push 1
push 0x1c64
add edi, 0xec
push edi
call fcn.0055abfc
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0055aa1e
add esp, 0x14
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
xor ecx, esp
call fcn.0055a677
add esp, 0x48
ret

Function at 0x402d70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x6a7564]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
mov esi, ecx
push edi
mov ecx, 0x6b6da8
call fcn.00547dd0
mov ecx, eax
call fcn.00402d60
movzx eax, ax
push eax
lea ecx, [esp + 0x14]
push str.._data_aiconfig__d.dat
push ecx
call fcn.0055adac
push 0x1c64
lea edi, [esi + 0xec]
push 0
push edi
call fcn.0055a690
push 0x57e64c
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.0055ad59
mov eax, dword [esp + 0x2c]
add esp, 0x24
test eax, eax
je 0x402e50
push eax
push 1
push 0x1c64
push edi
call fcn.0055b0e7
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0055aa1e
add esp, 0x14
call fcn.004011c0
mov edx, dword [eax + 0x228]
imul edx, edx, 0x64
mov dword [esp + 0xc], edx
fild dword [esp + 0xc]
test edx, edx
jge 0x402e13
fadd dword [0x57e5c0]
fstp dword [esi + 0xe0]
call fcn.004011c0
mov eax, dword [eax + 0x22c]
imul eax, eax, 0x64
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jge 0x402e39
fadd dword [0x57e5c0]
pop edi
fstp dword [esi + 0xe8]
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0055a677
add esp, 0x4c
ret
mov ecx, esi
call fcn.00402e70
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
call fcn.0055a677
add esp, 0x4c
ret
Function at 0x402d7e
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x6a7564]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
mov esi, ecx
push edi
mov ecx, 0x6b6da8
call fcn.00547dd0
mov ecx, eax
call fcn.00402d60
movzx eax, ax
push eax
lea ecx, [esp + 0x14]
push str.._data_aiconfig__d.dat
push ecx
call fcn.0055adac
push 0x1c64
lea edi, [esi + 0xec]
push 0
push edi
call fcn.0055a690
push 0x57e64c
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.0055ad59
mov eax, dword [esp + 0x2c]
add esp, 0x24
test eax, eax
je 0x402e50
push eax
push 1
push 0x1c64
push edi
call fcn.0055b0e7
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0055aa1e
add esp, 0x14
call fcn.004011c0
mov edx, dword [eax + 0x228]
imul edx, edx, 0x64
mov dword [esp + 0xc], edx
fild dword [esp + 0xc]
test edx, edx
jge 0x402e13
fadd dword [0x57e5c0]
fstp dword [esi + 0xe0]
call fcn.004011c0
mov eax, dword [eax + 0x22c]
imul eax, eax, 0x64
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jge 0x402e39
fadd dword [0x57e5c0]
pop edi
fstp dword [esi + 0xe8]
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0055a677
add esp, 0x4c
ret
mov ecx, esi
call fcn.00402e70
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
call fcn.0055a677
add esp, 0x4c
ret
Function at 0x402e70
Capabilities:
Create directory
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
mov esi, 0x1d4
lea ebx, [edi + 1]
call fcn.004011c0
mov dword [eax + esi + 0xbc], ebx
call fcn.004011c0
cmp ebp, 5
mov dword [eax + esi], edi
jge 0x402ebf
call fcn.004011c0
mov dword [eax + esi - 0x88], edi
call fcn.004011c0
mov dword [eax + esi - 0x34], edi
call fcn.004011c0
mov dword [eax + esi + 0x88], ebx
cmp ebp, 4
jge 0x402ee6
call fcn.004011c0
mov dword [eax + esi - 0x74], edi
call fcn.004011c0
mov dword [eax + esi - 0x20], edi
call fcn.004011c0
mov dword [eax + esi + 0x9c], 5
cmp ebp, 2
jge 0x402f2f
call fcn.004011c0
mov dword [eax + esi - 0x64], edi
call fcn.004011c0
mov dword [eax + esi - 0x5c], edi
call fcn.004011c0
mov dword [eax + esi - 0x10], edi
call fcn.004011c0
mov dword [eax + esi + 0xac], 5
call fcn.004011c0
mov dword [eax + esi - 8], edi
call fcn.004011c0
mov dword [eax + esi + 0xb4], 5
add esi, 4
add ebp, ebx
cmp esi, 0x1ec
jl 0x402e85
call fcn.004011c0
mov dword [eax + 0x240], 0x1e
call fcn.004011c0
mov dword [eax + 0x180], ebx
call fcn.004011c0
mov dword [eax + 0x184], ebx
call fcn.004011c0
mov esi, 0xfa
mov dword [eax + 0x228], esi
call fcn.004011c0
mov dword [eax + 0x22c], esi
call fcn.004011c0
mov dword [eax + 0x188], ebx
call fcn.004011c0
mov dword [eax + 0x18c], ebx
call fcn.004011c0
mov dword [eax + 0x250], ebx
call fcn.004011c0
mov ebp, 3
mov dword [eax + 0x254], ebp
call fcn.004011c0
mov dword [eax + 0x190], ebx
call fcn.004011c0
mov dword [eax + 0x12c], ebx
call fcn.004011c0
mov dword [eax + 0xf0], edi
call fcn.004011c0
mov dword [eax + 0xf4], edi
call fcn.004011c0
mov dword [eax + 0xf8], edi
call fcn.004011c0
mov dword [eax + 0x194], edi
call fcn.004011c0
mov dword [eax + 0x198], edi
call fcn.004011c0
mov esi, 5
mov dword [eax + 0x218], esi
call fcn.004011c0
mov dword [eax + 0x220], esi
call fcn.004011c0
mov dword [eax + 0x21c], esi
call fcn.004011c0
mov dword [eax + 0x258], ebp
call fcn.004011c0
mov dword [eax + 0x204], esi
call fcn.004011c0
mov dword [eax + 0x19c], edi
call fcn.004011c0
mov dword [eax + 0xfc], edi
call fcn.004011c0
mov dword [eax + 0x10c], ebx
call fcn.004011c0
mov dword [eax + 0x110], ebx
call fcn.004011c0
mov dword [eax + 0x118], ebx
call fcn.004011c0
mov dword [eax + 0x120], ebx
call fcn.004011c0
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x2a8], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp fcn.00402cc0
Function at 0x40c550
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
mov ecx, 0x6989c0
call fcn.00424700
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
mov dword [0x6a91e8], ebp
call ebx
mov edi, eax
push 7
add edi, edi
call ebx
mov esi, eax
push 4
add esi, esi
call ebx
mov ecx, eax
add ecx, esi
mov esi, dword [0x6d949c]
xor edx, edx
mov eax, esi
div dword [0x6d8a28]
mov eax, dword [0x6d8a2c]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x40c5ae
cmp dword [edx], esi
je 0x40c5f2
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x40c5a3
push 0
push ebp
push 0
push 0
add ecx, 0x300
push ecx
add edi, 0x400
push edi
push 0
push 0x80000000
push 0x2ca0000
push 0x6a8fe8
push 0x6a8de8
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x6a91ec], esi
test esi, esi
jne 0x40c60e
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [edx + 4]
test edx, edx
je 0x40c5ae
mov eax, dword [edx + 8]
push 0
push ebp
push 0
add eax, ecx
mov ecx, dword [edx + 4]
push 0
push eax
add ecx, edi
push ecx
jmp 0x40c5c3
mov edx, dword [esp + 0x18]
push edx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x5ad1a4
call fcn.0040d370
cmp dword [0x69b930], 0
push 0
mov ecx, 0x5ad1a4
push 0
jne 0x40c65f
push 1
call fcn.0040d150
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
push 2
call fcn.0040d150
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x40ca10
Capabilities:
Create directory
Delete file
Log keystrokes via application hook

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0
push esi
push 0x40c3b0
push 0xd
call edi
mov dword [0x6a91f4], eax
mov eax, dword [esp + 0x30]
mov dword [0x6a8ca0], 0
mov ecx, str.gvkc9jw0ot0Ut
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ca63
test dl, dl
je 0x40ca5f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ca63
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ca43
xor eax, eax
jmp 0x40ca68
sbb eax, eax
sbb eax, 0xffffffff
push 0
test eax, eax
je 0x40ca8a
push str.Error__
push 0x57ea14
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
push esi
push 0x40c3b0
push 0xd
call edi
push str.._Log_Debug.txt
mov dword [0x6a91f4], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x57ea00
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str._______________________________________________________
push 0x6a47bc
call fcn.005090b0
push str._____________________Client_Start______________________
push 0x6a47bc
call fcn.005090b0
push str._______________________________________________________
push 0x6a47bc
call fcn.005090b0
add esp, 0x18
call fcn.0040c440
mov ecx, 0x6bf490
call fcn.00516810
push 0x6d88fa
push 0x6a8fe8
call fcn.0055adac
push 0x6d88fa
push 0x6a8de8
call fcn.0055adac
push esi
call fcn.0040c9a0
add esp, 0x14
mov ecx, 0x6bf490
call fcn.005133d0
push str.._Resource_QuestScript_QuestString.bin
mov ecx, 0x6bd1d0
call fcn.004e1c40
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x6bd1d0
call fcn.004e2810
push str.._Resource_QuestScript_NewbieGuide.bin
mov ecx, 0x6bd1d0
call fcn.004e0a00
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x6bd1d0
call fcn.004e1e20
mov ecx, 0x6b6658
call fcn.00432280
mov eax, dword [esp + 0x34]
push eax
push esi
call fcn.0040c550
add esp, 8
test eax, eax
jne 0x40cb9d
mov eax, dword [0x6a91fc]
test eax, eax
je 0x40cb93
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6a91fc], 0
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebp
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
call esi
test eax, eax
je 0x40cbd3
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esp + 0xc]
push eax
call ebp
jmp 0x40cbb0
mov ecx, 0x5ad1a4
call fcn.0040d6d0
cmp eax, 0xffffffff
jne 0x40cbb0
mov eax, dword [0x6a91fc]
pop ebp
test eax, eax
je 0x40cbfd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6a91fc], 0
mov eax, dword [esp + 0x10]
pop edi
pop esi
add esp, 0x1c
ret 0x10
Function at 0x41fad0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x130
mov eax, dword [0x6a7564]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
mov esi, dword [esp + 0x13c]
xor ebx, ebx
mov dword [esp + 0x24], esi
cmp esi, ebx
je 0x41fc82
cmp byte [esi], bl
je 0x41fc82
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41fc82
mov edx, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x41fb54
mov dword [esp + 0xc], 0x64
push edi
xor edi, edi
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x10], ebx
jbe 0x41fc70
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea esp, [esp]
xor eax, eax
push edi
push str._04u
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], al
lea eax, [esp + 0x38]
push 5
push eax
call fcn.0041c920
mov eax, dword [esp + 0x28]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x3c]
push edx
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41fc49
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 0x104
call ebp
test eax, eax
je 0x41fbef
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41fc49
push esi
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x41fc0c
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41fc49
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push str.Characteristics
push edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], 4
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41fc67
mov esi, dword [esp + 0x2c]
inc edi
cmp edi, dword [esp + 0x14]
jb 0x41fb70
mov edx, dword [esp + 0x18]
pop ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x41fc84
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
pop ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x41fc84
xor eax, eax
mov ecx, dword [esp + 0x134]
pop esi
pop ebx
xor ecx, esp
call fcn.0055a677
add esp, 0x130
ret 4
Function at 0x41fca0
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 8
push ebp
push edi
lea eax, [esp + 8]
xor edi, edi
push eax
push edi
mov ebp, ecx
mov dword [esp + 0x10], edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x41fce2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push ecx
call fcn.0041c920
add esp, 0x10
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
mov edx, dword [esp + 8]
push esi
push edx
call fcn.0055c231
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
cmp esi, edi
jne 0x41fd15
mov eax, dword [esp + 0x18]
push str.GetMAC_Failed__Because_malloc_failed_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x41fd50
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x18]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push edx
call fcn.0041c920
push esi
call fcn.0055c154
add esp, 0x14
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [esi + 0x190]
cmp eax, 6
jb 0x41fd8b
cmp eax, 8
ja 0x41fd8b
push eax
lea eax, [esi + 0x194]
push eax
push ebx
call fcn.0055bb10
mov edi, dword [esi + 0x190]
add esp, 0xc
lea ecx, [esi + 8]
push ecx
mov ecx, ebp
call fcn.0041fad0
test al, 4
jne 0x41fd91
mov esi, dword [esi]
test esi, esi
jne 0x41fd55
mov edx, dword [esp + 0x14]
push edx
call fcn.0055c154
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
add esp, 8
ret 4

Function at 0x423340
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
push 0
mov ecx, 0x5ad1a4
call fcn.0040d0c0
mov ecx, eax
call fcn.0040d250
cmp dword [esi + 0x10], 0
je 0x42337f
mov ecx, 0x6a93d8
call fcn.00412a70
push 0
push 0
push 3
mov ecx, 0x5ad1a4
call fcn.0040d150
mov dword [esi + 0x10], 0
jmp 0x42338f
push 0
push 0
push 2
mov ecx, 0x5ad1a4
call fcn.0040d150
mov ecx, 0x69b898
call fcn.00401a60
cmp dword [eax + 0x94], 0
pop esi
jne 0x4233c1
mov ecx, 0x69b898
call fcn.00401a60
mov dword [eax + 0x94], 1
mov ecx, 0x69b898
jmp fcn.004c3450
ret
Function at 0x43e070
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x573a93
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6a7564]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.00430cf0
xor edi, edi
lea ecx, [esi + 0x50]
mov dword [esp + 0x1c], edi
mov dword [esi], vtable.cWindow.0
call fcn.00430060
mov ebx, 1
lea ecx, [esi + 0x194]
mov byte [esp + 0x1c], bl
call fcn.0042d050
fldz
fst dword [esi + 0x1e4]
xor eax, eax
fstp dword [esi + 0x1e8]
mov ecx, ebx
fld1
xor edx, edx
fst dword [esi + 0x1f0]
mov word [esi + 0x1c], ax
mov word [esi + 0x1ee], ax
fstp dword [esi + 0x1f4]
mov dword [esi + 8], edi
mov word [esi + 0xc], cx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edi
mov word [esi + 0x1ec], dx
mov dword [esi + 0x1b4], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 4], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x1b8], 0xffffff
mov dword [esi + 0x1bc], 0xff
mov dword [esi + 0x1c0], 0x64
mov dword [esi + 0x18], fcn.0041ffc0
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x445830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x573c2b
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x6a7564]
xor eax, esp
mov dword [esp + 0xc0], eax
push esi
push edi
mov eax, dword [0x6a7564]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.0042d050
push 0
lea eax, [esp + 0x10]
push eax
push 0x3f
mov ecx, 0x6b6658
mov dword [esp + 0xe4], 0
call fcn.00431a60
push 0x166
mov ecx, 0x699268
call fcn.00431090
lea edx, [esp + 0x4c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x4458a5
mov ecx, dword [0x6b88bc]
imul ecx, ecx, 0x290
add ecx, 0x6b7e3c
push ecx
mov ecx, dword [0x6a97f8]
lea edx, [esp + 0x30]
push edx
call fcn.004bdf80
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x50]
push ecx
mov edx, ecx
push str._s__s_
push edx
call edi
add esp, 0x10
push 0x33517d
lea eax, [esp + 0x10]
push eax
push 0xffffff
lea ecx, [esp + 0x58]
push ecx
mov ecx, dword [esi + 0x21c]
call fcn.0043e400
push 0x168
mov ecx, 0x699268
call fcn.00431090
lea edx, [esp + 0x4c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x445921
mov eax, dword [0x6b88bc]
mov ecx, dword [0x6a97f8]
imul eax, eax, 0x290
add eax, 0x6b7e8c
push eax
lea edx, [esp + 0x30]
push edx
call fcn.004bdf80
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x50]
push ecx
mov edx, ecx
push str._s__s_
push edx
call edi
add esp, 0x10
push 0x33517d
lea eax, [esp + 0x10]
push eax
push 0xffffff
lea ecx, [esp + 0x58]
push ecx
mov ecx, dword [esi + 0x224]
call fcn.0043e400
lea ecx, [esp + 0xc]
mov dword [esp + 0xd8], 0xffffffff
call fcn.0042d060
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0055a677
add esp, 0xd0
ret
Function at 0x446f70
Capabilities:
Get process heap flags
Get process heap force flags
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x573dc3
mov eax, dword fs:[0]
push eax
sub esp, 0x100
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6a7564]
xor eax, esp
push eax
lea eax, [esp + 0x114]
mov dword fs:[0], eax
mov edi, ecx
mov eax, 0x74
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, 0x62
xor ebp, ebp
mov ebx, 1
lea ecx, [esp + 0xd4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 2
mov dword [esp + 0x38], 3
mov dword [esp + 0x3c], 4
mov dword [esp + 0x40], 5
mov dword [esp + 0x44], 6
mov dword [esp + 0x48], 7
mov dword [esp + 0x4c], 8
mov dword [esp + 0x50], 9
mov dword [esp + 0x54], 0xa
mov dword [esp + 0x58], 0xb
mov dword [esp + 0x5c], 0xc
mov dword [esp + 0x60], 0xd
mov dword [esp + 0x64], 0xe
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x6c], 0x10
mov dword [esp + 0x70], 0x11
mov dword [esp + 0x74], 0x12
mov dword [esp + 0x78], 0x13
mov dword [esp + 0x7c], 0x14
mov dword [esp + 0x80], 0x15
mov dword [esp + 0x84], 0x16
mov dword [esp + 0x88], 0x17
mov dword [esp + 0x8c], 0x18
mov dword [esp + 0x90], 0x19
mov dword [esp + 0x94], 0x1a
mov dword [esp + 0x98], 0x1b
mov dword [esp + 0x9c], 0x1c
mov dword [esp + 0xa0], 0x1d
mov dword [esp + 0xa4], 0x4d
mov dword [esp + 0xa8], 0x4e
mov dword [esp + 0xac], 0x4f
call fcn.0042d050
lea ecx, [esp + 0xb4]
mov dword [esp + 0x11c], ebp
call fcn.0042d050
lea ecx, [esp + 0xf4]
mov byte [esp + 0x11c], bl
call fcn.0042d050
movzx eax, word [esp + 0x124]
lea esi, [eax + eax*2]
add esi, esi
push ebp
lea eax, [esp + 0xb8]
add esi, esi
mov ecx, dword [esp + esi + 0x18]
push eax
push ecx
mov ecx, 0x6b6658
mov byte [esp + 0x128], 2
call fcn.00431a60
mov eax, dword [esp + esi + 0x18]
push ebp
lea edx, [esp + 0xf8]
push edx
push eax
mov ecx, 0x6b6658
call fcn.00431a60
mov edx, dword [esp + esi + 0x1c]
push ebp
lea ecx, [esp + 0xd8]
push ecx
push edx
mov ecx, 0x6b6658
call fcn.00431a60
push 0x3d8
call fcn.0055a781
add esp, 4
mov dword [esp + 0xb0], eax
mov byte [esp + 0x11c], 3
cmp eax, ebp
je 0x4471a8
mov ecx, eax
call fcn.004438d0
mov esi, eax
jmp 0x4471aa
xor esi, esi
mov ebp, dword [esi]
lea ecx, [edi + 0x284]
mov byte [esp + 0x11c], 2
add ebp, 0x40
call fcn.00558d30
push eax
push 0
lea eax, [esp + 0xfc]
push eax
movzx eax, word [edi + 0x23e]
lea ecx, [esp + 0xc0]
push ecx
movzx ecx, word [edi + 0x23c]
lea edx, [esp + 0xe4]
push edx
mov edx, dword [ebp]
push eax
push ecx
push 0
push 0
mov ecx, esi
call edx
lea ecx, [esp + 0xf4]
mov dword [esi + 0x24], ebx
mov byte [esp + 0x11c], bl
call fcn.0042d060
lea ecx, [esp + 0xb4]
mov byte [esp + 0x11c], 0
call fcn.0042d060
lea ecx, [esp + 0xd4]
mov dword [esp + 0x11c], 0xffffffff
call fcn.0042d060
mov eax, esi
mov ecx, dword [esp + 0x114]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
Function at 0x454f50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x577d48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x6a7564]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
push 0x526
call edx
mov dword [esi + 0x218], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
push 0x527
mov ecx, esi
call edx
mov dword [esi + 0x21c], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
push 0x524
mov ecx, esi
call edx
mov dword [esi + 0x37b4], eax
test eax, eax
je 0x454fcb
add eax, 0x344
lea edx, [esi + 0x37b8]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x454fc1
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
push 0x52b
mov ecx, esi
call edx
mov dword [esi + 0x220], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
push 0x52c
mov ecx, esi
call edx
mov dword [esi + 0x224], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
push 0x52d
mov ecx, esi
call edx
lea ecx, [esp + 8]
mov dword [esi + 0x228], eax
call fcn.0042d050
push 0
lea eax, [esp + 0xc]
push eax
push 0x3f
mov ecx, 0x6b6658
mov dword [esp + 0x3c], 0
call fcn.00431a60
push 0x33517d
lea ecx, [esp + 0xc]
push ecx
push 0xffffffffffffffff
push 0x4b4
mov ecx, 0x6b8950
call fcn.004c5020
mov ecx, dword [esi + 0x220]
push eax
call fcn.0043e400
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.0042d060
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret