joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e95
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax], 0x20000000
mov dword [ebp - 4], edi
jne 0x406fdc
push ebx
push esi
push 4
pop esi
add eax, esi
mov ecx, dword [eax]
cmp ecx, 0x40020000
jne 0x406f3b
add eax, esi
mov ecx, dword [eax]
xor edx, edx
cmp ecx, 0x40000001
je 0x406ee5
cmp ecx, 0x40010001
je 0x406ee5
cmp ecx, 0x40020001
je 0x406ee5
cmp ecx, 0x40030001
jne 0x406ef0
shr ecx, 0x10
and ecx, 0xf
inc ecx
mov edx, ecx
add eax, esi
cmp dword [eax], 0x40050002
jne 0x406f02
inc edx
mov dword [ebp - 4], 0x1000
add eax, esi
mov ecx, edx
sub ecx, edi
je 0x406f35
dec ecx
je 0x406f2f
dec ecx
je 0x406f29
dec ecx
je 0x406f23
dec ecx
je 0x406f1d
dec ecx
jne 0x406f48
or dword [ebp - 4], 0xe
jmp 0x406f48
or dword [ebp - 4], 0xc
jmp 0x406f48
or dword [ebp - 4], 0xa
jmp 0x406f48
or dword [ebp - 4], 8
jmp 0x406f48
or dword [ebp - 4], 6
jmp 0x406f48
or dword [ebp - 4], 2
jmp 0x406f48
cmp ecx, 0x40030000
jne 0x406f48
mov dword [ebp - 4], esi
add eax, esi
cmp dword [eax], 0x40020003
push 0x10
pop ecx
jne 0x406f58
or dword [ebp - 4], ecx
add eax, esi
cmp dword [eax], 0x40000004
jne 0x406f66
or dword [ebp - 4], 0x20
add eax, esi
cmp dword [eax], 0x40040005
jne 0x406f74
or dword [ebp - 4], 0x40
add eax, esi
cmp dword [eax], 0x40040006
jne 0x406f82
or byte [ebp - 4], 0x80
add eax, esi
push 7
pop esi
mov edx, dword [eax]
mov ebx, esi
or ebx, 0x40000000
cmp ebx, edx
jne 0x406f97
push 3
jmp 0x406fc2
mov ebx, esi
or ebx, 0x40010000
cmp ebx, edx
je 0x406fc8
mov ebx, esi
or ebx, 0x40020000
cmp ebx, edx
jne 0x406fb4
xor edx, edx
inc edx
jmp 0x406fc3
mov ebx, esi
or ebx, 0x40030000
cmp ebx, edx
jne 0x406fd4
push 2
pop edx
shl edx, cl
or dword [ebp - 4], edx
add eax, 4
inc edi
inc ecx
inc ecx
inc esi
cmp ecx, 0x20
jb 0x406f85
shl edi, 8
or dword [ebp - 4], edi
pop esi
pop ebx
cmp dword [eax], 0xffffffff
pop edi
je 0x406fe9
mov eax, 0x8876086c
jmp 0x406ff3
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
leave
ret 8

Function at 0x41040c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x6230f0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x410464
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x410464
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x410464
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x41048d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x6230f0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x4104fb
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4104f2
cmp dword [ebp - 0xc], 4
jne 0x4104f2
cmp dword [ebp - 0x10], edi
je 0x4104f2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x69345c], edi
xor eax, eax
jmp 0x410523
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x69345c], edi
jge 0x41051e
mov dword [0x69345c], edi
call fcn.00410468
test eax, eax
je 0x41051e
emms
mov dword [0x69345c], 1
mov eax, dword [0x69345c]
pop edi
leave
ret

Function at 0x410603
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x41063a
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x41065c
cmp dword [ebp - 0x20], 4
ja 0x410666
jne 0x410656
cmp dword [ebp - 0x1c], 0xa
jb 0x410656
cmp word [ebp - 0x18], 0x55d
jae 0x410666
mov byte [ebp + 0x73], 1
jmp 0x410666
cmp dword [ebp - 0x14], 2
jne 0x41067c
test bl, bl
je 0x410697
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x410687
dec eax
je 0x410680
sub eax, 3
jne 0x41067c
cmp byte [ebp + 0x73], 0
je 0x4106a8
xor eax, eax
jmp 0x4106b0
call fcn.00410526
jmp 0x4106b0
cmp byte [ebp + 0x73], 0
jne 0x41067c
call fcn.0041055e
and eax, 4
jmp 0x4106b0
cmp dword [ebp + 0x7c], 0xa
je 0x4106a8
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x4106b0
call fcn.0041055e
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x42dbb3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x42dbc1
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x42dc95
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x625718]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x625718]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x625718]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x625718]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x625718]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x625718]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x625718]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x625718]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x42dbde
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x42dcb5
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x625718]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x42dc9b
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x43fca0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 1
call dword [sym.imp.DevIL.dll_ilGenImages]
push dword [ebp - 4]
call dword [sym.imp.DevIL.dll_ilBindImage]
push 0x600
call dword [sym.imp.DevIL.dll_ilEnable]
push 0x602
call dword [sym.imp.DevIL.dll_ilOriginFunc]
mov edi, dword [ebp + 8]
push edi
push 0
call dword [sym.imp.DevIL.dll_ilLoad]
test al, al
jne 0x43fcf6
mov eax, dword [ebp + 0xc]
pop edi
pop ebx
mov dword [eax], 2
xor al, al
mov esp, ebp
pop ebp
ret 8
push esi
mov esi, dword [sym.imp.DevIL.dll_ilGetInteger]
push 0xde4
call esi
cmp eax, 0x40
je 0x43fd1d
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
mov dword [eax], 3
xor al, al
mov esp, ebp
pop ebp
ret 8
push 0xde5
call esi
cmp eax, 0x80
je 0x43fd3f
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
mov dword [eax], 4
xor al, al
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 4]
push eax
push 1
call dword [sym.imp.DevIL.dll_ilDeleteImages]
call dword [sym.imp.DevIL.dll_ilShutDown]
push 0x647f14
push edi
call fcn.005b059b
mov esi, eax
add esp, 8
test esi, esi
jne 0x43fd6e
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 2
push 2
push 0
push esi
call fcn.005b0d59
push esi
call fcn.005b147d
push 0
push 0
push esi
mov dword [ebx + 0x394], eax
call fcn.005b0d59
push dword [ebx + 0x394]
call fcn.0056a5e5
push esi
push 1
push dword [ebx + 0x394]
mov dword [ebx + 0x39c], eax
push eax
call fcn.005b1686
push esi
call fcn.005b0a06
push edi
call fcn.004c5690
add esp, 0x38
mov dword [ebx + 0x398], eax
mov al, 1
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4475a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp ecx, edx
mov eax, edx
cmovbe eax, ecx
cmovbe ecx, edx
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
mov dword [ebp - 4], ecx
xor eax, eax
nop dword [eax + eax]
movzx ecx, byte [edx]
inc edx
imul eax, eax, 0x1000193
xor eax, ecx
lea ecx, [ebp]
cmp edx, ecx
jb 0x4475c0
mov esp, ebp
pop ebp
ret
Function at 0x44b2f0
Capabilities:
Access peb ldr_data
Create directory
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x604364
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x697398]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [0x6e7e44], edi
mov dword [ebp - 4], 0
lea esi, [edi + 4]
mov dword [edi], vtable.CGuildMarkManager.0
mov dword [ebp - 0x10], esi
push 0x18
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0056a5b5
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 1
lea esi, [edi + 0xc]
mov dword [ebp - 0x10], esi
push 0x18
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0056a5b5
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
add edi, 0x14
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], edi
push 0x14
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.0056a5b5
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [eax + 0x1c], xmm0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0xf
mov byte [eax + 0x1c], 0
lea esi, [eax + 0x34]
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], esi
push 0x24
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0056a5b5
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
push str.mark
mov byte [ebp - 4], 5
call fcn.005b952b
add esp, 0x14
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00448cf0
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0x1900
jb 0x44b417
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44d090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044d0a0

Function at 0x44d0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
lea ecx, [edi + 0x18]
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
lea eax, [esi + 0x18]
push eax
call fcn.0043d830
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
mov eax, dword [esi + 0x6c]
mov dword [edi + 0x6c], eax
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov ax, word [esi + 0x74]
mov word [edi + 0x74], ax
movzx eax, byte [esi + 0x76]
mov byte [edi + 0x76], al
mov eax, dword [esi + 0x78]
mov dword [edi + 0x78], eax
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x7c], eax
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
cmp edi, esi
je 0x44d174
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x44d16b
mov esi, dword [esi]
push eax
push esi
mov ecx, edi
call fcn.0043d3e0
pop edi
pop esi
pop ebp
ret 4
Function at 0x44d180
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60445d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x697398]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
xorps xmm0, xmm0
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
lea ecx, [edx + 0x18]
call fcn.0043d800
push 0
push 0
mov ecx, edx
call fcn.0044cff0
xor eax, eax
mov byte [edx + 0x20], 0
mov word [edx + 0x74], ax
mov byte [edx + 0x76], al
mov dword [edx + 0x78], eax
mov eax, edx
mov dword [edx + 0x24], 0
mov dword [edx + 0x28], 0
mov dword [edx + 0x30], 0
mov dword [edx + 0x34], 0
mov dword [edx + 0x38], 0
mov dword [edx + 0x3c], 0
mov dword [edx + 0x64], 0
mov dword [edx + 0x68], 0
mov dword [edx + 0x6c], 0
mov dword [edx + 0x2c], 0
mov dword [edx + 0x70], 0
mov dword [edx + 0x60], 0
mov dword [edx + 0x5c], 0
mov dword [edx + 0x58], 0
cmp dword [edx + 0x14], 0x10
jb 0x44d25d
mov eax, dword [edx]
mov dword [edx + 0x10], 0
lea ecx, [edx + 0x18]
mov byte [eax], 0
call fcn.0043d820
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44e390
Capabilities:
Enumerate process modules

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60456d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x250
mov eax, dword [0x697398]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x44e55f
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
call fcn.004c4960
push 0x220
lea eax, [ebp - 0x254]
push 0
push eax
call fcn.005a6450
add esp, 0x10
mov dword [ebp - 0x258], 0x224
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x44e4a7
mov edi, dword [sym.imp.KERNEL32.dll_Module32Next]
nop dword [eax + eax]
cmp dword [ebp - 0x18], 0x10
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x138]
cmovae edx, dword [ebp - 0x2c]
call fcn.0044e340
test eax, eax
jne 0x44e4e2
push 0x220
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.005a6450
add esp, 0xc
mov dword [ebp - 0x258], 0x224
lea eax, [ebp - 0x258]
push eax
push esi
call edi
test eax, eax
jne 0x44e460
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x44e55f
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44e555
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44e57f
jmp 0x44e555
lea edx, [ebp - 0x138]
lea edi, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x44e4f0
mov ecx, dword [ebp - 0x25c]
lea eax, [ebp - 0x138]
sub edx, edi
push edx
push eax
call fcn.0043d3e0
mov ecx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x244]
push esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x44e551
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44e547
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44e57f
push ecx
push edx
call fcn.0056a59a
add esp, 8
mov al, 1
jmp 0x44e561
push ecx
push edx
call fcn.0056a59a
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0056a569
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.005b0360
int3
Function at 0x451f10
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
mov eax, dword [0x697398]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x14]
push edi
xorps xmm0, xmm0
mov dword [esp + 0x38], 0
push eax
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0x2c], xmm0
call fcn.00451e90
push 0x648798
push esi
call fcn.005b059b
add esp, 8
mov edi, eax
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
movss xmm0, dword [esp + 0x20]
sub esp, 0x18
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [esp + 0x34]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x30]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push str.CenterPos__f__f__f_n
push 0
push edi
call fcn.004ed130
movss xmm0, dword [esp + 0x54]
add esp, 0xc
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [esp + 0x4c]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x50]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push str.CameraSetting__f__f__f_n
push 0
push edi
call fcn.004ed130
movss xmm0, dword [esp + 0x50]
add esp, 0xc
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [esp + 0x40]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x3c]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push str.CmrPos__f__f__f_n
push 0
push edi
call fcn.004ed130
cvttss2si eax, dword [esp + 0x50]
push eax
cvttss2si eax, dword [esp + 0x50]
push eax
cvttss2si eax, dword [esp + 0x50]
push eax
cvttss2si eax, dword [esp + 0x60]
push eax
cvttss2si eax, dword [esp + 0x68]
push eax
cvttss2si eax, dword [esp + 0x70]
push eax
cvttss2si eax, dword [esp + 0x5c]
push eax
cvttss2si eax, dword [esp + 0x5c]
push eax
cvttss2si eax, dword [esp + 0x5c]
push eax
push str.Line__x__dy__dz__ddistance__dpitch__drot__dup__dview__dcross__d__n
push 0
push edi
call fcn.004ed130
add esp, 0x54
push edi
call fcn.005b0a06
mov ecx, dword [esp + 0x40]
add esp, 4
pop edi
pop esi
xor ecx, esp
call fcn.0056a569
mov esp, ebp
pop ebp
ret 4

Function at 0x4551d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
push 0x40
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 0xc
Function at 0x45a4c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x604d6e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x697398]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [0x6e7e4c], edi
lea edx, [edi + 4]
mov dword [ebp - 4], 0
mov dword [0x6e89fc], edx
mov dword [edx], vtable.IAbstractCharacterManager.0
lea eax, [edi + 8]
mov dword [eax], vtable.IObjectManager.0
mov dword [0x6e5348], eax
mov byte [ebp - 4], 2
lea esi, [edi + 0x20]
mov dword [edi], vtable.CPythonCharacterManager.2.0
mov dword [edx], vtable.CPythonCharacterManager.1.0
mov dword [eax], vtable.CPythonCharacterManager.0
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0056a5b5
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 3
push 0xc
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.0056a5b5
add esp, 8
mov ecx, edi
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
call fcn.0045a480
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45b3d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
dec edi
mov dword [ebp - 4], edx
mov eax, edi
mov dword [ebp - 0xc], edi
sar eax, 1
mov ebx, ecx
mov dword [ebp - 8], eax
mov ecx, esi
cmp esi, eax
jge 0x45b422
lea edi, [ecx + ecx]
push dword [ebx + edi*4 + 4]
mov ecx, dword [ebx + edi*4 + 8]
call fcn.00440950
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, edi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + esi*4], eax
mov esi, ecx
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x45b3f4
mov edx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, eax
jne 0x45b436
mov eax, dword [ebp + 8]
test al, 1
jne 0x45b436
mov eax, dword [ebx + eax*4 - 4]
mov dword [ebx + esi*4], eax
mov esi, edi
cmp edx, esi
jge 0x45b463
nop word [eax + eax]
mov eax, dword [ebp + 0xc]
lea edi, [esi - 1]
sar edi, 1
push dword [eax]
mov ecx, dword [ebx + edi*4]
call fcn.00440950
test al, al
je 0x45b463
mov eax, dword [ebx + edi*4]
mov dword [ebx + esi*4], eax
mov esi, edi
cmp dword [ebp - 4], edi
jl 0x45b440
mov eax, dword [ebp + 0xc]
pop edi
mov eax, dword [eax]
mov dword [ebx + esi*4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ccd0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.004e45d0
Function at 0x48cbb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x58edadb9
xor ecx, ecx
cmp byte [ebp - 4], cl
jbe 0x48cbeb
mov eax, dword [ebp - 4]
xor eax, 0x80164043
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub eax, 0x29e08a43
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ecx*4 + 0x6e8ce0], eax
inc ecx
movzx eax, byte [ebp - 4]
cmp ecx, eax
jb 0x48cbc2
movups xmm0, xmmword [0x6e8d7d]
push esi
xor esi, esi
movups xmmword [0x6e8330], xmm0
nop dword [eax]
call fcn.004c5800
mov dword [esi + 0x6e8330], eax
add esi, 4
cmp esi, 0x10
jb 0x48cc00
pop esi
push 0x10
push 0x6e8d05
push 0x6e8330
push 0x6e8314
call fcn.004c6290
add esp, 0x10
mov esp, ebp
pop ebp
ret