joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10079830
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10005781
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x101f8b08], 0
jne 0x1007986d
cmp dword [0x101f8b04], 0
je 0x1007986d
mov eax, dword [0x101f8b04]
mov dword [0x101f8b08], eax
cmp dword [0x101f8b08], 0
je 0x100798ea
mov ecx, dword [0x101f8b08]
cmp dword [ecx + 8], 0
je 0x100798ea
mov edx, dword [0x101f8b08]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x100798ea
mov ecx, dword [0x101f8b08]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x100798ea
mov eax, dword [0x101f8b08]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x100798b9
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x100798c0
xor eax, eax
jmp 0x10079a09
mov ecx, dword [0x101f8b08]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10004255
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10079a09
mov edx, dword [0x101f8b04]
mov dword [0x101f8b08], edx
jmp 0x10079906
mov eax, dword [0x101f8b08]
mov ecx, dword [eax + 4]
mov dword [0x101f8b08], ecx
cmp dword [0x101f8b08], 0
je 0x10079946
cmp dword [0x101f8b08], 0
je 0x10079944
mov edx, dword [0x101f8b08]
cmp dword [edx + 8], 0
je 0x10079944
mov eax, dword [0x101f8b08]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10079944
mov edx, dword [0x101f8b08]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10079944
jmp 0x1007989e
jmp 0x100798f8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10079a90
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10079a07
mov eax, dword [ebp - 0x18]
mov dword [0x101f8b08], eax
mov ecx, dword [0x101f8b08]
mov dword [ecx], 0x52727464
mov edx, dword [0x101f8b08]
mov dword [edx + 8], 0
mov eax, dword [0x101f8b08]
mov ecx, dword [0x101f8b04]
mov dword [eax + 4], ecx
mov edx, dword [0x101f8b08]
mov dword [0x101f8b04], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x101f8b08]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x100799d7
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x100799f7
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x100799ce
mov eax, dword [0x101f8b08]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1007989e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1007ab00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101f8b04]
mov dword [ebp - 4], eax
jmp 0x1007ab19
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1007ab40
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1007ab3e
call sub.KERNEL32.dll_GetLastError
jmp 0x1007ab42
jmp 0x1007ab10
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1007d280
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x101f8b60], 0
je 0x1007d296
xor eax, eax
jmp 0x1007d4a8
cmp dword [0x101f8b5c], 0
je 0x1007d2a9
mov eax, dword [0x101f8b5c]
jmp 0x1007d4a8
push 0x24
push 0
push 0x101f8b30
call fcn.10004255
add esp, 0xc
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [0x101f8b30], eax
push 0
push 0
push str.dbghelp.dll
call sub.KERNEL32.dll_LoadLibraryExW
mov dword [0x101f8b34], eax
cmp dword [0x101f8b34], 0
jne 0x1007d34b
mov dword [0x101f8b60], 1
cmp dword [0x101f8b34], 0
je 0x1007d2fe
mov eax, dword [0x101f8b34]
push eax
call sub.KERNEL32.dll_FreeLibrary
mov dword [0x101f8b38], 0
mov dword [0x101f8b3c], 0
mov dword [0x101f8b40], 0
mov dword [0x101f8b44], 0
mov dword [0x101f8b48], 0
mov dword [0x101f8b4c], 0
mov dword [0x101f8b50], 0
xor eax, eax
jmp 0x1007d4a8
push str.ImagehlpApiVersionEx
mov ecx, dword [0x101f8b34]
push ecx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x101f8b38], eax
push str.SymInitialize
mov edx, dword [0x101f8b34]
push edx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x101f8b3c], eax
push str.SymSetOptions
mov eax, dword [0x101f8b34]
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x101f8b40], eax
push str.SymGetOptions
mov ecx, dword [0x101f8b34]
push ecx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x101f8b44], eax
push str.SymLoadModule64
mov edx, dword [0x101f8b34]
push edx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x101f8b48], eax
push str.SymGetModuleInfo64
mov eax, dword [0x101f8b34]
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x101f8b4c], eax
push str.SymFromName
mov ecx, dword [0x101f8b34]
push ecx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x101f8b50], eax
push 8
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.10004255
add esp, 0xc
mov eax, 0xc
mov word [ebp - 0xc], ax
cmp dword [0x101f8b38], 0
je 0x1007d429
cmp dword [0x101f8b3c], 0
je 0x1007d429
cmp dword [0x101f8b48], 0
je 0x1007d429
cmp dword [0x101f8b4c], 0
je 0x1007d429
cmp dword [0x101f8b50], 0
jne 0x1007d42e
jmp 0x1007d2e0
lea ecx, [ebp - 0xc]
push ecx
call dword [0x101f8b38]
movzx edx, word [ebp - 0xc]
cmp edx, 0xc
jge 0x1007d446
jmp 0x1007d2e0
push 0
push 0
mov eax, dword [0x101f8b30]
push eax
call dword [0x101f8b3c]
test eax, eax
jne 0x1007d45f
jmp 0x1007d2e0
cmp dword [0x101f8b44], 0
je 0x1007d499
cmp dword [0x101f8b40], 0
je 0x1007d499
call dword [0x101f8b44]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xfffffff8
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, 0x2704
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
call dword [0x101f8b40]
mov dword [0x101f8b5c], 0x101f8b30
mov eax, dword [0x101f8b5c]
mov esp, ebp
pop ebp
ret
Function at 0x10153c50
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.100024ff
mov eax, dword [0x101f2274]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x101f9fb0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x10153e28
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x10153d77
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x10153d77
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x10153d55
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x10153cd9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10153de1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x10153e48
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x10153e23
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x10153e48
jmp 0x10153cb2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004147
mov esp, ebp
pop ebp
ret
Function at 0x10153ee0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.100024ff
mov eax, dword [0x101f2274]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x101f9fb0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x101540cb
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x10154016
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x10154016
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x10153ff2
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x10153f69
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10154084
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x101540eb
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x101540c6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x101540eb
jmp 0x10153f42
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004147
mov esp, ebp
pop ebp
ret
Function at 0x401b20
Capabilities:
Encrypt data using rc4 via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi], 0
jne 0x401b48
push esi
call fcn.00401810
test al, al
je 0x401be4
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push 0x8003
push dword [esi]
mov dword [ebp - 4], 0
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x401bb4
mov eax, dword [ebp + 0xc]
mov ecx, eax
cmp dword [eax + 0x14], 0xf
jbe 0x401b7e
mov ecx, dword [eax]
push 0
push dword [eax + 0x10]
push ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x401bb4
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 4]
push 0x6801
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
mov eax, dword [ebp - 4]
test eax, eax
je 0x401bcb
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
jne 0x401bcb
mov dword [ebp - 4], eax
jmp 0x401bd6
mov dword [ebp - 4], 0
test bl, bl
jne 0x401bf8
mov eax, dword [ebp - 8]
test eax, eax
je 0x401be4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push edi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 8]
call fcn.004019b0
add esp, 4
mov bl, al
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40ce60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505fe0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x565040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.004d2c4b
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004d473d
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.0040d070
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415440
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88
mov eax, dword [0x565040]
xor eax, esp
mov dword [esp + 0x84], eax
cmp dword [ecx + 0x10], 0
je 0x415490
cmp dword [ecx + 0x14], 0xf
jbe 0x415468
mov ecx, dword [ecx]
lea eax, [esp + 4]
push eax
push ecx
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x415490
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.004d2bfe
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x84]
or eax, 0xffffffff
xor ecx, esp
call fcn.004d2bfe
mov esp, ebp
pop ebp
ret

Function at 0x417da0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x507a80
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x230
mov eax, dword [0x565040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x23c], edi
push 0x208
lea eax, [ebp - 0x220]
mov dword [ebp - 0x23c], edi
push 0
push eax
mov dword [ebp - 0x23c], 0
call fcn.004d7890
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x417edd
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x23c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 0x23c]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xorps xmm0, xmm0
test esi, esi
je 0x417ee0
push 1
push 0x5219d8
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x228], 0
movups xmmword [ebp - 0x238], xmm0
mov dword [ebp - 0x224], 0
call fcn.00416e10
lea eax, [ebp - 0x238]
mov dword [ebp - 4], 0
push eax
lea edx, [ebp - 0x220]
mov ecx, edi
call fcn.0041b5b0
mov ecx, dword [ebp - 0x224]
add esp, 4
cmp ecx, 7
jbe 0x417eff
mov edx, dword [ebp - 0x238]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x417ed1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417f1f
push ecx
push edx
call fcn.004d2c11
add esp, 8
jmp 0x417eff
xorps xmm0, xmm0
push 0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov ecx, edi
push 0x521a28
mov dword [edi + 0x14], 0
call fcn.00416e10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d2bfe
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004e23ec
int3
Function at 0x418c70
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push 1
lea eax, [ebp - 4]
mov dword [ebp - 8], ecx
push eax
push 0
mov dword [ebp - 4], 0
xor bl, bl
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
mov eax, dword [ebp - 4]
test eax, eax
je 0x418d03
push esi
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x418cfb
push 1
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
test eax, eax
jne 0x418cf4
mov edx, dword [esi]
xor ecx, ecx
test edx, edx
je 0x418cf4
lea eax, [esi + 4]
cmp dword [eax], 0
je 0x418ce0
inc ecx
add eax, 0x38
cmp ecx, edx
jb 0x418cc4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ecx*8]
mov bl, 1
sub eax, ecx
mov ecx, dword [ebp - 8]
mov eax, dword [esi + eax*8 + 0x10]
mov dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4250f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::FindChildByName_wchar_t_const___int_]
mov edi, eax
test edi, edi
je 0x425124
mov esi, dword [edi]
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SImageWnd::GetClassNameW_void_]
push eax
mov ecx, edi
call dword [esi + 4]
test eax, eax
je 0x425124
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingletonPtr_void_]
test eax, eax
je 0x425140
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingleton_void_]
mov ecx, eax
call dword [sym.imp.soui.dll_public:_struct_SOUI::ILog4zManager____thiscall_SOUI::SApplication::GetLogManager_void_]
mov esi, eax
jmp 0x425142
xor esi, esi
push 0x2800
call fcn.004ed7b1
add esp, 4
mov edi, eax
push 0x5000
call fcn.004ed7b1
add esp, 4
mov ebx, eax
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SImageWnd::GetClassNameW_void_]
push eax
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.004244f0
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x4251b0
push 0
push 0
push eax
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.004eab91
add esp, 4
test esi, esi
je 0x425205
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x425205
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.D:codeworkspace_souiSOUIincludecoreSWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.004eab91
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
push 0x2800
call fcn.004ed7b1
add esp, 4
mov esi, eax
push 0x20e
push str.D:codeworkspace_souiSOUIincludecoreSWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push 0x2800
push esi
call fcn.00424550
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.004eab91
add esp, 4
push edi
call fcn.004eab91
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x425260
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::FindChildByName_wchar_t_const___int_]
mov edi, eax
test edi, edi
je 0x425294
mov esi, dword [edi]
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SStatic::GetClassNameW_void_]
push eax
mov ecx, edi
call dword [esi + 4]
test eax, eax
je 0x425294
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingletonPtr_void_]
test eax, eax
je 0x4252b0
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingleton_void_]
mov ecx, eax
call dword [sym.imp.soui.dll_public:_struct_SOUI::ILog4zManager____thiscall_SOUI::SApplication::GetLogManager_void_]
mov esi, eax
jmp 0x4252b2
xor esi, esi
push 0x2800
call fcn.004ed7b1
add esp, 4
mov edi, eax
push 0x5000
call fcn.004ed7b1
add esp, 4
mov ebx, eax
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SStatic::GetClassNameW_void_]
push eax
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.004244f0
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x425320
push 0
push 0
push eax
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.004eab91
add esp, 4
test esi, esi
je 0x425375
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x425375
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.D:codeworkspace_souiSOUIincludecoreSWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.004eab91
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
push 0x2800
call fcn.004ed7b1
add esp, 4
mov esi, eax
push 0x20e
push str.D:codeworkspace_souiSOUIincludecoreSWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push 0x2800
push esi
call fcn.00424550
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.004eab91
add esp, 4
push edi
call fcn.004eab91
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8