joyce8/EMBER2024-capa huggingface dataset:
Function at 0x559110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c5dfb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6f405c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
xor edi, edi
mov dword [esi], vtable.CSkillObjectTargetList.0
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
push 1
mov dword [ebp - 4], edi
call fcn.004d4860
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0xb7]
mov word [esi + 0x30], cx
movzx edx, word [eax + 0xad]
mov word [esi + 0x32], dx
mov dword [esi + 0x2c], edi
movzx ecx, word [eax + 0x27]
mov word [esi + 0x34], cx
movzx edx, word [eax + 0x29]
mov word [esi + 0x36], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x563c10
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [esi + 0x4c]
add eax, 0x493e0
cmp edi, eax
jbe 0x563c3d
mov ecx, esi
call fcn.00563bd0
push 0x5dcd68
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esi + 0x4c], edi
pop edi
pop esi
ret

Function at 0x563ee0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c643e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6f405c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
xor edi, edi
mov dword [esi], vtable.CMHAudioManager.0
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
mov dword [0x730850], edi
push 0x20
mov dword [ebp - 4], edi
mov dword [esi + 0x46], edi
call fcn.004d4860
fld1
xor eax, eax
fst dword [esi + 0x28]
fst dword [esi + 0x2c]
mov word [esi + 0x40], ax
fstp dword [esi + 0x30]
mov dword [esi + 0x34], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x566e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
cmp dword [eax], 0x10
je 0x566f7f
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
push 0x92
mov dword [ebp + 8], esi
add esi, 0x358
push 0
push esi
call fcn.0059e5b0
add esp, 0xc
mov ecx, edi
call fcn.00565090
push 0
mov ecx, edi
call fcn.005650a0
test eax, eax
je 0x566f67
push ebx
jmp 0x566e50
mov edi, dword [eax]
mov ecx, eax
call fcn.00564ce0
mov ecx, dword [ebp + 8]
mov bl, al
add bl, byte [ecx + 0x528]
mov ecx, 0x7308b0
mov byte [ebp - 4], bl
mov edx, dword [ebp - 4]
push edx
call fcn.00566520
test eax, eax
je case.0x566e94.10
movzx ecx, word [edi + 0x2c]
add ecx, 0xfffffffd
cmp ecx, 0x75
ja case.0x566e94.10
movzx ecx, byte [ecx + 0x566fcc]
jmp dword [ecx*4 + 0x566f88]
movzx edx, word [edi + 0x2e]
mov eax, dword [eax]
mov dword [esi + edx*4 - 4], eax
jmp case.0x566e94.10
movzx ecx, word [edi + 0x2e]
fld dword [eax + 8]
fstp dword [ebp - 8]
test cx, cx
je case.0x566e94.10
fld dword [eax + 4]
fstp dword [esi + ecx*4 + 0x24]
fld dword [ebp - 8]
fstp dword [esi + ecx*4 + 0x3c]
jmp case.0x566e94.10
mov ecx, dword [eax + 0xc]
mov dword [esi + 0x5c], ecx
jmp case.0x566e94.10
mov edx, dword [eax + 0x10]
mov dword [esi + 0x58], edx
jmp case.0x566e94.10
mov eax, dword [eax + 0x14]
mov dword [esi + 0x60], eax
jmp case.0x566e94.10
mov ecx, dword [eax + 0x18]
mov dword [esi + 0x64], ecx
jmp case.0x566e94.10
mov edx, dword [eax + 0x1c]
mov dword [esi + 0x68], edx
jmp case.0x566e94.10
mov eax, dword [eax + 0x20]
mov dword [esi + 0x6c], eax
jmp case.0x566e94.10
mov ecx, dword [eax + 0x20]
mov dword [esi + 0x70], ecx
jmp case.0x566e94.10
mov edx, dword [eax + 0x20]
mov dword [esi + 0x74], edx
jmp case.0x566e94.10
mov eax, dword [eax + 0x20]
mov dword [esi + 0x78], eax
jmp case.0x566e94.10
fld dword [eax + 0x24]
movzx ecx, bl
fstp dword [esi + 0x7c]
mov word [esi + 0x80], cx
jmp case.0x566e94.10
fld dword [eax + 0x28]
fstp dword [esi + 0x82]
jmp case.0x566e94.10
mov edx, dword [eax + 0x2c]
mov dword [esi + 0x86], edx
jmp case.0x566e94.10
mov eax, dword [eax + 0x30]
mov dword [esi + 0x8a], eax
jmp case.0x566e94.10
mov ecx, dword [eax + 0x34]
mov dword [esi + 0x8e], ecx
mov ecx, dword [ebp + 0x10]
push 0
call fcn.005650a0
test eax, eax
jne 0x566e50
pop ebx
mov ecx, dword [0x6f62d4]
call fcn.0044faf0
mov ecx, dword [0x6f62d4]
call fcn.0044f7b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x568e20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x1f2]
test ecx, ecx
jne 0x568e33
xor eax, eax
pop ebp
ret 8
pop ebp
jmp fcn.0056ce10
Function at 0x56a520
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x1f2], 0
push edi
je 0x56a5cd
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x56a5cd
push 0
push 1
push 0x730978
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x56a5cd
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [0x730924], ecx
mov edx, dword [eax + 4]
mov dword [0x730928], edx
mov eax, dword [eax + 8]
mov dword [0x73092c], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [0x730918], ecx
mov edx, dword [eax + 4]
mov dword [0x73091c], edx
mov eax, dword [eax + 8]
mov edx, dword [ebp + 0x14]
mov dword [0x730920], eax
mov ecx, dword [esi + 0x1f2]
lea eax, [ebp + 0x10]
push eax
push 0
push 0
push 0x56a490
push 0
push 0
mov dword [0x730974], ecx
mov dword [0x730970], edi
mov dword [0x6f2b84], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x56a5d5
push eax
push 0x730978
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x574d90
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c6e20
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6f405c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi], vtable.CEffectManager.0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
push fcn.00574540
push 0x5741f0
push 2
mov dword [ebp - 4], eax
push 0xc
lea eax, [esi + 0x34]
push eax
call fcn.005a0a7c
xor eax, eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
push 0xa
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 2
call fcn.00598c60
push 0x20
lea ecx, [esi + 4]
mov byte [ebp - 4], 3
call fcn.004d4860
push 0x20
lea ecx, [esi + 0x4c]
call fcn.004d4860
push 0x190
call fcn.0059e640
xor edi, edi
add esp, 4
cmp eax, edi
je 0x574e4e
mov dword [eax], vtable.CMemoryPoolTempl_class_CDamageNumber_.0
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov byte [eax + 0x10], 0
jmp 0x574e50
xor eax, eax
push 0x190
mov dword [esi + 0x2c], eax
call fcn.0059e640
add esp, 4
cmp eax, edi
je 0x574e76
mov dword [eax], vtable.CMemoryPoolTempl_class_CEffect_.0
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov byte [eax + 0x10], 0
jmp 0x574e78
xor eax, eax
mov edi, dword [esi + 0x2c]
push 0x80
lea ecx, [edi + 0x10]
push str.CDamageNumber
push ecx
mov dword [esi + 0x28], eax
call fcn.005a06e0
lea ebx, [edi + 4]
add esp, 0xc
cmp dword [ebx], 0
mov dword [edi + 0xc], 0x28
jne 0x574eb3
push 0x3c
push ebx
call fcn.00575f10
mov edx, dword [ebx]
add esp, 8
mov dword [edi + 8], edx
mov edi, dword [esi + 0x28]
push 0x80
lea eax, [edi + 0x10]
push str.CEffect
push eax
call fcn.005a06e0
lea ebx, [edi + 4]
add esp, 0xc
cmp dword [ebx], 0
mov dword [edi + 0xc], 0x32
jne 0x574eeb
push 0x64
push ebx
call fcn.00576030
mov ecx, dword [ebx]
add esp, 8
mov dword [edi + 8], ecx
mov eax, esi
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57f230
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp esi, 0x12
jb 0x57f250
push 0
push 0x72
push str.DirectoryManager.cpp
call fcn.0053e8b0
add esp, 0xc
cmp esi, dword [edi + 0x50]
je 0x57f268
cmp esi, 0x11
je 0x57f268
mov eax, dword [edi + esi*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [edi + 0x50], esi
pop edi
pop esi
pop ebp
ret 4

Function at 0x586ce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c787e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6f405c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
push 0x40
mov byte [ebp - 4], 2
call fcn.004d4860
push 0x40
lea ecx, [esi + 0x24]
call fcn.004d4860
push 0x40
lea ecx, [esi + 0x48]
call fcn.004d4860
mov ecx, esi
call fcn.00586840
mov ecx, esi
call fcn.005866a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x597990
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74c
mov eax, dword [0x6f405c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x74c], ecx
cmp dword [ebp + 8], 0
jne 0x5979b6
xor eax, eax
jmp 0x597c1b
cmp dword [ebp + 0xc], 0
jne 0x5979c3
xor eax, eax
jmp 0x597c1b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x744], eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 1
lea edx, [ebp - 0x331]
push edx
call fcn.0059ef2b
add esp, 0x10
mov eax, dword [ebp - 0x74c]
add eax, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0x33c], 0
push 0x200
push 0
lea ecx, [ebp - 0x330]
push ecx
call fcn.0059e5b0
add esp, 0xc
lea edx, [ebp - 0x130]
push edx
push str._02X
mov eax, dword [ebp - 4]
push eax
call fcn.005a06b6
add esp, 0xc
test eax, eax
jle 0x597a64
cmp dword [ebp - 0x33c], 0x200
jge 0x597a64
mov ecx, dword [ebp - 0x33c]
mov dl, byte [ebp - 0x130]
mov byte [ebp + ecx - 0x330], dl
mov eax, dword [ebp - 0x33c]
add eax, 1
mov dword [ebp - 0x33c], eax
mov ecx, dword [ebp - 4]
add ecx, 2
mov dword [ebp - 4], ecx
jmp 0x597a0f
push 0x100
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x128]
push eax
call fcn.00596430
add esp, 0xc
mov cl, byte [ebp + 0x14]
mov byte [ebp - 5], cl
mov dword [ebp - 0x338], 0
jmp 0x597aa0
mov edx, dword [ebp - 0x338]
add edx, 0x10
mov dword [ebp - 0x338], edx
mov eax, dword [ebp - 0x338]
cmp eax, dword [ebp - 0x744]
jge 0x597b9a
mov ecx, dword [ebp + 8]
push ecx
push 0x10
push 1
lea edx, [ebp - 0x740]
push edx
call fcn.0059ef2b
add esp, 0x10
cmp eax, 0x10
je 0x597b15
push 0
push str.Error__
push str.Header_Version_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
push 0
lea eax, [ebp - 0x740]
push eax
call fcn.0059e5b0
add esp, 0xc
push 0x118
push 0
lea ecx, [ebp - 0x128]
push ecx
call fcn.0059e5b0
add esp, 0xc
xor eax, eax
jmp 0x597c1b
lea edx, [ebp - 0x740]
push edx
lea eax, [ebp - 0x740]
push eax
push 0
lea ecx, [ebp - 0x128]
push ecx
call fcn.00596730
add esp, 0x10
mov dword [ebp - 0x748], 0
jmp 0x597b4f
mov edx, dword [ebp - 0x748]
add edx, 1
mov dword [ebp - 0x748], edx
cmp dword [ebp - 0x748], 0x10
jge 0x597b95
mov eax, dword [ebp - 0x338]
add eax, dword [ebp - 0x748]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x748]
mov dl, byte [ebp + edx - 0x740]
mov byte [ecx + eax], dl
movsx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x338]
add ecx, dword [ebp - 0x748]
mov edx, dword [ebp + 0xc]
movsx ecx, byte [edx + ecx]
add eax, ecx
mov byte [ebp - 5], al
jmp 0x597b40
jmp 0x597a91
mov edx, dword [ebp + 8]
push edx
push 1
push 1
lea eax, [ebp - 0x129]
push eax
call fcn.0059ef2b
add esp, 0x10
movsx ecx, byte [ebp - 0x331]
movsx edx, byte [ebp - 0x129]
cmp ecx, edx
jne 0x597bd2
movsx eax, byte [ebp - 0x331]
movsx ecx, byte [ebp - 5]
cmp eax, ecx
je 0x597c16
push 0
push str.Error__
push str.Header_Version_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
push 0
lea edx, [ebp - 0x740]
push edx
call fcn.0059e5b0
add esp, 0xc
push 0x118
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.0059e5b0
add esp, 0xc
xor eax, eax
jmp 0x597c1b
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0059e593
mov esp, ebp
pop ebp
ret 0x10
Function at 0x59e593
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6f405c]
jne 0x59e59d
repz ret
jmp fcn.005a6b1c

Function at 0x5ac563
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6f405c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.005a6515
and dword [ebp - 0x14], 0
cmp dword [0x733f5c], 0
mov dword [ebp - 0x18], eax
jne 0x5ac616
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x5ac6be
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x5ac6be
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5e09b4
push ebx
mov dword [0x733f5c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x733f60], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x733f64], eax
call edi
push eax
call esi
mov dword [0x733f6c], eax
test eax, eax
je 0x5ac616
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x733f68], eax
mov eax, dword [0x733f68]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x5ac66f
cmp dword [0x733f6c], ecx
je 0x5ac66f
push eax
call esi
push dword [0x733f6c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x5ac66f
test ebx, ebx
je 0x5ac66f
call edi
test eax, eax
je 0x5ac666
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x5ac666
test byte [ebp - 8], 1
jne 0x5ac66f
or dword [ebp + 0x10], 0x200000
jmp 0x5ac6a2
mov eax, dword [0x733f60]
cmp eax, dword [ebp - 0x18]
je 0x5ac6a2
push eax
call esi
test eax, eax
je 0x5ac6a2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5ac6a2
mov eax, dword [0x733f64]
cmp eax, dword [ebp - 0x18]
je 0x5ac6a2
push eax
call esi
test eax, eax
je 0x5ac6a2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x733f5c]
call esi
test eax, eax
je 0x5ac6be
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x5ac6c0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059e593
leave
ret
Function at 0x403436
Capabilities:
Terminate process

Disassembly:
jmp 0x44d4ae
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x44d4bf
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004055ec
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403558
Capabilities:
Query environment variable

Disassembly:
jmp 0x48d974
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x48d988
xor edi, edi
jmp 0x48d9bf
push ebx
push esi
call fcn.0048d87e
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403dc3
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x48d9af
push ebx
push esi
push edi
call fcn.004053d0
add esp, 0xc
push 0
call fcn.00405ede
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x40548e
Capabilities:
Parse pe header

Disassembly:
jmp 0x43df6d
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43dfad
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43dfad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43dfad
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43dfad
cmp dword [ecx + 0x74], 0xe
jbe 0x43dfad
cmp dword [ecx + 0xe8], 0
je 0x43dfad
mov al, 1
ret
xor al, al
ret
Function at 0xe502f1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xe48410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
test eax, eax
jne 0xe50314
push ebx
call dword [0xe6101c]
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [ebp - 0xc], 0x646f632e
mov dword [ebp - 8], 0x65
movzx edi, word [esi + 0x14]
push dword [esi + 0x88]
add edi, 0x18
push esi
add edi, esi
call fcn.00e49824
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0xe503bd
movzx edx, word [esi + 6]
xor ecx, ecx
test edx, edx
jle 0xe5036a
lea eax, [ebp - 0xc]
mov eax, dword [eax]
cmp eax, dword [edi]
jne 0xe50362
lea eax, [ebp - 0xc]
mov eax, dword [eax + 4]
cmp eax, dword [edi + 4]
je 0xe5036a
add edi, 0x28
inc ecx
cmp ecx, edx
jl 0xe5034e
cmp ecx, edx
je 0xe503bd
mov ecx, dword [esi + 0x34]
add ecx, dword [edi + 0xc]
mov edi, 0xe49e30
xor edx, edx
mov eax, dword [ecx + edx*4]
cmp eax, dword [edi + edx*4]
jne 0xe503bd
inc edx
cmp edx, 4
jne 0xe5037b
xor edx, edx
mov eax, dword [ecx + edx*4 + 0x140]
cmp eax, dword [edi + edx*4]
jne 0xe503bd
inc edx
cmp edx, 4
jne 0xe5038b
cmp dword [ecx + 0x124], 0
je 0xe503ad
push 0xe5067c
jmp 0xe503b2
push 0xe50661
push esi
push ebx
push ecx
call fcn.00e503ce
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00e51d46
mov esp, ebp
pop ebp
ret
Function at 0xe90b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.00ea4670
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
call fcn.00ea3ef0
add eax, ebx
push eax
call dword [0x100df290]
test eax, eax
jne 0xe90c55
mov ecx, esi
call fcn.00ea3ef0
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax + ebx + 8]
mov edi, dword [eax + ebx + 0xc]
call fcn.00ea3ef0
mov ecx, dword [esp + 0x2c]
add eax, ebx
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebx
call fcn.00ea3ef0
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov edx, esp
mov ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx], ebx
mov dword [edx + 0xc], eax
call fcn.00ea3ef0
mov ebx, dword [esp + 0x20]
lea ecx, [ebx + eax]
call fcn.00e8e380
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov esi, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], edi
call fcn.00ea3ef0
lea ecx, [ebx + eax]
call fcn.00e8e380
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.00ea3ef0
add eax, dword [esp + 0x20]
mov ecx, eax
call fcn.00e8e380
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
call fcn.00ea3d20
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
jmp fcn.00ea51c0

Function at 0xe90c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.00ea4670
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
call fcn.00ea3ef0
add eax, ebx
push eax
call dword [0x100df290]
test eax, eax
jne 0xe90d55
mov ecx, esi
call fcn.00ea3ef0
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax + ebx + 8]
mov edi, dword [eax + ebx + 0xc]
call fcn.00ea3ef0
mov ecx, dword [esp + 0x2c]
add eax, ebx
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebx
call fcn.00ea3ef0
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov edx, esp
mov ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx], ebx
mov dword [edx + 0xc], eax
call fcn.00ea3ef0
mov ebx, dword [esp + 0x20]
lea ecx, [ebx + eax]
call fcn.00e8e420
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov esi, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], edi
call fcn.00ea3ef0
lea ecx, [ebx + eax]
call fcn.00e8e420
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.00ea3ef0
add eax, dword [esp + 0x20]
mov ecx, eax
call fcn.00e8e420
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
call fcn.00ea3d20
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
jmp fcn.00ea51c0