joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4076e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x40772c
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x40770f
cmp edi, 2
jb 0x40770f
cmp byte [esi], cl
jne 0x40770f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4578b8]
test edi, edi
jne 0x4076f5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x40775b
cmp cl, 0x23
jne 0x407742
cmp byte [esi], cl
jne 0x407742
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4578b8]
test cl, cl
jne 0x407733
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x4078a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4078b3
mov dword [edi], 0
mov edx, 0x4574ac
call fcn.00407770
mov esi, eax
test esi, esi
je 0x40796b
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x407961
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x407961
push esi
call ebx
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x407961
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x407961
mov ecx, ebx
call fcn.0040b000
mov dword [ebp + 8], eax
test eax, eax
je 0x407961
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x40794a
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [ebp + 8]
add esp, 4
call fcn.0040b0a0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x407959
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x40a570
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x46300c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 4
mov eax, dword [edi + 0xec]
mov ebx, dword [edi + 0xf4]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4578b8]
sub esi, 1
jne 0x40a5b0
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3fc4], ebx
jne 0x40a5e7
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.0041d9a0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452309
mov esp, ebp
pop ebp
ret 4

Function at 0x40a600
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x46300c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x18]
mov edi, 0x10
movss xmm1, dword [edx + 0x108]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x10c]
subss xmm0, xmm1
mov ecx, dword [edx + 0xec]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xf4]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 0xc], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4578b8]
sub edi, 1
jne 0x40a680
mov ecx, dword [ebp - 8]
not edx
pop edi
xor ecx, ebp
mov eax, edx
pop esi
call fcn.00452309
mov esp, ebp
pop ebp
ret 4
Function at 0x40e020
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x46300c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [0x463880]
mov ebx, edx
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [esi + 0x3f8c]
mov ecx, edi
mov eax, dword [esi + 0x4954]
or eax, 0x100
mov dword [esi + 0x498c], 1
mov dword [esi + 0x4954], eax
cmp dword [edi + 0x198], 0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
jne 0x40e081
cmp dword [esi + 0x4ce0], 0
mov eax, 0x234
je 0x40e086
mov eax, 0x204
movss xmm1, dword [edi + eax]
movss xmm2, dword [edi + eax + 4]
mov eax, dword [ebp + 8]
subss xmm2, dword [ecx + 0xfc]
subss xmm1, dword [ecx + 0xf8]
lea ecx, [ebp - 0x24]
push dword [eax + 4]
push dword [eax]
call fcn.00416a60
mov eax, dword [ebp - 0x14]
add esp, 8
mov ecx, dword [ebp - 0x20]
or eax, 2
mov dword [esi + 0x4954], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x4978], ecx
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x4974], eax
mov dword [esi + 0x495c], 1
mov eax, dword [edi + 4]
push ebx
test ecx, ecx
je 0x40e0fe
push ecx
push eax
push str._s__s__08X
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004075b0
add esp, 0x18
jmp 0x40e112
push eax
push str._s__08X
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004075b0
add esp, 0x14
movss xmm0, dword [esi + 0x38d8]
xor edx, edx
mov ecx, dword [ebp - 0x14]
push 0x1000107
movss dword [ebp - 0x10], xmm0
call fcn.00410da0
mov edi, dword [esi + 0x3f8c]
add esp, 4
movss xmm0, dword [ebp - 0x10]
movss dword [esi + 0x38d8], xmm0
mov byte [ebp - 9], al
cmp word [edi + 0xbc], 1
mov dword [ebp - 0x10], edi
mov dword [edi + 0x78], ebx
jne 0x40e16c
mov eax, dword [ebp - 0x18]
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x1c]
mov dword [eax + 0xf8], ecx
mov dword [eax + 0xfc], edx
mov edi, ebx
mov edx, 0x4568f1
not edi
mov al, 0x23
mov ebx, edi
nop dword [eax]
cmp al, 0x23
jne 0x40e18e
cmp byte [edx], al
jne 0x40e18e
cmp byte [edx + 1], al
cmove ebx, edi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x4578b8]
test al, al
jne 0x40e180
mov edi, dword [ebp - 0x10]
not ebx
cmp dword [esi + 0x3fdc], ebx
jne 0x40e1bd
xor edx, edx
xor ecx, ecx
call fcn.0040a930
mov eax, dword [ebp - 0x1c]
cmp dword [esi + 0x4a50], eax
jne 0x40e202
cmp word [edi + 0x154], 0
jne 0x40e1db
cmp byte [edi + 0x15a], 0
je 0x40e202
xor edx, edx
mov ecx, edi
call fcn.00413620
xor dl, dl
mov ecx, edi
call fcn.00419180
mov edx, edi
mov ecx, ebx
call fcn.0040a930
mov eax, dword [esi + 0x4a7c]
mov dword [esi + 0x4000], eax
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 9]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00452309
mov esp, ebp
pop ebp
ret
Function at 0x40e440
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x40e47d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x40e463
cmp byte [esi], bl
jne 0x40e463
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x4578b8]
test bl, bl
jne 0x40e454
pop edi
pop esi
not ecx
pop ebx
jmp fcn.0040e3d0
Function at 0x41c540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
cmp dword [esi + 0x5e2c], 0
lea ecx, [esi + 0x5e30]
je 0x41c5ac
push 0
call fcn.0041e5f0
push dword [ebp + 8]
lea ecx, [esi + 0x5e30]
push ebx
call fcn.00407f40
mov edx, dword [esi + 0x5e30]
mov ecx, 0x46387c
push dword [esi + 0x5e2c]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x5e38]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push ebx
call fcn.00407f40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c950
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x463880]
test bl, bl
je 0x41c996
or edi, 0xffffffff
cmp bl, 0x23
jne 0x41c977
cmp byte [esi], bl
jne 0x41c977
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x4578b8]
test bl, bl
jne 0x41c968
mov edi, dword [0x463880]
mov ecx, dword [edi + 0x5dd0]
not eax
mov edx, dword [edi + 0x5dd8]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x41c9bd
cmp dword [edx + 4], eax
je 0x41c9c0
add edx, 0x24
cmp edx, ecx
jne 0x41c9b1
xor eax, eax
ret
mov eax, edx
ret

Function at 0x41cbb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [0x463880]
mov eax, ecx
mov dword [ebp - 0xc], eax
mov dword [edi + 0x5dc0], 0
test eax, eax
je 0x41cc6d
lea ebx, [edi + 0x5dc4]
mov dword [edi + 0x5dc0], 0
push 0
mov ecx, ebx
call fcn.0041e5f0
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
mov ecx, ebx
call fcn.0041e570
mov eax, dword [edi + 0x5dd0]
mov esi, dword [edi + 0x5dd8]
lea eax, [eax + eax*8]
lea eax, [esi + eax*4]
mov dword [ebp - 8], eax
cmp esi, eax
je 0x41cc2a
mov eax, dword [esi + 0x1c]
push ebx
push esi
push edi
call eax
add esi, 0x24
add esp, 0xc
cmp esi, dword [ebp - 8]
jne 0x41cc17
mov esi, dword [ebx]
mov edx, 0x4574b0
mov ecx, dword [ebp - 0xc]
mov ebx, 0x46387c
lea eax, [esi - 1]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [edi + 0x5dcc]
test eax, eax
cmovne ebx, eax
call fcn.00407770
mov edi, eax
test edi, edi
je 0x41cc6d
push edi
push esi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4263d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4263f3
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.0040b0a0
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x426414
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.0040b0a0
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x426435
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.0040b0a0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x426472
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.0040b0a0
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x426493
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.0040b0a0
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x4264b4
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.0040b0a0
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00428750
Function at 0x429000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
cmp byte [ecx + 0x3c], 0
jne 0x4290a1
push dword [0x463878]
lea edi, [ebx + 0x3c]
push 0x60
call fcn.00406cf0
mov esi, dword [0x463880]
add esp, 8
mov ecx, eax
test esi, esi
je 0x429086
movsx edx, word [esi + 0x5ee4]
lea eax, [esi + 0x5ee8]
mov edi, dword [esi + 0x3f08]
lea eax, [eax + edx*8]
cmp dword [eax], edi
je 0x429079
lea eax, [edx + 1]
mov dword [ebp - 8], 6
cdq
idiv dword [ebp - 8]
movzx eax, dx
mov word [esi + 0x5ee4], ax
cwde
add eax, 0xbdd
xor edx, edx
lea eax, [esi + eax*8]
mov dword [eax], edi
mov dword [eax + 4], edx
inc word [eax + 4]
lea edi, [ebx + 0x3c]
inc dword [esi + 0x5edc]
test ecx, ecx
je 0x429091
call fcn.0042afa0
jmp 0x429093
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, edi
lea eax, [ebp - 8]
push eax
call fcn.0041e1e0
mov ecx, dword [ebx + 0x54]
mov edi, dword [ebx + 0x58]
cmp ecx, edi
jne 0x4290fc
lea esi, [ecx + 1]
test edi, edi
je 0x4290bd
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
jmp 0x4290c2
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, edi
jle 0x4290fc
imul ecx, esi, 0x7c
call fcn.0040b000
mov edi, eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x4290f3
imul ecx, dword [ebx + 0x54], 0x7c
push ecx
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebx + 0x5c]
add esp, 0xc
call fcn.0040b0a0
mov ecx, dword [ebx + 0x54]
mov dword [ebx + 0x5c], edi
mov dword [ebx + 0x58], esi
mov edi, dword [ebx + 0x5c]
mov edx, dword [ebp + 8]
mov esi, edx
imul eax, ecx, 0x7c
mov ecx, 0x1f
add edi, eax
rep movsd dword es:[edi], dword [esi]
inc dword [ebx + 0x54]
imul edi, dword [ebx + 0x54], 0x7c
add edi, dword [ebx + 0x5c]
mov ecx, dword [edi - 4]
test ecx, ecx
jne 0x42912e
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x44]
mov ecx, dword [eax + ecx*4 - 4]
mov dword [edi - 4], ecx
cmp byte [edi - 0x74], 0
jne 0x42915a
mov ecx, dword [edi - 0x78]
call fcn.0040b000
mov ecx, dword [ebp + 8]
push dword [edi - 0x78]
mov dword [edi - 0x7c], eax
mov byte [edi - 0x74], 1
push dword [ecx]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0xffff
cmp word [ecx + 0x3c], ax
jne 0x42916d
mov ax, word [edx + 0x4c]
mov word [ecx + 0x3c], ax
imul esi, dword [ebx + 0x54], 0x7c
mov ecx, dword [ebx + 0x5c]
add esi, ecx
cmp ecx, esi
je 0x4291a0
nop word [eax + eax]
cmp byte [ecx + 0x3c], 0
mov edx, dword [ecx + 0x78]
jne 0x429190
mov dword [edx + 0x34], ecx
xor eax, eax
jmp 0x429194
movzx eax, word [edx + 0x38]
inc eax
add ecx, 0x7c
mov word [edx + 0x38], ax
cmp ecx, esi
jne 0x429180
mov ecx, dword [ebx + 0x1c]
mov byte [ebx + 0x18], 0
test ecx, ecx
je 0x4291b0
call fcn.0040b0a0
mov ecx, dword [ebx + 0x20]
test ecx, ecx
je 0x4291bc
call fcn.0040b0a0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov byte [ebx + 0x19], 0
mov eax, dword [edi - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42ae60
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0042ab60
mov ecx, ebx
call fcn.0042ac90
xor eax, eax
mov dword [esp + 0x10], eax
cmp dword [ebx + 0x48], eax
jle 0x42af6f
xor ecx, ecx
mov dword [esp + 0x14], ecx
nop
mov edi, dword [ebx + 0x50]
add edi, ecx
cmp dword [edi + 0x18], 0
je 0x42af5a
cmp dword [edi + 8], 0
je 0x42af5a
movzx eax, word [edi + 4]
sub esp, 0x20
movzx esi, word [edi]
movzx ecx, word [edi + 6]
movzx edx, word [edi + 2]
movss xmm0, dword [edi + 0xc]
movss xmm4, dword [edi + 0x14]
movss dword [esp + 0x1c], xmm0
movd xmm6, eax
add eax, esi
movd xmm3, ecx
cvtdq2ps xmm3, xmm3
movd xmm2, eax
lea eax, [edx + ecx]
mulss xmm3, dword [ebx + 0x30]
mov ecx, dword [edi + 0x18]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm2, xmm2
mulss xmm1, dword [ebx + 0x30]
mulss xmm2, dword [ebx + 0x2c]
movd xmm0, edx
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm6, xmm6
movss dword [esp + 0x18], xmm1
addss xmm0, xmm4
mulss xmm6, dword [ebx + 0x2c]
movss dword [esp + 0x14], xmm2
movss dword [esp + 0x10], xmm3
movss xmm3, dword [edi + 0x10]
movss dword [esp + 0xc], xmm6
movss dword [esp + 8], xmm0
movd xmm0, esi
cvtdq2ps xmm0, xmm0
addss xmm0, dword [edi + 0x10]
movss dword [esp + 4], xmm0
movss dword [esp], xmm4
push dword [edi + 8]
push 0
call fcn.0042b790
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add ecx, 0x1c
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
cmp eax, dword [ebx + 0x48]
jl 0x42ae90
mov esi, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
lea edi, [esi + eax*4]
cmp esi, edi
je 0x42af94
nop dword [eax]
mov ecx, dword [esi]
cmp byte [ecx + 0x48], 0
je 0x42af8d
call fcn.0042b150
add esi, 4
cmp esi, edi
jne 0x42af80
pop edi
pop esi
mov byte [ebx + 0x18], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42da30
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x46300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x463880]
lea eax, [ebp - 0x10]
push esi
push edi
push eax
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x42dbe1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x42dbe1
push dword [0x463878]
push 0x38
call fcn.00406cf0
mov esi, dword [0x463880]
add esp, 8
mov edi, eax
test esi, esi
je 0x42dad8
movsx edx, word [esi + 0x5ee4]
lea eax, [esi + 0x5ee8]
mov ecx, dword [esi + 0x3f08]
lea eax, [eax + edx*8]
cmp dword [eax], ecx
je 0x42dace
lea eax, [edx + 1]
mov dword [ebp - 0x1c], 6
cdq
idiv dword [ebp - 0x1c]
movzx eax, dx
mov word [esi + 0x5ee4], ax
cwde
add eax, 0xbdd
lea eax, [esi + eax*8]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
inc word [eax + 4]
inc dword [esi + 0x5edc]
test edi, edi
je 0x42daeb
push 0x38
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x42daed
xor edi, edi
or dword [ebx + 0xc], 6
mov dword [ebx + 0x74], edi
mov dword [ebx + 0x6c], str.imgui_impl_win32
mov ebx, dword [ebp - 0x24]
mov dword [edi], ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x20], 9
test esi, esi
je 0x42db28
mov esi, dword [esi + 0x74]
jmp 0x42db2a
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x42db4d
mov dword [esi], eax
mov eax, dword [0x463880]
xor esi, esi
mov dword [ebp - 0x38], str.xinput1_4.dll
mov dword [ebp - 0x34], str.xinput1_3.dll
mov dword [ebp - 0x30], str.xinput9_1_0.dll
mov eax, dword [eax + 0x4a34]
mov dword [ebp - 0x2c], str.xinput1_2.dll
mov dword [ebp - 0x28], str.xinput1_1.dll
mov eax, dword [eax]
mov dword [eax + 0x28], ebx
mov byte [edi + 0x29], 1
push dword [ebp + esi*4 - 0x38]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x42dbaf
inc esi
cmp esi, 5
jl 0x42db86
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452309
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x2c], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x30], eax
call esi
mov dword [edi + 0x34], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452309
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452309
mov esp, ebp
pop ebp
ret
Function at 0x43beb0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x46300c]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0x10], 0x128
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x43bf1c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
nop dword [eax]
push str.nfs3.exe
lea eax, [esp + 0x38]
push eax
call edi
test eax, eax
je 0x43bf3a
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test eax, eax
jne 0x43bf00
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.00452309
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00452309
mov esp, ebp
pop ebp
ret

Function at 0x43c110
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x130
mov eax, dword [0x46300c]
xor eax, esp
mov dword [esp + 0x12c], eax
push esi
push edi
push 0
push 2
mov dword [esp + 0x10], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x43c1a5
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
nop word [eax + eax]
mov eax, str.nfs3.exe
lea ecx, [esp + 0x2c]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43c190
test dl, dl
je 0x43c18c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43c190
add ecx, 2
add eax, 2
test dl, dl
jne 0x43c170
xor eax, eax
jmp 0x43c195
sbb eax, eax
or eax, 1
test eax, eax
je 0x43c1c2
lea eax, [esp + 8]
push eax
push esi
call edi
test eax, eax
jne 0x43c160
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.00452309
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x134]
mov eax, dword [esp + 0x10]
pop edi
pop esi
xor ecx, esp
call fcn.00452309
mov esp, ebp
pop ebp
ret
Function at 0x43c1f0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x46300c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.0043c110
push eax
push 0
push 0x1fffff
mov dword [0x4638a0], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [0x4638a0]
mov dword [0x4638a4], eax
push 0x18
mov dword [ebp - 0x230], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x43c2a7
mov edi, dword [sym.imp.KERNEL32.dll_Module32Next]
nop dword [eax]
nop dword [eax + eax]
mov eax, str.nfs3.exe
lea ecx, [ebp - 0x210]
nop dword [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43c290
test dl, dl
je 0x43c28c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43c290
add ecx, 2
add eax, 2
test dl, dl
jne 0x43c270
xor eax, eax
jmp 0x43c295
sbb eax, eax
or eax, 1
test eax, eax
je 0x43c2c8
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
jne 0x43c260
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4638ac], 0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452309
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
xor ecx, ebp
pop edi
mov dword [0x4638ac], eax
pop esi
call fcn.00452309
mov esp, ebp
pop ebp
ret