joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd2af10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xd3f9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xd2b002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00d2edff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xd2b002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00d266e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00d2f20b
push 0x10
call fcn.00d2f1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xd2afc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00d1b1c0
jmp 0xd2afc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00d2ab80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xd2aff0
mov ecx, edi
call fcn.00d1b2c0
push edi
call fcn.00d2f1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xd2b021
inc ebx
cmp ebx, 0x20
jb 0xd2af3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xd2c250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xd40808
push 0xd30288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xd2c329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xd2c329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00d2f1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xd2c329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xd2c329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xd2c32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00d2c351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xd2cd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd2cd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xd2cd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd2cd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xd2cd94
push eax
push esi
call fcn.00d2f20b
add esp, 8
pop esi
ret 0x10

Function at 0xd2cda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd2ce22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xd2ce15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xd45320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00d2edff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xd2cdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xd2ce30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd2cec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xd2ceb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xd45320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00d2edff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xd2ceab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xd2ce6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xd2d000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xd2d131
push esi
call fcn.00d30145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00d1f080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xd2d131
push 0
push ebp
call fcn.00d1f3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00d1f260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xd2d08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00d1f2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xd2d121
push 0xd45918
push edi
call fcn.00d2e3f0
push eax
push ebx
push esi
call fcn.00d2cf60
push 0xd458f8
push edi
call fcn.00d2e3f0
push eax
push ebx
push esi
call fcn.00d2cf60
push 0xd458d8
push edi
call fcn.00d2e3f0
push eax
push ebx
push esi
call fcn.00d2cf60
push 0xd458c0
push edi
call fcn.00d2e3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00d2cf60
push 0xd458a0
push edi
call fcn.00d2e3f0
push eax
push ebx
push esi
call fcn.00d2cf60
push 0xd45888
push edi
call fcn.00d2e3f0
push eax
push ebx
push esi
call fcn.00d2cf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xd2e1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d2e140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d2e140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d2e140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d2e140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd2ebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd2ec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd4087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd2ec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd2ec52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4095e0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov ecx, dword [edi + 0x9c]
lea esi, [edi + 0x40]
cmp ecx, 0xffffffff
je 0x4096bb
cmp ecx, 0x40
jbe 0x409620
mov edx, esi
mov ecx, edi
call fcn.0040db70
mov dword [edi + 0x9c], 0x14
mov ecx, 0x14
mov eax, 0x40
sub eax, ecx
push eax
lea eax, [ecx + edi]
push 0
push eax
call fcn.0044e9c0
movups xmm0, xmmword [edi]
mov edx, 0x40
mov ecx, edi
movaps xmm2, xmmword [str.6666666666666666]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi], xmm1
push esi
movups xmm0, xmmword [edi + 0x10]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi + 0x10], xmm1
movups xmm0, xmmword [edi + 0x20]
pxor xmm0, xmm2
movups xmmword [edi + 0x20], xmm0
movups xmm0, xmmword [edi + 0x30]
pxor xmm2, xmm0
movups xmmword [edi + 0x30], xmm2
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
call fcn.0040d8b0
mov eax, dword [ebp - 4]
add esp, 0x10
mov dword [edi + 0x9c], 0xffffffff
test ebx, ebx
je 0x4096cc
push esi
mov edx, ebx
mov ecx, eax
call fcn.0040d8b0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4096e0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x495574]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 0x1c], ecx
cmp dword [edi + 0x9c], 0xffffffff
je 0x409710
push edi
xor edx, edx
xor ecx, ecx
call fcn.004095e0
add esp, 4
push esi
lea esi, [edi + 0x40]
mov edx, esi
lea ecx, [ebp - 0x18]
call fcn.0040db70
movups xmm0, xmmword [edi]
mov edx, 0x40
mov ecx, edi
movaps xmm2, xmmword [0x48a880]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi], xmm1
push esi
movups xmm0, xmmword [edi + 0x10]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi + 0x10], xmm1
movups xmm0, xmmword [edi + 0x20]
pxor xmm0, xmm2
movups xmmword [edi + 0x20], xmm0
movups xmm0, xmmword [edi + 0x30]
pxor xmm2, xmm0
movups xmmword [edi + 0x30], xmm2
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
call fcn.0040d8b0
push esi
mov edx, 0x14
lea ecx, [ebp - 0x18]
call fcn.0040d8b0
add esp, 8
lea ecx, [ebp - 0x18]
mov edx, esi
call fcn.0040db70
pop esi
test ebx, ebx
je 0x4097c6
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call fcn.0044dec0
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0044c2a6
mov esp, ebp
pop ebp
ret
Function at 0x40ec80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46cf98
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x495574]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
call fcn.00437bed
mov ecx, eax
test ecx, ecx
je 0x40edd2
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x471758
jne 0x40eddc
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x208
or eax, ecx
jge 0x40ed06
push 0x208
lea ecx, [ebp - 0x10]
call fcn.00404670
mov esi, dword [ebp - 0x10]
push esi
push 0
push 0x4829cc
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push dword [esi - 8]
mov ebx, eax
push esi
call fcn.004541f2
add esp, 8
test eax, eax
js 0x40edc8
cmp eax, dword [esi - 8]
jg 0x40edc8
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test ebx, ebx
jne 0x40edb5
push 0x47a2ec
mov ecx, edi
call fcn.00404300
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40eda1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, 0x471758
jne 0x40ede3
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x40ede3
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add esi, 0xfffffff0
push esi
call fcn.00403cc0
add esp, 4
add eax, 0x10
mov dword [edi], eax
jmp 0x40ed50
push 0x80070057
call fcn.00404830
push 0x80004005
call fcn.00404830
call edx
jmp 0x40ecd5
call edx
jmp 0x40eda1
Function at 0x416860
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d938
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x495574]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x34]
call fcn.004145e0
push ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00416370
add esp, 4
test al, al
je 0x4169d6
cmp byte [ebp - 0x30], 0
je 0x4169d6
mov edx, esi
lea ecx, [ebp - 0x14]
call fcn.0041b630
push 0x485760
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push 0x58ea20
push eax
call fcn.00403bc0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403500
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov ecx, dword [ebp - 0x18]
add esp, 0x18
add ecx, 0xfffffff0
mov eax, esi
lock xadd dword [ecx + 0xc], eax
dec eax
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jg 0x41693b
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, 0x471758
jne 0x4169f4
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4169f4
push 0
push dword [edx + 4]
call edi
push dword [ebp - 0x10]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0x10]
test eax, eax
mov eax, esi
sete bl
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41699b
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x18], edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, 0x471758
jne 0x416a04
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x18], edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4169fd
push 0
push dword [edx + 4]
call edi
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], esi
dec esi
test esi, esi
jg 0x4169d8
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x471758
jne 0x416a0b
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x416a0b
push 0
push dword [edx + 4]
call edi
jmp 0x4169d8
xor bl, bl
lea ecx, [ebp - 0x34]
call fcn.004147f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call ebx
jmp 0x41693b
mov ecx, edx
call dword [ebp - 0x18]
jmp 0x41699b
mov ecx, edx
call dword [ebp - 0x18]
jmp 0x41699b
mov ecx, edx
call esi
jmp 0x4169d8
Function at 0x41ce20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e090
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x495574]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebx + 4]
movzx eax, byte [ecx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ecx + 1]
xor edx, eax
imul eax, edx, 0x1000193
mov edx, dword [ebx + 0x18]
and edx, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov edi, dword [eax + edx*8]
cmp esi, edi
je 0x41cedd
mov esi, dword [eax + edx*8 + 4]
mov esi, dword [esi]
nop
cmp esi, edi
je 0x41cedd
mov esi, dword [esi + 4]
mov ax, word [ecx]
cmp ax, word [esi + 8]
jne 0x41ce90
mov edx, dword [ebp + 0x10]
push 0x10
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.0044c2b7
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x41cf0d
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx*8]
cmp eax, dword [ebx + 4]
jne 0x41cf24
mov dword [ecx + edx*8], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx*8 + 4], edi
jmp 0x41cf49
cmp eax, esi
jne 0x41cf2d
mov dword [ecx + edx*8], edi
jmp 0x41cf49
mov eax, dword [ecx + edx*8 + 4]
mov eax, dword [eax]
mov dword [ecx + edx*8 + 4], eax
cmp eax, edi
je 0x41cf49
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx*8 + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
mov dword [ebp - 4], 2
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x48a870]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x48a870]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x41cfda
cmp ecx, 0x200
jae 0x41cf9e
shl ecx, 3
jmp 0x41cfa8
cmp ecx, 0x1fffffff
jae 0x41cfa8
add ecx, ecx
push ecx
mov ecx, ebx
call fcn.0041c640
mov eax, dword [ebx + 4]
cmp dword [eax], eax
je 0x41cfda
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], eax
nop dword [eax]
mov esi, dword [ebx + 4]
mov ecx, ebx
mov esi, dword [esi]
push esi
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0041ce20
cmp esi, dword [ebp + 0xc]
jne 0x41cfc0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x429ea0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46eb29
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x495574]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CStickerMap.0
call fcn.0043bb76
mov dword [esi + 0x1c], vtable.CMap_struct_SStickerMapModPosKey__struct_SStickerMapModPosKey_const___class_CStickerMapModPosDesc__class_CStickerMapModPosDesc_const__.0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0x11
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0xa
mov dword [esi + 0x40], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x3c], vtable.OCArray_struct_SStickerMapModPosKey_.0
push 0xffffffffffffffff
push 1
lea ecx, [esi + 4]
mov byte [ebp - 4], 3
call fcn.0043bcf7
cmp dword [esi + 0xc], 0
jle 0x42a09a
mov eax, dword [esi + 8]
lea ecx, [esi + 0x1c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xffffff
mov word [ebp - 0x18], 0
mov byte [eax], 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xe]
mov byte [esi + 0x18], 0
push eax
mov word [ebp - 0xe], 0
call fcn.0042d300
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
lea eax, [ebp - 0xe]
mov dword [ebp - 0x1c], 0xffffff
push eax
lea ecx, [esi + 0x1c]
mov word [ebp - 0x18], 0
mov word [ebp - 0xe], 0x100
call fcn.0042d300
push ecx
push 0x10
lea ecx, [esi + 0x3c]
mov word [esi + 0x38], 0x101
call fcn.0042d8c0
xor edx, edx
mov eax, dword [esi + 0x40]
mov word [eax + edx], 0
mov eax, dword [esi + 0x40]
mov word [edx + eax + 2], 0
mov eax, dword [esi + 0x40]
mov word [edx + eax + 4], 0
mov eax, dword [esi + 0x40]
mov word [eax + edx + 6], 0
add edx, 8
cmp edx, 0x20
jl 0x429fc1
movsd xmm0, qword [0x48a830]
mov eax, 0x7f
mov word [esi + 0xa0], ax
mov eax, esi
mov dword [esi + 0x50], 2
mov dword [esi + 0x54], 2
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 1
mov dword [esi + 0x60], 1
mov dword [esi + 0x64], 1
mov dword [esi + 0x68], 0xffffff
mov dword [esi + 0x6c], 0
mov byte [esi + 0x70], 1
mov dword [esi + 0x74], 0xe6e6e6
mov byte [esi + 0x78], 1
mov dword [esi + 0x7c], 0x646464
mov byte [esi + 0x80], 1
mov dword [esi + 0x84], 0xffdcdc
mov byte [esi + 0x88], 0
mov dword [esi + 0x8c], 0xff0000
mov dword [esi + 0x90], 0
movsd qword [esi + 0x98], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00437e01
int3