joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434ae0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov ebx, eax
mov eax, dword [ebx + 0x124]
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x434b31
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 0x124]
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 2
call dword [sym.imp.USER32.dll_TrackMouseEvent]
call fcn.0043bc40
cmp dword [eax + 4], 0
je 0x434ba3
call fcn.0043bc40
mov esi, dword [eax + 4]
call fcn.0043bc40
cmp dword [eax + 4], esi
jne 0x434ba3
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
inc eax
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x434bba
mov edx, dword [esp + 0x30]
mov dword [esp + 0x14], edx
mov dword [esp + 0x34], ebp
call fcn.0043bc40
mov eax, dword [eax + 4]
lea esi, [esp + 0x34]
lea edi, [esp + 0x14]
call fcn.00434910
call fcn.0043bc40
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x14]
mov esi, dword [eax + 4]
push ecx
push edx
call fcn.0043a940
mov eax, dword [esp + 0x30]
push ebp
push eax
mov ecx, ebx
call fcn.0043a670
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
mov eax, dword [esp + 0x30]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ebp
call fcn.0043bc40
mov eax, dword [eax + 4]
lea esi, [esp + 0x30]
lea edi, [esp + 0x34]
call fcn.00434910
call fcn.0043bc40
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [eax + 4]
push edx
call fcn.0043a670
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x437d60
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x4f7b40], 0
je 0x437db5
mov eax, dword [0x4f7b48]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x437db5
cmp dword [eax], 3
jbe 0x437db5
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x437db5
push 0
push 0x4f9104
push 0x4f8e44
push 0
push eax
call fcn.004773f4
add esp, 0x14
test eax, eax
je 0x437db5
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 4]
mov dword [ecx], eax
mov al, 1
ret
xor al, al
ret

Function at 0x437dc0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x4f7b40], 0
push esi
push edi
mov esi, eax
je 0x437e09
mov eax, dword [0x4f7b48]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
test eax, eax
je 0x437e09
cmp dword [eax], 3
jbe 0x437e09
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x437e36
push 8
call fcn.004706a8
add esp, 4
test eax, eax
je 0x437e0e
mov dword [eax + 4], esi
mov dword [eax], 0x4d78a4
mov esi, eax
jmp 0x437e10
pop edi
xor al, al
pop esi
ret
xor esi, esi
cmp dword [0x4f7b40], 0
je 0x437e3e
mov edx, dword [0x4f7b48]
push edx
call edi
test eax, eax
je 0x437e3e
cmp dword [eax], 3
jbe 0x437e3e
mov eax, dword [eax + 8]
mov dword [eax + 0xc], esi
pop edi
mov al, 1
pop esi
ret
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push esi
call eax
pop edi
mov al, 1
pop esi
ret
Function at 0x438e90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b26e2
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x4f4930]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], 0x4d7a58
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 1
lea eax, [esi + 0x88]
xor ebx, ebx
mov dword [esp + 0x14], ebx
push eax
mov dword [esi], 0x4d7b3c
call fcn.0040b830
lea ecx, [esi + 0xa0]
push ecx
mov byte [esp + 0x18], 1
call fcn.0040b830
lea edx, [esi + 0xb8]
push edx
mov byte [esp + 0x18], 2
call fcn.0040b830
lea eax, [esi + 0xfc]
push eax
mov byte [esp + 0x18], 3
call fcn.0040b830
fldz
fst qword [esi + 0x10]
mov dword [esi + 0x20], ebx
fst qword [esi + 0x18]
mov dword [esi + 0x24], ebx
fld1
mov dword [esi + 0x28], ebx
fst qword [esi + 0x38]
mov dword [esi + 0x2c], ebx
fstp qword [esi + 0x40]
mov byte [esi + 0x30], 1
mov byte [esi + 0x31], 1
mov byte [esi + 0x32], 0xff
mov dword [esi + 0x60], ebx
fst qword [esi + 0x48]
mov byte [esi + 0x64], bl
fst qword [esi + 0x50]
mov dword [esi + 0x68], ebx
fstp qword [esi + 0x58]
mov dword [esi + 0x6c], ebx
mov byte [esi + 0x70], bl
mov byte [esi + 0x71], bl
mov byte [esi + 0x72], 1
mov byte [esi + 0x73], bl
mov byte [esi + 0xd0], bl
mov byte [esi + 0x74], bl
mov byte [esi + 0x75], 1
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0x78], ebx
mov byte [esi + 0x7c], bl
mov dword [esi + 0xd4], 0xffffffff
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xd8], ebx
mov byte [esi + 0xf4], bl
mov byte [esi + 0x114], bl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x43c5f0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x4f7b40], 0
je 0x43c645
mov eax, dword [0x4f7b48]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43c645
cmp dword [eax], 0xc
jbe 0x43c645
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0x30]
test eax, eax
je 0x43c645
push 0
push 0x4f9194
push 0x4f8e44
push 0
push eax
call fcn.004773f4
add esp, 0x14
test eax, eax
je 0x43c645
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 4]
mov dword [ecx], eax
mov al, 1
ret
xor al, al
ret
Function at 0x43c650
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x4f7b40], 0
push esi
push edi
mov esi, eax
je 0x43c699
mov eax, dword [0x4f7b48]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
test eax, eax
je 0x43c699
cmp dword [eax], 0xc
jbe 0x43c699
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + 0x30]
test ecx, ecx
jne 0x43c6c6
push 8
call fcn.004706a8
add esp, 4
test eax, eax
je 0x43c69e
mov dword [eax + 4], esi
mov dword [eax], 0x4d7c00
mov esi, eax
jmp 0x43c6a0
pop edi
xor al, al
pop esi
ret
xor esi, esi
cmp dword [0x4f7b40], 0
je 0x43c6ce
mov edx, dword [0x4f7b48]
push edx
call edi
test eax, eax
je 0x43c6ce
cmp dword [eax], 0xc
jbe 0x43c6ce
mov eax, dword [eax + 8]
mov dword [eax + 0x30], esi
pop edi
mov al, 1
pop esi
ret
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push esi
call eax
pop edi
mov al, 1
pop esi
ret

Function at 0x43d4b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test eax, eax
jne 0x43d4b7
xor al, al
ret
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43d4b4
shr eax, 4
not eax
and eax, 1
ret
Function at 0x43f810
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b1348
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4930]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebp, dword [sym.imp.USER32.dll_GetDesktopWindow]
call ebp
push eax
call dword [sym.imp.USER32.dll_GetDC]
xor ebx, ebx
mov ecx, 0x64
mov edi, eax
mov dword [esp + 0x1c], 0x4d7a58
mov dword [esp + 0x20], 0xffffffff
push 0xff
mov eax, ecx
lea esi, [esp + 0x20]
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], 0x4d7cd8
mov byte [esp + 0x30], bl
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x40], bl
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x2c], ebx
call fcn.0043e260
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x68]
push ecx
mov ecx, dword [esp + 0x68]
push edx
push eax
mov eax, dword [esp + 0x80]
push ecx
mov dword [esp + 0x6c], ebx
call fcn.0043f6c0
push edi
mov byte [esp + 0x1f], al
call ebp
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], 0x4d7cd8
cmp eax, ebx
je 0x43f901
mov edx, dword [esp + 0x48]
push edx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [esp + 0x44], ebx
mov eax, dword [esp + 0x4c]
cmp eax, ebx
je 0x43f910
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov al, byte [esp + 0x1b]
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
Function at 0x443160
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b511b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
call fcn.00432a30
mov eax, dword [eax]
push eax
call fcn.00430e90
mov edi, dword [esp + 0x30]
mov ebx, eax
mov eax, dword [edi + 0x128]
sub eax, dword [edi + 0x124]
push 0x150
sar eax, 2
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
call fcn.004706a8
add esp, 4
mov dword [esp + 0x1c], eax
xor ebp, ebp
mov dword [esp + 0x28], ebp
cmp eax, ebp
je 0x4431d5
mov esi, eax
call fcn.0043f930
mov ebp, eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [edi + 0x150]
mov esi, dword [ebx + 0xc]
push eax
push 0x64
push ecx
mov edi, ebp
mov dword [esp + 0x28], ebp
call fcn.0043fa60
lea edx, [ebx + 0x28]
add ebx, 0x10
mov dword [ebp + 0x130], ebx
mov ebx, dword [esp + 0x34]
mov dword [ebp + 0x128], esi
mov dword [ebp + 0x12c], edx
mov byte [ebp + 0x134], 1
mov eax, dword [ebp + 0x120]
call fcn.00438230
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0x38]
mov ecx, dword [ebp + 0x120]
call fcn.004381c0
mov ecx, dword [ebp + 0x120]
mov eax, dword [esi + 0x3c]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp + 0x120]
mov dword [edx + 0x134], 0x25
mov eax, dword [ebp + 0x120]
push 0xf1
push 0xdc
or bl, 0xff
or cl, 0xff
mov byte [eax + 0x140], 1
call fcn.00437f60
mov ecx, dword [ebp + 0x120]
mov edi, dword [esp + 0x38]
add esp, 8
push edi
lea esi, [ebp + 0x118]
mov dword [ecx + 0x13c], eax
call fcn.004439d0
mov esi, dword [esp + 0x18]
push 5
mov ecx, ebp
test esi, esi
jne 0x4432c1
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 4]
push eax
mov dword [edi + 0x154], eax
call fcn.00439270
add dword [edi + 0x154], 0x64
jmp 0x4432e0
mov eax, dword [edi + 0x154]
mov ebx, dword [esp + 0x18]
add eax, dword [ebx + 8]
push eax
call fcn.00439270
mov ecx, dword [ebx + 8]
add ecx, 0x64
add dword [edi + 0x154], ecx
push 1
add esi, 0xc8
push esi
push ebp
push edi
call fcn.00439410
lea ebx, [esp + 0x1c]
add edi, 0x118
call fcn.0043d760
mov edx, dword [ebp]
mov eax, dword [edx + 8]
mov ecx, ebp
call eax
mov esi, dword [esp + 0x30]
mov eax, dword [esi + 0x150]
mov ecx, dword [esi + 0x154]
mov edx, dword [esi]
add eax, 5
add ecx, 0xa
push eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov eax, dword [edx + 0x44]
push ecx
mov ecx, esi
call eax
mov al, 1
mov byte [esi + 0x64], al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x4489e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x1ec]
add esi, 0x1dc
push edi
cmp dword [esi + 0xc], ebx
jbe 0x448a05
call fcn.00470dee
mov edi, dword [esi + 0xc]
mov eax, dword [esi]
mov dword [esp + 0x10], eax
cmp edi, dword [esi + 0x10]
jbe 0x448a18
call fcn.00470dee
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
push ebx
push ecx
push edi
push eax
lea ebx, [esp + 0x20]
call fcn.0043b830
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0x1d4]
sub edx, dword [esi + 0x1d0]
add esi, 0x1c4
sar edx, 2
xor edi, edi
test edx, edx
jbe 0x448a78
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
sar eax, 2
cmp edi, eax
jb 0x448a5b
call fcn.00470dee
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx + edi*4]
mov ebx, dword [ebp + 8]
push edx
call fcn.004395a0
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
inc edi
sar eax, 2
cmp edi, eax
jb 0x448a49
mov eax, dword [esi + 0x10]
mov dword [esp + 0x10], eax
cmp dword [esi + 0xc], eax
jbe 0x448a89
call fcn.00470dee
mov edi, dword [esi + 0xc]
mov ebx, dword [esi]
cmp edi, dword [esi + 0x10]
jbe 0x448a98
call fcn.00470dee
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
push ecx
push ebx
push edi
push eax
lea ebx, [esp + 0x20]
call fcn.0043b7a0
mov esi, dword [ebp + 8]
cmp byte [esi + 0x30], 0
je 0x448ac3
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
push 0
mov ecx, esi
mov byte [esi + 0x30], 0
call eax
cmp dword [esi + 0x84], esi
je 0x448acf
mov byte [esi + 0x64], 1
mov ecx, dword [esi + 0x124]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x448c30
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x5c
push ebx
push edi
mov edi, eax
xor ecx, ecx
xor eax, eax
test edi, edi
je 0x448c56
mov eax, dword [edi + 8]
add eax, dword [edi]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [edi + 0xc]
add eax, dword [edi + 4]
sar ecx, 1
cdq
sub eax, edx
sar eax, 1
push 2
push eax
push ecx
call dword [sym.imp.USER32.dll_MonitorFromPoint]
lea ecx, [esp + 0x38]
push ecx
push eax
mov dword [esp + 0x40], 0x28
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x448c99
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esi], edx
mov edx, dword [esp + 0x58]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
pop edi
pop ebx
add esp, 0x5c
ret
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
push 1
mov ebx, eax
call edi
xor edx, edx
xor ecx, ecx
mov dword [esi], ecx
mov dword [esi + 4], edx
push edx
mov dword [esi + 8], ebx
push str.Shell_TrayWnd
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
mov dword [esi + 0xc], eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x448d0a
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.USER32.dll_IntersectRect]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_SubtractRect]
pop edi
pop ebx
add esp, 0x5c
ret
Function at 0x44cfd0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x4f4930]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push edi
push 0x3c
call fcn.00470104
mov edi, eax
xor ebx, ebx
add esp, 4
cmp edi, ebx
jne 0x44d00f
pop edi
mov dword [0x4fe0c4], 0x6d
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0046fdae
add esp, 0xc
ret
push esi
push 0x3c
push ebx
push edi
call fcn.00476c30
push 0x6148
call fcn.00470104
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x44d053
push edi
mov dword [0x4fe0c4], 0x6d
call fcn.00470027
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0046fdae
add esp, 0xc
ret
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x38], esi
mov dword [esi + 4], ebx
mov dword [esi + 0x38], ebx
mov dword [esi], 8
mov dword [esi + 0x3c], 0x449770
mov ecx, dword [edi + 0x38]
mov dword [edi + 0x34], eax
mov eax, dword [ecx + 0x3c]
cmp eax, ebx
je 0x44d089
push 6
lea ecx, [esp + 0x10]
push ecx
push edi
call eax
add esp, 0xc
jmp 0x44d09e
mov edx, dword [ecx + 0x38]
push edx
push 6
lea eax, [esp + 0x14]
push 1
push eax
call fcn.00475584
add esp, 0x10
cmp eax, 6
je 0x44d0af
mov dword [0x4fe0c4], 0x66
jmp 0x44d0d5
push 3
lea ecx, [esp + 0x10]
push ecx
push str.GIFVER
mov byte [esp + 0x1e], bl
call fcn.00474e84
add esp, 0xc
test eax, eax
je 0x44d0f8
mov dword [0x4fe0c4], 0x67
push esi
call fcn.00470027
push edi
call fcn.00470027
add esp, 8
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0046fdae
add esp, 0xc
ret
call fcn.0044d120
test eax, eax
je 0x44d0d5
mov ecx, dword [esp + 0x14]
pop esi
mov eax, edi
pop edi
mov dword [0x4fe0c4], ebx
pop ebx
xor ecx, esp
call fcn.0046fdae
add esp, 0xc
ret
Function at 0x44d120
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [edi + 0x38]
test byte [eax], 8
jne 0x44d137
mov dword [0x4fe0c4], 0x6f
xor eax, eax
pop ecx
ret
push edi
mov edx, edi
call fcn.0044d810
add esp, 4
test eax, eax
je 0x44d133
lea ecx, [edi + 4]
push ecx
mov edx, edi
call fcn.0044d810
add esp, 4
test eax, eax
je 0x44d133
mov eax, dword [edi + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x44d171
push 3
lea edx, [esp + 4]
push edx
push edi
call ecx
add esp, 0xc
jmp 0x44d186
mov eax, dword [eax + 0x38]
push eax
push 3
lea ecx, [esp + 8]
push 1
push ecx
call fcn.00475584
add esp, 0x10
cmp eax, 3
je 0x44d199
mov dword [0x4fe0c4], 0x66
xor eax, eax
pop ecx
ret
mov dl, byte [esp]
movzx eax, dl
mov ecx, eax
shr ecx, 4
and ecx, 7
inc ecx
mov dword [edi + 8], ecx
movzx ecx, byte [esp + 1]
and eax, 7
push ebx
inc eax
push esi
mov dword [edi + 0xc], ecx
test dl, dl
jns 0x44d287
mov ecx, eax
mov esi, 1
shl esi, cl
push 0
call fcn.0044de00
add esp, 4
mov dword [edi + 0x10], eax
test eax, eax
jne 0x44d1e9
pop esi
mov dword [0x4fe0c4], 0x6d
pop ebx
pop ecx
ret
xor ebx, ebx
cmp dword [eax], ebx
jle 0x44d28e
xor esi, esi
mov eax, dword [edi + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x44d20e
push 3
lea edx, [esp + 0xc]
push edx
push edi
call ecx
add esp, 0xc
jmp 0x44d223
mov eax, dword [eax + 0x38]
push eax
push 3
lea ecx, [esp + 0x10]
push 1
push ecx
call fcn.00475584
add esp, 0x10
cmp eax, 3
jne 0x44d268
mov edx, dword [edi + 0x10]
mov eax, dword [edx + 8]
movzx ecx, byte [esp + 8]
mov byte [esi + eax], cl
mov edx, dword [edi + 0x10]
mov eax, dword [edx + 8]
movzx ecx, byte [esp + 9]
mov byte [eax + esi + 1], cl
mov edx, dword [edi + 0x10]
movzx ecx, byte [esp + 0xa]
mov eax, dword [edx + 8]
mov byte [eax + esi + 2], cl
mov edx, dword [edi + 0x10]
inc ebx
add esi, 3
cmp ebx, dword [edx]
jl 0x44d1f5
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov esi, dword [edi + 0x10]
call fcn.0044de80
pop esi
mov dword [edi + 0x10], 0
mov dword [0x4fe0c4], 0x66
xor eax, eax
pop ebx
pop ecx
ret
mov dword [edi + 0x10], 0
pop esi
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x44d2a0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [edx + 0x38]
test byte [eax], 8
jne 0x44d2b7
mov dword [0x4fe0c4], 0x6f
xor eax, eax
pop ecx
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x44d2cd
push 1
lea eax, [esp + 7]
push eax
push edx
call ecx
add esp, 0xc
jmp 0x44d2e2
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0xb]
push 1
push edx
call fcn.00475584
add esp, 0x10
cmp eax, 1
je 0x44d2f5
mov dword [0x4fe0c4], 0x66
xor eax, eax
pop ecx
ret
mov al, byte [esp + 3]
cmp al, 0x21
je 0x44d333
cmp al, 0x2c
je 0x44d326
cmp al, 0x3b
je 0x44d319
mov dword [esi], 0
mov dword [0x4fe0c4], 0x6b
xor eax, eax
pop ecx
ret
mov dword [esi], 4
mov eax, 1
pop ecx
ret
mov dword [esi], 2
mov eax, 1
pop ecx
ret
mov dword [esi], 3
mov eax, 1
pop ecx
ret
Function at 0x44d640
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 0x38]
test byte [eax], 8
jne 0x44d65b
mov dword [0x4fe0c4], 0x6f
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x44d671
push 1
lea eax, [esp + 0xb]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x44d686
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0xf]
push 1
push edx
call fcn.00475584
add esp, 0x10
cmp eax, 1
je 0x44d69a
mov dword [0x4fe0c4], 0x66
xor eax, eax
pop esi
pop ecx
ret
movzx eax, byte [esp + 7]
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
call fcn.0044d6b0
pop esi
pop ecx
ret

Function at 0x44d6b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esi + 0x38]
cmp dword [edi + 0x3c], 0
mov eax, edi
je 0x44d6cf
mov edx, dword [eax + 0x3c]
push 1
lea ecx, [esp + 0xb]
push ecx
push esi
call edx
add esp, 0xc
jmp 0x44d6e4
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0xf]
push 1
push edx
call fcn.00475584
add esp, 0x10
cmp eax, 1
jne 0x44d730
mov cl, byte [esp + 7]
test cl, cl
jbe 0x44d73f
lea eax, [edi + 0x44]
mov byte [eax], cl
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx + 0x3c]
mov dword [ebx], eax
inc eax
test edx, edx
je 0x44d712
movzx ecx, byte [esp + 7]
push ecx
push eax
push esi
call edx
add esp, 0xc
jmp 0x44d727
mov edx, dword [ecx + 0x38]
movzx ecx, byte [esp + 7]
push edx
push ecx
push 1
push eax
call fcn.00475584
add esp, 0x10
movzx edx, byte [esp + 7]
cmp eax, edx
je 0x44d745
mov dword [0x4fe0c4], 0x66
xor eax, eax
pop edi
pop ecx
ret
mov dword [ebx], 0
mov eax, 1
pop edi
pop ecx
ret

Function at 0x44d810
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [edx + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x44d82a
push 2
lea eax, [esp + 4]
push eax
push edx
call ecx
add esp, 0xc
jmp 0x44d83f
mov ecx, dword [eax + 0x38]
push ecx
push 2
lea edx, [esp + 8]
push 1
push edx
call fcn.00475584
add esp, 0x10
cmp eax, 2
je 0x44d852
mov dword [0x4fe0c4], 0x66
xor eax, eax
pop ecx
ret
mov ax, word [esp]
movzx ecx, ah
movzx edx, al
mov eax, dword [esp + 8]
shl ecx, 8
add ecx, edx
mov dword [eax], ecx
mov eax, 1
pop ecx
ret
Function at 0x44d870
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esi + 0x38]
cmp dword [edi + 0x3c], 0
mov eax, edi
je 0x44d894
mov edx, dword [eax + 0x3c]
push 1
lea ecx, [esp + 0xf]
push ecx
push esi
call edx
add esp, 0xc
jmp 0x44d8a9
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0x13]
push 1
push edx
call fcn.00475584
add esp, 0x10
cmp eax, 1
jne 0x44d8f6
mov cl, byte [esp + 0xb]
test cl, cl
jbe 0x44d906
lea eax, [edi + 0x44]
mov byte [eax], cl
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx + 0x3c]
mov dword [ebp], eax
inc eax
test edx, edx
je 0x44d8d8
movzx ecx, byte [esp + 0xb]
push ecx
push eax
push esi
call edx
add esp, 0xc
jmp 0x44d8ed
mov edx, dword [ecx + 0x38]
movzx ecx, byte [esp + 0xb]
push edx
push ecx
push 1
push eax
call fcn.00475584
add esp, 0x10
movzx edx, byte [esp + 0xb]
cmp eax, edx
je 0x44d918
pop edi
mov dword [0x4fe0c4], 0x66
xor eax, eax
pop ebp
pop ecx
ret
mov dword [ebp], 0
mov byte [edi + 0x44], 0
mov dword [edi + 0x34], 0
pop edi
mov eax, 1
pop ebp
pop ecx
ret

Function at 0x44d930
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [eax + 0x38]
xor ebx, ebx
push edi
mov ecx, esi
cmp dword [esi + 0x3c], ebx
je 0x44d952
push 1
lea edx, [esp + 0x13]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
add esp, 0xc
jmp 0x44d967
mov edx, dword [ecx + 0x38]
push edx
push 1
lea eax, [esp + 0x17]
push 1
push eax
call fcn.00475584
add esp, 0x10
movzx ecx, byte [esp + 0xf]
mov eax, 1
shl eax, cl
mov dword [esi + 8], ecx
inc ecx
mov edx, 1
mov dword [esi + 0xc], eax
inc eax
mov dword [esi + 0x10], eax
inc eax
shl edx, cl
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov eax, 0x1002
mov byte [esi + 0x44], bl
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea edi, [esi + 0x2144]
mov dword [esi + 0x1c], edx
mov ecx, 0x1000
rep stosd dword es:[edi], eax
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret