joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442655
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5bd528
call fcn.0056ca5d
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x44267b
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4426da
call fcn.00442d33
push eax
lea ecx, [ebp - 0x10]
call fcn.0040ae70
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.0056ca20
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0057bfc0
push eax
call fcn.004095d0
add esp, 0x14
test esi, esi
je 0x4426cd
push esi
call fcn.0057c02c
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00409780
mov eax, ebx
call fcn.0056ca26
ret 8

Function at 0x4514bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x4514d6
mov edi, dword [esi + 0xc]
jmp 0x451516
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4514ef
call fcn.00444908
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x451504
call fcn.00444908
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x451516
call fcn.00444908
call fcn.00446293
cmp dword [eax + 0x3c], 0
je 0x45152b
push edi
mov ecx, ebx
call fcn.00450bf2
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00451708
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x451554
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x451560
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46ed2c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0044259f
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x46ed68
call fcn.0046ef4e
mov dword [esi + 0xc], 1
jmp 0x46ed6d
call fcn.0046ef4e
cmp dword [esi], 0
je 0x46edb6
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x46ed90
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0043d6f3
jmp 0x46eda1
push 0xff
mov ecx, esi
call fcn.0040ae30
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0043890f
jmp 0x46edda
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x46edda
push dword [esi]
push dword [ebp - 4]
call fcn.00448489
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46eea3
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0046ef4e
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x46eeeb
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0043d6f3
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0043890f
jmp 0x46eef6
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00448489
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4a6e69
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x4a6e82
call fcn.00446293
mov esi, dword [eax + 0xc]
push 0x5fe02c
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4a6ed8
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4a6ed7
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4a6eb8
xor esi, esi
jmp 0x4a6ece
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.004a6ee0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x58a217
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0058a096

Function at 0x58f753
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0058f413

Function at 0x597e76
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4130d0
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 8
push ebp
push esi
xor ebp, ebp
push edi
lea esi, [esp + 0x10]
mov edx, ebx
mov dword [esp + 0x10], ebp
call fcn.0041c950
test al, al
je 0x413108
jmp 0x4130f0
mov eax, dword [esp + 0x10]
call fcn.00463e40
lea esi, [esp + 0x10]
mov edx, ebx
call fcn.0041c950
test al, al
jne 0x4130f0
lea esi, [esp + 0x10]
mov edx, ebx
mov dword [esp + 0x10], ebp
call fcn.0041c8f0
test al, al
je 0x413138
jmp 0x413120
mov eax, dword [esp + 0x10]
call fcn.0052ae60
lea esi, [esp + 0x10]
mov edx, ebx
call fcn.0041c8f0
test al, al
jne 0x413120
lea esi, [esp + 0x10]
mov edx, ebx
mov dword [esp + 0x10], ebp
call fcn.0041c9b0
test al, al
je 0x413168
jmp 0x413150
mov eax, dword [esp + 0x10]
jmp 0x798a10
lea esi, [esp + 0x10]
mov edx, ebx
mov dword [esp + 0x10], ebp
call fcn.0041ca10
test al, al
je 0x413198
jmp 0x413180
mov eax, dword [esp + 0x10]
call fcn.00431500
lea esi, [esp + 0x10]
mov edx, ebx
call fcn.0041ca10
test al, al
jne 0x413180
lea esi, [esp + 0x10]
mov edx, ebx
mov dword [esp + 0x10], ebp
call fcn.0041ca70
test al, al
je 0x4131c9
jmp 0x4131b0
mov eax, dword [esp + 0x10]
push eax
call fcn.004586e0
lea esi, [esp + 0x10]
mov edx, ebx
call fcn.0041ca70
test al, al
jne 0x4131b0
mov edi, dword [ebx + 0x13c]
call fcn.00438da0
mov esi, dword [ebx + 0x138]
call fcn.00438780
mov eax, dword [ebx + 0x144]
xor esi, esi
cmp dword [eax + 0x24], ebp
jle 0x41320a
xor edi, edi
mov edi, edi
lea eax, [edi + eax + 0x28]
call fcn.00487250
mov eax, dword [ebx + 0x144]
add esi, 1
add edi, 0x50
cmp esi, dword [eax + 0x24]
jl 0x4131f0
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x43c910
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [eax + 8]
cmp ecx, dword [0x6aa294]
push edi
jge 0x43c927
mov edx, dword [eax]
cmp byte [edx + 0x7f5], 0
je 0x43c946
mov edi, dword [eax]
call fcn.0044f380
cmp dword [edi + 0x7f8], 0
jne 0x43c93e
mov eax, edi
call fcn.0044f890
mov eax, edi
pop edi
jmp fcn.0044f890
pop edi
ret

Function at 0x441be0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, eax
mov eax, dword [esi + 8]
test eax, eax
je 0x441c2b
add dword [esi + 0x10], edi
mov ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0xc]
jbe 0x441c18
lea ecx, [esp + 4]
call fcn.0061bef1
push 0x68669c
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x658588
call fcn.006217cb
push edi
push eax
push edx
call fcn.00624510
add esp, 0xc
add dword [esi + 8], edi
pop esi
add esp, 0xc
ret
mov esi, dword [esi + 4]
test esi, esi
jne 0x441c52
lea ecx, [esp + 4]
call fcn.0061bef1
push 0x68669c
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x658588
call fcn.006217cb
push esi
push edi
push 1
push edx
call fcn.0061d24e
add esp, 0x10
cmp eax, edi
je 0x441c26
lea ecx, [esp + 4]
call fcn.0061bef1
push 0x68669c
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x658588
call fcn.006217cb
int3

Function at 0x443770
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 8], 0
je 0x443798
mov ecx, dword [esi + 0xc]
add ecx, 4
call fcn.00443730
mov eax, dword [esi + 0xc]
add eax, dword [esi + 8]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
add dword [esi + 0xc], 4
pop esi
ret 4
mov esi, dword [esi + 4]
test esi, esi
je 0x4437b1
push esi
push 4
lea edx, [esp + 0x10]
push 1
push edx
call fcn.0061d3c8
add esp, 0x10
pop esi
ret 4

Function at 0x4437c0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 8], 0
je 0x4437ea
mov ecx, dword [esi + 0xc]
add ecx, 2
call fcn.00443730
mov eax, dword [esi + 0xc]
add eax, dword [esi + 8]
mov cx, word [esp + 8]
mov word [eax], cx
add dword [esi + 0xc], 2
pop esi
ret 4
mov esi, dword [esi + 4]
test esi, esi
je 0x443803
push esi
push 2
lea edx, [esp + 0x10]
push 1
push edx
call fcn.0061d3c8
add esp, 0x10
pop esi
ret 4
Function at 0x443810
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, eax
movzx eax, word [edi + 0x14]
mov esi, ecx
cmp dword [esi + 8], 0
mov dword [esp + 0xc], eax
je 0x443845
mov ecx, dword [esi + 0xc]
add ecx, 2
call fcn.00443730
mov ecx, dword [esi + 0xc]
add ecx, dword [esi + 8]
mov dx, word [esp + 0xc]
mov word [ecx], dx
add dword [esi + 0xc], 2
jmp 0x44385e
mov eax, dword [esi + 4]
test eax, eax
je 0x44385e
push eax
push 2
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0061d3c8
add esp, 0x10
cmp dword [edi + 0x18], 0x10
mov eax, dword [edi + 0x14]
jb 0x44386c
mov ebx, dword [edi + 4]
jmp 0x44386f
lea ebx, [edi + 4]
cmp dword [esi + 8], 0
movzx edi, ax
je 0x44389b
mov ecx, dword [esi + 0xc]
add ecx, edi
call fcn.00443730
mov ecx, dword [esi + 0xc]
add ecx, dword [esi + 8]
push edi
push ebx
push ecx
call fcn.00624510
add esp, 0xc
add dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ecx
ret
mov esi, dword [esi + 4]
test esi, esi
je 0x4438af
push esi
push edi
push 1
push ebx
call fcn.0061d3c8
add esp, 0x10
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x443920
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x100
cmp dword [0x6a9eb0], 0
jne 0x443981
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 4]
push str.gPakInterfaceP__d
push eax
call fcn.0061d4e6
add esp, 0xc
lea ecx, [esp]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x6a9eb0], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x6a9eb4], eax
mov eax, dword [eax]
add esp, 0x100
ret
mov edx, dword [0x6a9eb4]
mov eax, dword [edx]
add esp, 0x100
ret

Function at 0x443f60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x643b10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
lea eax, [esp + 0x34]
push eax
lea esi, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.005afc50
add esp, 4
mov byte [esp + 0x2c], 1
mov ecx, dword [0x6a9f38]
mov edx, dword [ecx + 0x634]
push edx
mov ecx, eax
call fcn.005b7c00
mov esi, 0x10
cmp dword [esp + 0x20], esi
mov dword [edi], eax
jb 0x443fc5
mov eax, dword [esp + 0xc]
push eax
call fcn.0061c19a
add esp, 4
cmp dword [edi], 0
jne 0x443fef
cmp dword [esp + 0x4c], esi
jb 0x443fdd
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0061c19a
add esp, 4
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop esi
add esp, 0x2c
ret
cmp dword [esp + 0x4c], esi
jb 0x444002
mov edx, dword [esp + 0x38]
push edx
call fcn.0061c19a
add esp, 4
mov ecx, dword [esp + 0x24]
mov al, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x2c
ret
Function at 0x44f5f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64f21b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
call fcn.0044f380
push 0x57b0
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44f635
push eax
mov ecx, edi
call fcn.00407b50
jmp 0x44f637
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [edi + 0xc4]
push ecx
mov ecx, dword [edi + 0xc0]
push ecx
mov dword [edi + 0x768], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x768]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
mov eax, dword [edi + 0x768]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x768]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
add esp, 0x10
ret

Function at 0x44f890
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, eax
mov ecx, esi
mov byte [esi + 0x801], 0
call fcn.0044f5f0
mov eax, dword [esi + 0x768]
push eax
call fcn.0040af90
mov dword [esi + 0x888], 0
mov dword [esi + 0x7fc], 2
call fcn.0044fdc0
jmp 0x79fea0

Function at 0x44f8e0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x64f1fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
call fcn.0044f380
mov eax, dword [edi + 0x770]
test eax, eax
je 0x44f929
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x10]
call eax
mov edx, dword [edi]
mov eax, dword [edi + 0x770]
mov edx, dword [edx + 0x88]
push eax
mov ecx, edi
call edx
push 0x130
jmp loc.007a0790

Function at 0x44fa20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64ba7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push 0x9c
mov dword [esi + 0x7fc], 5
call fcn.0061c130
add esp, 4
mov dword [esp], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x44fa6b
mov ecx, dword [esp + 0x14]
push ecx
push eax
mov ecx, esi
call fcn.00405780
jmp 0x44fa6d
xor eax, eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x778], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x778]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x778]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x778]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x44fb30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64ba5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push pe_nt_image_headers32
mov dword [esi + 0x7fc], 6
call fcn.0061c130
add esp, 4
mov dword [esp], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x44fb76
push eax
mov ecx, esi
call fcn.00433a70
jmp 0x44fb78
xor eax, eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x77c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x77c]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x77c]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x77c]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x44fc30
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x64ba3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push 0x1e4
mov dword [esi + 0x7fc], 7
call fcn.0061c130
add esp, 4
mov dword [esp], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x44fc7a
mov ecx, dword [esp + 0x14]
push ecx
push esi
push eax
call fcn.0042dae0
jmp 0x44fc7c
xor eax, eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
jmp 0x7a0500

Function at 0x44fdc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64997b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push 0xd40
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44fdfd
push eax
call fcn.00483380
jmp 0x44fdff
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x774], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x774]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x774]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x45db60
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 4]
test edx, edx
push esi
push edi
mov esi, eax
mov edi, ecx
mov dword [ebx + 0x28], edi
mov dword [ebx + 0x1c], esi
je 0x45dbd3
mov ecx, dword [edx + 0x8c]
cmp dword [ecx + 0x7f8], 0x2b
jne 0x45dbb4
mov eax, dword [edx + 0x554c]
cmp eax, 6
je 0x45dba4
cmp eax, 8
je 0x45dba4
cmp eax, 7
jne 0x45dbb4
mov eax, dword [ecx + 0x81c]
call fcn.00521450
mov edx, dword [ebx + 4]
jmp 0x45dbbd
lea eax, [edi + edi*4]
shl eax, 4
add eax, 0x28
mov dword [ebx + 8], eax
mov eax, esi
mov ecx, edi
mov ebx, edx
call fcn.0041c740
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov ebx, ecx
xor edi, edi
lea eax, [edi + 7]
mov dword [ebx + 0x2c], edi
mov byte [ebx + 0x140], 1
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x90], edi
call fcn.005af400
fldz
mov edx, dword [ebp + 0x10]
fst dword [ebx + 0xc0]
mov esi, dword [ebp + 0xc]
fstp dword [ebx + 0xc4]
add eax, 0xc
mov dword [ebx + 0x34], eax
or eax, 0xffffffff
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x84], eax
mov eax, dword [ebx + 0x1c]
push 0x64
mov dword [ebx + 0x88], eax
mov eax, 0x50
lea ecx, [ebx + 0xc8]
push edi
push ecx
mov dword [ebx + 0x38], 5
mov dword [ebx + 0x3c], edi
mov byte [ebx + 0x141], 0
mov byte [ebx + 0x142], 0
mov dword [ebx + 0x24], esi
mov dword [ebx + 0x138], edx
mov dword [ebx + 0x40], 0x12c
mov dword [ebx + 0x50], edi
mov dword [ebx + 0x4c], 0xc8
mov dword [ebx + 0x54], edi
mov dword [ebx + 0x8c], edi
mov dword [ebx + 0x94], edi
mov dword [ebx + 0x98], edi
mov dword [ebx + 0x9c], edi
mov dword [ebx + 0xa0], edi
mov dword [ebx + 0xa4], edi
mov dword [ebx + 0xa8], edi
mov dword [ebx + 0xac], edi
mov dword [ebx + 0xb0], edi
mov dword [ebx + 0xb4], edi
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edi
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
jmp 0x796950

Function at 0x4606f0
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
jmp fcn.00798bb0
Function at 0x463150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x144], 0
je 0x463410
mov ecx, dword [edi]
mov eax, dword [ecx + 0x7f8]
cmp eax, 0x2b
je 0x463410
cmp eax, 0x32
je 0x463410
cmp dword [edi + 0x3c], 2
je 0x46318b
cmp byte [edi + 0x142], 0
je 0x46319b
add dword [edi + 0x4c], 0xffffffff
jns 0x46319b
push edi
call fcn.004679b0
pop edi
pop esi
pop ecx
ret
mov eax, dword [edi + 0x130]
test eax, eax
jle 0x463217
add eax, 0xffffffff
cmp eax, 0x3c
mov dword [edi + 0x130], eax
jne 0x463205
cmp byte [ecx + 0x8c5], 0
jne 0x463205
fldz
mov esi, dword [ecx + 0x784]
mov ecx, dword [0x6a9f00]
fst dword [esp + 8]
fcomp dword [ecx + 0x10e0]
fnstsw ax
test ah, 0x44
jnp 0x4631f1
fld dword [ecx + 0x10e0]
push ecx
fstp dword [esp]
call fcn.005af410
fstp dword [esp + 0xc]
add esp, 4
fld dword [esp + 8]
push ecx
mov eax, 0x53
fstp dword [esp]
mov ecx, esi
call fcn.00515020
cmp dword [edi + 0x130], 0
jne 0x463217
push 0
mov eax, edi
call fcn.0045e860
cmp byte [edi + 0x143], 0
jne 0x463410
cmp byte [edi + 0x142], 0
jne 0x463410
cmp dword [edi + 0x134], 0
jne 0x463410
mov eax, edi
call fcn.00464820
mov eax, dword [edi + 0x54]
test eax, eax
jle 0x463252
jmp 0x798080
mov ecx, dword [edi]
call fcn.00453840
test al, al
je 0x463266
call fcn.00462ce0
pop edi
pop esi
pop ecx
ret
mov ecx, dword [edi + 0x24]
cmp ecx, 0x11
jne 0x463279
push edi
call fcn.004609d0
jmp 0x4633ee
cmp ecx, 0xf
jne 0x46328a
mov eax, edi
call fcn.00460dd0
jmp 0x4633ee
cmp ecx, 0xe
jne 0x4632b9
cmp byte [edi + 0x143], 0
jne 0x4633ee
cmp dword [edi + 0x3c], 2
je 0x4633ee
mov dword [edi + 0x3c], 2
mov dword [edi + 0x50], 0x64
jmp 0x4633ee
cmp ecx, 6
jne 0x4632ca
mov eax, edi
call fcn.00461320
jmp 0x4633ee
cmp ecx, 0x1b
jne 0x4632d9
call fcn.00460f00
jmp 0x4633ee
cmp ecx, 0x21
jne 0x4632e4
cmp dword [edi + 0x3c], 0x2f
jmp 0x4632ed
cmp ecx, 0x10
jne 0x463309
cmp dword [edi + 0x3c], 0x30
jne 0x4633ee
jmp 0x799490
cmp ecx, 0x30
jne 0x463318
call fcn.00466ca0
jmp 0x4633ee
cmp ecx, 0x23
jne 0x463329
mov ecx, edi
call fcn.00460f60
jmp 0x4633ee
cmp ecx, 0x25
jne 0x46333a
mov eax, edi
call fcn.00460fa0
jmp 0x4633ee
cmp ecx, 0x2f
jne 0x46334b
mov eax, edi
call fcn.00461020
jmp 0x4633ee
cmp ecx, 0x1a
jne 0x46335c
mov eax, edi
call fcn.004611f0
jmp 0x4633ee
cmp ecx, 0x1f
jne 0x46336c
push edi
call fcn.00461d90
jmp 0x4633ee
cmp ecx, 0x2d
mov eax, edi
jne 0x46337a
call fcn.00462680
jmp 0x4633ee
cmp ecx, 9
jne 0x463386
call fcn.0045fb70
jmp 0x4633ee
call fcn.0045f980
test al, al
jne 0x4633e9
cmp ecx, 0x26
je 0x4633e9
cmp ecx, 0xb
jne 0x4633a1
push edi
call fcn.0045fc70
jmp 0x4633ee
cmp ecx, 0x16
jne 0x4633ae
push edi
call fcn.00460610
jmp 0x4633ee
cmp ecx, 4
jne 0x4633bc
mov eax, edi
call fcn.0045fe20
jmp 0x4633ee
cmp ecx, 0x15
je 0x4633e0
cmp ecx, 0x2e
je 0x4633e0
cmp ecx, 0x13
jne 0x4633d3
push edi
call fcn.00460060
jmp 0x4633ee
cmp ecx, 0xd
jne 0x4633ee
push edi
call fcn.00460420
jmp 0x4633ee
mov eax, edi
call fcn.00460370
jmp 0x4633ee
call fcn.0045f9a0
cmp dword [edi + 0x48], 1
jne 0x4633fb
mov eax, edi
call fcn.0045f8a0
mov eax, dword [edi + 0x50]
test eax, eax
jle 0x463410
jmp 0x797a40
pop edi
pop esi
pop ecx
ret