joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e3c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4531b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46304c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0042c370
mov edx, dword [esp + 0x20]
push 0
push esi
mov dword [esi], vtable.OsNet::IOTCPCONN.0
mov dword [esi + 0x630], 1
mov eax, dword [esi + 4]
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
jne 0x42e453
push eax
mov ecx, esi
call fcn.0042bf90
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x20
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x42e46c
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42e46c
push eax
push ecx
mov ecx, esi
call fcn.0042af10
mov ecx, esi
call fcn.00425e40
test eax, eax
je 0x42e489
mov ecx, dword [esi + 0x60]
push 1
push esi
call fcn.0042be80
mov ecx, esi
call fcn.00426590
mov ecx, esi
call fcn.0042c540
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x20

Function at 0x42e6e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4531e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46304c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0042c650
mov edx, dword [esp + 0x20]
mov eax, dword [esi + 0x6c]
push 0
push esi
push edx
push eax
mov dword [esp + 0x24], 0
mov dword [esi], vtable.OsNet::IOFILECONN.0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
mov ecx, esi
jne 0x42e782
call fcn.00425e00
mov ecx, dword [esi + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov ecx, esi
mov dword [esi + 0x6c], 0xffffffff
call fcn.0042bf90
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18
call fcn.00426730
mov ecx, esi
call fcn.00425e40
test eax, eax
je 0x42e79f
mov ecx, dword [esi + 0x60]
push 3
push esi
call fcn.0042be80
jmp 0x42e7a6
mov ecx, esi
call fcn.0042c6d0
mov ecx, esi
call fcn.0042c6d0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18
Function at 0x42e7e0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x453218
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46304c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0042c650
push 0
push 0
push 0
push 0
mov dword [esp + 0x24], 0
mov dword [esi], vtable.OsNet::SLFILECONN.0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esi + 0x8c], eax
je 0x42e8b9
lea edx, [esp + 0x2c]
push edx
push 0
push esi
push 0x428f10
push 0
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
test eax, eax
mov dword [esi + 0x88], eax
je 0x42e8b9
mov ecx, esi
call fcn.00425e40
test eax, eax
je 0x42e89d
mov ecx, dword [esi + 0x60]
push 3
push esi
call fcn.0042be80
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14
mov ecx, esi
call fcn.0042c6d0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14
mov ecx, esi
call fcn.00425e00
push 0
mov ecx, esi
call fcn.0042bf90
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14

Function at 0x42ee80
Capabilities:
Get socket status

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov eax, ebx
imul eax, eax, 0x3e8
push esi
xor edx, edx
push edi
mov edi, ecx
mov ecx, dword [esp + 0x24]
shr ecx, 6
add ecx, 1
div ecx
mov esi, dword [edi + 0x108]
lea ecx, [edi + 0x20c]
lea edx, [edi + 0x108]
lea ebp, [edi + 4]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
mov dword [esp + 0x20], eax
neg eax
sbb eax, eax
and eax, ecx
mov ecx, esi
neg ecx
sbb ecx, ecx
and ecx, edx
mov edx, dword [ebp]
mov dword [esp + 0x24], edx
neg edx
sbb edx, edx
and edx, ebp
mov ebp, dword [esp + 0x24]
cmp ebp, esi
ja 0x42eef3
mov ebp, esi
mov esi, dword [esp + 0x20]
cmp ebp, esi
jbe 0x42ef09
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x10]
cmp ebp, esi
jbe 0x42ef09
mov esi, ebp
neg ebx
sbb ebx, ebx
lea ebp, [esp + 0x14]
and ebx, ebp
push ebx
push eax
push ecx
push edx
add esi, 1
push esi
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
jne 0x42ef32
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
test eax, eax
je 0x42ef86
xor ebp, ebp
lea ebx, [ebp + 2]
lea esi, [edi + 4]
mov edi, edi
cmp dword [esi], 0
jbe 0x42ef72
add dword [esi], 0xffffffff
mov eax, dword [esi]
add eax, ebx
mov edx, dword [edi + eax*4]
push 0x470088
push edx
lea ecx, [edi + 0x310]
call fcn.0042ea40
mov ecx, dword [eax + 0x18]
mov eax, dword [ecx]
mov edx, dword [edi]
mov eax, dword [eax]
push ebp
push edx
call eax
cmp dword [esi], 0
ja 0x42ef45
add ebx, 0x41
add ebp, 1
add esi, 0x104
cmp ebx, 0xc5
jb 0x42ef40
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 8
Function at 0x42fdb0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [esp + 0x34]
push ebp
push edi
xor edi, edi
cmp ebx, 0xffffffff
mov ebp, ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
je 0x42fdea
cmp dword [0x470090], edi
je 0x42fde0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x42fdea
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x20], eax
push ebx
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [ebp + 0x618]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
mov edx, dword [0x47024c]
test edx, edx
jne 0x42ff35
push esi
cmp ebx, 0xffffffff
mov edx, dword [esp + 0x18]
je 0x42fe2b
test eax, eax
jne 0x42fe2b
test edx, edx
je 0x42ff34
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x42fe7a
test edx, edx
je 0x42fe71
mov esi, dword [edx + 0x14]
sub esi, 0
je 0x42fe5f
sub esi, 1
jne 0x42fe71
mov esi, dword [ecx]
push eax
mov eax, dword [esp + 0x18]
push eax
push edx
mov edx, dword [esi + 0x1c]
call edx
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
call edx
jmp 0x42fe92
mov esi, dword [ecx]
push eax
mov eax, dword [esp + 0x18]
push eax
push edx
mov edx, dword [esi + 0x20]
call edx
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
call edx
jmp 0x42fe92
test edx, edx
je 0x42fe92
mov ecx, dword [edx + 0x14]
sub ecx, 2
jne 0x42fe92
push eax
add edx, 0xfffffff8
push edx
mov ecx, ebp
call fcn.0042f6a0
cmp ebx, 0xffffffff
je 0x42ff05
cmp dword [0x470090], 0
je 0x42fef5
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
fnstcw word [esp + 0x40]
mov ecx, dword [esp + 0x2c]
sub ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x30]
sbb edx, dword [esp + 0x28]
movzx eax, word [esp + 0x40]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
or eax, 0xc00
mov dword [esp + 0x1c], eax
fild qword [esp + 0x34]
fmul dword [0x47008c]
fldcw word [esp + 0x1c]
fistp qword [esp + 0x1c]
mov edi, dword [esp + 0x1c]
test edi, edi
fldcw word [esp + 0x40]
jl 0x42ff34
jmp 0x42ff01
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
sub edi, dword [esp + 0x24]
cmp edi, ebx
jae 0x42ff34
mov eax, ebx
sub eax, edi
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x618]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
mov edx, dword [0x47024c]
test edx, edx
je 0x42fe16
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x2c
ret 4

Function at 0x42ff40
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
cmp dword [ecx + 0xc], 0
je 0x42ff4c
jmp dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ecx + 0x618], 0
je 0x42ff5a
jmp fcn.0042fdb0
jmp dword [sym.imp.KERNEL32.dll_Sleep]
Function at 0x42ff90
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x4700ac]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
xor edi, edi
cmp eax, edi
je 0x42ffb8
push eax
mov dword [0x4700a0], edi
mov dword [0x47009c], edi
call esi
mov dword [0x4700ac], edi
mov eax, dword [0x4700b0]
cmp eax, edi
je 0x42ffd6
push eax
mov dword [0x4700a8], edi
mov dword [0x4700a4], edi
call esi
mov dword [0x4700b0], edi
call dword [sym.imp.WSOCK32.dll_WSACleanup]
cmp dword [0x4700b4], edi
jne 0x430055
mov eax, dword [0x470258]
push ebx
add eax, 0x620
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x470258]
mov esi, dword [eax + 0x630]
add eax, 0x628
cmp esi, edi
jle 0x43003d
mov ecx, dword [esi + 0x14]
push edi
push ecx
call ebx
mov ecx, esi
call fcn.0042a950
push edi
push 0xffffffffffffffff
push 0x456b10
push esi
call sub.Storm.dll_Ordinal_403
mov ecx, dword [0x470258]
call fcn.0042ff60
jmp 0x430000
mov eax, dword [0x470258]
mov edx, dword [eax + 0x620]
add eax, 0x620
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop ebx
pop edi
pop esi
ret
Function at 0x430e30
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0
push 0
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esi + 0x24], eax
je 0x430e75
mov ecx, esi
call fcn.00425c80
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x4300c0
push 0
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
test eax, eax
jne 0x430e7c
mov ecx, esi
call fcn.0042ff60
xor eax, eax
pop esi
pop ecx
ret 4
mov dword [esi + 0x20], eax
mov eax, 1
pop esi
pop ecx
ret 4

Function at 0x431da0
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 4], 0
push esi
push edi
mov dword [esp + 0xc], 0
jbe 0x431e59
lea ebx, [ebx]
mov ecx, ebx
call fcn.00425c80
cmp dword [ebx + 0x618], 0
mov eax, 0x430e00
jne 0x431dda
mov eax, 0x4317e0
lea ecx, [esp + 0x14]
push ecx
push 0
push ebx
push eax
push 0
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
mov edx, eax
add esp, 0x18
test edx, edx
mov dword [esp + 0x10], edx
je 0x431e65
mov edi, dword [ebx + 0xc]
lea esi, [ebx + 8]
add edi, 1
cmp edi, dword [esi]
jbe 0x431e34
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x431e18
push edi
mov ecx, esi
call fcn.004182b0
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
test edx, edx
je 0x431e28
sub ecx, edx
add ecx, edi
mov edi, ecx
push edi
mov ecx, esi
call fcn.00418310
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
lea ecx, [ecx + eax*4]
add eax, 1
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
add eax, 1
mov dword [ecx], edx
cmp eax, dword [ebx + 4]
mov dword [esp + 0xc], eax
jb 0x431dc0
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret
mov ecx, ebx
call fcn.0042ff60
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret

Function at 0x432b10
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
mov esi, ecx
call edi
test eax, eax
mov dword [esi + 0x54c], eax
je 0x432b6f
push 0
push 0
push 0
push 0
call edi
test eax, eax
mov dword [esi + 0x554], eax
je 0x432b6f
mov ecx, esi
call fcn.00425c80
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x431e80
push 0
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
test eax, eax
jne 0x432b77
mov ecx, esi
call fcn.0042ff60
pop edi
xor eax, eax
pop esi
pop ecx
ret 4
mov dword [esi + 0x548], eax
pop edi
mov eax, 1
pop esi
pop ecx
ret 4
Function at 0x432c00
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x618], 0
jne 0x432c1b
call fcn.00431da0
test eax, eax
jne 0x432c1b
pop esi
pop ecx
ret 4
test byte [esp + 0xc], 2
push edi
mov edi, dword [sym.imp.MSVCR80.dll__beginthreadex]
je 0x432c59
mov ecx, esi
call fcn.00425c80
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x431bc0
push 0
push 0
call edi
add esp, 0x18
test eax, eax
je 0x432c8f
push 0xffffffffffffffff
push eax
mov dword [esi + 0x514], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esi + 0x1c], eax
je 0x432c96
mov ecx, esi
call fcn.00425c80
lea ecx, [esp + 8]
push ecx
push 0
push esi
push 0x4327b0
push 0
push 0
call edi
add esp, 0x18
test eax, eax
jne 0x432c9e
mov ecx, esi
call fcn.0042ff60
pop edi
xor eax, eax
pop esi
pop ecx
ret 4
mov dword [esi + 0x18], eax
pop edi
mov eax, 1
pop esi
pop ecx
ret 4
Function at 0x432d00
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x453707
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x46304c]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
push esi
push edi
mov eax, dword [0x46304c]
xor eax, esp
push eax
lea eax, [esp + 0xbc]
mov dword fs:[0], eax
mov dword [esp + 0x10], edx
mov ebx, ecx
lea ecx, [esp + 0x10]
call fcn.00425b40
mov ecx, 0x470274
call fcn.004129a0
mov cl, byte [esp + 0x10]
xor esi, esi
test cl, 8
mov edi, 1
je 0x432e3c
mov eax, dword [0x47025c]
mov edx, eax
add eax, edi
test edx, edx
lea esi, [edi + 7]
mov dword [0x47025c], eax
jne 0x432e3c
lea eax, [esp + 0x18]
push eax
mov dword [0x470094], edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
mov dword [0x470090], eax
je 0x432da6
fild qword [esp + 0x18]
fdivr qword [0x4574b0]
jmp 0x432da8
fldz
lea ecx, [esp + 0x24]
fstp dword [0x47008c]
push ecx
mov dword [esp + 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x432dd2
cmp dword [esp + 0x28], 5
mov dword [0x4700b4], edi
jb 0x432ddc
mov dword [0x4700b4], 0
push 0
push 0x74f
push str..W32OsTcp.cpp
push 0x634
call sub.Storm.dll_Ordinal_401
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0xc4], 0
je 0x432e12
mov ecx, eax
call fcn.0042efa0
jmp 0x432e14
xor eax, eax
mov dword [0x470258], eax
mov ecx, dword [0x470258]
push ebx
mov dword [esp + 0xc8], 0xffffffff
call fcn.00432b10
test eax, eax
je 0x432f01
mov cl, byte [esp + 0x10]
test cl, 1
je 0x432e6d
mov eax, dword [0x470260]
mov edx, eax
add eax, edi
or esi, edi
test edx, edx
mov dword [0x470260], eax
jne 0x432e6d
mov ecx, dword [0x470258]
push ebx
call fcn.00430e30
test eax, eax
je 0x432f01
mov cl, byte [esp + 0x10]
test cl, 0x10
je 0x432e9b
mov eax, dword [0x470268]
mov edx, eax
add eax, edi
or esi, 0x10
test edx, edx
mov dword [0x470268], eax
jne 0x432e9b
mov ecx, dword [0x470258]
push ebx
call fcn.00425bb0
test eax, eax
je 0x432f01
mov cl, byte [esp + 0x10]
test cl, 0x20
je 0x432ec9
mov eax, dword [0x47026c]
mov edx, eax
add eax, edi
or esi, 0x20
test edx, edx
mov dword [0x47026c], eax
jne 0x432ec9
mov ecx, dword [0x470258]
push ebx
call fcn.00432b90
test eax, eax
je 0x432f01
mov cl, byte [esp + 0x10]
test cl, 4
je 0x432ed7
or esi, 4
add dword [0x470270], edi
test cl, 2
je 0x432f0a
mov eax, dword [0x470264]
mov ecx, eax
add eax, edi
or esi, 2
test ecx, ecx
mov dword [0x470264], eax
jne 0x432f0a
mov ecx, dword [0x470258]
push ebx
call fcn.00432c00
test eax, eax
jne 0x432f0a
mov ecx, esi
xor edi, edi
call fcn.00430d00
mov edx, dword [0x470278]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [esp + 0xbc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.00401d9e
add esp, 0xb8
ret
jmp 0x432d00
Function at 0x432f40
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x453707
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x46304c]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
push esi
push edi
mov eax, dword [0x46304c]
xor eax, esp
push eax
lea eax, [esp + 0xbc]
mov dword fs:[0], eax
mov dword [esp + 0x10], edx
mov ebx, ecx
lea ecx, [esp + 0x10]
call fcn.00425b40
mov ecx, 0x470274
call fcn.004129a0
mov cl, byte [esp + 0x10]
xor esi, esi
test cl, 8
mov edi, 1
je 0x432e3c
mov eax, dword [0x47025c]
mov edx, eax
add eax, edi
test edx, edx
lea esi, [edi + 7]
mov dword [0x47025c], eax
jne 0x432e3c
lea eax, [esp + 0x18]
push eax
mov dword [0x470094], edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
mov dword [0x470090], eax
je 0x432da6
fild qword [esp + 0x18]
fdivr qword [0x4574b0]
jmp 0x432da8
fldz
lea ecx, [esp + 0x24]
fstp dword [0x47008c]
push ecx
mov dword [esp + 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x432dd2
cmp dword [esp + 0x28], 5
mov dword [0x4700b4], edi
jb 0x432ddc
mov dword [0x4700b4], 0
push 0
push 0x74f
push str..W32OsTcp.cpp
push 0x634
call sub.Storm.dll_Ordinal_401
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0xc4], 0
je 0x432e12
mov ecx, eax
call fcn.0042efa0
jmp 0x432e14
xor eax, eax
mov dword [0x470258], eax
mov ecx, dword [0x470258]
push ebx
mov dword [esp + 0xc8], 0xffffffff
call fcn.00432b10
test eax, eax
je 0x432f01
mov cl, byte [esp + 0x10]
test cl, 1
je 0x432e6d
mov eax, dword [0x470260]
mov edx, eax
add eax, edi
or esi, edi
test edx, edx
mov dword [0x470260], eax
jne 0x432e6d
mov ecx, dword [0x470258]
push ebx
call fcn.00430e30
test eax, eax
je 0x432f01
mov cl, byte [esp + 0x10]
test cl, 0x10
je 0x432e9b
mov eax, dword [0x470268]
mov edx, eax
add eax, edi
or esi, 0x10
test edx, edx
mov dword [0x470268], eax
jne 0x432e9b
mov ecx, dword [0x470258]
push ebx
call fcn.00425bb0
test eax, eax
je 0x432f01
mov cl, byte [esp + 0x10]
test cl, 0x20
je 0x432ec9
mov eax, dword [0x47026c]
mov edx, eax
add eax, edi
or esi, 0x20
test edx, edx
mov dword [0x47026c], eax
jne 0x432ec9
mov ecx, dword [0x470258]
push ebx
call fcn.00432b90
test eax, eax
je 0x432f01
mov cl, byte [esp + 0x10]
test cl, 4
je 0x432ed7
or esi, 4
add dword [0x470270], edi
test cl, 2
je 0x432f0a
mov eax, dword [0x470264]
mov ecx, eax
add eax, edi
or esi, 2
test ecx, ecx
mov dword [0x470264], eax
jne 0x432f0a
mov ecx, dword [0x470258]
push ebx
call fcn.00432c00
test eax, eax
jne 0x432f0a
mov ecx, esi
xor edi, edi
call fcn.00430d00
mov edx, dword [0x470278]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [esp + 0xbc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.00401d9e
add esp, 0xb8
ret
jmp 0x432d00
Function at 0x4378e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4379cb
test al, 0x10
je 0x4379cb
push 0x436cb0
call dword [sym.imp.mss32.dll__AIL_mem_use_malloc_4]
push 0x436d20
call dword [sym.imp.mss32.dll__AIL_mem_use_free_4]
push esi
push str.Setting_MP3_redist_directory_to__s
push edi
call sub.Storm.dll_Ordinal_548
add esp, 0xc
push esi
call dword [sym.imp.mss32.dll__AIL_set_redist_directory_4]
call fcn.00451e30
call dword [sym.imp.mss32.dll__AIL_startup_0]
mov eax, dword [0x470454]
test eax, eax
je 0x43793f
push eax
call dword [sym.imp.mss32.dll__AIL_close_digital_driver_4]
xor eax, eax
test bl, 0x10
je 0x43794b
mov eax, 1
push eax
mov eax, dword [0x465530]
mov ecx, dword [eax*4 + 0x459180]
push 2
push 0x10
push ecx
call dword [sym.imp.mss32.dll__AIL_open_digital_driver_16]
test eax, eax
mov dword [0x470454], eax
jne 0x437986
call fcn.0043c070
mov edx, dword [eax]
push str.Error__cannot_open_Miles_digital_sound_driver_
push 0
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0xc
xor eax, eax
ret
push 0x4344d0
push 0x434470
push 0x434460
push 0x434430
call dword [sym.imp.mss32.dll__AIL_set_file_callbacks_16]
mov ecx, dword [0x470454]
push ecx
push str.DIG_handle_is_0x_08x
push edi
call sub.Storm.dll_Ordinal_548
add esp, 0xc
test bl, 4
jne 0x4379c0
push ebx
call fcn.00437770
call fcn.00441260
mov eax, 1
ret
call fcn.0043c070
mov edx, dword [eax]
push str.Error__invalid_redist_directory_specified_
push 0
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0xc
xor eax, eax
ret
Function at 0x448a50
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x453ad8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46304c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
xor edx, edx
mov dword [esp + 0x14], edx
call fcn.00447b00
movzx eax, word [ebx + 2]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 1]
sub eax, 1
and eax, dword [esp + 0x48]
mov dword [esp + 0x28], edx
lea edi, [ecx + eax*4]
mov dword [esp + 0x30], edx
mov eax, dword [edi]
cmp eax, edx
mov dword [esp + 0x40], edx
je 0x448abf
mov eax, dword [eax]
mov dword [esp + 0x28], eax
mov ecx, dword [edi]
lea eax, [esp + 0x28]
mov dword [ecx], eax
jmp 0x448ac7
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], ecx
lea eax, [esp + 0x28]
mov dword [edi], eax
mov esi, dword [esp + 0x28]
cmp esi, eax
mov ecx, eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], esi
mov ebp, esi
je 0x448bad
jmp 0x448af2
xor edx, edx
mov ecx, dword [ebp + 8]
cmp ecx, edx
jne 0x448b62
cmp byte [ebx], 1
jne 0x448b89
test esi, esi
mov edx, esi
je 0x448b3e
mov ecx, dword [esp + 0x20]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [edi]
cmp esi, ecx
jne 0x448b36
mov eax, dword [esp + 0x20]
cmp eax, ecx
jne 0x448b30
mov dword [esp + 0x20], 0
mov dword [edi], 0
xor esi, esi
jmp 0x448b38
mov dword [edi], eax
xor esi, esi
jmp 0x448b38
mov esi, eax
mov dword [edx], 0
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x448b51
add dword [ecx + 4], 0xffffffff
jne 0x448b51
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
push 0
push 0
push ebp
mov ecx, 0x470c24
call sym.War3.exe_II
jmp 0x448b9b
mov edx, dword [esp + 0x48]
cmp dword [ebp + 4], edx
jne 0x448b89
mov eax, dword [ebp + 0xc]
mov edx, dword [esp + 0x4c]
mov dword [edx + 8], eax
mov eax, dword [ecx]
push edx
mov edx, dword [eax + 0xc]
call edx
test eax, eax
je 0x448b89
mov dword [esp + 0x14], 1
test esi, esi
je 0x448b9b
cmp esi, dword [edi]
mov dword [esp + 0x20], esi
jne 0x448b99
xor esi, esi
jmp 0x448b9b
mov esi, dword [esi]
lea eax, [esp + 0x28]
cmp esi, eax
mov ebp, esi
jne 0x448af0
mov dword [esp + 0x24], esi
lea ecx, [esp + 0x1c]
push ecx
mov ecx, edi
call fcn.00447c10
mov ecx, ebx
call fcn.00447b10
cmp byte [ebx], 0
jne 0x448bd5
mov dx, word [esp + 0x18]
cmp word [ebx + 2], dx
jbe 0x448bd5
call fcn.004488f0
mov eax, dword [esp + 0x30]
test eax, eax
mov dword [esp + 0x40], 0xffffffff
je 0x448bf9
add dword [eax + 4], 0xffffffff
mov ecx, eax
add eax, 4
cmp dword [eax], 0
jne 0x448bf9
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 8