joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458a78
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x2c
mov edx, ecx
xor eax, eax
mov dword [esp + 4], ecx
mov dword [ecx], 0xffffffff
mov byte [edx + 0xc], al
mov dword [edx + 8], 0
mov byte [edx + 0xd], al
cmp dword [0x494030], eax
jne 0x458abb
mov dword [esp + 4], edx
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0xc]
mov dword [0x494030], edx
mov edx, dword [esp + 4]
mov dword [edx + 4], 0
cmp dword [0x494030], 0
jne 0x458ad5
mov dword [0x494030], 0x1000
add esp, 0x2c
mov eax, edx
ret

Function at 0x458bc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test dword [edi + 8], 4
jne 0x458c92
cmp dword [esp + 0x10], 0
je 0x458c92
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
lea ebp, [edx + ecx - 1]
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x20]
cmp ebp, ecx
jb 0x458c72
cmp byte [ecx], 0x1a
je 0x458c72
cmp byte [ebx], 0xd
je 0x458c21
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
jmp 0x458c68
cmp ebx, ebp
jae 0x458c2d
cmp byte [ebx + 1], 0xa
jne 0x458c64
jmp 0x458c68
mov byte [esp + 0x14], 0x20
push 0
lea ecx, [esp + 0x1c]
push ecx
push 1
lea edx, [esp + 0x20]
push edx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x18], 0
je 0x458c5d
push 1
push 0
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esp + 0x14], 0xa
je 0x458c68
mov byte [esi], 0xd
inc esi
inc ebx
cmp ebx, ebp
ja 0x458c72
cmp byte [ebx], 0x1a
jne 0x458c15
cmp ebx, ebp
ja 0x458c88
push 1
lea edx, [ebp + 1]
sub edx, ebx
push 0
push edx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
sub eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x458ca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, 1
sub esp, 0x1000
test dword [esp], esp
dec edx
jne 0x458ca8
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x1030], ecx
test dword [esi + 8], 1
je 0x458cd6
push 4
mov ecx, esi
push 0
call fcn.00458e4c
test dword [esi + 8], 4
je 0x458d01
push 0
lea edx, [ebp - 0x102c]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [ebp - 0x102c]
jmp 0x458e18
mov dword [ebp - 0x1030], esi
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea ecx, [edx + ecx]
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x1028]
mov dword [ebp - 0x24], ecx
mov ecx, 0x1000
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp + 0xc]
jge 0x458d2e
lea ecx, [ebp - 0x1c]
jmp 0x458d31
lea ecx, [ebp + 0xc]
mov ecx, dword [ecx]
test ecx, ecx
mov dword [ebp - 0x20], ecx
jle 0x458db8
push dword [ebp - 0x20]
push 0xa
push edx
call fcn.0045e440
add esp, 0xc
test eax, eax
mov dword [ebp - 0x18], eax
je 0x458db8
mov edi, dword [ebp - 0x18]
sub edi, esi
push edi
push esi
push ebx
call fcn.0045a4e0
lea edx, [edi + 1]
add ebx, edi
mov byte [ebx], 0xd
inc ebx
add esi, edx
mov byte [ebx], 0xa
mov ecx, dword [ebp - 0x24]
sub ecx, esi
xor edx, edx
inc ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0xc], ecx
sub eax, ebx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
add esp, 0xc
cmp edx, eax
jge 0x458d8c
lea edx, [ebp - 0x10]
jmp 0x458d8f
lea edx, [ebp - 0x14]
mov eax, dword [edx]
cmp eax, ecx
jge 0x458d97
jmp 0x458d9a
lea edx, [ebp - 0xc]
mov ecx, dword [edx]
test ecx, ecx
mov dword [ebp - 0x20], ecx
jle 0x458db8
push dword [ebp - 0x20]
push 0xa
push esi
call fcn.0045e440
add esp, 0xc
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x458d4f
mov edi, dword [ebp - 0x20]
test edi, edi
jle 0x458dce
push edi
push esi
push ebx
call fcn.0045a4e0
add ebx, edi
add esi, edi
add esp, 0xc
lea edx, [ebp - 0x1028]
mov edi, ebx
sub edi, edx
mov dword [ebp - 8], edx
je 0x458e0d
push 0
lea ecx, [ebp - 4]
push ecx
push edi
mov edx, dword [ebp - 0x1030]
push dword [ebp - 8]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 4], edi
je 0x458e0d
cmp dword [ebp - 4], 0
je 0x458e3f
sub edi, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add dword [ebp - 8], ecx
test edi, edi
jne 0x458ddd
mov ebx, esi
mov esi, dword [ebp - 0x1030]
sub ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], ebx
jne 0x458e2b
pop edi
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test ebx, ebx
jle 0x458e3f
cmp ebx, dword [ebp + 0xc]
jge 0x458e3f
sub dword [ebp + 0xc], ebx
add dword [ebp + 8], ebx
jmp 0x458cc2
pop edi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x458ef4
Capabilities:
Read file via mapping

Disassembly:
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1c]
push 0
push 0
push 0
push 2
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x458f69
push edi
mov eax, dword [esp + 0x1c]
mov edx, eax
mov dword [esp + 0x10], eax
sar edx, 0x1f
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x14]
xor edx, edx
push eax
mov eax, dword [esp + 0x14]
push ecx
push 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test eax, eax
je 0x458f5c
push 1
mov edx, dword [esp + 0x1c]
lea ecx, [edx + edi]
push ecx
mov ecx, esi
call fcn.00458e4c
test eax, eax
jns 0x458f6b
push edi
mov ecx, esi
push ebx
call fcn.00458f78
xor ebx, ebx
jmp 0x458f6b
xor ebx, ebx
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x459afc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x496c20
push 0x45e844
push edx
mov dword fs:[0], esp
sub esp, 8
push eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
jmp 0x459b4a
call fcn.0045ed80
mov eax, esp
mov dword [0x49e5e8], eax
call fcn.0045f008
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x49e5f0], eax
call fcn.0045efec
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x49e5ec], eax
call fcn.0045f318
call fcn.0045eed4
call fcn.0045ea8c
call fcn.0045edc0
push 0
push dword [0x49896c]
push dword [0x4986a5]
push dword [0x4986a1]
call fcn.00422620
add esp, 0x10
push eax
call fcn.00459bfc
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45a040
Capabilities:
Move file

Disassembly:
push eax
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x45a057
pop ecx
xor eax, eax
ret
call fcn.00460c10
mov eax, 0xffffffff
pop ecx
ret
Function at 0x45e6ac
Capabilities:
Get file size

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x24]
push esi
push edi
push 0x20
push 0
push ebx
call fcn.00459cc8
mov word [ebx + 6], 1
add esp, 0xc
mov eax, dword [esp + 0x28]
push dword [eax*4 + 0x496c74]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x45e6f2
mov di, word [esp + 0x28]
mov edx, 0x2180
mov word [ebx], di
mov word [ebx + 0xc], di
jmp 0x45e76e
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
mov edx, dword [esp + 0x34]
push dword [edx*4 + 0x496c74]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x45e721
call fcn.00460c10
mov eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x18
ret
lea esi, [esp + 0x1c]
push esi
call fcn.0045e798
test eax, eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x18], eax
jne 0x45e744
pop edi
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x18
ret
mov dword [esp + 0x14], 0x8180
xor ecx, ecx
push ecx
mov edx, dword [esp + 0x2c]
mov word [ebx], cx
mov word [ebx + 0xc], cx
push dword [edx*4 + 0x496c74]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x14]
mov dword [ebx + 0x10], eax
mov esi, edx
and esi, 0x1c0
mov dword [esp + 0x10], esi
sar esi, 3
mov eax, dword [esp + 0x10]
or esi, edx
sar eax, 6
or esi, eax
mov word [ebx + 4], si
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x460f30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0x3c
jae 0x460f7a
mov ecx, dword [ebp + 0x10]
or ecx, ecx
je 0x460f76
test byte [ebx + 0x496c38], 0x10
jne 0x460f8b
mov edx, dword [ebp + 0xc]
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x496c74]
call sub.KERNEL32.dll_ReadFile
pop edx
pop ecx
or eax, eax
je 0x460f7a
mov eax, dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x460f71
push 9
call fcn.00460cac
mov eax, 0xffffffff
jmp 0x460f71
push esi
push edi
mov edi, dword [ebp + 0xc]
and byte [ebx + 0x496c38], 0xfe
cld
push ds
pop es
mov edx, edi
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x496c74]
call sub.KERNEL32.dll_ReadFile
pop edx
pop ecx
or eax, eax
je 0x461069
mov eax, dword [ebp - 8]
add edx, eax
cmp eax, ecx
je 0x460fce
or byte [ebx + 0x496c38], 1
mov ecx, eax
or ecx, ecx
je 0x461110
push edi
mov al, 0x1a
repne scasb al, byte es:[edi]
je 0x461038
pop edi
mov ecx, edx
sub ecx, edi
mov al, 0xd
xor esi, esi
repne scasb al, byte es:[edi]
jne 0x461110
cmp edi, edx
jae 0x46107d
cmp byte [edi], 0xa
jne 0x460fe6
mov esi, edi
mov dword [ebp - 4], edi
dec dword [ebp - 4]
mov ecx, edx
sub ecx, edi
mov al, 0xd
repne scasb al, byte es:[edi]
jne 0x4610da
cmp edi, edx
jae 0x46107d
cmp byte [edi], 0xa
jne 0x461009
mov ecx, edi
dec ecx
sub ecx, esi
mov eax, edi
mov edi, dword [ebp - 4]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], edi
mov edi, eax
inc esi
jmp 0x461003
dec edi
test byte [ebx + 0x496c38], 8
jne 0x46105b
sub edx, edi
push 1
push 0
push edx
push dword [ebx*4 + 0x496c74]
call sub.KERNEL32.dll_SetFilePointer
cmp ax, 0xffff
je 0x461069
or byte [ebx + 0x496c38], 1
mov edx, edi
jmp 0x460fdd
push 9
call fcn.00460cac
mov eax, 0xffffffff
jmp 0x461115
test byte [ebx + 0x496c38], 1
jne 0x4610da
dec edx
mov ecx, 1
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x496c74]
call sub.KERNEL32.dll_ReadFile
pop edx
pop ecx
or eax, eax
je 0x461069
mov eax, dword [ebp - 8]
or eax, eax
je 0x4610d3
cmp byte [edi - 1], 0xa
je 0x4610da
mov byte [edi - 1], 0xd
push 1
push 0
push 0xffffffffffffffff
push dword [ebx*4 + 0x496c74]
call sub.KERNEL32.dll_SetFilePointer
cmp ax, 0xffff
je 0x461069
jmp 0x4610da
or byte [ebx + 0x496c38], 1
cmp esi, 0
je 0x461110
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [ebx + 0x496c38], 8
jne 0x461110
mov ecx, esi
sub ecx, edi
je 0x461110
test byte [ebx + 0x496c38], 1
je 0x460f9a
mov eax, edi
sub eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4652d0
Capabilities:
Query environment variable

Disassembly:
push ebx
xor ebx, ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
je 0x46532d
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x46532d
lea ecx, [edi + 1]
push ecx
call fcn.0045ae50
add esp, 4
mov ebx, eax
test eax, eax
je 0x46532d
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x46531a
push ebx
call fcn.0045ace4
xor ebx, ebx
add esp, 4
jmp 0x46532d
push ebx
push esi
call fcn.004639ac
add esp, 4
push eax
call fcn.004651e0
add esp, 8
pop edi
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0xbced00], 1
mov dword [0xbcecfc], 1
mov dword [0xbcecf8], 1
mov dword [0xbcecf0], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x5c9014], eax
mov eax, dword [0xbced0c]
test eax, eax
je 0x4010b0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0xbced20]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0xbced08]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x587784], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060
Function at 0x402c87
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xcc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov eax, dword [eax]
movzx edx, al
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edi, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
movzx eax, word [eax]
movzx ebx, ax
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov ebx, dword [eax]
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov esi, dword [eax]
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov esi, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
mov ebx, dword [eax]
mov dword [esp + 0x9c], 9
fld qword [0x58fa78]
fstp qword [esp + 0x94]
mov dword [esp + 0x90], edx
mov dword [esp + 0x8c], 0
mov dword [esp + 0x88], ecx
mov dword [esp + 0x84], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 1
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], 0
fld qword [0x58fa48]
fstp qword [esp + 0x68]
fld qword [0x58fa80]
fstp qword [esp + 0x60]
mov dword [esp + 0x5c], 0
fld qword [0x58fa80]
fstp qword [esp + 0x54]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x50], eax
mov dword [esp + 0x4c], 0
fldz
fstp qword [esp + 0x44]
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x40], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], 0
mov eax, dword [ebp - 0x28]
mov dword [esp + 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 2
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], 9
fld qword [0x58fa80]
fstp qword [esp + 0x18]
fld qword [0x58fa68]
fstp qword [esp + 0x10]
fldz
fstp qword [esp + 8]
mov dword [esp + 4], 0
mov dword [esp], 1
call sym._bi_reverse
mov dword [ebx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 1
nop
add esp, 0xcc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4048de
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x404903
cmp dword [ebp - 0xc], 1
je 0x404a07
jmp 0x404a02
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___super_fnc__725
mov dword [ebp - 0xc], 1
nop
jmp 0x4048ee
nop
leave
ret
Function at 0x405c7f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x48]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x4c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x50]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x54]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x6c]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x70]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x74]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 0x8c]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0x90]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
lea eax, [ebp + 0x7c]
mov dword [esp + 4], eax
lea eax, [ebp + 0x5c]
mov dword [esp], eax
call sym.___super_fnc__2869
mov eax, dword [ebp + 0x7c]
movzx eax, word [eax + 0xe72]
test ax, ax
jne 0x405e48
lea eax, [ebp - 0x48]
mov dword [esp + 0x88], eax
lea eax, [ebp - 0x44]
mov dword [esp + 0x84], eax
lea eax, [ebp - 0x40]
mov dword [esp + 0x80], eax
lea eax, [ebp - 0x3c]
mov dword [esp + 0x7c], eax
lea eax, [ebp - 0x38]
mov dword [esp + 0x78], eax
lea eax, [ebp - 0x34]
mov dword [esp + 0x74], eax
lea eax, [ebp - 0x30]
mov dword [esp + 0x70], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 0x6c], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x68], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0x64], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0x60], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x5c], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0x58], eax
lea eax, [ebp + 0xa4]
mov dword [esp + 0x54], eax
lea eax, [ebp + 0x9c]
mov dword [esp + 0x50], eax
lea eax, [ebp + 0x98]
mov dword [esp + 0x4c], eax
lea eax, [ebp - 0x90]
mov dword [esp + 0x48], eax
lea eax, [ebp + 0x80]
mov dword [esp + 0x44], eax
lea eax, [ebp + 0x7c]
mov dword [esp + 0x40], eax
lea eax, [ebp - 0x88]
mov dword [esp + 0x3c], eax
lea eax, [ebp - 0x80]
mov dword [esp + 0x38], eax
lea eax, [ebp + 0x68]
mov dword [esp + 0x34], eax
lea eax, [ebp + 0x64]
mov dword [esp + 0x30], eax
lea eax, [ebp + 0x60]
mov dword [esp + 0x2c], eax
lea eax, [ebp + 0x58]
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x78]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x70]
mov dword [esp + 0x20], eax
lea eax, [ebp + 0x3c]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x60]
mov dword [esp + 0x18], eax
lea eax, [ebp + 0x2c]
mov dword [esp + 0x14], eax
lea eax, [ebp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [ebp + 0x24]
mov dword [esp + 0xc], eax
lea eax, [ebp + 0x20]
mov dword [esp + 8], eax
lea eax, [ebp + 0x1c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x50]
mov dword [esp], eax
call sym.___super_fnc__2870
jmp 0x405e49
nop
leave
ret
Function at 0x40ab30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x40ab55
cmp dword [ebp - 0xc], 1
je 0x40acb4
jmp 0x40acaf
mov eax, dword [ebp + 0xa4]
mov dword [esp + 0x9c], eax
mov eax, dword [ebp + 0xa0]
mov dword [esp + 0x98], eax
mov eax, dword [ebp + 0x9c]
mov dword [esp + 0x94], eax
mov eax, dword [ebp + 0x98]
mov dword [esp + 0x90], eax
mov eax, dword [ebp + 0x94]
mov dword [esp + 0x8c], eax
mov eax, dword [ebp + 0x90]
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 0x8c]
mov dword [esp + 0x84], eax
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___super_fnc__13
mov dword [ebp - 0xc], 1
nop
jmp 0x40ab40
nop
leave
ret