joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4265a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, edx
mov dword [esp + 0xc], eax
cmp dword [edi + 0x2fac], 0
je 0x426634
mov ebx, dword [edi + 0x2fb4]
lea esi, [edi + 0x2fb0]
test ebx, ebx
jns 0x4265f2
je 0x4265da
mov eax, ebx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
add ecx, ebx
jmp 0x4265df
mov ecx, 8
xor eax, eax
test ecx, ecx
cmovg eax, ecx
mov ecx, esi
push eax
call fcn.00427ab0
mov eax, dword [esp + 0xc]
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push eax
call fcn.00417500
mov edx, dword [esi]
test edx, edx
je 0x42660c
dec edx
jmp 0x42660e
xor edx, edx
push dword [edi + 0x2fac]
mov eax, dword [esi + 8]
mov ecx, 0x66bad2
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call fcn.004c2a75
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
lea ecx, [edi + 0x2fb0]
push eax
call fcn.00417500
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x426a30
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
or ecx, 0xffffffff
mov al, byte [edi]
lea esi, [edi + 1]
test al, al
je 0x426a6c
push ebx
or ebx, 0xffffffff
cmp al, 0x23
jne 0x426a52
cmp byte [esi], al
jne 0x426a52
cmp byte [esi + 1], al
cmove ecx, ebx
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x4ff310]
test al, al
jne 0x426a44
pop ebx
not ecx
call fcn.004269e0
test eax, eax
jne 0x426a80
mov ecx, edi
pop edi
pop esi
jmp fcn.00426970
pop edi
pop esi
ret

Function at 0x426a90
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x66bb0c]
test bl, bl
je 0x426ad6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x426ab7
cmp byte [esi], bl
jne 0x426ab7
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x4ff310]
test bl, bl
jne 0x426aa8
mov edi, dword [0x66bb0c]
mov esi, dword [edi + 0x2f70]
xor ecx, ecx
not eax
test esi, esi
jle 0x426afc
mov edi, dword [edi + 0x2f78]
lea edx, [edi + 4]
lea ecx, [ecx]
cmp dword [edx], eax
je 0x426b02
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x426af0
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x430050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43008d
mov eax, dword [0x66bb0c]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x430076
dec dword [eax + 0x36c]
push dword [0x66bb08]
push ecx
call dword [0x4ff1c0]
add esp, 8
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x4300c8
mov eax, dword [0x66bb0c]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x4300b1
dec dword [eax + 0x36c]
push dword [0x66bb08]
push ecx
call dword [0x4ff1c0]
add esp, 8
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x430103
mov eax, dword [0x66bb0c]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x4300ec
dec dword [eax + 0x36c]
push dword [0x66bb08]
push ecx
call dword [0x4ff1c0]
add esp, 8
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x43015a
mov eax, dword [0x66bb0c]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x430143
dec dword [eax + 0x36c]
push dword [0x66bb08]
push ecx
call dword [0x4ff1c0]
add esp, 8
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x430195
mov eax, dword [0x66bb0c]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x43017e
dec dword [eax + 0x36c]
push dword [0x66bb08]
push ecx
call dword [0x4ff1c0]
add esp, 8
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x4301d0
mov eax, dword [0x66bb0c]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x4301b9
dec dword [eax + 0x36c]
push dword [0x66bb08]
push ecx
call dword [0x4ff1c0]
add esp, 8
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00432a60
Function at 0x436dd0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x5e6ea9af
push esi
mov esi, edx
mov ecx, 1
mul ebx
push edi
shr edx, 0xb
xor edi, edi
imul eax, edx, 0x15b0
mov edx, ebx
mov dword [ebp - 0x10], edi
sub edx, eax
mov dword [ebp - 4], edx
test ebx, ebx
je 0x436f08
xor ebx, ebx
cmp edx, 7
jbe 0x436e69
mov eax, 7
sub eax, esi
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
add ebx, 8
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add esi, 8
add ecx, eax
mov eax, dword [ebp - 0x10]
add eax, esi
add edi, ecx
cmp eax, edx
jb 0x436e18
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
cmp ebx, eax
jae 0x436ecd
sub eax, ebx
cmp eax, 2
jb 0x436eb9
mov edx, dword [ebp - 4]
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea ebx, [ebx + edx*2]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 8]
mov edi, ebx
movzx eax, byte [esi]
add ecx, eax
movzx eax, byte [esi + 1]
add ebx, ecx
add esi, 2
add ecx, eax
add edi, ecx
dec edx
jne 0x436e95
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
cmp ebx, dword [ebp - 4]
jae 0x436ec6
movzx eax, byte [esi]
add ecx, eax
add edi, ecx
inc esi
mov eax, dword [ebp - 0xc]
add eax, edx
add edi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, dword [ebp - 4]
add edi, eax
sub dword [ebp + 8], edx
mov edx, 0x15b0
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edx
jne 0x436e07
shl edi, 0x10
lea eax, [ecx + edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x517748]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x66bb0c]
lea eax, [ebp - 0x18]
push edi
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x4380cc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0564
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4380b9
mov eax, dword [0x66bb0c]
test eax, eax
je 0x4380e9
inc dword [eax + 0x36c]
push dword [0x66bb08]
push 0x38
call dword [0x4ff1c8]
mov edi, eax
add esp, 8
test edi, edi
je 0x43810f
push 0x38
push 0
push edi
call fcn.004c6800
add esp, 0xc
jmp 0x438111
xor edi, edi
or dword [esi + 0xc], 6
mov dword [esi + 0xc4], edi
mov dword [esi + 0xbc], str.imgui_impl_win32
mov dword [edi], ebx
mov byte [edi + 0x25], 1
mov eax, dword [ebp - 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x14], eax
mov dword [edi + 0x20], 9
mov dword [esi + 0xe0], ebx
mov dword [esi + 0x34], 9
mov dword [esi + 0x38], 0x25
mov dword [esi + 0x3c], 0x27
mov dword [esi + 0x40], 0x26
mov dword [esi + 0x44], 0x28
mov dword [esi + 0x48], 0x21
mov dword [esi + 0x4c], 0x22
mov dword [esi + 0x50], 0x24
mov dword [esi + 0x54], 0x23
mov dword [esi + 0x58], 0x2d
mov dword [esi + 0x5c], 0x2e
mov dword [esi + 0x60], 8
mov dword [esi + 0x64], 0x20
mov dword [esi + 0x68], 0xd
mov dword [esi + 0x6c], 0x1b
mov dword [esi + 0x70], 0xd
mov dword [esi + 0x74], 0x41
mov dword [esi + 0x78], 0x43
mov dword [esi + 0x7c], 0x56
mov dword [esi + 0x80], 0x58
mov dword [esi + 0x84], 0x59
mov dword [esi + 0x88], 0x5a
xor esi, esi
mov dword [ebp - 0x2c], str.xinput1_4.dll
mov dword [ebp - 0x28], str.xinput1_3.dll
mov dword [ebp - 0x24], str.xinput9_1_0.dll
mov dword [ebp - 0x20], str.xinput1_2.dll
mov dword [ebp - 0x1c], str.xinput1_1.dll
jmp 0x438220
push dword [ebp + esi*4 - 0x2c]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x438249
inc esi
cmp esi, 5
jl 0x438220
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0564
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x28], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x2c], eax
call esi
mov ecx, dword [ebp - 4]
mov dword [edi + 0x30], eax
xor ecx, ebp
pop edi
pop esi
mov al, 1
pop ebx
call fcn.004c0564
mov esp, ebp
pop ebp
ret
Function at 0x439160
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xorps xmm0, xmm0
mov dword [ebp - 4], ecx
push edi
movdqu xmmword [ebp - 0x28], xmm0
or eax, 0xffffffff
mov dword [ebp - 0x28], str.Table
movdqu xmmword [ebp - 0x18], xmm0
mov bl, 0x54
mov esi, 0x50740d
or edi, 0xffffffff
lea ecx, [ecx]
cmp bl, 0x23
jne 0x43919f
cmp byte [esi], bl
jne 0x43919f
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x4ff310]
test bl, bl
jne 0x439190
mov esi, dword [ebp - 4]
not eax
add esi, 0x2f70
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x438940
mov dword [ebp - 0x18], 0x438a20
mov dword [ebp - 0x14], 0x438b00
mov ecx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x10], 0x4389d0
mov dword [ebp - 0xc], 0x438d60
cmp ecx, edi
jne 0x439214
inc ecx
test edi, edi
je 0x439202
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
jmp 0x439207
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00428680
mov eax, dword [esi]
movdqu xmm0, xmmword [ebp - 0x28]
pop edi
lea ecx, [eax + eax*8]
mov eax, dword [esi + 8]
movdqu xmmword [eax + ecx*4], xmm0
movdqu xmm0, xmmword [ebp - 0x18]
movdqu xmmword [eax + ecx*4 + 0x10], xmm0
mov dword [eax + ecx*4 + 0x20], 0
inc dword [esi]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e430
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x24], ecx
jle 0x43e618
mov eax, dword [ebp + 8]
push ebx
push esi
add eax, 2
push edi
nop
xor esi, esi
movzx edx, byte [eax - 2]
movzx ecx, byte [eax - 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 1]
shl edx, 8
add eax, 4
or edx, ecx
mov dword [ebp + esi*4 - 0x12c], edx
inc esi
cmp esi, 0x10
jl 0x43e452
mov dword [ebp - 0x2c], eax
lea ebx, [ebp - 0xf4]
mov eax, 0x30
mov edi, edi
mov edx, dword [ebx]
lea ebx, [ebx + 4]
mov esi, dword [ebx - 0x38]
mov edi, edx
mov ecx, edx
rol edi, 0xf
rol ecx, 0xd
xor edi, ecx
shr edx, 0xa
xor edi, edx
mov ecx, esi
mov edx, esi
ror ecx, 7
rol edx, 0xe
xor edx, ecx
shr esi, 3
xor edx, esi
add edi, edx
add edi, dword [ebx - 0x3c]
add edi, dword [ebx - 0x18]
mov dword [ebx + 4], edi
dec eax
jne 0x43e490
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x20], 0
mov eax, dword [ebx + 0x88]
mov esi, eax
mov ecx, dword [ebx + 0x8c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x90]
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x94]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x9c]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0xa0]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0xa4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebx + 0x98]
mov ebx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], esi
mov dword [ebp - 0x18], ecx
mov edi, ebx
ror esi, 0xd
ror edi, 0xb
mov ecx, ebx
rol ecx, 7
mov edx, ebx
xor edi, ecx
not edx
and edx, dword [ebp - 0xc]
mov ecx, ebx
ror ecx, 6
xor edi, ecx
mov ecx, dword [ebp - 4]
and ecx, ebx
xor edx, ecx
mov ecx, dword [ebp - 0x20]
add edi, edx
add edi, dword [ecx + 0x503390]
add edi, dword [ebp + ecx - 0x12c]
mov ecx, dword [ebp - 8]
add edi, dword [ebp - 0x14]
rol ecx, 0xa
xor esi, ecx
mov ecx, dword [ebp - 8]
ror ecx, 2
xor esi, ecx
mov ecx, dword [ebp - 0x1c]
mov edx, ecx
and ecx, dword [ebp + 8]
xor edx, dword [ebp + 8]
and edx, dword [ebp - 8]
xor edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
add esi, edx
mov ecx, dword [ebp - 4]
add esi, edi
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
add ebx, edi
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + 8], ecx
mov ecx, dword [ebp - 0x20]
add ecx, 4
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], ecx
cmp ecx, 0x100
jl 0x43e524
mov ecx, dword [ebp - 0x28]
add ecx, esi
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x24]
mov dword [ebx + 0x88], ecx
mov ecx, dword [ebp + 8]
add dword [ebx + 0x90], ecx
mov ecx, dword [ebp - 0x10]
add dword [ebx + 0x94], ecx
mov ecx, dword [ebp - 0x18]
add dword [ebx + 0x98], ecx
mov ecx, dword [ebp - 4]
add dword [ebx + 0x9c], ecx
mov ecx, dword [ebp - 0xc]
add dword [ebx + 0xa0], ecx
mov ecx, dword [ebp - 0x14]
add dword [ebx + 0x8c], edx
add dword [ebx + 0xa4], ecx
dec dword [ebp + 0xc]
jne 0x43e450
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43e890
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f6658
mov eax, dword fs:[0]
push eax
sub esp, 0x1c0
mov eax, dword [0x517748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x124], 0
mov dword [ebp - 4], 0
lea esi, [ebp - 0x1cc]
cmp dword [ebp + 0x1c], 0x10
lea edi, [ebp - 0x11c]
push dword [ebp + 0x18]
mov ecx, 0x2a
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
xorps xmm0, xmm0
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x94], 0x6a09e667
movdqu xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x90], 0xbb67ae85
movdqu xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x8c], 0x3c6ef372
mov dword [ebp - 0x88], 0xa54ff53a
mov dword [ebp - 0x84], 0x510e527f
mov dword [ebp - 0x80], 0x9b05688c
mov dword [ebp - 0x7c], 0x1f83d9ab
mov dword [ebp - 0x78], 0x5be0cd19
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x11c], 0
call fcn.0043e620
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x11c]
call fcn.0043e6c0
mov byte [ebp - 0x34], 0
lea edi, [ebp - 0x74]
xor esi, esi
movzx eax, byte [ebp + esi - 0x30]
push eax
push str._02x
push edi
call fcn.004c0ec3
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x20
jb 0x43e981
mov esi, dword [ebp - 0x120]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x74], 0
jne 0x43e9bf
xor ecx, ecx
jmp 0x43e9ce
lea ecx, [ebp - 0x74]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43e9c5
sub ecx, edx
push ecx
lea eax, [ebp - 0x74]
mov ecx, esi
push eax
call fcn.00401970
cmp dword [ebp + 0x1c], 0x10
jb 0x43e9eb
push dword [ebp + 8]
call fcn.00440f10
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c0564
mov esp, ebp
pop ebp
ret
Function at 0x443dd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [edi], 0
cmp dword [0x668758], 0
je 0x443e27
mov eax, dword [0x66bb18]
test eax, eax
je 0x443e00
push eax
call dword [0x6687b0]
add esp, 4
lea edx, [ebp - 4]
mov ecx, 0x14
call fcn.004415b0
mov eax, dword [0x66bb18]
test eax, eax
je 0x443e22
push eax
call dword [0x6687b8]
mov esi, dword [ebp - 4]
jmp 0x443e31
mov esi, dword [ebp - 4]
jmp 0x443e34
push 0x14
call dword [0x668780]
mov esi, eax
add esp, 4
test esi, esi
jne 0x443e42
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x66875c], 0
mov ebx, dword [ebp + 8]
je 0x443e8c
mov eax, dword [0x668860]
test eax, eax
je 0x443e65
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x443e8c
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x443da0
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.004c4fe9
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x443e9a
xorps xmm0, xmm0
movdqu xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x443eb3
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp - 8]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], edx
xor ebx, ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], ebx
test edi, edi
je 0x457949
cmp byte [edi + 9], bl
je 0x457776
inc dword [edi + 0xc]
cmp byte [edi + 0xa], bl
jne 0x457776
call fcn.00453c20
mov esi, dword [edi + 4]
mov esi, dword [esi + 8]
test esi, esi
je 0x457937
cmp dword [ebp + 8], 0
je 0x4577ef
test byte [esi + 0x40], 1
jne 0x4577ef
mov al, byte [esi + 0x42]
cmp al, 1
je 0x45779f
cmp al, 2
jne 0x457860
cmp al, 2
jne 0x4577a9
mov byte [esi + 0x42], 1
jmp 0x4577b0
mov dword [esi + 0x3c], 0
mov ecx, esi
call fcn.004540f0
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
jne 0x4577cc
mov ecx, esi
call fcn.00454020
mov byte [esi + 0x42], 3
and byte [esi + 0x40], 0xf1
test ebx, ebx
je 0x457860
mov edi, dword [esp + 0x20]
mov edx, ebx
push 0
mov ecx, edi
call fcn.00457740
add esp, 4
jmp 0x457937
mov edi, dword [esi + 0x30]
test edi, edi
je 0x45784e
cmp dword [0x668758], 0
je 0x457844
mov eax, dword [0x66bb18]
test eax, eax
je 0x457812
push eax
call dword [0x6687b0]
add esp, 4
push edi
call dword [0x66878c]
sub dword [0x66bb50], eax
add esp, 4
dec dword [0x66bb74]
push edi
call dword [0x668784]
mov eax, dword [0x66bb18]
add esp, 4
test eax, eax
je 0x45784e
push eax
call dword [0x6687b8]
jmp 0x45784b
push edi
call dword [0x668784]
add esp, 4
mov eax, dword [esp + 0x24]
mov dword [esi + 0x30], 0
mov byte [esi + 0x42], 4
mov dword [esi + 0x3c], eax
cmp byte [esi + 0x44], 0
mov dword [esp + 0x14], 0
jl 0x457924
lea edi, [esi + 0x78]
mov dword [esp + 0x18], edi
lea esp, [esp]
mov ecx, dword [edi]
test ecx, ecx
je 0x457902
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x18], 0x20
mov ebx, dword [ecx + 0x10]
mov dword [esp + 0x10], ebx
je 0x4578e1
dec dword [ebx + 0x80]
mov eax, dword [ebx + 0x90]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x10]
mov edi, dword [ebx + 0x40]
mov dword [ebx + 0x90], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0xa0]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004c88c0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
mov ebx, dword [esp + 0x20]
add esp, 0x10
mov edi, dword [esp + 0x18]
jmp 0x4578e6
call fcn.00449e00
cmp dword [ebx + 0x80], 0
jne 0x457902
mov eax, dword [ebx + 0xd4]
cmp dword [eax + 0xc], 0
jne 0x457902
mov ecx, ebx
call fcn.0044cb20
mov ecx, dword [esp + 0x14]
mov dword [edi], 0
inc ecx
movsx eax, byte [esi + 0x44]
add edi, 4
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edi
cmp ecx, eax
jle 0x457880
mov esi, dword [esi + 8]
test esi, esi
jne 0x457784
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
cmp byte [edi + 9], 0
je 0x457949
dec dword [edi + 0xc]
jne 0x457949
mov ecx, edi
call fcn.00453be0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov al, byte [esi + 0x42]
cmp al, 3
jb 0x458394
cmp al, 4
jne 0x458383
mov eax, dword [esi + 0x3c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x30]
call fcn.004419d0
add esp, 4
mov dword [esi + 0x30], ebx
mov byte [esi + 0x42], bl
mov al, byte [esi + 0x44]
test al, al
js 0x45843a
je 0x458482
mov cl, byte [esi + 0x44]
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x20
mov ebx, dword [ecx + 0x10]
mov dword [esp + 0xc], ebx
je 0x45840b
dec dword [ebx + 0x80]
mov eax, dword [ebx + 0x90]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0xc]
mov edi, dword [ebx + 0x40]
mov dword [ebx + 0x90], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0xa0]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004c88c0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
mov ebx, dword [esp + 0x1c]
add esp, 0x10
jmp 0x458410
call fcn.00449e00
cmp dword [ebx + 0x80], 0
jne 0x45842c
mov eax, dword [ebx + 0xd4]
cmp dword [eax + 0xc], 0
jne 0x45842c
mov ecx, ebx
call fcn.0044cb20
cmp byte [esi + 0x44], 0
jne 0x4583a5
xor ebx, ebx
jmp 0x458482
mov edx, dword [esi + 0x34]
test edx, edx
jne 0x45844d
mov byte [esi + 0x42], bl
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [esi + 0x41]
lea edi, [esi + 0x78]
mov ecx, dword [esi]
push eax
push 0
push edi
mov ecx, dword [ecx + 4]
call fcn.00455720
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x458476
mov byte [esi + 0x42], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x44], 0
mov eax, dword [edi]
mov al, byte [eax + 2]
mov byte [esi + 0x45], al
mov edx, dword [esi + 0x78]
cmp byte [edx], 0
je 0x458504
movzx eax, byte [edx + 2]
xor ecx, ecx
cmp dword [esi + 0x48], ecx
sete cl
cmp ecx, eax
jne 0x458504
xor eax, eax
mov word [esi + 0x50], ax
and byte [esi + 0x40], 0xf1
mov word [esi + 0x22], ax
cmp word [edx + 0x12], ax
jbe 0x4584bb
mov byte [esi + 0x42], 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edx + 4], al
jne 0x4584f8
cmp dword [edx + 0x54], 1
je 0x4584d7
mov ecx, 0xf94e
call fcn.004bda20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [edx + 5]
mov eax, dword [edx + 0x38]
mov edx, dword [ecx + eax + 8]
mov ecx, esi
bswap edx
mov byte [esi + 0x42], 1
call fcn.004582f0
mov ebx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x42], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x50b368
push 0xf942
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.00443bc0
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret