joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436b00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x61a440
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ecx]
xor edx, edx
push 1
push 0x6b01b8
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
push eax
lea edx, [esp + 0x1c]
mov dword [esp + 0x34], eax
push edx
mov edx, dword [esi + 0x80]
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], vtable.CryptoPP::ArraySink.1.0
mov dword [esp + 0x30], vtable.CryptoPP::ArraySink.0
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005c5ea5
mov esp, ebp
pop ebp
ret 8

Function at 0x436fa0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x61a410
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push 1
mov dword [esp + 0x20], eax
mov dword [esp + 8], eax
push 0x6b01b8
lea eax, [esp + 0xc]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x10], edx
mov edx, dword [ecx]
mov edx, dword [edx + 0x7c]
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.CryptoPP::ArraySink.1.0
mov dword [esp + 0x20], vtable.CryptoPP::ArraySink.0
call edx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.005c5ea5
mov esp, ebp
pop ebp
ret 8
Function at 0x43dfa0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x43dfb0
movzx edx, byte [esi + str.cw]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov ebx, edx
shl ebx, 0x19
xor ecx, ebx
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ecx, ebx
lea ebx, [edx + edx]
xor eax, ebx
xor eax, edx
or eax, ecx
xor edx, edx
xor ebx, ebx
or edx, ecx
or eax, ebx
mov dword [esi*8 + 0x6f8a80], edx
mov dword [esi*8 + 0x6f8a84], eax
inc esi
cmp esi, 0x100
jl 0x43dfb0
mov dword [0x6f9288], edi
mov dword [0x6f928c], edi
mov dword [0x6f9280], edi
mov dword [0x6f9284], edi
pop edi
pop esi
mov byte [0x6f92a0], 1
pop ebx
ret

Function at 0x43e030
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
lea ecx, [ecx]
movzx eax, byte [eax + 0x64f780]
mov ebp, eax
shr ebp, 7
mov dword [esp + 0x1c], ebp
imul ebp, ebp, 0x1b000000
mov ecx, eax
shr ecx, 6
mov esi, ecx
and ecx, 1
mov dword [esp + 0x10], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
xor ecx, eax
shl ecx, 0x19
xor ecx, ebp
and esi, 2
mov dword [esp + 0x14], esi
mov edi, eax
shr edi, 5
mov edx, edi
mov esi, edi
and edi, 1
mov ebp, edi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and esi, 2
mov ebp, esi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x10]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x14]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and edx, 4
mov ebp, edx
imul ebp, ebp, 0x1b000000
xor ecx, ebp
lea ebp, [ebx*4]
xor ebp, eax
shl ebp, 8
mov ebx, edi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, esi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x14]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, edx
imul ebx, ebx, 0x11b00
xor ebp, ebx
or ecx, ebp
mov ebp, edi
imul edi, edi, 0x11b
imul ebp, ebp, 0x11b0000
lea ebx, [eax*8]
xor ebx, eax
shl ebx, 0x10
xor ebx, ebp
mov ebp, esi
imul ebp, ebp, 0x11b0000
xor ebx, ebp
mov ebp, edx
imul ebp, ebp, 0x11b0000
xor ebx, ebp
or ecx, ebx
mov ebx, dword [esp + 0x1c]
imul ebx, ebx, 0x11b
lea ebp, [eax*4]
xor ebp, eax
add ebp, ebp
xor ebp, ebx
xor ebp, edi
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebp, esi
xor ebp, edx
xor ebp, eax
or eax, ecx
or ebp, ecx
xor edx, edx
or edx, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
or ebp, ecx
mov dword [eax*8 + 0x6f8278], edx
mov dword [eax*8 + 0x6f827c], ebp
inc eax
cmp eax, 0x100
mov dword [esp + 0x18], eax
jl 0x43e040
pop edi
pop esi
pop ebp
mov byte [0x6f92a1], 1
pop ebx
add esp, 0x10
ret
Function at 0x43f760
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, dword [ebp + 8]
movdqa xmm0, xmmword [eax]
sub esp, 8
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
movdqa xmm1, xmmword [edi]
lea edx, [esi - 1]
pxor xmm0, xmm1
movdqa xmmword [eax], xmm0
cmp edx, 1
jbe 0x43f7c7
add edx, 0xfffffffe
shr edx, 1
lea ecx, [edi + 0x10]
inc edx
jmp 0x43f7a0
movdqa xmm1, xmmword [ecx]
movdqa xmm0, xmmword [eax]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
movdqa xmm1, xmmword [ecx + 0x10]
add ecx, 0x20
sub edx, 1
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
jne 0x43f7a0
movdqa xmm0, xmmword [eax]
shl esi, 4
movdqa xmm1, xmmword [esi + edi - 0x10]
lea ecx, [esi + edi]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
movdqa xmm1, xmmword [ecx]
pop edi
aesenclast xmm0, xmm1
movdqa xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43f800
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push ecx
mov eax, dword [ebp + 8]
movdqa xmm1, xmmword [eax]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
movdqa xmm0, xmmword [edi]
pxor xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
pxor xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
pxor xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
pxor xmm1, xmm0
movdqa xmmword [esi], xmm1
cmp ebx, 1
jbe 0x43f8a6
add edi, 0x10
dec ebx
lea esp, [esp]
movdqa xmm0, xmmword [edi]
movdqa xmm1, xmmword [eax]
aesenc xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
aesenc xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
aesenc xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
add edi, 0x10
sub ebx, 1
aesenc xmm1, xmm0
movdqa xmmword [esi], xmm1
jne 0x43f860
mov ebx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
movdqa xmm1, xmmword [eax]
shl ebx, 4
movdqa xmm0, xmmword [ebx + edi]
aesenclast xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
aesenclast xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
aesenclast xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
pop edi
aesenclast xmm1, xmm0
movdqa xmmword [esi], xmm1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x445b80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60d4c8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x40]
mov edi, ecx
mov ecx, dword [esi + 0x18]
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [0x6b2000]
call fcn.00460670
test al, al
je 0x445c7b
mov edx, dword [esp + 0xc]
mov eax, edx
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x445bf0
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00416460
push 1
push 0
push 0x62207c
lea ecx, [esp + 0x1c]
mov dword [esp + 0x44], 0
call fcn.004448f0
test eax, eax
jle 0x445c46
mov ecx, dword [esp + 0x24]
cmp eax, ecx
ja 0x445c38
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x18]
call fcn.004165a0
jmp 0x445c46
sub eax, ecx
push 0
push eax
lea ecx, [esp + 0x18]
call fcn.0041fcc0
mov eax, dword [esp + 0x14]
mov esi, 0x10
cmp dword [esp + 0x28], esi
jae 0x445c59
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x24]
push edx
push eax
mov ecx, edi
call fcn.004458d0
cmp dword [esp + 0x28], esi
jb 0x445c95
mov eax, dword [esp + 0x14]
push eax
call fcn.005c5896
add esp, 4
jmp 0x445c95
cmp dword [esi + 0x64], 0x10
mov eax, dword [esi + 0x60]
jb 0x445c89
mov esi, dword [esi + 0x50]
jmp 0x445c8c
add esi, 0x50
push eax
push esi
mov ecx, edi
call fcn.004458d0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x30
ret 4
Function at 0x4474a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x609598
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0xc]
call fcn.004d0a10
lea ecx, [esp + 8]
push ecx
lea ecx, [esi + 0x1f0]
mov dword [esp + 0x2c], 0
call fcn.004ca0d0
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.004d0b30
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4

Function at 0x449150
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
sub esp, 8
cmp eax, ecx
jbe 0x449165
mov edx, eax
mov eax, ecx
mov ecx, edx
mov dword [esp], eax
mov dword [esp + 4], ecx
lea ecx, [esp]
xor eax, eax
movzx edx, byte [ecx]
imul eax, eax, 0x1000193
xor eax, edx
inc ecx
lea edx, [esp + 8]
cmp ecx, edx
jb 0x449171
add esp, 8
ret
Function at 0x464110
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x60a1a1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CPythonPlayer.1.0
mov dword [esi + 4], vtable.CPythonPlayer.0
lea ecx, [esi + 0x41dc]
mov dword [esp + 0x18], 7
call fcn.0051e790
lea ecx, [esi + 0x4144]
mov byte [esp + 0x18], 6
call fcn.00550850
lea ecx, [esi + 0x4124]
mov byte [esp + 0x18], 5
call fcn.00550850
lea ecx, [esi + 0x4104]
mov byte [esp + 0x18], 4
call fcn.00550850
lea ecx, [esi + 0x40e4]
mov byte [esp + 0x18], 3
call fcn.00463dc0
cmp dword [esi + 0x44], 0x10
jb 0x4641ab
mov eax, dword [esi + 0x30]
push eax
call fcn.005c5896
add esp, 4
xor ebx, ebx
mov dword [esi + 0x44], 0xf
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0xc]
mov byte [esi + 0x30], bl
mov byte [esp + 0x18], 1
call fcn.0051e790
mov dword [esi + 4], vtable.TAbstractSingleton_class_IAbstractPlayer_.0
mov dword [0x6b2004], ebx
mov dword [esi], vtable.CSingleton_class_CPythonPlayer_.0
mov dword [0x6b2008], ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x46cdd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60a4db
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0xac]
push eax
call fcn.0046c690
xor ebx, ebx
mov eax, 0xf
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
mov dword [esp + 0x84], eax
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
lea ecx, [esp + 0x14]
add esi, 4
push ecx
mov ecx, esi
mov dword [esp + 0xa8], ebx
call fcn.0046ccc0
lea ecx, [esp + 0x14]
mov dword [esp + 0xa4], 0xffffffff
call fcn.0046ba60
mov edi, dword [esi + 0x10]
cmp dword [esi + 0xc], edi
jbe 0x46ce99
call fcn.005c5aaf
mov esi, dword [esi]
mov ebp, esi
mov dword [esp + 0x98], edi
cmp esi, ebx
jne 0x46cec7
call fcn.005c5aaf
xor esi, esi
cmp edi, dword [esi + 0xc]
ja 0x46ceb9
call fcn.005c5aaf
lea esi, [edi - 0x80]
cmp ebp, ebx
jne 0x46cecb
call fcn.005c5aaf
jmp 0x46cece
mov esi, dword [esi]
jmp 0x46ceaf
mov ebx, dword [ebp]
cmp esi, dword [ebx + 0x10]
jb 0x46ced8
call fcn.005c5aaf
mov edx, dword [esp + 0xac]
mov dword [esi], edx
mov ecx, dword [0x6b47a4]
call fcn.0053d010
call fcn.005c5ec0
mov dword [esi + 0x7c], eax
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret 4
Function at 0x47fd70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x60bd1b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
fld dword [edi + 0x10]
fstp dword [esi + 0x10]
mov ecx, dword [edi + 0x14]
lea edx, [edi + 0x18]
mov dword [esi + 0x14], ecx
push edx
lea ecx, [esi + 0x18]
call fcn.00568d60
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x1c], 0
call fcn.0047f820
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x480530
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x60bde6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 1
call fcn.004804a0
lea edi, [esi + 0x30]
mov ecx, edi
call fcn.00451ca0
mov eax, dword [edi]
push eax
call fcn.005c5896
add esi, 0x10
add esp, 4
mov ecx, esi
call fcn.00535c70
mov ecx, dword [esi]
push ecx
call fcn.005c5896
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4851d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x60c278
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
lea ebp, [edi + edi + 2]
cmp ebp, esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], edi
jge 0x485286
jmp 0x485220
lea eax, [ebp + ebp*4]
mov cl, byte [ebx + eax*8 + 0x20]
cmp cl, byte [ebx + eax*8 - 8]
lea eax, [ebx + eax*8]
jae 0x485232
dec ebp
lea edx, [ebp + ebp*4]
mov ecx, dword [ebx + edx*8]
lea esi, [ebx + edx*8]
lea eax, [edi + edi*4]
push 0xffffffffffffffff
lea edi, [ebx + eax*8]
push 0
lea edx, [esi + 4]
mov dword [edi], ecx
push edx
lea ecx, [edi + 4]
call fcn.00416950
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
mov cl, byte [esi + 0x21]
mov byte [edi + 0x21], cl
mov dl, byte [esi + 0x22]
mov byte [edi + 0x22], dl
movzx eax, byte [esi + 0x23]
mov byte [edi + 0x23], al
mov ecx, dword [esi + 0x24]
mov dword [edi + 0x24], ecx
mov edi, ebp
lea ebp, [ebp + ebp + 2]
cmp ebp, dword [esp + 0x34]
jl 0x485220
mov esi, dword [esp + 0x34]
cmp ebp, esi
jne 0x4852ce
lea edx, [esi + esi*4]
mov ecx, dword [ebx + edx*8 - 0x28]
lea ebp, [ebx + edx*8 - 0x28]
lea eax, [edi + edi*4]
push 0xffffffffffffffff
lea edi, [ebx + eax*8]
push 0
lea edx, [ebp + 4]
mov dword [edi], ecx
push edx
lea ecx, [edi + 4]
call fcn.00416950
movzx eax, byte [ebp + 0x20]
mov byte [edi + 0x20], al
mov cl, byte [ebp + 0x21]
mov byte [edi + 0x21], cl
mov dl, byte [ebp + 0x22]
mov byte [edi + 0x22], dl
movzx eax, byte [ebp + 0x23]
mov byte [edi + 0x23], al
mov ecx, dword [ebp + 0x24]
mov dword [edi + 0x24], ecx
lea edi, [esi - 1]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x38]
push edx
sub esp, 0x28
mov esi, esp
mov dword [esp + 0x44], esp
push 0xffffffffffffffff
lea ecx, [esi + 4]
mov dword [esi], eax
push 0
lea edx, [esp + 0x70]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push edx
mov byte [ecx + 4], 0
call fcn.00416950
mov al, byte [esp + 0x84]
mov byte [esi + 0x20], al
mov cl, byte [esp + 0x85]
mov byte [esi + 0x21], cl
mov dl, byte [esp + 0x86]
mov byte [esi + 0x22], dl
mov edx, dword [esp + 0x40]
mov al, byte [esp + 0x87]
push edx
mov byte [esi + 0x23], al
mov ecx, dword [esp + 0x8c]
push edi
push ebx
mov dword [esi + 0x24], ecx
call fcn.00484a80
add esp, 0x38
cmp dword [esp + 0x54], 0x10
jb 0x48535a
mov eax, dword [esp + 0x40]
push eax
call fcn.005c5896
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x486c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x60c390
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0x18]
mov eax, dword [ecx + 4]
xor ebx, ebx
mov dword [esp + 0x14], ecx
cmp byte [eax + 0x31], bl
jne 0x486cc7
mov edx, dword [esp + 0x74]
mov dl, byte [edx]
cmp byte [eax + 0xc], dl
jae 0x486cba
mov eax, dword [eax + 8]
jmp 0x486cbe
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0x31], bl
je 0x486cb0
mov dword [esp + 0x14], ecx
mov esi, dword [edi]
mov eax, dword [edi + 0x18]
mov ebp, ecx
mov dword [esp + 0x1c], eax
cmp esi, ebx
je 0x486cda
cmp esi, esi
je 0x486ce3
call fcn.005c5aaf
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
je 0x486cf8
mov edx, dword [esp + 0x74]
mov al, byte [edx]
cmp al, byte [ecx + 0xc]
jae 0x486da4
mov eax, 0xf
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov ecx, dword [esp + 0x74]
mov dl, byte [ecx]
mov cl, byte [esp + 0x20]
push 0xffffffffffffffff
mov byte [esp + 0x44], dl
push ebx
lea edx, [esp + 0x2c]
mov byte [esp + 0x4c], cl
push edx
lea ecx, [esp + 0x54]
mov dword [esp + 0x78], ebx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
call fcn.00416950
lea eax, [esp + 0x40]
push eax
push ebp
push esi
lea ecx, [esp + 0x24]
push ecx
mov ecx, edi
mov byte [esp + 0x7c], 1
call fcn.00486420
mov esi, dword [eax]
mov ebp, dword [eax + 4]
mov edi, 0x10
cmp dword [esp + 0x60], edi
jb 0x486d71
mov edx, dword [esp + 0x4c]
push edx
call fcn.005c5896
add esp, 4
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
cmp dword [esp + 0x3c], edi
jb 0x486d94
mov eax, dword [esp + 0x28]
push eax
call fcn.005c5896
add esp, 4
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
cmp esi, ebx
jne 0x486dd2
call fcn.005c5aaf
xor esi, esi
cmp ebp, dword [esi + 0x18]
jne 0x486db9
call fcn.005c5aaf
lea eax, [ebp + 0x10]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 4
mov esi, dword [esi]
jmp 0x486daf
Function at 0x4982c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + 4]
push edi
lea edi, [esi + 4]
push ecx
mov ecx, edi
call fcn.0054e020
mov eax, dword [edi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x18]
xor ebx, ebx
mov dword [edi + 0x1c], ebx
mov dword [eax], eax
mov edi, dword [edi + 0x18]
mov dword [edi + 8], edi
mov ecx, dword [esi + 0x78]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esi + 0x78]
mov dword [ecx + 4], ecx
mov dword [esi + 0x7c], ebx
cmp eax, dword [esi + 0x78]
je 0x498313
mov edi, dword [eax]
push eax
call fcn.005c5896
add esp, 4
mov eax, edi
cmp edi, dword [esi + 0x78]
jne 0x498301
mov edx, dword [esi + 0x3c]
mov eax, dword [edx + 4]
lea edi, [esi + 0x24]
push eax
mov ecx, edi
call fcn.0054e020
mov eax, dword [edi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], ebx
mov dword [eax], eax
mov edi, dword [edi + 0x18]
mov dword [edi + 8], edi
mov ecx, dword [esi + 0x94]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esi + 0x94]
mov dword [ecx + 4], ecx
mov dword [esi + 0x98], ebx
cmp eax, dword [esi + 0x94]
je 0x498375
lea esp, [esp]
mov edi, dword [eax]
push eax
call fcn.005c5896
add esp, 4
mov eax, edi
cmp edi, dword [esi + 0x94]
jne 0x498360
mov ecx, dword [esi + 0x5c]
mov edx, dword [ecx + 4]
lea edi, [esi + 0x44]
push edx
mov ecx, edi
call fcn.0054e020
mov eax, dword [edi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], ebx
mov dword [eax], eax
mov edi, dword [edi + 0x18]
mov dword [edi + 8], edi
pop edi
lea ecx, [esi + 0x9c]
pop esi
pop ebx
jmp fcn.00497ee0
Function at 0x4a2e30
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
push 0x62bf7c
push str.interface.cfg
mov edi, ecx
call fcn.005c6f30
mov esi, eax
add esp, 8
test esi, esi
jne 0x4a2e51
pop edi
xor al, al
pop esi
ret
push esi
push 0xc8
push 1
add edi, 0x2628
push edi
call fcn.005c81c9
push esi
call fcn.005c6cd4
add esp, 0x14
pop edi
mov al, 1
pop esi
ret

Function at 0x4a2e80
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x2624], 0
je 0x4a2ef0
push esi
push 0x624d74
call dword [0x6216c8]
push eax
mov eax, dword [edi + 0x2624]
push str.OnSaveInterfaceStatus
push eax
call fcn.00547d00
push 0x62d37c
push str.interface.cfg
call fcn.005c6f30
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x4a2ed2
push str.Cannot_open_interface.cfg
call fcn.0053cd50
add esp, 4
pop esi
pop edi
ret
push esi
push 0xc8
push 1
add edi, 0x2628
push edi
call fcn.005c8bc0
push esi
call fcn.005c6cd4
add esp, 0x14
pop esi
pop edi
ret

Function at 0x4a4660
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x2c
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
lea eax, [esp + 4]
push eax
push 3
mov ebx, ecx
call fcn.0051d2f0
test al, al
jne 0x4a4693
mov al, 1
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x2c
ret
mov ecx, ebx
call fcn.0051d200
movzx ecx, word [esp + 5]
cmp ecx, eax
jg 0x4a4681
lea edx, [esp + 8]
push edx
push 7
mov ecx, ebx
call fcn.0051d300
test al, al
jne 0x4a46c5
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x2c
ret
mov eax, dword [esp + 9]
add eax, 0xfffffff9
push ebp
mov ebp, dword [esp + 0xf]
movzx eax, ax
push esi
movzx esi, ax
push edi
push esi
call fcn.005c523d
add esp, 4
mov edi, eax
push edi
push esi
mov ecx, ebx
call fcn.0051d300
test al, al
jne 0x4a470f
push edi
call fcn.005c6b29
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x2c
ret
mov eax, dword [0x68a0e4]
mov ebx, 0x10
cmp dword [0x68a0f8], ebx
jae 0x4a4726
mov eax, 0x68a0e4
push eax
call fcn.0053d2e0
push ebp
call fcn.004bcba0
add esp, 8
push eax
lea ecx, [esp + 0x20]
call fcn.00416540
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x34], ebx
jae 0x4a474d
lea eax, [esp + 0x20]
push 0x62d37c
push eax
call fcn.005c6f30
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4a4788
push edi
call fcn.005c6b29
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.0046da60
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x2c
ret
push ebx
push 1
push esi
push edi
call fcn.005c8bc0
push ebx
call fcn.005c6cd4
push edi
call fcn.005c6b29
add esp, 0x18
lea ecx, [esp + 0x1c]
call fcn.0046da60
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.005c5ea5
add esp, 0x2c
ret