joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003bb84
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3fc
mov eax, dword [0x100ba2d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x24]
push esi
push edi
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp + 0x10]
mov edi, edx
mov esi, edi
imul esi, dword [ebp + 0xc]
cmp dword [ebp + 0x18], 0
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x3f8], ecx
jl 0x1003bbda
push 0
push dword [ebp + 0x18]
push eax
call fcn.10064049
add esp, 0xc
cmp dword [ebp + 0x1c], 0
jne 0x1003bc77
cmp edi, dword [ebp - 0x3f4]
jne 0x1003bc77
push dword [ebp - 0x3fc]
push 1
push esi
push dword [ebp - 0x3f0]
call fcn.10063fa2
add esp, 0x10
test eax, eax
jne 0x1003bd92
mov edi, dword [ebp - 0x3f8]
test edi, edi
je 0x1003bc6f
mov eax, dword [ebp - 0x3f8]
push 8
pop ecx
mov esi, 0x100a2ac0
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003bc2c
sub eax, esi
imul ebx, ebx, 0x220
lea ebx, [ebx + 0x100ee648]
mov ecx, ebx
mov edi, eax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003bc48
sub ecx, esi
add ecx, edi
cmp ecx, 0xff
jae 0x1003bc6f
push ebx
push str.Ephemeris_file__s_is_damaged__2_.
push dword [ebp - 0x3f8]
call fcn.10062ff4
add esp, 0xc
or eax, 0xffffffff
jmp 0x1003bd94
push dword [ebp - 0x3fc]
lea eax, [ebp - 0x3ec]
push 1
push esi
push eax
call fcn.10063fa2
add esp, 0x10
test eax, eax
jne 0x1003bcea
mov edi, dword [ebp - 0x3f8]
test edi, edi
je 0x1003bc6f
mov eax, dword [ebp - 0x3f8]
push 8
pop ecx
mov esi, str.Ephemeris_file_is_damaged__3_.
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003bcb0
sub eax, esi
imul ebx, ebx, 0x220
lea ebx, [ebx + 0x100ee648]
mov ecx, ebx
mov edi, eax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003bccc
sub ecx, esi
add ecx, edi
cmp ecx, 0xff
jae 0x1003bc6f
push ebx
push str.Ephemeris_file__s_is_damaged__4_.
jmp 0x1003bc61
cmp edi, dword [ebp - 0x3f4]
je 0x1003bd0d
mov eax, dword [ebp - 0x3f4]
imul eax, dword [ebp + 0xc]
push eax
push 0
push dword [ebp - 0x3f0]
call fcn.1006a660
add esp, 0xc
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x1003bd92
mov ebx, dword [ebp - 0x3f0]
lea ecx, [ebp - 0x3ec]
mov dword [ebp - 0x3f0], eax
lea eax, [edi - 1]
test eax, eax
js 0x1003bd82
mov edx, edi
sub edx, eax
dec edx
mov dword [ebp - 0x3fc], edx
cmp dword [ebp + 0x1c], 0
mov esi, edx
jne 0x1003bd42
mov esi, eax
cmp edi, dword [ebp - 0x3f4]
je 0x1003bd6c
cmp dword [ebp + 0x20], 0
jne 0x1003bd56
cmp dword [ebp + 0x1c], 0
je 0x1003bd62
cmp dword [ebp + 0x20], 1
jne 0x1003bd6c
cmp dword [ebp + 0x1c], 0
je 0x1003bd6c
mov edx, dword [ebp - 0x3f4]
sub edx, edi
add esi, edx
mov dl, byte [ecx + eax]
mov byte [ebx + esi], dl
mov edx, dword [ebp - 0x3fc]
inc edx
dec eax
mov dword [ebp - 0x3fc], edx
jns 0x1003bd38
add ebx, dword [ebp - 0x3f4]
add ecx, edi
dec dword [ebp - 0x3f0]
jne 0x1003bd26
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10062fe5
leave
ret
Function at 0x10045756
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x100eccec], 0
jne 0x10045790
xor ecx, ecx
mov eax, ecx
push 8
shl eax, 0x18
pop edx
test eax, eax
jns 0x10045779
add eax, eax
xor eax, 0x4c11db7
jmp 0x1004577b
add eax, eax
dec edx
test edx, edx
jg 0x1004576c
mov dword [ecx*4 + 0x100ecce8], eax
inc ecx
cmp ecx, 0x100
jl 0x10045764
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
cmp dword [ebp + 0xc], 0
jle 0x100457bc
push edi
movzx edi, byte [ecx]
mov edx, eax
shr edx, 0x18
xor edx, edi
shl eax, 8
xor eax, dword [edx*4 + 0x100ecce8]
inc ecx
dec dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0
jg 0x1004579d
pop edi
not eax
pop ebp
ret
Function at 0x1005b792
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x100ba2d8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x100e076c], edi
jne 0x1005b866
cmp dword [0x100bb64c], edi
je 0x1005b866
cmp dword [0x100bb7e0], edi
je 0x1005b7f3
mov eax, dword [0x100bb754]
cmp eax, edi
jne 0x1005b7e7
push str.Astrolog
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x100bb754], eax
cmp eax, edi
je 0x1005b7f3
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x100bb538]
cmp eax, 1
jne 0x1005b806
cmp byte [0x100bb5d4], 0x42
jne 0x1005b815
cmp eax, 2
je 0x1005b815
cmp eax, 4
mov eax, 0x100a8288
jne 0x1005b81a
mov eax, 0x1007a1e8
push eax
push dword [0x100bb64c]
call fcn.10063435
pop ecx
pop ecx
mov dword [0x100bb650], eax
cmp eax, edi
jne 0x1005b866
cmp dword [0x100bb7e0], edi
jne 0x1005b866
push esi
push dword [0x100bb64c]
lea eax, [ebp - 0x104]
push str.Couldnt_create_output_file:__s
push eax
call fcn.10062ff4
add esp, 0xc
lea esi, [ebp - 0x104]
call fcn.1001f3be
mov dword [0x100bb64c], edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10062fe5
leave
ret

Function at 0x1005b873
Capabilities:
Change the wallpaper

Disassembly:
mov eax, dword [0x100bb538]
push ebx
push esi
push edi
cmp eax, 1
jne 0x1005b8ba
mov ecx, dword [0x100bb650]
test ecx, ecx
je 0x1005b8f9
mov al, byte [0x100bb5d4]
cmp al, 0x42
jne 0x1005b89c
mov esi, ecx
call fcn.1005b2ad
jmp 0x1005b8e9
cmp al, 0x41
jne 0x1005b8a8
push ecx
call fcn.1005b218
jmp 0x1005b8d6
movzx eax, al
push eax
push dword [0x100bb64c]
call fcn.1005af5e
pop ecx
jmp 0x1005b8d6
cmp eax, 2
jne 0x1005b8c6
call fcn.1005bd07
jmp 0x1005b8e9
cmp eax, 3
jne 0x1005b8d9
push dword [0x100bb650]
call fcn.1005c3a4
pop ecx
jmp 0x1005b8e9
cmp eax, 4
jne 0x1005b8e9
mov edi, dword [0x100bb650]
call fcn.1005c424
mov eax, dword [0x100bb650]
test eax, eax
je 0x1005b8f9
push eax
call fcn.10063665
pop ecx
cmp dword [0x100bb7e0], 0
je 0x1005b912
mov eax, dword [0x100bb754]
test eax, eax
je 0x1005b912
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ax, word [0x100bb774]
mov ecx, 0x9d24
lea ebx, [ecx - 1]
cmp ax, cx
je 0x1005b96b
add ecx, 0xfffffffc
cmp ax, cx
je 0x1005b940
cmp ax, bx
je 0x1005b940
lea ecx, [ebx - 1]
cmp ax, cx
je 0x1005b940
dec ecx
cmp ax, cx
jne 0x1005b9ba
mov eax, 0x100a334c
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
push eax
push str.TileWallpaper
mov edi, str.Desktop
push edi
call esi
mov ax, word [0x100bb774]
cmp ax, bx
jne 0x1005b972
mov eax, 0x1007a358
jmp 0x1005b997
mov eax, 0x1007a354
jmp 0x1005b945
mov ecx, 0x9d22
cmp ax, cx
jne 0x1005b983
mov eax, 0x1007a370
jmp 0x1005b997
mov ecx, 0x9d21
cmp ax, cx
mov eax, 0x1007a380
je 0x1005b997
mov eax, 0x100a334c
push eax
push str.WallpaperStyle
push edi
call esi
push 3
push dword [0x100bb64c]
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
xor eax, eax
mov word [0x100bb774], ax
pop edi
pop esi
pop ebx
ret

Function at 0x10062fe5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100ba2d8]
jne 0x10062fef
repz ret
jmp fcn.100658bb
Function at 0x1006ff02
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100ba2d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100685af
and dword [ebp - 0x14], 0
cmp dword [0x100e4650], 0
mov dword [ebp - 0x18], eax
jne 0x1006ffb5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1007005d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1007005d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100e4650], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100e4654], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x100e4658], eax
call edi
push eax
call esi
mov dword [0x100e4660], eax
test eax, eax
je 0x1006ffb5
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x100e465c], eax
mov eax, dword [0x100e465c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1007000e
cmp dword [0x100e4660], ecx
je 0x1007000e
push eax
call esi
push dword [0x100e4660]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1007000e
test ebx, ebx
je 0x1007000e
call edi
test eax, eax
je 0x10070005
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10070005
test byte [ebp - 8], 1
jne 0x1007000e
or dword [ebp + 0x10], 0x200000
jmp 0x10070041
mov eax, dword [0x100e4654]
cmp eax, dword [ebp - 0x18]
je 0x10070041
push eax
call esi
test eax, eax
je 0x10070041
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10070041
mov eax, dword [0x100e4658]
cmp eax, dword [ebp - 0x18]
je 0x10070041
push eax
call esi
test eax, eax
je 0x10070041
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100e4650]
call esi
test eax, eax
je 0x1007005d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1007005f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10062fe5
leave
ret
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40701c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x407028
push 0x407024
push 0x407020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x407028]
push dword [0x407024]
push dword [0x407020]
mov dword [0x407014], esp
call fcn.00401537
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x4019de
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, esi
add ebx, 0xc8
mov edi, dword [ebp + 0xc]
mov ecx, esi
mov eax, edi
shl eax, cl
cdq
idiv ebx
mov dword [ebp - 8], eax
and dword [ebp - 4], 0
jmp 0x401a7c
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
jmp 0x401a17
add dword [ebp - 0xc], ebx
inc dword [ebp - 0x10]
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x10], eax
jl 0x401a11
mov ecx, dword [ebp - 8]
cmp eax, ecx
jne 0x401a30
mov eax, dword [ebp + 0xc]
add eax, esi
mov ebx, eax
sub ebx, dword [ebp - 0xc]
or ebx, ebx
je 0x401a8d
and dword [ebp - 0x14], 0
push ebx
push dword [ebp - 0xc]
push esi
call fcn.0040198a
mov dword [ebp - 0x18], eax
push ebx
push dword [ebp - 0xc]
push esi
call fcn.0040198a
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
or edx, esi
add edx, eax
push edx
mov edx, dword [ebp - 0x18]
xor edx, esi
add edx, eax
push edx
call fcn.00401970
add esp, 0x20
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x7e8
jl 0x401a38
inc dword [ebp - 4]
mov eax, dword [ebp - 8]
mov edx, esi
dec edx
and eax, edx
cmp dword [ebp - 4], eax
jle 0x401a07
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x4029d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x858]
mov ecx, dword [esi + 0x4c]
cdq
and edx, 0xff
mov dword [esp + 0x10], 0x40
add eax, edx
sar eax, 8
mov dword [esi + ecx*4 + 0x154], eax
mov eax, dword [esi + 0x860]
cdq
and edx, 0xff
add eax, edx
mov edx, dword [esi + 0x4c]
sar eax, 8
mov dword [esi + edx*4 + 0x54], eax
mov eax, dword [esi + 0x4c]
mov edx, dword [esi + 0x50]
inc eax
and eax, 0x3f
xor ebx, ebx
mov dword [esi + 0x4c], eax
mov ecx, dword [edx]
mov ebp, dword [esi + eax*4 + 0x54]
imul ebp, ecx
add edi, ebp
mov ebp, dword [esi + eax*4 + 0x154]
imul ebp, ecx
mov ecx, dword [esp + 0x10]
add ebx, ebp
add edx, 4
inc eax
and eax, 0x3f
dec ecx
mov dword [esp + 0x10], ecx
jne 0x402a27
mov ebp, edi
mov dword [esp + 0x18], ebx
sar ebp, 0x10
sar ebx, 0x10
mov eax, ebx
mov edx, ebp
imul eax, ebx
imul edx, ebp
add eax, edx
mov ecx, 0x1e
test eax, eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ecx
jle 0x402a84
sar eax, 1
inc ecx
test eax, eax
jg 0x402a79
mov dword [esp + 0x14], ecx
add ecx, 0xffffffe2
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], ecx
xor ecx, ecx
mov cx, word [esi + 0x32]
mov edx, ecx
xor ecx, ecx
mov cx, word [esi + 0x30]
add eax, edx
add ecx, eax
mov al, byte [esi + 0x20]
test al, al
jne 0x402b40
mov edi, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
mov edx, edi
mov dword [esp + 0x1c], eax
imul edx, ebx
imul eax, ebp
sub eax, edx
imul edi, ebp
cdq
xor eax, edx
sub eax, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
imul eax, ebx
add edi, eax
mov eax, dword [esp + 0x20]
sub edi, eax
jns 0x402b3c
mov ebx, dword [esi + 0x14]
lea edi, [ecx + ecx*2 + 0x7fff]
sar edi, 2
and edi, 0xffff
mov byte [esi + 0x20], 1
test ebx, ebx
je 0x402b14
mov eax, edi
sub eax, ecx
cdq
shl ebx, 4
idiv ebx
mov ecx, eax
mov eax, dword [esi + 0x10]
mov edx, eax
shl edx, 5
sub edx, eax
add ecx, edx
sar ecx, 5
mov dword [esi + 0x10], ecx
mov eax, dword [esi + 0x10]
cmp eax, 0x80
jle 0x402b27
mov dword [esi + 0x10], 0x80
jmp 0x402b33
cmp eax, 0xffffff80
jge 0x402b33
mov dword [esi + 0x10], 0xffffff80
mov ecx, edi
mov dword [esi + 0x14], 0
mov edi, dword [esp + 0x10]
cmp ecx, 0xffff
mov word [esi + 0x30], cx
jle 0x402b92
mov ecx, dword [esi + 0x14]
mov byte [esi + 0x20], 0
inc ecx
mov dword [esi + 0x14], ecx
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x402b6e
mov edx, dword [esp + 0x14]
mov eax, dword [ecx]
push edx
mov edx, dword [esp + 0x1c]
push edx
push edi
call dword [eax + 4]
mov eax, edi
cdq
and edx, 0xffff
add eax, edx
sar eax, 0x10
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x18]
cdq
and edx, 0xffff
add eax, edx
sar eax, 0x10
mov dword [esi + 0x1c], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x40c340
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5b6a98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 8], bl
mov byte [esp + 0xf], bl
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x1a], bl
mov byte [esp + 0x21], bl
mov dword [esp + 0x34], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x64
push 7
lea ecx, [esp + 0x30]
mov byte [esp + 0x70], 2
mov dword [esp + 0x58], ebx
call fcn.0040b8a0
mov eax, 1
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
push eax
mov eax, dword [esp + 0x88]
push ecx
mov ecx, dword [esp + 0x88]
push edx
mov edx, dword [esp + 0x88]
push eax
mov eax, dword [esp + 0x88]
push ecx
mov ecx, dword [esp + 0x88]
push edx
push eax
push ecx
lea edx, [esi + 0x28]
push ebx
lea eax, [esi + 0x16]
push edx
lea ecx, [esi + 4]
push eax
push ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x9c], 3
call fcn.0040d490
lea edx, [esp + 8]
mov ecx, esi
push edx
call fcn.0040c660
mov eax, dword [esp + 0x54]
mov dword [esp + 0x6c], 6
cmp eax, ebx
mov dword [esp + 0x2c], ebx
je 0x40c42d
push eax
call fcn.0058ed21
add esp, 4
mov eax, dword [esp + 0x34]
mov byte [esp + 0x6c], 5
cmp eax, ebx
je 0x40c457
mov ecx, dword [eax - 4]
lea esi, [eax - 4]
push fcn.00425060
push ecx
push 0x12
push eax
call fcn.00573a14
push esi
call fcn.0058ed21
add esp, 4
mov ecx, dword [esp + 0x64]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret 0x20

Function at 0x40faf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b6f66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [esp], ecx
mov eax, dword [ecx + 0x30]
mov dword [esp + 0xc], 1
test eax, eax
je 0x40fb38
mov ecx, dword [eax - 4]
push esi
lea esi, [eax - 4]
push fcn.00425060
push ecx
push 0x12
push eax
call fcn.00573a14
push esi
call fcn.0058ed21
add esp, 4
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x418eb0
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x5b79f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi], 0x5dafa0
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x44], 0xffffffff
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x48], 0x2710
mov dword [esi + 0x4c], edi
mov eax, dword [0x639698]
mov dword [esp + 0x14], edi
mov dword [esi + 0x50], eax
mov eax, 1
mov dword [esi + 0x54], eax
mov dword [esi + 0x74], edi
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x14], al
push ecx
mov dword [esi], 0x5dbbc8
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0x8c], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [esi + 0x80], eax
je 0x419039
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Init
push eax
call ebx
mov edx, dword [esi + 0x80]
push str.ModeCommand
push edx
mov dword [esi + 0x88], eax
call ebx
mov dword [esi + 0x90], eax
mov eax, dword [esi + 0x80]
push str.SetSampleRate
push eax
call ebx
mov ecx, dword [esi + 0x80]
push str.AddRxSamples
push ecx
mov dword [esi + 0x94], eax
call ebx
mov edx, dword [esi + 0x80]
push str.FillSoundBuffer
push edx
mov dword [esi + 0x98], eax
call ebx
mov dword [esi + 0x9c], eax
mov eax, dword [esi + 0x80]
push str.SetPtt
push eax
call ebx
mov ecx, dword [esi + 0x80]
push 0x62a2a8
push ecx
mov dword [esi + 0xa0], eax
call ebx
mov edx, dword [esi + 0x80]
push str.GetMacrosFunc
push edx
mov dword [esi + 0xa4], eax
call ebx
mov dword [esi + 0x8c], eax
mov eax, dword [esi + 0x88]
cmp eax, edi
pop ebx
je 0x419039
mov ecx, dword [0x664810]
push ecx
push 0x4193c0
push esi
call eax
add esp, 0xc
mov dword [esi + 0x84], eax
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x41e200
Capabilities:
Check http status code

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0xeac]
mov eax, dword [esi + 0x1004]
lea ecx, [esi + 0x1004]
push edx
call dword [eax + 0xc]
mov edx, dword [esi + 0xea4]
lea ecx, [esi + 0x1020]
mov ebx, eax
push edx
mov eax, dword [ecx]
mov dword [esp + 0x18], ebx
call dword [eax + 0xc]
mov ebp, eax
mov eax, dword [esi + 0xff4]
mov dword [esp + 0x10], ebp
fild dword [esp + 0x10]
fild dword [esp + 0x14]
mov ecx, dword [esi + eax*4 + 0xf30]
lea edi, [esi + eax*4 + 0xf30]
mov eax, dword [esi + 0xff0]
fpatan
sub eax, ecx
mov dword [esi + 0xff0], eax
fmul qword [0x5dab70]
call fcn.00573170
mov ecx, dword [esi + 0xffc]
mov dword [esi + 0xffc], eax
sub ecx, eax
mov eax, 0x431bde83
imul ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 0xc8
jle 0x41e2a2
mov edx, 0xc8
jmp 0x41e2af
cmp edx, 0xffffff38
jge 0x41e2af
mov edx, 0xffffff38
mov dword [edi], edx
mov edi, dword [esi + 0xff0]
mov eax, dword [esi + 0xff4]
add edi, edx
inc eax
mov ecx, 0xc
cdq
idiv ecx
sar ebx, 0x10
sar ebp, 0x10
mov dword [esi + 0xff0], edi
mov dword [esi + 0x140], edi
mov dword [esi + 0xeb0], ebx
mov dword [esi + 0xeb4], ebp
mov dword [esi + 0xff4], edx
mov edx, dword [esi + 0xf24]
cmp edx, edi
jg 0x41e2f8
mov edx, edi
mov ebx, dword [esi + 0xf20]
mov dword [esi + 0xf24], edx
cmp ebx, edi
jl 0x41e30a
mov ebx, edi
mov eax, edx
lea ecx, [ebx + edx]
shl eax, 7
sar ecx, 1
sub eax, edx
mov ebp, dword [esi + 0xf2c]
add eax, ecx
mov dword [esi + 0x144], 0
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
mov dword [esi + 0xf24], eax
mov eax, ebx
shl eax, 7
sub eax, ebx
xor ebx, ebx
add eax, ecx
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
cmp edi, ecx
mov dword [esi + 0xf20], eax
mov eax, dword [esi + 0xf28]
setg bl
xor edx, edx
mov dx, word [esi + 0xf02]
add ebp, edx
cmp eax, ebx
mov dword [esi + 0xf2c], ebp
mov ecx, ebp
je 0x41e3c6
test ebx, ebx
je 0x41e37f
mov dword [esi + 0xf24], edi
jmp 0x41e385
mov dword [esi + 0xf20], edi
lea edi, [ecx + 0x8000]
sar edi, 0x10
test edi, edi
jle 0x41e3a5
mov ebp, edi
mov eax, dword [esi + 0xf28]
mov ecx, esi
push eax
call fcn.0041e5d0
dec ebp
jne 0x41e394
mov ecx, dword [esi + 0xf2c]
mov dword [esi + 0xf28], ebx
shl edi, 0x10
sub ecx, edi
pop edi
sar ecx, 1
mov dword [esi + 0xf2c], ecx
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp ecx, 0x20000
jle 0x41e3e0
push eax
mov ecx, esi
call fcn.0041e5d0
add dword [esi + 0xf2c], 0xffff0000
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x41e3f0
Capabilities:
Check http status code

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0xeac]
mov eax, dword [esi + 0x103c]
lea ecx, [esi + 0x103c]
push edx
call dword [eax + 0xc]
mov edx, dword [esi + 0xea4]
lea ecx, [esi + 0x1058]
mov dword [esp + 0x14], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xec]
fild dword [esp + 0x10]
fild dword [esp + 0x14]
mov ecx, dword [esi + eax*4 + 0x28]
mov ebx, dword [esi + 0xe8]
lea edi, [esi + eax*4 + 0x28]
sub ebx, ecx
fpatan
mov dword [esi + 0xe8], ebx
fmul qword [0x5dab70]
call fcn.00573170
mov ecx, dword [esi + 0x114]
mov dword [esi + 0x114], eax
sub ecx, eax
mov eax, 0x431bde83
imul ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 0xc8
jle 0x41e488
mov edx, 0xc8
jmp 0x41e495
cmp edx, 0xffffff38
jge 0x41e495
mov edx, 0xffffff38
mov dword [edi], edx
mov edi, dword [esi + 0xe8]
mov eax, dword [esi + 0xec]
add edi, edx
inc eax
mov ecx, 6
cdq
idiv ecx
mov eax, dword [esi + 0x10]
mov ebx, edi
cmp eax, ebx
mov dword [esi + 0xe8], edi
mov dword [esi + 0x140], ebx
mov dword [esi + 0xec], edx
jg 0x41e4cb
mov eax, ebx
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x10], eax
cmp ecx, ebx
jl 0x41e4d7
mov ecx, ebx
lea edx, [eax*8]
lea edi, [ecx + eax]
sub edx, eax
mov ebp, dword [esi + 0x24]
sar edi, 1
lea edx, [edx + edx*4]
mov dword [esi + 0x144], 0
lea edx, [eax + edx*8]
lea edx, [eax + edx*2]
add eax, edi
lea edx, [eax + edx*2]
mov eax, 0x3a196b1f
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [ecx*8]
sub eax, ecx
mov dword [esi + 0x10], edx
lea edx, [eax + eax*4]
lea eax, [ecx + edx*8]
lea edx, [ecx + eax*2]
lea eax, [edi + ecx]
lea ecx, [eax + edx*2]
mov eax, 0x3a196b1f
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov dword [esi + 0xc], edx
xor edx, edx
cmp ebx, edi
setg dl
xor eax, eax
mov edi, edx
mov ax, word [esi + 0xf02]
shl eax, 1
add ebp, eax
mov eax, dword [esi + 0x20]
cmp eax, edi
mov dword [esi + 0x24], ebp
mov ecx, ebp
je 0x41e5a3
test edi, edi
je 0x41e56b
mov dword [esi + 0x10], ebx
jmp 0x41e56e
mov dword [esi + 0xc], ebx
lea ebx, [ecx + 0x8000]
sar ebx, 0x10
test ebx, ebx
jle 0x41e58b
mov ebp, ebx
mov ecx, dword [esi + 0x20]
push ecx
mov ecx, esi
call fcn.0041e820
dec ebp
jne 0x41e57d
mov edx, dword [esi + 0x24]
mov dword [esi + 0x20], edi
shl ebx, 0x10
sub edx, ebx
pop edi
sar edx, 1
mov dword [esi + 0x24], edx
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp ecx, 0x20000
jle 0x41e5ba
push eax
mov ecx, esi
call fcn.0041e820
add dword [esi + 0x24], 0xffff0000
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret