joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4169e0
Capabilities:
Extract resource via kernel32 functions
Set file attributes
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x62d7c8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x714dfc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 0x14]
call fcn.0045d9e0
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.0045db70
push 0x6d75b0
push 0xc8
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x416aef
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x416aef
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.0045dd30
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x6d7438
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.005b9820
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.0045dba0
push eax
lea ecx, [esp + 0x18]
call fcn.0045dbd0
push eax
call fcn.005b94d0
add esp, 8
cmp dword [esp + 0xc], eax
je 0x416b2a
push 0x80
push 0x6d7438
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x6d6ddc
push 0x6d7438
call fcn.005df820
mov esi, eax
add esp, 8
test esi, esi
jne 0x416b05
push 0x10
push str.Warning
push str.Can_not_update_steam_api.dll
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x416b2a
push 0x10
push str.Warning
push str.No_steam_api.dll_resource
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x416b2a
push esi
lea ecx, [esp + 0x18]
call fcn.0045dba0
push eax
push 1
lea ecx, [esp + 0x20]
call fcn.0045dbd0
push eax
call fcn.005e028e
push esi
call fcn.005df0e0
add esp, 0x14
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.0045da90
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x416cd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x62d988
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push edi
mov eax, dword [0x714dfc]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
fldz
lea ecx, [esp + 0x14]
fst dword [esi]
mov dword [esi + 8], 0
fstp dword [esi + 4]
call fcn.0045d9e0
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0
call fcn.0045db70
movzx eax, word [esp + 0x5c]
push 0x6d76cc
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x416e0d
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x416e0d
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
lea ecx, [esp + 0x1c]
call fcn.0045dd30
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.0045dba0
push eax
lea ecx, [esp + 0x1c]
call fcn.0045dbd0
mov ecx, dword [0x71bb54]
push eax
add ecx, 0x50
call fcn.005bb690
push eax
call sub.d3dx9_43.dll_D3DXCreateTextureFromFileInMemory
test eax, eax
jne 0x416e0d
mov ecx, dword [0x71bb54]
call fcn.005cb030
push 1
push 1
push 0x16
push 4
push 4
mov ecx, eax
mov dword [esi + 8], eax
call fcn.005ccc80
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 8]
push edx
call fcn.005ccaf0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push 0
push eax
mov eax, dword [ecx + 0x44]
call eax
fild dword [esp + 0x60]
mov ecx, dword [esp + 0x40]
fild dword [esp + 0x40]
test ecx, ecx
jge 0x416dee
fadd dword [0x6d9294]
fdivp st(1)
mov edx, dword [esp + 0x44]
fstp dword [esi]
fild dword [esp + 0x64]
fild dword [esp + 0x44]
test edx, edx
jge 0x416e08
fadd dword [0x6d9294]
fdivp st(1)
fstp dword [esi + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0xffffffff
call fcn.0045da90
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x4c
ret 0xc
Function at 0x418440
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x41c
mov eax, dword [0x714dfc]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push ebp
lea eax, [esp + 0x14]
mov ebx, ecx
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.005b9820
add esp, 0xc
test al, al
je 0x41847f
mov edx, dword [esp + 0x10]
cmp edx, dword [esi + 0x10e]
je 0x418565
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6d6ddc
push esi
call fcn.005df820
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x4184c0
push esi
lea eax, [esp + 0x1c]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.00410ac0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov eax, edi
call fcn.00417900
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.0045dba0
push eax
mov ecx, ebx
call fcn.0045dbd0
push eax
push esi
lea ecx, [edi + 0x4e0]
call fcn.005c71d0
mov ecx, dword [esi + 0x106]
cmp ecx, dword [esp + 8]
je 0x41850b
push 0
push 0x19b
push str..Updater.cpp
push str.fe__size__out_size
call fcn.005b8de0
add esp, 0x10
lea ebx, [edi + 0x20dd4]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push ebp
push 1
push edx
push eax
call fcn.005e028e
push ebp
call fcn.005df0e0
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.maidudnaisus.exe
push esi
call fcn.005e235c
add esp, 8
test eax, eax
jne 0x418558
mov byte [edi + 0x21654], 1
call fcn.004187d0
mov ecx, dword [esp + 0xc]
push ecx
call fcn.005baa80
add esp, 4
mov ecx, dword [esp + 0x41c]
pop ebp
pop ebx
xor ecx, esp
call fcn.005dec57
add esp, 0x41c
ret
Function at 0x418650
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x62e428
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x714dfc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
xor esi, esi
mov dword [esp + 0x18], ebx
call fcn.0041ad50
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], esi
call fcn.0041ade0
mov ecx, dword [edi + 0x5f8]
sub ecx, dword [edi + 0x5f4]
sar ecx, 2
test ecx, ecx
jbe 0x4186ff
mov ebp, 0x100000
mov edx, dword [edi + 0x5f8]
sub edx, dword [edi + 0x5f4]
sar edx, 2
cmp esi, edx
jb 0x4186c8
call fcn.005dfe56
mov eax, dword [edi + 0x5f4]
mov eax, dword [eax + esi*4]
test dword [eax + 0x116], ebp
jne 0x4186e5
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0041aef0
inc ebx
mov edx, dword [edi + 0x5f8]
sub edx, dword [edi + 0x5f4]
inc esi
sar edx, 2
cmp esi, edx
jb 0x4186b0
mov dword [esp + 0x14], ebx
xor esi, esi
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x418778
xor ebp, ebp
lea ebx, [edi + 0x5e4]
cmp esi, eax
jb 0x41872d
call fcn.005dfe56
mov eax, dword [esp + 0x24]
lea edi, [eax + ebp]
push edi
mov ecx, ebx
call fcn.005c8c50
test byte [edi + 0x116], 1
je 0x41874c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
add ebp, 0x128
cmp esi, eax
jb 0x41872d
mov ebx, dword [esp + 0x14]
xor esi, esi
push ebx
push str.removed__d_files_n
call fcn.005b8ad0
mov eax, dword [esp + 0x2c]
add esp, 8
cmp eax, esi
je 0x418797
push eax
call fcn.005baa80
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.005baa80
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x4187d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x61c
mov eax, dword [0x714dfc]
xor eax, esp
mov dword [esp + 0x614], eax
lea eax, [esp + 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.maidudnaisus.exe
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 8]
push 0x6d7dfc
push edx
call fcn.00410aa0
push str.AfterKUB
lea eax, [esp + 0x224]
push str.Allow_network_traffic_for__s
push eax
call fcn.00410ac0
lea ecx, [esp + 0x22c]
add esp, 0x1c
push ecx
lea ecx, [esp + 4]
call fcn.00410710
mov ecx, dword [esp + 0x618]
add esp, 4
xor ecx, esp
call fcn.005dec57
add esp, 0x61c
ret
Function at 0x418cb0
Capabilities:
Delete file

Disassembly:
sub esp, 0x40c
mov eax, dword [0x714dfc]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
push ebp
push esi
push str.Making_sure_extracted_files_exists_n
call fcn.005b8ad0
add esp, 4
push 1
lea ebx, [edi + 0x4e0]
push 1
mov ecx, ebx
call fcn.005c6d50
mov eax, dword [edi + 0x5f8]
sub eax, dword [edi + 0x5f4]
xor ebp, ebp
sar eax, 2
test eax, eax
jbe 0x418d9e
mov edi, edi
mov ecx, dword [edi + 0x5f8]
sub ecx, dword [edi + 0x5f4]
sar ecx, 2
cmp ebp, ecx
jb 0x418d18
call fcn.005dfe56
mov edx, dword [edi + 0x5f4]
mov esi, dword [edx + ebp*4]
test byte [esi + 0x116], 1
je 0x418d86
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.005b9820
add esp, 0xc
test al, al
je 0x418d59
mov edx, dword [esp + 0x10]
cmp edx, dword [esi + 0x10e]
jne 0x418d59
mov eax, dword [esp + 0xc]
cmp eax, dword [esi + 0x106]
je 0x418d86
push esi
push str.restoring__s_n
call fcn.005b8ad0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6d7f88
push esi
mov ecx, ebx
call fcn.005c7c20
test al, al
je 0x418dca
mov ecx, dword [edi + 0x5f8]
sub ecx, dword [edi + 0x5f4]
inc ebp
sar ecx, 2
cmp ebp, ecx
jb 0x418d00
mov ecx, ebx
call fcn.005c6eb0
push str.Making_sure_extracted_files_exists___finished_n
call fcn.005b8ad0
mov ecx, dword [esp + 0x418]
add esp, 4
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dec57
add esp, 0x40c
ret
push esi
lea edx, [esp + 0x18]
push str.Cant_extract_file__s_nPlease_delete_this_file_manually
push edx
call fcn.00410ac0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov eax, edi
call fcn.00417900
int3
Function at 0x4192e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62e470
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x714dfc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [esi + 0x20dec], 0
je 0x419337
push 0
push 0x34b
push str..Updater.cpp
push str.status___STATUS_Checking
call fcn.005b8de0
add esp, 0x10
mov ecx, esi
call fcn.00417960
call fcn.00417b50
test al, al
je 0x419362
mov ecx, esi
call fcn.00417bc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [esi + 0x98], 1
call fcn.00417e50
mov dword [esi + 0x20dec], eax
lea eax, [esi + 0x20df5]
push 0x6d71c2
push eax
call fcn.00410ac0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
mov ebx, 5
cmp dword [esi + 0x20dec], ebx
jne 0x419493
mov ecx, dword [esi + 0x21760]
mov eax, dword [0x7c10e0]
or eax, dword [0x7c10e4]
mov dword [0x7c10d0], ecx
mov edx, dword [esi + 0x21764]
mov dword [0x7c10d4], edx
je 0x4193ec
call fcn.00411bd0
test al, al
je 0x4193ec
push 0
push 0
push 0x7c10d0
push 0x411890
push 0
push 0
call fcn.005df597
add esp, 0x18
mov dword [0x7c1298], eax
call fcn.00417eb0
call fcn.00418000
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x5e4]
push ecx
push eax
push str.current_build_version_d__updater_data_version_d_n
call fcn.005b8ad0
mov eax, dword [esi + 0x5e4]
add esp, 0xc
cmp eax, dword [esi + 0x1c]
jne 0x419420
mov eax, esi
call fcn.00419210
mov edi, esi
call fcn.004182a0
mov ecx, esi
call fcn.004189a0
call fcn.00419170
push str.Validating_game_data_n
call fcn.005b8ad0
add esp, 4
lea edx, [esi + 0x20df5]
push str.Validating_game_data
push edx
call fcn.00410ac0
add esp, 8
lea eax, [esi + 0x21600]
push eax
lea ecx, [esi + 0x215f8]
push ecx
push 0
lea ecx, [esi + 0x4e0]
call fcn.005ca730
test al, al
jne 0x41947f
push str.Game_data_is_damaged__please_restart_launcher_to_repair_damaged_files
mov eax, esi
call fcn.00417900
push str.Validating_game_data___finished_n
call fcn.005b8ad0
add esp, 4
mov eax, esi
call fcn.00419210
push 0x32
call edi
jmp 0x419393

Function at 0x41a950
Capabilities:
Create thread

Disassembly:
cmp dword [esi + 0x21638], 0
je 0x41a972
push 0
push 0x5c5
push str..Updater.cpp
push str.mainThread___NULL
call fcn.005b8de0
add esp, 0x10
cmp dword [esi + 0x21658], 0
je 0x41a994
push 0
push 0x5c6
push str..Updater.cpp
push str.loginThread___NULL
call fcn.005b8de0
add esp, 0x10
push ebx
push edi
push 0
push 0
push esi
push 0x419560
push 0
push 0
call fcn.005df597
push 0
push 0
push esi
push 0x419e30
push 0
push 0
mov dword [esi + 0x21638], eax
call fcn.005df597
add esp, 0x30
mov dword [esi + 0x21c88], eax
lea edi, [esi + 0x21648]
mov ebx, 3
push 0
push 0
push esi
push 0x419e40
push 0
push 0
call fcn.005df597
mov dword [edi], eax
add esp, 0x18
add edi, 4
sub ebx, 1
jne 0x41a9d6
pop edi
pop ebx
ret
Function at 0x41aa80
Capabilities:
Terminate thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push str.CUpdater::Stop___n
mov esi, eax
call fcn.005b8ad0
add esp, 4
cmp byte [esi + 0x20df4], 0
jne 0x41aaa3
mov eax, dword [esi + 0x21640]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x7a3e8c
call edi
lea eax, [esi + 0x20dd4]
push eax
mov dword [esp + 0x14], eax
call edi
mov eax, dword [esi + 0x21638]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp eax, ebx
je 0x41aae8
push ebx
push eax
call edi
mov ecx, dword [esi + 0x21638]
push ecx
call ebp
mov dword [esi + 0x21638], ebx
mov eax, dword [esi + 0x21c88]
cmp eax, ebx
je 0x41ab05
push ebx
push eax
call edi
mov edx, dword [esi + 0x21c88]
push edx
call ebp
mov dword [esi + 0x21c88], ebx
mov eax, dword [esi + 0x21658]
cmp eax, ebx
je 0x41ab22
push ebx
push eax
call edi
mov eax, dword [esi + 0x21658]
push eax
call ebp
mov dword [esi + 0x21658], ebx
add esi, 0x21648
mov ebx, 3
lea ecx, [ecx]
mov eax, dword [esi]
test eax, eax
je 0x41ab46
push 0
push eax
call edi
mov ecx, dword [esi]
push ecx
call ebp
mov dword [esi], 0
add esi, 4
sub ebx, 1
jne 0x41ab30
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edx
call esi
push 0x7a3e8c
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x41ce80
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41ced9
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ceb0
mov ecx, dword [esp]
sub eax, edx
inc eax
push eax
push esi
push 1
push 0
push str.username
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x41cee0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41cf30
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.username
push eax
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 8
ret 4
Function at 0x427cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x714dfc]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
lea edi, [eax + esi]
cmp eax, 8
ja 0x427d06
mov eax, 0xffffffe2
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.005dec57
mov esp, ebp
pop ebp
ret
add esi, 8
lea eax, [ebx + 0x681c]
push eax
mov ecx, edi
sub ecx, esi
push ecx
lea edx, [ebx + 0x2818]
push esi
push edx
call fcn.0044ec70
add esp, 0x10
cmp eax, 0xffffff88
ja 0x427ced
add esi, eax
mov eax, edi
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x24], 0x1f
call fcn.0044bfe0
add esp, 0x14
mov dword [esp + 8], eax
cmp eax, 0xffffff88
ja 0x427ced
mov ecx, dword [esp + 0x10]
cmp ecx, 0x1f
ja 0x427ced
mov eax, dword [esp + 0x24]
cmp eax, 8
ja 0x427ced
push eax
push 0x6d57e0
push 0x6d5760
push ecx
lea ecx, [esp + 0x38]
push ecx
lea edx, [ebx + 0x1008]
push edx
call fcn.00425550
add esi, dword [esp + 0x20]
mov eax, edi
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0xd8]
push eax
mov dword [esp + 0x38], 0x34
call fcn.0044bfe0
add esp, 0x2c
mov dword [esp + 8], eax
cmp eax, 0xffffff88
ja 0x427ced
mov ecx, dword [esp + 0xc]
cmp ecx, 0x34
ja 0x427ced
mov eax, dword [esp + 0x1c]
cmp eax, 9
ja 0x427ced
push eax
push 0x6d5038
push 0x6d5860
push ecx
lea ecx, [esp + 0xc0]
push ecx
lea edx, [ebx + 0x1810]
push edx
call fcn.00425550
add esi, dword [esp + 0x20]
mov eax, edi
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x90]
push eax
mov dword [esp + 0x34], 0x23
call fcn.0044bfe0
add esp, 0x2c
mov dword [esp + 0x20], eax
cmp eax, 0xffffff88
ja 0x427ced
mov ecx, dword [esp + 8]
cmp ecx, 0x23
ja 0x427ced
mov eax, dword [esp + 0x14]
cmp eax, 9
ja 0x427ced
push eax
push 0x6d4f60
push 0x6d56d0
push ecx
lea ecx, [esp + 0x78]
push ecx
push ebx
call fcn.00425550
add esi, dword [esp + 0x38]
add esp, 0x18
lea edx, [esi + 0xc]
cmp edx, edi
ja 0x427ced
sub edi, esi
sub edi, 0xc
xor ecx, ecx
lea edx, [ebx + 0x701c]
mov eax, dword [esi]
add esi, 4
test eax, eax
je 0x427ced
cmp eax, edi
jae 0x427ced
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 3
jl 0x427e85
mov ecx, dword [esp + 0x124]
mov eax, esi
sub eax, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
call fcn.005dec57
mov esp, ebp
pop ebp
ret
Function at 0x450f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7fc
mov eax, dword [0x714dfc]
xor eax, esp
mov dword [esp + 0x7f4], eax
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x40
lea eax, [esp + 0x80]
push esi
push eax
mov edi, ecx
mov dword [esp + 0x84], esi
call fcn.005e23b0
add esp, 0xc
push 0x44
lea ecx, [esp + 0x38]
push esi
push ecx
mov dword [esp + 0x3c], esi
call fcn.005e23b0
mov ebx, dword [edi]
add edi, 4
add esp, 0xc
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
cmp ebx, 0x10
jbe 0x450fc6
mov eax, 0xffffffd4
jmp 0x45114e
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x81c]
lea ecx, [esp + 0x80]
push ecx
mov ecx, dword [esp + 0x81c]
lea edx, [esp + 0x50c]
push edx
call fcn.00450600
add esp, 0x10
mov dword [esp + 0x2c], eax
cmp eax, 0xffffff88
ja 0x45114e
mov edi, dword [esp + 0x1c]
cmp edi, ebx
ja 0x450fbc
mov dword [esp + 0x14], edi
cmp dword [esp + edi*4 + 0x78], esi
jne 0x451020
dec edi
cmp dword [esp + edi*4 + 0x78], esi
je 0x451015
mov dword [esp + 0x14], edi
xor ebp, ebp
lea eax, [ebp + 1]
lea ebx, [edi + 1]
mov dword [esp + 0x20], ebp
cmp ebx, eax
jbe 0x451043
mov ecx, ebp
add ebp, dword [esp + eax*4 + 0x78]
mov dword [esp + eax*4 + 0x34], ecx
inc eax
cmp eax, ebx
jb 0x451030
mov dword [esp + 0x20], ebp
mov esi, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x34], ebp
test esi, esi
jbe 0x45107b
movzx edx, byte [esp + eax + 0x500]
mov ecx, dword [esp + edx*4 + 0x34]
mov byte [esp + ecx*2 + 0x600], al
inc eax
lea edi, [ecx + 1]
mov dword [esp + edx*4 + 0x34], edi
mov byte [esp + ecx*2 + 0x601], dl
cmp eax, esi
jb 0x451051
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
sub edx, dword [esp + 0x1c]
xor esi, esi
lea eax, [esi + 1]
dec edx
mov dword [esp + 0x34], esi
cmp ebx, eax
jbe 0x4510b2
mov ebp, dword [esp + eax*4 + 0x78]
lea ecx, [eax + edx]
shl ebp, cl
mov edi, esi
mov dword [esp + eax*4 + 0xc0], edi
inc eax
add esi, ebp
cmp eax, ebx
jb 0x451091
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
sub ecx, edi
mov edi, dword [esp + 0x24]
inc ecx
sub edi, ecx
inc edi
cmp ecx, edi
jae 0x451117
mov edx, ecx
neg edx
mov eax, ecx
shl eax, 4
shl edx, 4
add eax, ecx
sub edx, ecx
lea eax, [esp + eax*4 + 0xc4]
add edx, edx
mov dword [esp + 0x18], eax
add edx, edx
cmp ebx, 1
jbe 0x451104
lea esi, [ebx - 1]
jmp 0x4510f0
mov ebp, dword [edx + eax]
shr ebp, cl
add eax, 4
sub esi, 1
mov dword [eax - 4], ebp
jne 0x4510f0
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
inc ecx
add eax, 0x44
sub edx, 0x44
mov dword [esp + 0x18], eax
cmp ecx, edi
jb 0x4510e3
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
inc ecx
push ecx
push edx
lea eax, [esp + 0xc8]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x38]
push ebp
lea edx, [esp + 0x614]
push edx
push eax
push ecx
call fcn.00450e30
mov eax, dword [esp + 0x4c]
add esp, 0x20
mov ecx, dword [esp + 0x804]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dec57
add esp, 0x7fc
ret
Function at 0x458c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebp, dword [esp + 0x7c]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x80]
mov ebx, dword [edi + 0x6860]
lea ecx, [esi + eax]
mov dword [esp + 0x28], ecx
lea ecx, [edx + ebp]
lea edx, [edi + 0x1004]
mov dword [esp + 0x14], edx
mov edx, dword [edi + 0x6814]
mov dword [esp + 0x38], edx
mov edx, dword [edi + 0x6818]
mov dword [esp + 0x34], edx
mov edx, dword [edi + 0x681c]
mov dword [esp + 0x30], edx
mov edx, dword [edi + 0x6858]
push edx
push eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov ecx, dword [edi + 0x685c]
mov dword [esp + 0x20], ecx
add ebx, ecx
push esi
lea ecx, [edi + 0x1808]
push eax
push ecx
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x98]
call fcn.004584b0
add esp, 0x18
cmp eax, 0xffffff88
ja 0x458e61
cmp dword [esp + 0x80], 0
lea edx, [eax + esi]
je 0x458e25
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x74], eax
add eax, ecx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x28]
mov esi, 1
sub eax, edx
lea ecx, [esp + 0x48]
mov dword [esp + 0x44], esi
mov dword [esp + 0x70], esi
call fcn.004568f0
cmp eax, 0xffffff88
jbe 0x458d45
mov eax, 0xffffffec
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
lea edx, [esp + 0x58]
push edx
mov eax, edi
lea edx, [esp + 0x4c]
call fcn.00456a80
lea eax, [esp + 0x64]
add esp, 4
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x4c]
call fcn.00456a80
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x6c]
add esp, 4
push ecx
lea edx, [esp + 0x4c]
call fcn.00456a80
add esp, 4
lea ecx, [esp + 0x48]
call fcn.004569f0
cmp eax, 2
jg 0x458e17
jmp 0x458da5
mov esi, 1
cmp dword [esp + 0x80], 0
je 0x458e25
sub dword [esp + 0x80], esi
lea edx, [esp + 0x3c]
push edx
lea esi, [esp + 0x4c]
call fcn.00458890
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
add esp, 4
push eax
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x4c]
push ebx
lea eax, [esp + 0x28]
push eax
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x64]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 8], ecx
push edx
mov eax, ebp
call fcn.00458a90
add esp, 0x24
cmp eax, 0xffffff88
ja 0x458e61
mov ecx, esi
add ebp, eax
call fcn.004569f0
cmp eax, 2
jle 0x458da0
cmp dword [esp + 0x80], 0
jne 0x458d38
mov eax, dword [esp + 0x18]
mov esi, ebx
sub esi, eax
cmp eax, ebx
ja 0x458d38
lea ecx, [esi + ebp]
cmp ecx, dword [esp + 0x1c]
jbe 0x458e4b
mov eax, 0xffffffba
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
push esi
push eax
push ebp
call fcn.005e2430
mov eax, esi
sub eax, dword [esp + 0x90]
add esp, 0xc
add eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret