joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1014eb62
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x1020f334]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
push eax
push ebx
mov edi, ecx
call fcn.1014ec61
mov esi, eax
test esi, esi
jne 0x1014ec4e
cmp dword [edi + 0x7c], eax
je 0x1014ec3c
cmp dword [ebp + 0x14], 0xffffffff
je 0x1014ebb1
push dword [ebp + 0x14]
mov ecx, edi
call fcn.1014edff
jmp 0x1014ec36
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1014ec2e
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
or dword [ebp - 0x258], 0xffffffff
lea ecx, [ebp - 0x258]
push 0
push 0
push eax
call fcn.100f7b0b
cmp dword [ebp - 0x258], 0xffffffff
je 0x1014ec14
cmp dword [ebp - 0x238], 0
ja 0x1014ec10
cmp dword [ebp - 0x234], 0x7fffffff
ja 0x1014ec10
push dword [ebp - 0x234]
mov ecx, edi
call fcn.1014edff
mov esi, eax
jmp 0x1014ec17
push 8
jmp 0x1014ec16
push 0x10
pop esi
cmp dword [ebp - 0x258], 0xffffffff
je 0x1014ec38
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1014ec38
push ebx
mov ecx, edi
call fcn.1012e59b
mov esi, eax
test esi, esi
jne 0x1014ec4c
cmp byte [ebp + 0xc], 0
je 0x1014ec4c
push ebx
mov ecx, edi
call fcn.10153008
mov esi, eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100042bb
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1014ec61
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x220
mov eax, 0x1017b168
call fcn.10004365
mov dword [ebp - 0x220], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
cmp byte [ebp + 0x10], bl
je 0x1014ecd6
push ebx
push ebx
push ebx
push ebx
push 0x100
lea eax, [ebp - 0x218]
push eax
push 3
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
xor eax, eax
add esp, 0x24
cmp ax, word [ebp - 0x18]
jne 0x1014ecb4
cmp ax, word [ebp - 0x218]
je 0x1014ecd6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1014ecd6
test al, 0x10
je 0x1014ecd6
mov ecx, dword [ebp - 0x220]
push edi
push esi
call fcn.1012e3ff
jmp 0x1014edf7
mov dword [ebp - 0x21c], ebx
lea eax, [ebp - 0x228]
mov dword [ebp - 4], ebx
push eax
push 0x5c
push esi
call fcn.101119ec
test al, al
jne 0x1014ed19
lea eax, [ebp - 0x228]
push eax
push 0x2f
push esi
call fcn.101119ec
test al, al
jne 0x1014ed19
push esi
lea ecx, [ebp - 0x21c]
call fcn.1000581a
mov esi, dword [ebp - 0x21c]
jmp 0x1014ed48
push esi
call fcn.1011208a
or ecx, 0xffffffff
sub ecx, dword [ebp - 0x228]
add eax, ecx
push eax
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.10111f6a
lea ecx, [ebp - 0x21c]
mov esi, dword [eax]
call fcn.1000586f
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x224]
push eax
push esi
call fcn.10101312
test al, al
jne 0x1014ed60
push 0x40
jmp 0x1014ede2
test edi, edi
je 0x1014ede3
mov ecx, edi
call fcn.1011756f
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.10115af2
cmp word [eax], bx
je 0x1014ede3
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x22c]
mov ecx, edi
push eax
call fcn.10116558
mov eax, dword [eax]
mov dword [ebp - 0x220], eax
push dword [ebp - 0x21c]
mov ecx, esi
mov byte [ebp - 4], 2
push eax
call fcn.10142246
test al, al
jne 0x1014edd1
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 5
call fcn.1000586f
lea eax, [ebp - 0x14]
mov byte [ebp - 4], bl
push eax
mov ecx, edi
call fcn.10115af2
cmp word [eax], bx
jne 0x1014ed81
jmp 0x1014ede3
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 3
call fcn.1000586f
push 4
pop ebx
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 6
call fcn.1000586f
mov eax, ebx
call fcn.100045f2
ret 0xc

Function at 0x10163b74
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, 0x10214ac8
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
cmp dword [esi], 0
jne 0x10163b9c
or dword [esi], 0xffffffff
jmp 0x10163bb8
push 0x64
call fcn.10163c04
pop ecx
jmp 0x10163b88
cmp dword [esi], 0xffffffff
je 0x10163b92
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10214e34]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1020f330]
mov dword [ecx + 0x30], eax
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
ret
Function at 0x40d430
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push 0x457768
push dword [ebp + 8]
call fcn.00442a3a
mov ebx, eax
add esp, 8
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x40d455
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
xor edi, edi
push 2
push edi
push ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
call fcn.00442d4f
push ebx
call fcn.00443162
mov esi, eax
add esp, 0x10
mov ebx, edi
mov dword [ebp - 0xc], ebx
inc esi
je 0x40d4b6
test esi, esi
jle 0x40d494
push esi
lea ecx, [ebp - 0x18]
call fcn.0040cfd0
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x18]
add ebx, esi
mov dword [ebp - 8], edi
mov eax, ebx
mov dword [ebp - 0xc], ebx
sub eax, esi
test eax, eax
jle 0x40d4b6
test esi, esi
jle 0x40d4b6
push eax
lea eax, [edi + esi]
push edi
push eax
call fcn.00440a20
add esp, 0xc
mov esi, dword [ebp - 4]
push 0
push 0
push esi
call fcn.00442d4f
push esi
lea eax, [ebx - 1]
push eax
push 1
push edi
call fcn.00442c14
push esi
call fcn.004428ff
push 0x20
mov byte [ebx + edi - 1], 0
call fcn.0043b590
add esp, 0x24
test eax, eax
je 0x40d4f9
push 0x457757
mov ecx, eax
call fcn.0043b530
mov esi, eax
jmp 0x40d4fb
xor esi, esi
push 0
push 0
push edi
push dword [ebp + 8]
mov ecx, esi
call fcn.0043ba10
test al, al
jne 0x40d517
mov ecx, esi
call fcn.0043cc70
xor esi, esi
lea ecx, [ebp - 0x18]
call fcn.0040c1a0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413a80
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x413a96
mov eax, 1
pop esi
pop ebp
ret 4
push edi
push str.VALVE_IPC_MGR__MTX_1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
test eax, eax
je 0x413b29
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test edi, edi
je 0x413ac4
cmp edi, 0x80
jne 0x413b07
push str.VALVE_IPC_MGR__MEM_1
push 0x40000
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
test eax, eax
je 0x413b07
push 0
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x413b07
mov dword [esi + 8], eax
mov eax, 1
pop edi
pop esi
pop ebp
ret 4
test edi, edi
je 0x413b13
cmp edi, 0x80
jne 0x413b29
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov ecx, esi
call fcn.00417c50
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x421e60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov ecx, 0x471cb0
mov dword [edi], vtable.MDLViewer.0
call fcn.00423990
mov ecx, edi
call fcn.00424ef0
mov eax, dword [0x4691c8]
push eax
push dword [eax + 0x78]
call fcn.00430450
add esp, 8
call fcn.00430350
push str.hlmv.cfg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.midump.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, edi
call fcn.00435b10
test byte [ebp + 8], 1
je 0x421ebf
push edi
call fcn.004250a0
add esp, 4
mov eax, edi
pop edi
pop ebp
ret 4

Function at 0x422360
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
je 0x422376
cmp dword [esi + 0x20], 0
je 0x422376
mov eax, 1
pop esi
ret
call fcn.00422f40
test eax, eax
je 0x4223ba
cmp dword [esi + 0x1c], 0
jne 0x4223ba
push 0
push 4
push esi
push 0x423440
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x4223ba
push eax
mov dword [esi + 0x20], 1
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [esi + 0x1c], 0
je 0x4223ba
cmp dword [esi + 0x20], 0
jne 0x42236f
mov ecx, esi
call fcn.00423990
xor eax, eax
pop esi
ret

Function at 0x422f40
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
mov esi, ecx
cmp dword [esi + 8], 0
push edi
lea edi, [esi + 8]
je 0x422f61
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0x1388
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00413a80
test eax, eax
je 0x42306b
push edi
push dword [esi + 4]
lea ecx, [ebp - 0xc]
call fcn.004230b0
test eax, eax
je 0x42306b
lea ecx, [ebp - 0xc]
call fcn.00422310
push dword [edi]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x110]
push str._s_ALIVE_1
push eax
call fcn.004431ce
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x10], eax
test eax, eax
je 0x423064
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x18], eax
test eax, eax
je 0x423064
push dword [edi]
lea eax, [ebp - 0x214]
push str..pipe_s_PIPE_1
push eax
call fcn.004431ce
add esp, 0xc
lea eax, [ebp - 0x214]
push 0
push 0x1388
push 0x10000
push 0x10000
push 1
push 6
push 0xc0000003
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0x14], eax
test eax, eax
je 0x423064
push 0x10000
call fcn.00425050
add esp, 4
mov dword [esi + 0x24], eax
test eax, eax
je 0x423064
push 0x10000
call fcn.00425050
add esp, 4
mov dword [esi + 0x2c], eax
test eax, eax
je 0x423064
mov edi, 1
jmp 0x42306d
mov ecx, esi
call fcn.00423990
xor edi, edi
mov eax, dword [ebp - 4]
test eax, eax
je 0x42307b
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 8]
test eax, eax
je 0x423089
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x42309e
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x423450
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, ecx
call fcn.00423c80
test eax, eax
je 0x4235d3
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
lea edi, [esi + 0x28]
xor eax, eax
mov dword [edi], 0
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push edi
push 0x10000
push dword [esi + 0x24]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x423516
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4235b9
cmp dword [esi + 0x20], 0
je 0x4235b9
push 0x32
push dword [esi + 0x18]
call ebx
test eax, eax
je 0x4234eb
cmp eax, 0x80
je 0x4234eb
cmp eax, 0x102
jne 0x4235b9
cmp dword [esi + 0x20], 0
jne 0x4234c3
jmp 0x4235b9
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [esi + 0x20], 0
je 0x4235b9
push 0
push edi
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x4235b9
mov ecx, dword [edi]
test ecx, ecx
je 0x4235b9
mov eax, dword [esi]
lea edi, [esi + 0x30]
push edi
push dword [esi + 0x2c]
mov dword [edi], 0
push ecx
push dword [esi + 0x24]
mov ecx, esi
call dword [eax]
test eax, eax
je 0x4235b6
mov ecx, dword [edi]
test ecx, ecx
je 0x4235b6
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
push ecx
push dword [esi + 0x2c]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x423584
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
lea edi, [esi + 0x28]
jne 0x4235b9
jmp 0x423471
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4235b6
cmp dword [esi + 0x20], 0
je 0x4235b6
push 0x32
push dword [esi + 0x18]
call ebx
test eax, eax
je 0x4235dd
cmp eax, 0x80
je 0x4235dd
cmp eax, 0x102
jne 0x4235b6
cmp dword [esi + 0x20], 0
jne 0x423597
lea edi, [esi + 0x28]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov ecx, esi
call fcn.00423c80
test eax, eax
jne 0x423471
pop edi
pop ebx
xor eax, eax
mov dword [esi + 0x20], eax
pop esi
mov esp, ebp
pop ebp
ret
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [esi + 0x20], 0
je 0x4235b6
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x4235b6
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
lea edi, [esi + 0x28]
je 0x423471
jmp 0x4235b9
Function at 0x423710
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov ecx, 0x471d00
call fcn.00412c50
test eax, eax
je 0x4238a8
mov ecx, dword [0x4691c8]
lea eax, [ebp - 0x34]
push eax
call fcn.00429ed0
push 0
push 0
push 0
lea ecx, [ebp - 0x94]
call fcn.0043e3b0
push 0
push 0
push 0
lea ecx, [ebp - 0x64]
call fcn.0043e3b0
fld dword [ebp - 8]
lea eax, [ebp - 0x94]
sub esp, 0x60
fstp qword [esp + 0x58]
fld dword [ebp - 0xc]
fstp qword [esp + 0x50]
fld dword [ebp - 0x10]
fstp qword [esp + 0x48]
fld dword [ebp - 0x14]
fstp qword [esp + 0x40]
fld dword [ebp - 0x18]
fstp qword [esp + 0x38]
fld dword [ebp - 0x1c]
fstp qword [esp + 0x30]
fld dword [ebp - 0x20]
fstp qword [esp + 0x28]
fld dword [ebp - 0x24]
fstp qword [esp + 0x20]
fld dword [ebp - 0x28]
fstp qword [esp + 0x18]
fld dword [ebp - 0x2c]
fstp qword [esp + 0x10]
fld dword [ebp - 0x30]
fstp qword [esp + 8]
fld dword [ebp - 0x34]
fstp qword [esp]
push str.hlmvModelTransform
push 0x459340
push eax
call fcn.0043f250
mov ecx, dword [ebp - 0x60]
add esp, 0x6c
cmp dword [0x471d04], 0
mov dword [ebp - 4], ecx
je 0x423860
mov eax, dword [0x471d08]
test eax, eax
je 0x423824
push 0
lea edx, [ebp - 4]
push edx
push ecx
push dword [ebp - 0x64]
push dword [ebp - 0x84]
push dword [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
jne 0x423812
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x42381f
push dword [ebp - 4]
lea ecx, [ebp - 0x64]
push 0
call fcn.0043f4e0
mov eax, dword [0x471d08]
cmp dword [0x471d04], 0
je 0x423860
test eax, eax
je 0x423842
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x471d08], 0
cmp dword [0x471d04], 0
je 0x423860
push 0x471d04
call dword [sym.imp.RPCRT4.dll_RpcStringFreeA]
mov dword [0x471d04], 0
cmp dword [ebp - 0x5c], 0
jl 0x423888
mov edx, dword [ebp - 0x64]
test edx, edx
je 0x423881
mov eax, dword [sym.imp.tier0.dll_g_pMemAlloc]
push edx
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
cmp dword [ebp - 0x8c], 0
jl 0x4238a8
mov edx, dword [ebp - 0x94]
test edx, edx
je 0x4238a8
mov eax, dword [sym.imp.tier0.dll_g_pMemAlloc]
push edx
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x424e60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
call fcn.004373d0
lea edx, [ebp - 0x100]
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x424e76
lea ecx, [ebp - 0x100]
dec ecx
lea ebx, [ebx]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x424e90
mov eax, dword [str._hlmv.rf]
mov dword [ecx], eax
mov eax, dword [0x45949c]
mov dword [ecx + 4], eax
mov al, byte [0x4594a0]
push esi
mov byte [ecx + 8], al
lea eax, [ebp - 0x100]
push 0x457768
push eax
call fcn.00442a3a
mov esi, eax
add esp, 8
test esi, esi
je 0x424ee7
push esi
push 1
push 0x800
push 0x471d18
call fcn.00442c14
push esi
call fcn.004428ff
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x424ef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
call fcn.004373d0
lea edx, [ebp - 0x100]
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x424f06
lea ecx, [ebp - 0x100]
dec ecx
lea ebx, [ebx]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x424f20
mov eax, dword [str._hlmv.rf]
mov dword [ecx], eax
mov eax, dword [0x45949c]
mov dword [ecx + 4], eax
mov al, byte [0x4594a0]
push esi
mov byte [ecx + 8], al
lea eax, [ebp - 0x100]
push 0x4594a4
push eax
call fcn.00442a3a
mov esi, eax
add esp, 8
test esi, esi
je 0x424f77
push esi
push 1
push 0x800
push 0x471d18
call fcn.0044386b
push esi
call fcn.004428ff
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x425190
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.tier0.dll_Plat_IsInDebugSession]
movzx eax, al
test eax, eax
je 0x4251a3
int3
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.tier0.dll_WriteMiniDump]
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop ebp
ret
Function at 0x42f670
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x42f6e8
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42f6e8
push esi
mov esi, dword [sym.imp.USER32.dll_EmptyClipboard]
call esi
test eax, eax
je 0x42f6e7
call esi
mov eax, ebx
lea edx, [eax + 1]
jmp 0x42f6a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42f6a0
sub eax, edx
push edi
lea esi, [eax + 1]
push esi
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push ebx
push eax
call fcn.00439a80
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebx
pop ebp
ret

Function at 0x42f8f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
lea eax, [ebp - 0x414]
push 0x63ab50
push str.SoftwareValve_s
push eax
call fcn.004431ce
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x42f943
xor al, al
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push 0x63ac10
lea eax, [ebp - 8]
mov dword [ebp - 4], 4
push eax
push 0
push str.renderxpos
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
push 0x63ac14
lea eax, [ebp - 8]
push eax
push 0
push str.renderypos
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
push 0x63ac18
lea eax, [ebp - 8]
push eax
push 0
push str.renderwidth
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
push 0x63ac1c
lea eax, [ebp - 8]
push eax
push 0
push str.renderheight
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.faceposerToolsDriveMouth
push dword [ebp - 0xc]
call esi
pop esi
test eax, eax
jne 0x42f9fe
cmp dword [ebp - 0x10], 4
jne 0x42f9fe
cmp dword [ebp - 8], eax
setne byte [0x63ac62]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x42fe40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42fe77
xor al, al
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x10]
lea eax, [ecx + 0xc]
push eax
lea eax, [ecx + 8]
push eax
lea eax, [ecx + 4]
push eax
push ecx
lea eax, [ebp - 0x88]
push str.__f__f__f__f_
push eax
call fcn.00443252
add esp, 0x18
cmp eax, 4
sete al
mov esp, ebp
pop ebp
ret

Function at 0x42feb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42fee7
xor al, al
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x88]
push eax
call fcn.00443409
mov eax, dword [ebp + 0x10]
add esp, 4
fstp dword [eax]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x42ff50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x80
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42ffcc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x94]
push str.__f__f__f_
push eax
call fcn.00443252
add esp, 0x14
cmp eax, 3
jne 0x42ffcc
mov eax, dword [ebp + 0x10]
movss xmm0, dword [ebp - 0xc]
movss dword [eax], xmm0
movss xmm0, dword [ebp - 8]
movss dword [eax + 4], xmm0
movss xmm0, dword [ebp - 4]
movss dword [eax + 8], xmm0
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x430030
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x430067
xor al, al
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x10]
lea eax, [ecx + 8]
push eax
lea eax, [ecx + 4]
push eax
push ecx
lea eax, [ebp - 0x88]
push str.__f__f__f_
push eax
call fcn.00443252
add esp, 0x14
cmp eax, 3
sete al
mov esp, ebp
pop ebp
ret