joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407a20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x59db49
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6e50b4]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6e50b4]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
movzx eax, word [esp + 0x74]
mov ebp, ecx
push eax
mov ecx, 0x6d7f50
mov dword [esp + 0x18], eax
call fcn.004960c0
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x407c0e
xor edi, edi
jmp 0x407a80
mov ecx, dword [ebp + 0x218]
movzx esi, di
push esi
call fcn.00408990
test eax, eax
je 0x407acc
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x78]
call eax
cmp word [esp + 0x14], ax
jne 0x407acc
mov ecx, dword [ebp + 0x218]
push esi
call fcn.00408990
mov esi, eax
test esi, esi
je 0x407acc
mov ecx, dword [ebp + 0x218]
push esi
call fcn.0042ef80
push esi
mov ecx, 0x6d6410
call fcn.00441f70
inc edi
cmp edi, 5
jl 0x407a80
mov edi, dword [ebx + 0x538]
test edi, edi
je 0x407c0e
mov ebx, dword [esp + 0x70]
mov ecx, dword [ebp + 0x218]
push ebx
call fcn.00408990
mov esi, eax
test esi, esi
je 0x407b0d
mov ecx, dword [ebp + 0x218]
push esi
call fcn.0042ef80
push esi
mov ecx, 0x6d6410
call fcn.00441f70
push 0x53c
call fcn.00582660
add esp, 4
mov dword [esp + 0x14], eax
xor esi, esi
mov dword [esp + 0x68], esi
cmp eax, esi
je 0x407b31
mov ecx, eax
call fcn.00495830
mov esi, eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.0042f0f0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x68], 1
call fcn.0042f0f0
mov eax, dword [edi + 0x33]
push 2
lea ecx, [esp + 0x40]
push ecx
push eax
mov ecx, 0x6f42b0
mov byte [esp + 0x74], 2
call fcn.004346c0
mov eax, dword [edi + 0x37]
push 2
lea edx, [esp + 0x20]
push edx
push eax
mov ecx, 0x6f42b0
call fcn.004346c0
mov eax, dword [esi]
lea ecx, [ebx + 0x109a0]
push ecx
lea edx, [esp + 0x20]
push edx
mov edx, dword [eax + 0xb4]
lea ecx, [esp + 0x44]
push ecx
push 0x28
push 0x28
push 0
push 0
mov ecx, esi
call edx
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x220]
add ecx, 0x4b8
push ecx
mov ecx, esi
mov dword [esi + 0x220], eax
call fcn.004959a0
mov eax, 0x8e
mov dword [esi + 0x538], edi
mov word [esi + 0xc], ax
mov ecx, dword [0x6d6428]
push esi
call fcn.0057d060
mov ecx, dword [ebp + 0x218]
push esi
push ebx
call fcn.0042ecf0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x68], 1
call fcn.0042f100
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.0042f100
jmp 0x407c2d
push 0x9ac
mov ecx, 0x6f63d0
call fcn.004d54d0
push eax
push 0x1d
push 0x6f63d0
call fcn.004d6a60
add esp, 0xc
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.005825b3
add esp, 0x58
ret 8
Function at 0x40aec0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x35c
mov eax, dword [0x6e50b4]
xor eax, esp
mov dword [esp + 0x358], eax
push ebx
push ebp
push 0x104
lea eax, [esp + 0x260]
push eax
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x25c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40aef6
mov ecx, dword [str.mfl.dat]
mov edx, dword [0x5b197c]
mov dword [eax], ecx
mov cl, byte [0x5b1980]
mov dword [eax + 4], edx
lea edx, [esp + 0x25c]
push 0x5b1920
push edx
mov byte [eax + 8], cl
call fcn.00582c01
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40af55
push eax
call fcn.00582900
add esp, 4
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x358]
xor ecx, esp
call fcn.005825b3
add esp, 0x35c
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x160]
push eax
push 0x104
call edi
lea eax, [esp + 0x160]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40af74
mov ecx, dword [str.Resource.bin]
mov edx, dword [0x5b196c]
mov dword [eax], ecx
mov ecx, dword [0x5b1970]
mov dword [eax + 4], edx
mov edx, dword [0x5b1974]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push str._d__s_t
push ebx
call fcn.005835d1
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x26]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.005835d1
add esp, 0x2c
lea ecx, [esp + 0x20]
push ecx
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40afb4
lea edx, [esp + 0x160]
push edx
push 0x104
call edi
lea edi, [esp + 0x160]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40b030
mov ecx, 6
mov esi, str.ResourceSkillArea.bsad
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea esp, [esp]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push str._d__s_t
push ebx
call fcn.005835d1
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x26]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.005835d1
add esp, 0x2c
lea ecx, [esp + 0x20]
push ecx
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b060
push ebx
call fcn.00582900
mov ecx, dword [esp + 0x36c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.005825b3
add esp, 0x35c
ret
Function at 0x40b0f0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
mov ecx, 0x6d59b0
call fcn.00425560
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
mov dword [0x6e6d48], ebp
call ebx
mov edi, eax
push 7
add edi, edi
call ebx
mov esi, eax
push 4
add esi, esi
call ebx
lea ecx, [esi + eax]
mov esi, dword [0x716fa4]
xor edx, edx
mov eax, esi
div dword [0x716530]
mov eax, dword [0x716534]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x40b14d
cmp dword [edx], esi
je 0x40b191
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x40b142
push 0
push ebp
push 0
push 0
add ecx, 0x300
push ecx
add edi, 0x400
push edi
push 0
push 0x80000000
push 0x2ca0000
push 0x6e6b48
push 0x6e6948
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x6e6d4c], esi
test esi, esi
jne 0x40b1ad
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [edx + 4]
test edx, edx
je 0x40b14d
mov eax, dword [edx + 8]
push 0
push ebp
push 0
add eax, ecx
mov ecx, dword [edx + 4]
push 0
push eax
add ecx, edi
push ecx
jmp 0x40b162
mov edx, dword [esp + 0x18]
push edx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x5ea140
call fcn.0040c830
cmp dword [0x6d8cf0], 0
push 0
mov ecx, 0x5ea140
push 0
jne 0x40b1fe
push 1
call fcn.0040c680
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
push 2
call fcn.0040c680
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x40ba00
Capabilities:
Create directory
Delete file
Log keystrokes via application hook

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0
push esi
push 0x40aa10
push 0xd
call edi
mov dword [0x6e6d54], eax
mov eax, dword [esp + 0x30]
mov dword [0x6e6800], 0
mov ecx, str.gvkc9jw0ot0Ut
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ba53
test dl, dl
je 0x40ba4f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ba53
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ba33
xor eax, eax
jmp 0x40ba58
sbb eax, eax
sbb eax, 0xffffffff
push 0
test eax, eax
je 0x40ba7a
push str.Error__
push 0x5b1aac
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
push esi
push 0x40aa10
push 0xd
call edi
push str.._Log_Debug.txt
mov dword [0x6e6d54], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x5b1a98
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str._______________________________________________________
push 0x6e1f10
call fcn.00524610
push str._____________________Client_Start______________________
push 0x6e1f10
call fcn.00524610
push str._______________________________________________________
push 0x6e1f10
call fcn.00524610
add esp, 0x18
call fcn.0040ac70
mov ecx, 0x6fcfb8
call fcn.005352a0
push 0x716402
push 0x6e6b48
call fcn.00582c5f
push 0x716402
push 0x6e6948
call fcn.00582c5f
push esi
call fcn.0040b990
add esp, 0x14
mov ecx, 0x6fcfb8
call fcn.0052f960
push str.._Resource_QuestScript_QuestString.bin
mov ecx, 0x6fabd8
call fcn.004f4650
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x6fabd8
call fcn.004f5270
push str.._Resource_QuestScript_NewbieGuide.bin
mov ecx, 0x6fabd8
call fcn.004f3260
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x6fabd8
call fcn.004f4830
mov ecx, 0x6f42b0
call fcn.00434bf0
mov eax, dword [esp + 0x34]
push eax
push esi
call fcn.0040b0f0
add esp, 8
test eax, eax
jne 0x40bb8d
mov eax, dword [0x6e6d5c]
test eax, eax
je 0x40bb83
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6e6d5c], 0
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebp
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
call esi
test eax, eax
je 0x40bbc3
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esp + 0xc]
push eax
call ebp
jmp 0x40bba0
mov ecx, 0x5ea140
call fcn.0040cc40
cmp eax, 0xffffffff
jne 0x40bba0
mov eax, dword [0x6e6d5c]
pop ebp
test eax, eax
je 0x40bbed
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6e6d5c], 0
mov eax, dword [esp + 0x10]
pop edi
pop esi
add esp, 0x1c
ret 0x10
Function at 0x41f850
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x130
mov eax, dword [0x6e50b4]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
mov esi, dword [esp + 0x13c]
xor ebx, ebx
mov dword [esp + 0x24], esi
cmp esi, ebx
je 0x41fa02
cmp byte [esi], bl
je 0x41fa02
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41fa02
mov edx, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x41f8d4
mov dword [esp + 0xc], 0x64
push edi
xor edi, edi
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x10], ebx
jbe 0x41f9f0
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea esp, [esp]
xor eax, eax
push edi
push str._04u
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], al
lea eax, [esp + 0x38]
push 5
push eax
call fcn.0041fd90
mov eax, dword [esp + 0x28]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x3c]
push edx
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41f9c9
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 0x104
call ebp
test eax, eax
je 0x41f96f
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41f9c9
push esi
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x41f98c
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41f9c9
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push str.Characteristics
push edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], 4
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41f9e7
mov esi, dword [esp + 0x2c]
inc edi
cmp edi, dword [esp + 0x14]
jb 0x41f8f0
mov edx, dword [esp + 0x18]
pop ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x41fa04
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
pop ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x41fa04
xor eax, eax
mov ecx, dword [esp + 0x134]
pop esi
pop ebx
xor ecx, esp
call fcn.005825b3
add esp, 0x130
ret 4
Function at 0x41fa20
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 8
push ebp
push edi
lea eax, [esp + 8]
xor edi, edi
push eax
push edi
mov ebp, ecx
mov dword [esp + 0x10], edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x41fa62
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push ecx
call fcn.0041fd90
add esp, 0x10
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
mov edx, dword [esp + 8]
push esi
push edx
call fcn.00584137
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
cmp esi, edi
jne 0x41fa95
mov eax, dword [esp + 0x18]
push str.GetMAC_Failed__Because_malloc_failed_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x41fad0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x18]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push edx
call fcn.0041fd90
push esi
call fcn.005840fd
add esp, 0x14
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [esi + 0x190]
cmp eax, 6
jb 0x41fb0b
cmp eax, 8
ja 0x41fb0b
push eax
lea eax, [esi + 0x194]
push eax
push ebx
call fcn.00583ac0
mov edi, dword [esi + 0x190]
add esp, 0xc
lea ecx, [esi + 8]
push ecx
mov ecx, ebp
call fcn.0041f850
test al, 4
jne 0x41fb11
mov esi, dword [esi]
test esi, esi
jne 0x41fad5
mov edx, dword [esp + 0x14]
push edx
call fcn.005840fd
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
add esp, 8
ret 4

Function at 0x423c65
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x5ea148]
push esi
mov esi, ecx
mov ecx, dword [eax + 8]
mov dword [ecx + 0xc], 1
cmp dword [esi + 0x10], 0
push 0
mov ecx, 0x5ea140
push 0
je 0x423c9b
push 3
mov dword [0x6e6f88], 1
call fcn.0040c680
mov dword [esi + 0x10], 0
jmp 0x423ca2
push 2
call fcn.0040c680
cmp dword [0x6d8cf0], 0
pop esi
jne 0x423cc0
mov dword [0x6d8cf0], 1
mov ecx, 0x6d8c58
jmp 0x4d36d0
ret
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str.._ini_GameOption.opt
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d3736
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], 0x61208
call edi
push 0
lea edx, [esp + 0x14]
push edx
push 0xac
add ebx, 4
push ebx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x42a820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x59eee0
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x6e50b4]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6e50b4]
xor eax, esp
push eax
lea eax, [esp + 0xa4]
mov dword fs:[0], eax
mov ecx, dword [esp + 0xbc]
xor ebx, ebx
mov eax, ecx
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x42a880
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x34]
call fcn.0042baa0
mov dword [esp + 0xac], ebx
cmp dword [esp + 0x3c], ebx
jbe 0x42aa22
mov ebp, dword [esp + 0xb8]
xor esi, esi
cmp esi, dword [esp + 0x3c]
jae 0x42aa22
push 1
push esi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x20], 0x7c
call fcn.0042b0a0
mov esi, eax
cmp esi, ebx
jl 0x42aa22
push 2
lea ecx, [esi + 1]
push ecx
lea edx, [esp + 0x6c]
push edx
lea ecx, [esp + 0x38]
call fcn.0042bb90
push esi
push ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0xb8], 1
call fcn.0042bb90
cmp dword [esp + 0x78], 0x10
mov eax, dword [esp + 0x64]
mov byte [esp + 0xac], 2
jae 0x42a91b
lea eax, [esp + 0x64]
push eax
call fcn.00583082
mov edi, eax
add esp, 4
cmp edi, 0x37
ja 0x42a9d5
lea ecx, [esp + 0x80]
call fcn.0042f0f0
fld1
mov eax, dword [esp + 0x58]
fst dword [esp + 0x20]
lea ecx, [ebp - 2]
fstp dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
fild dword [esp + 0x18]
lea edx, [eax + eax*2]
add edx, edx
mov dword [esp + 0x18], edx
fstp dword [esp + 0x28]
mov byte [esp + 0xac], 3
fild dword [esp + 0x18]
jns 0x42a975
fadd dword [0x5b1610]
fild dword [esp + 0xb4]
push ebx
lea eax, [esp + 0x84]
push eax
fadd qword [0x5b4370]
add edi, 0x94
push edi
mov ecx, 0x6f42b0
faddp st(1)
fstp dword [esp + 0x30]
call fcn.004346c0
fldz
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
push ecx
push ecx
fstp dword [esp]
push ebx
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x94]
call fcn.0042f110
lea ecx, [esp + 0x80]
mov byte [esp + 0xac], 2
call fcn.0042f100
mov edi, 0x10
add esi, 2
cmp dword [esp + 0x5c], edi
jb 0x42a9f0
mov eax, dword [esp + 0x48]
push eax
call fcn.00582655
add esp, 4
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
mov byte [esp + 0xac], bl
cmp dword [esp + 0x78], edi
jb 0x42aa1a
mov ecx, dword [esp + 0x64]
push ecx
call fcn.00582655
add esp, 4
cmp esi, ebx
jge 0x42a8ae
cmp dword [esp + 0x40], 0x10
jb 0x42aa36
mov edx, dword [esp + 0x2c]
push edx
call fcn.00582655
add esp, 4
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.005825b3
add esp, 0x9c
ret 0xc
Function at 0x4321b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x59f57e
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x6e50b4]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6e50b4]
xor eax, esp
push eax
lea eax, [esp + 0xa4]
mov dword fs:[0], eax
mov ecx, dword [esp + 0xbc]
xor ebx, ebx
mov eax, ecx
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x432210
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x34]
call fcn.0042baa0
mov dword [esp + 0xac], ebx
cmp dword [esp + 0x3c], ebx
jbe 0x4323b2
mov ebp, dword [esp + 0xb8]
xor esi, esi
cmp esi, dword [esp + 0x3c]
jae 0x4323b2
push 1
push esi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x20], 0x7c
call fcn.0042b0a0
mov esi, eax
cmp esi, ebx
jl 0x4323b2
push 2
lea ecx, [esi + 1]
push ecx
lea edx, [esp + 0x6c]
push edx
lea ecx, [esp + 0x38]
call fcn.0042bb90
push esi
push ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0xb8], 1
call fcn.0042bb90
cmp dword [esp + 0x78], 0x10
mov eax, dword [esp + 0x64]
mov byte [esp + 0xac], 2
jae 0x4322ab
lea eax, [esp + 0x64]
push eax
call fcn.00583082
mov edi, eax
add esp, 4
cmp edi, 0x37
ja 0x432365
lea ecx, [esp + 0x80]
call fcn.0042f0f0
fld1
mov eax, dword [esp + 0x58]
fst dword [esp + 0x20]
lea ecx, [ebp - 2]
fstp dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
fild dword [esp + 0x18]
lea edx, [eax + eax*2]
add edx, edx
mov dword [esp + 0x18], edx
fstp dword [esp + 0x28]
mov byte [esp + 0xac], 3
fild dword [esp + 0x18]
jns 0x432305
fadd dword [0x5b1610]
fild dword [esp + 0xb4]
push ebx
lea eax, [esp + 0x84]
push eax
fadd qword [0x5b4370]
add edi, 0x94
push edi
mov ecx, 0x6f42b0
faddp st(1)
fstp dword [esp + 0x30]
call fcn.004346c0
fldz
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
push ecx
push ecx
fstp dword [esp]
push ebx
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x94]
call fcn.0042f110
lea ecx, [esp + 0x80]
mov byte [esp + 0xac], 2
call fcn.0042f100
mov edi, 0x10
add esi, 2
cmp dword [esp + 0x5c], edi
jb 0x432380
mov eax, dword [esp + 0x48]
push eax
call fcn.00582655
add esp, 4
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
mov byte [esp + 0xac], bl
cmp dword [esp + 0x78], edi
jb 0x4323aa
mov ecx, dword [esp + 0x64]
push ecx
call fcn.00582655
add esp, 4
cmp esi, ebx
jge 0x43223e
cmp dword [esp + 0x40], 0x10
jb 0x4323c6
mov edx, dword [esp + 0x2c]
push edx
call fcn.00582655
add esp, 4
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.005825b3
add esp, 0x9c
ret 0xc
Function at 0x440f50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5a077d
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6e50b4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x1c]
push eax
lea edi, [esi + 0x234]
push edi
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, dword [esi + 0x240]
sub ecx, dword [esi + 0x238]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push 0x44
mov dword [esi + 0x230], 0xf
mov dword [esi + 0x22c], ecx
call fcn.00582660
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x440fd8
mov ecx, eax
call fcn.005276c0
jmp 0x440fda
xor eax, eax
mov edx, dword [esi + 0x23c]
sub edx, dword [edi]
mov ecx, dword [esp + 0x20]
push 0x100
push 1
push edx
push ecx
mov ecx, eax
mov dword [esp + 0x24], 0xffffffff
mov dword [esi + 0x224], eax
call fcn.00527710
mov ecx, dword [esi + 0x224]
push 5
call fcn.005275d0
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 4]
mov dword [esi + 0x258], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x25c], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x260], edx
mov ecx, dword [eax + 0x10]
mov dword [esi + 0x264], ecx
mov edx, dword [eax + 0x14]
mov dword [esi + 0x268], edx
mov ecx, dword [eax + 0x18]
mov dword [esi + 0x26c], ecx
mov edx, dword [eax + 0x1c]
mov ax, word [esp + 0x28]
mov dword [esi + 0x270], edx
mov word [esi + 0x274], ax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 4]
mov dword [esi + 0x27c], ecx
mov edx, dword [eax + 8]
mov dword [esi + 0x280], edx
mov ecx, dword [eax + 0xc]
mov dword [esi + 0x284], ecx
mov edx, dword [eax + 0x10]
mov dword [esi + 0x288], edx
mov ecx, dword [eax + 0x14]
mov dword [esi + 0x28c], ecx
mov edx, dword [eax + 0x18]
mov cx, word [esp + 0x30]
mov dword [esi + 0x290], edx
mov eax, dword [eax + 0x1c]
mov dword [esi + 0x294], eax
mov eax, dword [esp + 0x34]
mov word [esi + 0x298], cx
mov edx, dword [eax + 4]
mov dword [esi + 0x2a0], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x2a4], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x2a8], edx
mov ecx, dword [eax + 0x10]
mov dword [esi + 0x2ac], ecx
mov edx, dword [eax + 0x14]
mov dword [esi + 0x2b0], edx
mov ecx, dword [eax + 0x18]
mov dword [esi + 0x2b4], ecx
mov edx, dword [eax + 0x1c]
mov ax, word [esp + 0x38]
mov dword [esi + 0x2b8], edx
mov word [esi + 0x2bc], ax
mov dword [esi + 0x2c8], 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x20