joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push esi
push dword [ebp + 8]
mov esi, ecx
mov dword [esp + 0x10], 0
push edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.004025e0
push esi
lea ecx, [esp + 0xc]
call fcn.00402710
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402810
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov ebx, 0xcbf29ce4
push edi
mov edi, 0x84222325
test esi, esi
je 0x402859
movzx eax, byte [ecx]
inc ecx
push eax
mov dword [ebp - 4], ecx
call fcn.00486387
add esp, 4
cdq
xor edx, ebx
xor eax, edi
push 0x100
push 0x1b3
push edx
push eax
call fcn.00473530
mov ecx, dword [ebp - 4]
mov edi, eax
mov ebx, edx
sub esi, 1
jne 0x402827
mov eax, edi
mov edx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409de0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, ecx
test ebx, ebx
jne 0x409e25
mov edx, esi
mov edi, 0xc
mov esi, 0x4bbbc0
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x409e20
add edx, 4
add esi, 4
sub edi, 4
jae 0x409e04
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [ebp + 0x18]
mov edi, ecx
mov eax, dword [edi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x409e15
mov ecx, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [esp + 0x44], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x48], ecx
mov ecx, dword [ebp + 0x10]
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x2c], xmm0
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
mov dword [esp + 0x54], 0
mov dword [esp + 0x20], 0x10
mov dword [esp + 0x24], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ebx
mov ecx, dword [eax + 0x68]
test ecx, ecx
je 0x409e15
mov eax, dword [ecx + 0x10]
lea edx, [esp + 0x20]
push edx
push ecx
call eax
add esp, 8
test al, al
je 0x409e15
cmp dword [edi + 0xa4], 0
jle 0x409f01
push ebx
push dword [ebp + 8]
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x67452301
mov dword [esp + 0x34], 0xefcdab89
mov dword [esp + 0x38], 0x98badcfe
mov dword [esp + 0x3c], 0x10325476
call fcn.004025e0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
call fcn.00402710
mov edx, esi
lea ecx, [esp + 0x10]
mov esi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x409f0c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x409ef0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
call fcn.0043e140
add eax, 0x1808
cmp byte [eax + 0x216], 0
jne 0x409e15
push dword [ebp + 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword [edi + 0x20]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00413280
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40af70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a1d3d
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push ebx
mov ebx, ecx
push esi
push edi
mov ecx, dword [ebx + 0x128]
shr ecx, 9
call fcn.00406560
mov ecx, eax
mov edx, 0x200
mov eax, dword [ebx + 0x128]
shl edx, cl
cmp edx, eax
je 0x40b011
push eax
lea eax, [ebp - 0x168]
push str.m_options.sectorsize___d
push eax
call fcn.0043e750
add esp, 0xc
mov dword [ebp - 0x14], 0x4cfeb8
mov ecx, 0x4cfeb8
mov edx, eax
call fcn.00436390
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
cmp eax, 1
jne 0x40b000
push 0
push 0x4b362c
push edx
push str._512u____log2i__m_options.sectorsize___512______m_options.sectorsize
call fcn.00430100
add esp, 0x10
mov ecx, 0x4cfeb8
mov dword [ebp - 4], 0xffffffff
call fcn.004363a0
movzx eax, word [ebx + 0x44]
cmp eax, 3
ja case.default.0x40b01a
jmp dword [eax*4 + 0x40b1e4]
mov eax, 0x20
jmp 0x40b0d1
mov eax, 0x2c
jmp 0x40b0d1
mov eax, 0xd0
jmp 0x40b0d1
mov ecx, 0x4cfeb8
mov dword [ebp - 0x14], 0x4cfeb8
call fcn.00436390
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
cmp eax, 1
jne 0x40b078
push 0
push 0x4b362c
push 0x4b362c
push str.false
call fcn.00430100
add esp, 0x10
mov ecx, 0x4cfeb8
call fcn.004363a0
mov ecx, 0x4cfeb8
mov dword [ebp - 0x14], 0x4cfeb8
call fcn.00436390
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 2
cmp eax, 1
jne 0x40b0bb
push 0
push 0x4b362c
push 0x4b362c
push str.false
call fcn.00430100
add esp, 0x10
mov ecx, 0x4cfeb8
mov dword [ebp - 4], 0xffffffff
call fcn.004363a0
mov eax, 0x44
lea esi, [ebx + 0x38]
mov dword [ebp - 0x10], eax
mov ecx, 0x34
lea edi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x128]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebx + 0x64]
shr ecx, 9
mov dword [ebp - 0x140], 0x1a51504d
mov dword [ebp - 0x138], eax
call fcn.00406560
cmp word [ebp - 0x134], 2
mov ecx, dword [ebx + 0x5c]
mov word [ebp - 0x132], ax
mov eax, dword [ebx + 0x58]
mov dword [ebp - 0x120], eax
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x11c], ecx
mov ecx, dword [ebx + 0x68]
mov dword [ebp - 0x114], eax
mov eax, dword [ebx + 0x74]
mov dword [ebp - 0x110], ecx
mov ecx, dword [ebx + 0x78]
mov dword [ebp - 0x104], eax
mov eax, dword [ebx + 0x6c]
mov dword [ebp - 0x100], ecx
mov ecx, dword [ebx + 0x70]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], ecx
jb 0x40b1bd
mov dword [ebp - 0x6c], 0
lea esi, [ebp - 0x140]
mov dword [ebp - 0x68], 0x67452301
mov edi, 3
mov dword [ebp - 0x64], 0xefcdab89
mov dword [ebp - 0x60], 0x98badcfe
mov dword [ebp - 0x5c], 0x10325476
mov dword [ebp - 0x70], 0x600
nop dword [eax]
push esi
lea ecx, [ebp - 0x70]
call fcn.00401e40
add esi, 0x40
sub edi, 1
jne 0x40b1a0
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x70]
call fcn.00402710
push dword [ebp - 0x10]
mov ecx, dword [ebx + 0x20]
lea eax, [ebp - 0x140]
push 0
push 0
push eax
call fcn.00415ac0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40eb40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4d4
push ebx
mov eax, edx
mov ebx, ecx
push esi
push edi
xor edx, edx
mov dword [esp + 0x1c], eax
mov ecx, eax
mov dword [esp + 0x14], ebx
call fcn.00404ce0
mov dword [esp + 0x18], eax
xor esi, esi
mov ecx, dword [ebx]
mov dword [esp + 0x10], esi
mov edx, dword [ecx + 0x280]
mov ebx, dword [ecx + 0x27c]
sub edx, ebx
sar edx, 4
xor ecx, ecx
lea edi, [edx - 1]
mov eax, edi
and eax, dword [esp + 0x18]
test edx, edx
je 0x40ebad
mov esi, eax
shl esi, 4
add esi, ebx
cmp dword [esi + 0xc], 0xfffffffe
jae 0x40ec42
inc eax
inc ecx
and eax, edi
cmp ecx, edx
jb 0x40eb90
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x40ecee
lea eax, [edx + edx]
mov esi, 0x10000
cmp eax, esi
cmova esi, eax
cmp esi, 0x100000
jb 0x40ec23
push 2
call fcn.0047e39b
add esp, 4
push eax
push str.SFileCreateFile:_warning___hash_table_about_to_exceed_224_items__n
call fcn.0048779c
lea eax, [esp + 0x30]
mov dword [esp + 0x28], 0x43
push ecx
push str.SFileCreateFile:_warning___hash_table_about_to_exceed_224_items__n
mov edx, 0x43
mov dword [esp + 0x34], eax
mov ecx, eax
call fcn.0043aa60
add esp, 0x10
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x40ec23
push eax
call fcn.00472b7c
add esp, 4
mov ebx, dword [esp + 0x14]
mov edx, esi
mov ecx, dword [ebx]
call fcn.00405e70
test al, al
je 0x40ecee
mov esi, 1
jmp 0x40eb6a
mov ecx, dword [esp + 0x1c]
mov edx, 1
call fcn.00404ce0
mov ecx, dword [esp + 0x1c]
mov edx, 2
mov edi, eax
call fcn.00404ce0
mov edx, dword [esp + 0x14]
mov dword [esi + 4], eax
mov dword [esi], edi
mov eax, dword [edx]
mov ax, word [eax + 0x2a2]
mov word [esi + 8], ax
mov eax, dword [edx]
mov al, byte [eax + 0x2a4]
mov byte [esi + 0xa], al
mov eax, dword [ebp + 0xc]
mov byte [esi + 0xb], 0
mov dword [esi + 0xc], eax
mov edx, dword [edx]
mov ecx, dword [edx + 0x274]
cmp ecx, dword [edx + 0x278]
je 0x40ecd6
mov eax, dword [ebp + 8]
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [ecx + 0x20], xmm0
movq xmm0, qword [eax + 0x30]
movq qword [ecx + 0x30], xmm0
mov ax, word [eax + 0x38]
mov word [ecx + 0x38], ax
mov al, 1
add dword [edx + 0x274], 0x3a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push ecx
lea ecx, [edx + 0x270]
call fcn.004458f0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
call fcn.0047e39b
add esp, 4
push eax
push str.SFileCreateFile:_unable_to_insert_an_entry_into_the_hash_table__n
call fcn.0048779c
lea eax, [esp + 0x290]
mov dword [esp + 0x288], 0x41
push ecx
push str.SFileCreateFile:_unable_to_insert_an_entry_into_the_hash_table__n
mov edx, 0x41
mov dword [esp + 0x294], eax
mov ecx, eax
call fcn.0043aa60
add esp, 0x10
push dword [esp + 0x284]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 0x284]
lea ecx, [esp + 0x288]
cmp eax, ecx
je 0x40ed59
push eax
call fcn.00472b7c
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c6f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2990
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
push 0x4b362c
sub esp, 8
mov edi, edx
mov ebx, ecx
mov edx, 0x50
lea ecx, [ebp - 0x10]
push 0
call fcn.00438110
mov esi, dword [ebp - 0x10]
add esp, 0x10
mov dword [ebx + 0x94], esi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [ebp - 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dl, byte [ebp + 0x10]
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov byte [esi + 0x40], dl
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
test dl, dl
jne 0x41c7df
test eax, eax
jg 0x41c7df
jl 0x41c79b
test ecx, ecx
jae 0x41c7df
mov ecx, 0x4cfeb8
mov dword [ebp + 8], 0x4cfeb8
call fcn.00436390
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 2
cmp eax, 1
jne 0x41c7d1
push 0
push 0x4b362c
push 0x4b362c
push str.m_writeMode__length___0
call fcn.00430100
add esp, 0x10
mov ecx, 0x4cfeb8
mov byte [ebp - 4], 1
call fcn.004363a0
test edi, edi
jg 0x41c827
mov ecx, 0x4cfeb8
mov dword [ebp + 8], 0x4cfeb8
call fcn.00436390
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 3
cmp eax, 1
jne 0x41c819
push 0
push 0x4b362c
push 0x4b362c
push str.freq___0
call fcn.00430100
add esp, 0x10
mov ecx, 0x4cfeb8
mov byte [ebp - 4], 1
call fcn.004363a0
mov eax, dword [esi + 0x20]
dec eax
add eax, dword [esi + 0x18]
cdq
idiv dword [esi + 0x18]
cmp byte [ebp + 0x10], 0
mov dword [esi + 0x28], eax
je 0x41c84a
shl eax, 4
cmp eax, dword [esi]
jbe 0x41c84a
push eax
mov ecx, esi
call fcn.0043ea20
mov dword [ebp - 4], 0xffffffff
cmp dword [ebx + 0x94], 0
jne 0x41c89d
mov ecx, 0x4cfeb8
mov dword [ebp + 8], 0x4cfeb8
call fcn.00436390
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 4
cmp eax, 1
jne 0x41c893
push 0
push 0x4b362c
push 0x4b362c
push str.handle__md5VerifyData___NULL
call fcn.00430100
add esp, 0x10
mov ecx, 0x4cfeb8
call fcn.004363a0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41da10
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a29b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x78
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x18]
cdq
push edx
push eax
push dword [ebx + 0x10]
push dword [ebx + 0xc]
call fcn.004a0b60
or eax, edx
je 0x41daa5
mov ecx, 0x4cfeb8
mov dword [ebp - 0x1c], 0x4cfeb8
call fcn.00436390
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
cmp eax, 1
jne 0x41da94
push 0
push 0x4b362c
push 0x4b362c
push str._startOffset___m_frequency___0
call fcn.00430100
add esp, 0x10
mov ecx, 0x4cfeb8
mov dword [ebp - 4], 0xffffffff
call fcn.004363a0
mov edi, dword [ebx + 0x14]
mov eax, edi
cdq
add eax, dword [ebx + 0xc]
adc edx, dword [ebx + 0x10]
cmp edx, dword [esi + 0x24]
jl 0x41db00
jg 0x41dabd
cmp eax, dword [esi + 0x20]
jbe 0x41db00
mov ecx, 0x4cfeb8
mov dword [ebp - 0x1c], 0x4cfeb8
call fcn.00436390
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 1
cmp eax, 1
jne 0x41daf6
push 0
push 0x4b362c
push 0x4b362c
push str._startOffset__length____m_length
call fcn.00430100
add esp, 0x10
mov ecx, 0x4cfeb8
call fcn.004363a0
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x18], eax
cdq
push edx
push eax
push dword [ebx + 0x10]
push dword [ebx + 0xc]
call fcn.004a0ab0
shl eax, 4
mov dword [ebp - 0x14], eax
test edi, edi
jle 0x41db99
mov eax, dword [ebp - 0x18]
cmp eax, edi
mov dword [ebp - 0x84], 0
mov esi, edi
mov dword [ebp - 0x88], 0
cmovl esi, eax
mov dword [ebp - 0x80], 0x67452301
push esi
push dword [ebx + 8]
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x7c], 0xefcdab89
mov dword [ebp - 0x78], 0x98badcfe
mov dword [ebp - 0x74], 0x10325476
call fcn.004025e0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x88]
call fcn.00402710
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
movups xmm0, xmmword [ebp - 0x30]
add dword [ebx + 8], esi
mov eax, dword [edx + 4]
movups xmmword [eax + ecx], xmm0
mov eax, dword [edx + 0x18]
add ecx, 0x10
sub edi, eax
mov dword [ebp - 0x14], ecx
test edi, edi
jg 0x41db21
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
Function at 0x421500
Capabilities:
Get number of processors

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2aee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x48
push esi
mov esi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x1c], esi
push edi
movups xmmword [esi + 4], xmm0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xf
mov byte [esi + 4], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.Blizzard::Streaming::Manifests::ServerItem.0
movups xmmword [esi + 0x1c], xmm0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0xf
mov byte [esi + 0x1c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x14]
movlpd qword [ebp - 0x40], xmm0
push eax
push str._d:_d
push str.0:00
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x54], 0x7d0
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x50], 1
call fcn.00401cc0
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x54]
add esp, 0x10
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
call fcn.0043c900
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x44]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 0x64
cmp eax, dword [esi + 0x48]
je 0x42160f
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax], xmm0
add dword [esi + 0x44], 0x10
jmp 0x42161c
lea ecx, [ebp - 0x30]
push ecx
push eax
lea ecx, [esi + 0x40]
call fcn.00444800
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x54], 0xa
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [esi + 0x58], 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x42a620
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a269d
push eax
mov dword fs:[0], esp
sub esp, 0x114
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x84], 0
je 0x42a729
mov eax, dword [edi + 0x18]
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x70], 0x67452301
mov dword [ebp - 0x6c], 0xefcdab89
mov dword [ebp - 0x68], 0x98badcfe
mov dword [ebp - 0x64], 0x10325476
push dword [eax + 8]
push dword [eax]
call fcn.004025e0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x78]
call fcn.00402710
lea edx, [edi + 0x74]
mov esi, 0xc
lea ecx, [ebp - 0x20]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x42a6b3
add ecx, 4
add edx, 4
sub esi, 4
jae 0x42a6a0
jmp 0x42a6df
mov eax, dword [edi + 0x10]
mov esi, dword [edi + 8]
mov ecx, dword [edi + 0xc]
sub esi, 1
cdq
push edx
push eax
sbb ecx, 0
push ecx
push esi
call fcn.004a0ab0
mov ecx, dword [edi]
push eax
push 0
mov edx, dword [ecx + 0x50]
mov ecx, edi
call edx
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x20]
mov esi, dword [edi + 0x40]
lea ecx, [ebp - 0x10]
call fcn.00441630
mov dword [ebp - 4], 0
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x120], 8
mov dword [ebp - 0x114], esi
call fcn.004327b0
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x42a722
call fcn.0040d490
mov byte [edi + 0x84], 0
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42b230
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a269d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
push ebx
push esi
push edi
mov edi, ecx
push dword [edi + 0xc]
mov eax, dword [edi]
push dword [edi + 8]
push 0
mov eax, dword [eax + 0x30]
push 0
call eax
mov esi, dword [edi + 0x40]
lea ecx, [ebp - 0x10]
mov byte [edi + 0x1c], al
call fcn.00441630
mov dword [ebp - 4], 0
lea edx, [ebp - 0xb8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xb8], 0x1c
mov dword [ebp - 0xac], esi
call fcn.004327b0
mov bl, al
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x42b2ac
call fcn.0040d490
mov dword [ebp - 4], 0xffffffff
test bl, bl
je 0x42b2eb
push dword [edi + 0x18]
mov ecx, dword [edi + 0x44]
lea edx, [edi + 0x20]
push dword [edi + 0x14]
push dword [edi + 0x10]
push dword [edi + 0xc]
push dword [edi + 8]
call fcn.0042b400
add esp, 0x14
test al, al
je 0x42b2eb
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42fe10
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a39ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x28]
mov dword [edi], vtable.Blizzard::URL::HttpCallback.0
mov dword [edi + 4], 1
mov byte [edi + 8], 1
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x18], 0xffffffff
mov dword [edi + 0x1c], 0xffffffff
mov dword [edi + 0x20], 0xffffffff
mov dword [edi + 0x24], 0xffffffff
push 0x40
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004728e6
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, dword [ebx + 8]
lea esi, [edi + 0x3c]
mov dword [edi + 0x30], 0
xorps xmm0, xmm0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], eax
push 3
movups xmmword [esi], xmm0
push 0x4b7360
mov dword [esi + 0x10], 3
push esi
mov dword [esi + 0x14], 0xf
call fcn.00474950
add esp, 0xc
mov byte [esi + 3], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
lea ecx, [edi + 0x5c]
mov byte [ebp - 4], 3
call fcn.004363b0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4

Function at 0x4303a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
push esi
mov esi, ecx
test esi, esi
je 0x43043e
push 2
call fcn.0047e39b
push eax
push esi
call fcn.0048779c
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4303d0
sub ecx, edx
lea edx, [ecx + 1]
mov dword [esp + 8], edx
cmp edx, 0x12c
ja 0x4303ee
lea eax, [esp + 0x10]
jmp 0x43040d
xor ecx, ecx
mov eax, edx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00472922
mov edx, dword [esp + 0xc]
add esp, 4
sub esp, 0xc
mov dword [esp + 0x18], eax
mov ecx, eax
push esi
call fcn.0043aa60
add esp, 0x10
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
cmp eax, ecx
je 0x43043e
push eax
call fcn.00472b7c
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x432c60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a1845
push eax
mov dword fs:[0], esp
sub esp, 0x808
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
jne 0x432ccc
mov ecx, 0x4cfeb8
mov dword [ebp - 0x14], 0x4cfeb8
call fcn.00436390
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], esi
cmp eax, 1
jne 0x432cbb
push esi
push 0x4b362c
push 0x4b362c
push str.file___NULL
call fcn.00430100
add esp, 0x10
mov ecx, 0x4cfeb8
mov dword [ebp - 4], 0xffffffff
call fcn.004363a0
cmp dword [esi], 0xffffffff
jne 0x432d01
push 0x43fa20
push ecx
mov edx, 0x43fa80
mov ecx, 0x4ce180
call fcn.0043b0b0
add esp, 8
mov dword [eax], 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x432d51
mov ecx, 0x4cfeb8
mov dword [ebp - 0x14], 0x4cfeb8
call fcn.00436390
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
cmp eax, 1
jne 0x432d40
push edi
push 0x4b362c
push 0x4b362c
push str.amount___NULL
call fcn.00430100
add esp, 0x10
mov ecx, 0x4cfeb8
mov dword [ebp - 4], 0xffffffff
call fcn.004363a0
cmp dword [edi], 0
je 0x432e8a
push dword [ebp + 0x10]
lea eax, [ebp + 8]
mov byte [esi + 8], 0
push eax
push dword [edi]
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov dword [edi], ecx
test eax, eax
jne 0x432e8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x27
je 0x432de2
cmp edi, 0x70
je 0x432de2
push 0x43fa20
push ecx
mov edx, 0x43fa80
mov ecx, 0x4ce180
call fcn.0043b0b0
mov dword [eax], 6
lea eax, [ebp - 0x414]
push dword [esi + 0x54]
push edi
push str.Win32_Write___d_____s
push eax
call fcn.0043efe0
add esp, 0x18
mov edx, 0x43fa80
mov esi, eax
push 0x43fa20
push ecx
mov ecx, 0x4ce180
call fcn.0043b0b0
mov edx, 6
jmp 0x432e31
push 0x43fa20
push ecx
mov edx, 0x43fa80
mov ecx, 0x4ce180
call fcn.0043b0b0
mov dword [eax], 0xb
lea eax, [ebp - 0x814]
push dword [esi + 0x54]
push edi
push str.Win32_Write___d_____s
push eax
call fcn.0043efe0
add esp, 0x18
mov edx, 0x43fa80
mov esi, eax
push 0x43fa20
push ecx
mov ecx, 0x4ce180
call fcn.0043b0b0
mov edx, 0xb
mov ecx, dword [eax + 8]
test esi, esi
mov eax, 0x4b362c
cmovne eax, esi
push 1
push eax
call fcn.00430600
mov edi, eax
add esp, 0x10
test edi, edi
je 0x432e78
push 0x43fa20
push ecx
mov edx, 0x43fa80
mov ecx, 0x4ce180
call fcn.0043b0b0
mov esi, eax
add esp, 8
mov ecx, dword [esi + 8]
cmp ecx, edi
je 0x432e75
call fcn.00430940
mov dword [esi + 8], edi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret