joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427246
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x519008]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
cmp esi, dword [edi]
je 0x42718b
mov edx, esi
call fcn.00427410
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [0x51dbec]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [0x51dbf0]
push dword [0x51dbe8]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x51dbf4]
push eax
push ecx
call fcn.004fce10
movzx ecx, word [ebp + 8]
mov ebx, eax
add ebx, esi
mov eax, edx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
adc eax, 0
mov dword [esp + 0x14], eax
push 0
push ecx
push dword [esp + 0x18]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je case.0x42723b.10014
cmp eax, 0xffffffff
jne 0x427218
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2734
je 0x427242
cmp eax, 0x2733
je 0x427242
cmp eax, 0x274c
je 0x427242
cmp eax, 0x2714
jg 0x42722a
je case.0x42723b.10014
sub eax, 1
jne case.0x42723b.10015
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
add eax, 0xffffd8e2
cmp eax, 0x4f
ja case.0x42723b.10015
movzx eax, byte [eax + 0x4272bc]
jmp dword [eax*4 + 0x4272b4]
push 0x64
call esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [0x51dbec]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [0x51dbf0]
push dword [0x51dbe8]
mov eax, dword [esp + 0x24]
sbb eax, dword [0x51dbf4]
push eax
push ecx
call fcn.004fce10
movzx ecx, word [ebp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
cmp edx, dword [esp + 0x14]
jb 0x4271d4
ja 0x42729c
movzx ecx, word [ebp + 8]
cmp eax, ebx
jb 0x4271d4
mov ecx, dword [esp + 0x24]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret

Function at 0x427410
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x519008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, edx
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x427479
mov dword [ebp - 8], esi
cmp esi, 0xffffffff
jne 0x42743f
mov dword [ebp - 8], 0
jmp 0x42744a
test esi, esi
jne 0x42744a
mov dword [ebp - 8], 1
push 4
lea ecx, [ebp - 8]
push ecx
push 0x1006
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x427479
mov dword [edi], esi
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
Function at 0x4277d0
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x519008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push 6
push 1
push 2
mov dword [esi + 4], 0xffffffff
mov dword [esi], 0x2710
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 4], eax
pop esi
cmp eax, 0xffffffff
jne 0x427880
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xfffffff4
cmp eax, 0x7b
ja case.0x42781a.14
movzx eax, byte [eax + 0x4278c0]
jmp dword [eax*4 + 0x4278ac]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
mov eax, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
mov eax, 0xff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
push 4
lea ecx, [ebp - 8]
mov dword [ebp - 8], 1
push ecx
push 4
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
Function at 0x429c40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x51dd94]
mov ebx, edx
push edi
mov edi, ecx
mov dword [edi], 0
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
cmp eax, vtable.rhea::AllocatorSimple_class_rhea::AllocatorTrackingPolicy_simple_.0
jne 0x429cf1
push 4
push 0x14
call fcn.0040bee4
add dword [esi + 0x1c], 0x14
mov ecx, eax
inc dword [esi + 0x18]
add esp, 8
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jbe 0x429c86
mov dword [esi + 0x20], eax
movzx eax, byte [esi + 0x15]
mov byte [ecx + 2], al
movzx eax, byte [esi + 0x14]
lea esi, [ecx + 8]
mov byte [ecx + 3], al
mov dword [ecx + 4], 0x14000000
mov ecx, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 8], ecx
mov ecx, dword [0x51dd9c]
lea edx, [ecx*8 + 0x51e760]
mov dword [esi + 4], ebx
inc ecx
mov dword [edx], 0x429d10
push 0
push 0
push edx
lea eax, [ecx - 0x20]
mov dword [edx + 4], esi
neg eax
push 0x42eb90
sbb eax, eax
push 0
and eax, ecx
push 0
mov dword [0x51dd9c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
xor eax, eax
mov dword [edi], esi
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
push 0
push 0x503d60
push 4
push 0xc
mov ecx, esi
call edx
mov esi, eax
jmp 0x429c9e

Function at 0x42a220
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x519008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push esi
mov esi, ecx
push edi
mov edi, edx
mov edx, 0x3a
mov cl, byte [esi + 4]
jmp 0x42a250
cmp cl, 0x1a
jae 0x42a312
mov eax, 1
shl eax, cl
test dword [esi], eax
jne 0x42a26b
inc cl
mov byte [esi + 4], cl
jmp 0x42a250
add cl, 0x41
mov word [edi + 1], 0x5c3a
mov byte [edi], cl
mov byte [edi + 3], 0
movzx eax, byte [esi + 4]
add ax, 0x41
mov dword [ebp - 0xa], 0x5c003a
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 6], ax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x40c]
push 0x100
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
push 0x100
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc]
push eax
call ebx
inc byte [esi + 4]
mov edx, 0x3a
test dword [ebp - 0x410], 0x80000
mov cl, byte [esi + 4]
jne 0x42a250
lea eax, [edi + 0x20]
push 0x100
push eax
lea ecx, [ebp - 0x20c]
call fcn.00426ff0
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
Function at 0x42a5f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x519008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp edx, 0xffffffff
jne 0x42a60a
or edx, edx
push 0x200
lea eax, [ebp - 0x404]
push eax
push edx
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x42a66f
cmp word [ebp + eax*2 - 0x404], 0
je 0x42a63e
xor ecx, ecx
mov word [ebp + eax*2 - 0x404], cx
push 0
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
je 0x42a65f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42a66f
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret

Function at 0x42ad60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
xor esi, esi
mov dword [ebp - 4], eax
mov ebx, edx
cmp edi, 0x400
jb 0x42adaf
jmp 0x42ad80
push eax
push 1
lea eax, [esi + ebx]
push 0x400
push eax
call fcn.0040d634
add esp, 0x10
test eax, eax
je 0x42adc5
mov eax, dword [ebp - 4]
sub edi, 0x400
add esi, 0x400
cmp edi, 0x400
jae 0x42ad80
test edi, edi
je 0x42adc5
push eax
push 1
lea eax, [esi + ebx]
push edi
push eax
call fcn.0040d634
add esp, 0x10
add esi, edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42add0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
push edi
push ebx
mov dword [ebp - 8], ebx
call fcn.0040cd09
push 2
push 0
push ebx
mov esi, eax
call fcn.0040d400
push ebx
call fcn.0040cd09
push 0
push esi
push ebx
mov edi, eax
call fcn.0040d400
mov eax, dword [ebp + 8]
add esp, 0x20
mov esi, dword [ebp - 4]
mov dword [eax], edi
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
cmp eax, vtable.rhea::AllocatorSimple_class_rhea::AllocatorTrackingPolicy_simple_.0
jne 0x42aee9
lea eax, [edi + 3]
and eax, 0xfffffffc
add eax, 8
push 4
push eax
mov dword [ebp - 4], eax
call fcn.0040bee4
mov ecx, dword [ebp - 4]
mov edx, eax
add dword [esi + 0x1c], ecx
add esp, 8
inc dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jbe 0x42ae4c
mov dword [esi + 0x20], eax
movzx eax, byte [esi + 0x15]
mov byte [edx + 2], al
movzx eax, byte [esi + 0x14]
mov byte [edx + 3], al
mov eax, ecx
shr eax, 0x18
mov byte [edx + 4], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 5], al
mov eax, ecx
shr eax, 8
mov byte [edx + 6], al
lea eax, [edx + 8]
mov byte [edx + 7], cl
mov dword [ebp - 4], eax
test eax, eax
jne 0x42ae91
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
xor esi, esi
cmp edi, 0x100000
jb 0x42aecc
mov ebx, edi
shr ebx, 0x14
push dword [ebp - 8]
add eax, esi
push 1
push 0x100000
push eax
call fcn.0040d881
mov eax, dword [ebp - 4]
add esp, 0x10
sub edi, 0x100000
add esi, 0x100000
sub ebx, 1
jne 0x42aea0
mov ebx, dword [ebp - 8]
test edi, edi
je 0x42aedf
push ebx
push 1
add eax, esi
push edi
push eax
call fcn.0040d881
add esp, 0x10
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x503d60
push 4
push edi
mov ecx, esi
call edx
jmp 0x42ae78
Function at 0x42afb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xcac
mov eax, dword [0x519008]
xor eax, esp
mov dword [esp + 0xca8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
test edi, edi
je 0x42b215
cmp byte [edi], 0
je 0x42b215
cmp byte [edi + 1], 0x3a
jne 0x42b215
cmp byte [edi + 3], 0
mov esi, 3
je 0x42b026
mov al, byte [edi + esi]
cmp al, 0x5c
je 0x42b00e
cmp al, 0x2f
jne 0x42b01f
mov edx, esi
mov ecx, edi
call fcn.0042a5f0
test al, al
je 0x42b215
inc esi
cmp byte [edi + esi], 0
jne 0x42b003
mov edx, esi
mov ecx, edi
call fcn.0042a5f0
test al, al
je 0x42b215
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x4b0]
push 0x200
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x42b215
cmp word [esp + eax*2 + 0x4b0], 0
je 0x42b075
xor ecx, ecx
mov word [esp + eax*2 + 0x4b0], cx
lea eax, [esp + 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42b215
test al, 0x10
je 0x42b215
push 0x504dec
mov edx, esi
mov byte [esp + 0x13], 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0042a710
add esp, 4
test al, al
je 0x42b1fc
lea esp, [esp]
mov eax, dword [esp + 0x1c]
shr eax, 4
test al, 1
je 0x42b17b
cmp byte [esp + 0x2ac], 0x2e
je 0x42b1e1
lea eax, [esp + 0x2ac]
push eax
push esi
push str._s__s
lea eax, [esp + 0x4bc]
push 0x400
push eax
call fcn.004014e0
add esp, 0x14
mov esi, ebx
test ebx, ebx
je 0x42b12a
mov eax, dword [esi]
test eax, eax
je 0x42b12a
lea ecx, [esp + 0x4b0]
push ecx
push eax
call fcn.0040c34f
add esp, 8
test eax, eax
je 0x42b1dd
add esi, 4
jne 0x42b106
lea eax, [esp + 0x2ac]
push eax
push edi
push str._s__s
lea eax, [esp + 0x8bc]
push 0x400
push eax
call fcn.004014e0
add esp, 0x14
lea edx, [esp + 0x8b0]
lea ecx, [esp + 0x4b0]
push ebx
push 0x100000
push dword [esp + 0x1c]
call fcn.0042afb0
mov esi, dword [esp + 0x1c]
add esp, 0xc
test al, al
jne 0x42b1e1
mov byte [esp + 0xf], al
jmp 0x42b1e1
lea eax, [esp + 0x2ac]
push eax
push esi
push str._s__s
lea eax, [esp + 0x4bc]
push 0x400
push eax
call fcn.004014e0
add esp, 0x14
lea eax, [esp + 0x2ac]
push eax
push edi
push str._s__s
lea eax, [esp + 0x8bc]
push 0x400
push eax
call fcn.004014e0
add esp, 0x10
lea edx, [esp + 0x8b4]
lea ecx, [esp + 0x4b4]
push dword [esp + 0x18]
call fcn.0042b230
add esp, 8
jmp 0x42b1e1
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x18]
call fcn.0042a680
test al, al
jne 0x42b0c0
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xca8]
xor ecx, esp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xcb4]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
Function at 0x42b380
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, edx
mov dword [ebp - 4], eax
cmp edi, esi
jb 0x42b3ba
push eax
push 1
push esi
push ebx
call fcn.0040d881
push dword [ebp + 8]
push 1
push esi
push ebx
call fcn.0040d634
mov eax, dword [ebp - 4]
sub edi, esi
add esp, 0x20
cmp edi, esi
jae 0x42b398
test edi, edi
je 0x42b3d7
push eax
push 1
push edi
push ebx
call fcn.0040d881
push dword [ebp + 8]
push 1
push edi
push ebx
call fcn.0040d634
add esp, 0x20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42b8f0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xaa4
mov eax, dword [0x519008]
xor eax, esp
mov dword [esp + 0xaa0], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x6a0]
push esi
push edi
push 0x200
push eax
push 0xffffffffffffffff
mov esi, ecx
mov byte [esp + 0x1b], dl
push esi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x42bacf
cmp word [esp + eax*2 + 0x6a8], 0
je 0x42b94f
xor ecx, ecx
mov word [esp + eax*2 + 0x6a8], cx
lea eax, [esp + 0x6a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42bacf
test al, 0x10
je 0x42bacf
push 0x504dec
mov edx, esi
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0042a710
add esp, 4
test al, al
je 0x42ba88
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x42b9a0
push esi
push 0x504f1c
lea eax, [esp + 0x4b0]
push 0x200
push eax
call fcn.004014e0
xor eax, eax
add esp, 0x10
cmp byte [esp + 0x4a8], al
je 0x42b9db
jmp 0x42b9d0
inc eax
cmp byte [esp + eax + 0x4a8], 0
jne 0x42b9d0
lea ecx, [esp + 0x2a4]
push ecx
mov ecx, 0x200
sub ecx, eax
push ecx
lea ecx, [esp + 0x4b0]
add eax, ecx
push eax
call fcn.0040c4a7
mov eax, dword [esp + 0x20]
add esp, 0xc
shr eax, 4
test al, 1
je 0x42ba22
cmp byte [esp + 0x2a4], 0x2e
je 0x42ba65
mov dl, 1
lea ecx, [esp + 0x4a8]
call fcn.0042b8f0
jmp 0x42ba65
push 0x200
lea eax, [esp + 0x6ac]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x4b4]
push eax
push 0
push 0xfde9
call ebx
test eax, eax
je 0x42ba65
cmp word [esp + eax*2 + 0x6a8], 0
je 0x42ba5b
xor ecx, ecx
mov word [esp + eax*2 + 0x6a8], cx
lea eax, [esp + 0x6a8]
push eax
call edi
lea ecx, [esp + 0x10]
call fcn.0042a680
test al, al
jne 0x42b9a0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esp + 0x10], 0xffffffff
cmp byte [esp + 0xf], 0
je 0x42bacf
push 0x200
lea eax, [esp + 0x6ac]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x42bacf
cmp word [esp + eax*2 + 0x6a8], 0
je 0x42bac1
xor ecx, ecx
mov word [esp + eax*2 + 0x6a8], cx
lea eax, [esp + 0x6a8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0xaac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
Function at 0x42d640
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x51dda0], eax
mov eax, 1
mov ecx, dword [eax*4 + 0x51dd9c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
mov dword [eax*4 + 0x51dda0], ecx
inc eax
cmp eax, 0x270
jl 0x42d650
mov dword [0x51dd98], 0x270
pop ebp
ret 4
Function at 0x432960
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 4
jb 0x4329cb
push edi
mov edi, esi
shr edi, 2
movzx eax, byte [edx]
sub esi, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5058e0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5058e0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5058e0]
movzx eax, byte [edx + 3]
add edx, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5058e0]
sub edi, 1
jne 0x432974
pop edi
test esi, esi
je 0x4329ea
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5058e0]
sub esi, 1
jne 0x4329d0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x438fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x519008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x51d9e4
push str._s_current_da3_vmcDataFile.timestamp
lea eax, [ebp - 0x208]
mov edi, ecx
push 0x200
push eax
call fcn.004014e0
lea eax, [ebp - 0x208]
push 0x504ff4
push eax
call fcn.0040c671
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x43901e
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
push esi
push 1
push 6
push edi
call fcn.0040d634
push esi
call fcn.0040d0b9
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
mov al, 1
pop edi
pop esi
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
Function at 0x43d140
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x519008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor bl, bl
push edi
xor edi, edi
mov dword [ebp - 0x30], edi
cmp dword [esi + 0xe0], 1
jne 0x43d345
lea esp, [esp]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [0x51dbec]
mov ecx, dword [ebp - 0x38]
sub ecx, dword [0x51dbf0]
push dword [0x51dbe8]
mov eax, dword [ebp - 0x34]
sbb eax, dword [0x51dbf4]
push eax
push ecx
call fcn.004fce10
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
cmp edx, dword [ebp - 0x30]
jb 0x43d2e5
ja 0x43d1b8
cmp eax, edi
jb 0x43d2e5
mov al, byte [esi + 0xbb3]
xor dl, dl
mov cl, byte [esi + 0xabc]
xor ch, ch
mov byte [ebp - 0xc], al
mov word [ebp - 0xb], 0
mov byte [ebp - 9], 0
mov eax, dword [ebp - 0xc]
mov byte [ebp - 0x25], cl
xor cl, cl
mov dword [ebp - 0x29], eax
xor eax, eax
mov word [ebp - 0x2c], 0x4223
mov byte [ebp - 0x2a], 9
lea esp, [esp]
add cl, byte [ebp + eax - 0x2c]
add dl, byte [ebp + eax - 0x2b]
add eax, 2
cmp eax, 7
jb 0x43d1f0
cmp eax, 8
jae 0x43d209
mov ch, byte [ebp + eax - 0x2c]
push 0
push 0x1f4
push dword [esi + 4]
add ch, cl
mov dword [ebp - 0x30], 0x800
add ch, dl
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 0x24], ch
lea edi, [esi + 0xe4]
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x2c]
push edi
push 9
push eax
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
test al, al
je 0x43d295
xor eax, eax
cmp ax, word [ebp - 0x30]
je 0x43d295
push ecx
push edi
mov ecx, esi
xor bl, bl
call fcn.0043c130
cmp dword [esi + 0x96c], 4
je 0x43d312
test byte [esi + 0x974], 2
je 0x43d2a0
mov eax, dword [esi + 4]
push str.CPUBridgeServer::priv_enterState_telemetry___n
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
add esp, 8
mov dword [esi + 0xe0], 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
inc bl
cmp bl, 5
jae 0x43d33e
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [0x51dbec]
mov ecx, dword [ebp - 0x40]
sub ecx, dword [0x51dbf0]
push dword [0x51dbe8]
mov eax, dword [ebp - 0x3c]
sbb eax, dword [0x51dbf4]
push eax
push ecx
call fcn.004fce10
mov edi, eax
mov eax, edx
mov dword [ebp - 0x40], edi
add edi, 0xfa
mov dword [ebp - 0x3c], eax
adc eax, 0
mov dword [ebp - 0x30], eax
push 0xfa
sub esp, 8
mov ecx, esi
call fcn.00443620
cmp dword [esi + 0xe0], 1
je 0x43d170
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
push str.CPUBridgeServer::priv_enterState_programmazione___n
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
add esp, 8
mov dword [esi + 0xe0], 3
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.0043d570
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403d8c
mov esp, ebp
pop ebp
ret
Function at 0x440090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x524
mov eax, dword [0x519008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x51d9e4
push str._s_current_da3_vmcDataFile.da3
lea eax, [ebp - 0x108]
push 0x100
push eax
call fcn.004014e0
mov esi, dword [0x51dd94]
lea eax, [ebp - 0x514]
push eax
mov edx, esi
mov dword [ebp - 0x51c], esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x514], 0
call fcn.0042af00
add esp, 0x14
mov dword [ebp - 0x518], eax
test eax, eax
je 0x4402eb
movzx edx, byte [ebp + 0xc]
mov ebx, dword [ebp - 0x514]
shl edx, 6
lea ecx, [edx + 0x40]
cmp ebx, ecx
jb 0x4401f4
mov esi, dword [ebp + 8]
lea edi, [edx + eax]
push 0x200
lea eax, [ebp - 0x508]
mov ecx, 0x10
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push 0
rep movsd dword es:[edi], dword [esi]
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x440172
cmp word [ebp + eax*2 - 0x508], 0
je 0x44015c
xor ecx, ecx
mov word [ebp + eax*2 - 0x508], cx
lea eax, [ebp - 0x508]
push 0x504ef8
push eax
call fcn.0040c65a
add esp, 8
jmp 0x440174
xor eax, eax
xor esi, esi
mov dword [ebp - 0x514], eax
cmp ebx, 0x400
jb 0x4401c0
mov edi, ebx
shr edi, 0xa
lea esp, [esp]
push eax
mov eax, dword [ebp - 0x518]
push 1
add eax, esi
push 0x400
push eax
call fcn.0040d634
mov eax, dword [ebp - 0x514]
add esp, 0x10
add esi, 0x400
sub ebx, 0x400
sub edi, 1
jne 0x440190
mov edi, dword [ebp - 0x514]
test ebx, ebx
je 0x4401df
mov eax, dword [ebp - 0x518]
push edi
push 1
add eax, esi
push ebx
push eax
call fcn.0040d634
add esp, 0x10
push edi
call fcn.0040d0b9
mov eax, dword [ebp - 0x518]
add esp, 4
mov esi, dword [ebp - 0x51c]
mov edx, dword [esi]
cmp edx, vtable.rhea::AllocatorSimple_class_rhea::AllocatorTrackingPolicy_simple_.0
jne 0x4402fe
movzx ecx, byte [eax - 4]
lea edx, [eax - 8]
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 7]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [edx + 6]
dec dword [esi + 0x18]
and ecx, 0x3fffffff
shl eax, 8
or ecx, eax
sub dword [esi + 0x1c], ecx
push edx
call fcn.0040beca
add esp, 4
lea ecx, [ebp - 0x520]
call fcn.004015b0
push 0x51d9e4
push str._s_last_installed_da3_dateUM.bin
lea eax, [ebp - 0x108]
push 0x100
push eax
call fcn.004014e0
add esp, 0x10
lea eax, [ebp - 0x508]
push 0x200
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4402b5
cmp word [ebp + eax*2 - 0x508], 0
je 0x44029d
xor ecx, ecx
mov word [ebp + eax*2 - 0x508], cx
lea eax, [ebp - 0x508]
push 0x504ef8
push eax
call fcn.0040c65a
add esp, 8
mov esi, eax
jmp 0x4402b7
xor esi, esi
mov ecx, dword [ebp - 0x520]
xor eax, eax
or eax, dword [ebp - 0x51c]
push esi
push 1
mov dword [ebp - 0x510], eax
lea eax, [ebp - 0x510]
push 8
push eax
mov dword [ebp - 0x50c], ecx
call fcn.0040d634
push esi
call fcn.0040d0b9
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403d8c
mov esp, ebp
pop ebp
ret 8
push 0
push eax
mov ecx, esi
call dword [edx + 0x10]
jmp 0x440239