joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d470
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x40c
push ebp
push esi
mov esi, ecx
push edi
test esi, esi
je 0x42d67f
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x42d4ac
mov eax, dword [0xcf3900]
test eax, eax
jne 0x42d67f
push str.dunno__select_with_invalid_socket
call fcn.0042cf60
pop edi
pop esi
pop ebp
add esp, 0x40c
ret
mov edx, dword [esi + 0x300e8]
mov ecx, 1
test edx, edx
mov dword [esp + 0xc], 0
mov dword [esp + 0x218], eax
mov dword [esp + 0x214], ecx
jle 0x42d4d9
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x114], eax
push eax
push esi
lea eax, [esp + 0x320]
push str._08x::SelectPoll___m_sock___d
push eax
mov dword [esp + 0x120], ecx
call fcn.004ee486
add esp, 0x10
lea ecx, [esp + 0x110]
lea edx, [esp + 0xc]
lea eax, [esp + 0x214]
push 0x636b40
push ecx
mov ecx, dword [esi + 4]
push edx
inc ecx
push eax
push ecx
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x42d67f
mov eax, dword [esi + 4]
lea edx, [esp + 0x110]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x42d56b
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x42d555
push eax
call sub.WSOCK32.dll_closesocket
mov dword [esi + 4], 0xffffffff
push str.exception_state_on_socket
mov ecx, esi
call fcn.0042cf60
pop edi
pop esi
pop ebp
add esp, 0x40c
ret
mov edx, dword [esi + 4]
lea ecx, [esp + 0x214]
push ecx
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x42d655
mov eax, dword [esi + 0x300e4]
mov ebp, 0x10000
sub ebp, eax
test ebp, ebp
jle 0x42d60e
mov ecx, dword [esi + 4]
push 0
lea eax, [eax + esi + 0x100e4]
push ebp
push eax
push ecx
call sub.WSOCK32.dll_recv
mov edi, eax
cmp edi, 0xffffffff
je 0x42d61d
mov eax, dword [esi + 0xd8]
test eax, eax
je 0x42d5fd
xor eax, eax
test edi, edi
jle 0x42d5fd
mov edx, dword [esi + 0x300e4]
add edx, eax
lea ecx, [edx + esi + 0x100e4]
mov edx, dword [esi + 0x31380]
and edx, reloc.WSOCK32.dll_ntohs
jns 0x42d5e2
dec edx
or edx, 0xfffffff0
inc edx
mov dl, byte [edx + esi + 0x31370]
xor byte [ecx], dl
mov edx, dword [esi + 0x31380]
inc eax
inc edx
cmp eax, edi
mov dword [esi + 0x31380], edx
jl 0x42d5c0
push edi
lea ecx, [esi + 8]
call fcn.00413ed0
add dword [esi + 0x300e4], edi
jmp 0x42d610
xor edi, edi
cmp edi, ebp
jne 0x42d655
test ebp, ebp
jle 0x42d655
jmp 0x42d584
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov ecx, esi
call fcn.0042d1c0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x42d63f
push eax
call sub.WSOCK32.dll_closesocket
mov dword [esi + 4], 0xffffffff
push str.Exiting_due_to_closed_connection.
mov ecx, esi
call fcn.0042cf60
pop edi
pop esi
pop ebp
add esp, 0x40c
ret
mov ecx, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x42d66e
mov ecx, esi
call fcn.0042d690
mov eax, dword [esi + 0x300e4]
test eax, eax
jle 0x42d67f
mov ecx, esi
call fcn.0042d920
pop edi
pop esi
pop ebp
add esp, 0x40c
ret
Function at 0x42d690
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
or ebx, 0xffffffff
push edi
cmp dword [esi + 4], ebx
jne 0x42d6b6
mov eax, dword [0xcf3900]
test eax, eax
jne 0x42d6b0
push str.dunno__select_with_invalid_socket
call fcn.0042cf60
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [esi + 0xd8]
test eax, eax
je 0x42d6f6
mov eax, dword [esi + 0xd0]
mov ecx, dword [esi + 0x300e8]
sub ecx, eax
lea edx, [eax + esi + 0x200e4]
push ecx
push edx
lea ecx, [esi + 0x30120]
call fcn.004d9540
mov eax, dword [esi + 0x300e8]
mov ecx, dword [esi + 0xd0]
add ecx, eax
mov dword [esi + 0xd0], ecx
mov ecx, dword [esi + 0x300e8]
lea edi, [esi + 0x200e4]
push 0
mov byte [ecx + esi + 0x200e4], 0
mov edx, dword [esi + 0x300e8]
mov eax, dword [esi + 4]
push edx
push edi
push eax
call sub.WSOCK32.dll_send
cmp eax, ebx
jne 0x42d743
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x42d731
push eax
call sub.WSOCK32.dll_closesocket
mov dword [esi + 4], ebx
push str.socket_error_in_send
mov ecx, esi
call fcn.0042cf60
pop edi
pop esi
xor eax, eax
pop ebx
ret
test eax, eax
jle 0x42d76c
mov edx, dword [esi + 0x300e8]
mov ecx, eax
cmp eax, edx
jge 0x42d76c
mov bl, byte [edi + ecx]
mov edx, ecx
sub edx, eax
inc ecx
mov byte [edx + esi + 0x200e4], bl
mov edx, dword [esi + 0x300e8]
cmp ecx, edx
jl 0x42d753
mov ebx, dword [esi + 0x300e8]
mov edi, dword [esi + 0xd0]
sub ebx, eax
sub edi, eax
push eax
lea ecx, [esi + 0x40]
mov dword [esi + 0x300e8], ebx
mov dword [esi + 0xd0], edi
call fcn.00413ed0
mov ecx, dword [esi + 0x300e8]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
pop ebx
ret

Function at 0x42d7d0
Capabilities:
Initialize winsock library

Disassembly:
push esi
mov esi, ecx
push str.CNetInfo::CNetInfo__:_begin._n
mov dword [esi], 0x501964
call fcn.004de1f0
add esp, 4
lea eax, [esi + 4]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x42d80c
push 0
push str.SockLib_Error
push str._r_nCNetInfo::CNetInfo____WSAStartup_failed.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, esi
pop esi
ret
Function at 0x42eef0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x4fb108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
push esi
mov esi, ecx
push edi
push str.CSocket::CSocket___begin._n
mov dword [esp + 0xc], esi
mov dword [esi], 0x501958
call fcn.004de1f0
add esp, 4
mov dword [esi + 4], 0xffffffff
push 0x413ce0
push 0x413c60
push 2
lea eax, [esi + 8]
xor edi, edi
push 0x38
push eax
mov dword [esp + 0x128], edi
call fcn.004ee90e
push 0x42b530
push 0x42b0f0
push 2
lea ecx, [esi + 0x78]
push 0x1c
push ecx
mov byte [esp + 0x128], 1
call fcn.004ee90e
push fcn.00402d20
push 0x42b800
push 2
lea edx, [esi + 0xb0]
push 0xc
push edx
mov byte [esp + 0x128], 2
call fcn.004ee90e
push str.CGMSSock::CGMSSock__:_begin._n
mov dword [esp + 0x118], 3
mov dword [esi], 0x501968
call fcn.004de1f0
add esp, 4
lea eax, [esp + 0xc]
mov dword [esi + 0x200cc], edi
mov dword [esi + 0x200c8], edi
push pe_nt_image_headers32
push eax
mov dword [esi + 0x200d0], edi
call sub.WSOCK32.dll_gethostname
lea ecx, [esp + 0xc]
push ecx
call sub.WSOCK32.dll_gethostbyname
cmp eax, edi
je 0x42eff0
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call sub.WSOCK32.dll_ntohl
mov dword [esi + 0x200d4], eax
jmp 0x42eff6
mov dword [esi + 0x200d4], edi
mov ecx, dword [esp + 0x10c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x110
ret
Function at 0x42f100
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4fb1b6
push eax
mov eax, dword [0xcf38a8]
mov dword fs:[0], esp
sub esp, 0x104
push ebp
push edi
xor edi, edi
mov ebp, ecx
cmp eax, edi
mov dword [0x8d0a5c], edi
je 0x42f2a4
cmp dword [eax + 4], 0xffffffff
je 0x42f2a4
cmp dword [0x557cdc], edi
jl 0x42f2a4
push edi
call fcn.004ee990
mov ecx, dword [0x636b5c]
sub eax, 0x3c
add esp, 4
cmp ecx, eax
jge 0x42f2a4
cmp dword [0xcf37a4], edi
jne 0x42f28a
push esi
push 0x200d8
call fcn.004ed8ee
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
cmp esi, edi
mov dword [esp + 0x118], edi
je 0x42f276
push str.CSocket::CSocket___begin._n
mov dword [esi], 0x501958
call fcn.004de1f0
add esp, 4
mov dword [esi + 4], 0xffffffff
push 0x413ce0
push 0x413c60
push 2
lea eax, [esi + 8]
push 0x38
push eax
mov byte [esp + 0x12c], 1
call fcn.004ee90e
push 0x42b530
push 0x42b0f0
push 2
lea ecx, [esi + 0x78]
push 0x1c
push ecx
mov byte [esp + 0x12c], 2
call fcn.004ee90e
push fcn.00402d20
push 0x42b800
push 2
lea edx, [esi + 0xb0]
push 0xc
push edx
mov byte [esp + 0x12c], 3
call fcn.004ee90e
push str.CGMSSock::CGMSSock__:_begin._n
mov byte [esp + 0x11c], 4
mov dword [esi], 0x501968
call fcn.004de1f0
add esp, 4
lea eax, [esp + 0x10]
mov dword [esi + 0x200cc], edi
mov dword [esi + 0x200c8], edi
push pe_nt_image_headers32
push eax
mov dword [esi + 0x200d0], edi
call sub.WSOCK32.dll_gethostname
lea ecx, [esp + 0x10]
push ecx
call sub.WSOCK32.dll_gethostbyname
cmp eax, edi
je 0x42f26c
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call sub.WSOCK32.dll_ntohl
mov dword [esi + 0x200d4], eax
jmp 0x42f278
xor eax, eax
mov dword [esi + 0x200d4], eax
jmp 0x42f278
xor esi, esi
mov dword [0xcf37a4], esi
mov dword [esp + 0x118], 0xffffffff
pop esi
push 0x14b4
mov ecx, ebp
call fcn.0042f0f0
push edi
call fcn.004ee990
add esp, 4
mov dword [0x636b5c], eax
mov ecx, dword [esp + 0x10c]
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x110
ret 4
Function at 0x42f2c0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x30c
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x42f2f4
mov eax, dword [0xcf3900]
test eax, eax
jne 0x42f44c
push str.dunno__select_with_invalid_socket
call fcn.0042f100
pop edi
pop esi
pop ebx
add esp, 0x30c
ret
mov edx, dword [esi + 0x200cc]
mov ecx, 1
test edx, edx
mov dword [esp + 0xc], 0
mov dword [esp + 0x218], eax
mov dword [esp + 0x214], ecx
jle 0x42f321
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x110], ecx
lea ecx, [esp + 0x110]
push 0x636af8
push ecx
lea edx, [esp + 0x14]
mov dword [esp + 0x11c], eax
lea ecx, [esp + 0x21c]
push edx
inc eax
push ecx
push eax
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x42f44c
mov eax, dword [esi + 4]
lea edx, [esp + 0x110]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x42f399
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x42f383
push eax
call sub.WSOCK32.dll_closesocket
mov dword [esi + 4], 0xffffffff
push str.exception_state_on_socket
mov ecx, esi
call fcn.0042f100
pop edi
pop esi
pop ebx
add esp, 0x30c
ret
mov edx, dword [esi + 4]
lea ecx, [esp + 0x214]
push ecx
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x42f422
mov eax, dword [esi + 0x200c8]
mov edi, 0x10000
sub edi, eax
test edi, edi
jle 0x42f3eb
mov ecx, dword [esi + 4]
push 0
lea eax, [eax + esi + 0xc8]
push edi
push eax
push ecx
call sub.WSOCK32.dll_recv
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42f3f7
push ebx
lea ecx, [esi + 8]
call fcn.00413ed0
add dword [esi + 0x200c8], ebx
jmp 0x42f3ed
xor ebx, ebx
cmp ebx, edi
jne 0x42f422
test edi, edi
jle 0x42f422
jmp 0x42f3ae
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x42f40c
push eax
call sub.WSOCK32.dll_closesocket
mov dword [esi + 4], 0xffffffff
push str.Exiting_due_to_closed_connection.
mov ecx, esi
call fcn.0042f100
pop edi
pop esi
pop ebx
add esp, 0x30c
ret
mov eax, dword [esi + 4]
lea edx, [esp + 0xc]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x42f43b
mov ecx, esi
call fcn.0042f460
mov eax, dword [esi + 0x200c8]
test eax, eax
jle 0x42f44c
mov ecx, esi
call fcn.0042f530
pop edi
pop esi
pop ebx
add esp, 0x30c
ret
Function at 0x42f460
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
or ebx, 0xffffffff
push edi
cmp dword [esi + 4], ebx
jne 0x42f486
mov eax, dword [0xcf3900]
test eax, eax
jne 0x42f480
push str.dunno__select_with_invalid_socket
call fcn.0042f100
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [esi + 0x200cc]
lea edi, [esi + 0x100c8]
push 0
mov byte [eax + esi + 0x100c8], 0
mov ecx, dword [esi + 0x200cc]
mov edx, dword [esi + 4]
push ecx
push edi
push edx
call sub.WSOCK32.dll_send
cmp eax, ebx
jne 0x42f4d3
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x42f4c1
push eax
call sub.WSOCK32.dll_closesocket
mov dword [esi + 4], ebx
push str.socket_error_in_send
mov ecx, esi
call fcn.0042f100
pop edi
pop esi
xor eax, eax
pop ebx
ret
test eax, eax
jle 0x42f4fc
mov edx, dword [esi + 0x200cc]
mov ecx, eax
cmp eax, edx
jge 0x42f4fc
mov bl, byte [edi + ecx]
mov edx, ecx
sub edx, eax
inc ecx
mov byte [edx + esi + 0x100c8], bl
mov edx, dword [esi + 0x200cc]
cmp ecx, edx
jl 0x42f4e3
mov edi, dword [esi + 0x200cc]
push eax
sub edi, eax
lea ecx, [esi + 0x40]
mov dword [esi + 0x200cc], edi
call fcn.00413ed0
mov ecx, dword [esi + 0x200cc]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
pop ebx
ret
Function at 0x430b10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fb208
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046b880
xor edi, edi
push 1
mov dword [esp + 0x1c], edi
mov dword [esi], 0x501af0
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x38], edi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
mov dword [esi + 0x30], edi
call fcn.004ab310
lea ecx, [ebx - 0x14]
mov dword [esi + 0x34], eax
cmp eax, ecx
jl 0x430b74
add ebx, 0xffffffd3
mov dword [esi + 0x34], ebx
push str.framedata_for_CInputGump
push 8
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 1
call fcn.004b9f50
add esp, 8
xor edx, edx
mov dword [esi + 0x40], eax
mov dword [eax], edx
push edi
push edi
mov ecx, esi
mov dword [eax + 4], edx
call fcn.0046af30
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
cmp eax, edi
mov eax, dword [esp + 0x28]
push eax
push ecx
push edx
mov ecx, esi
je 0x430bc0
call fcn.00430e00
jmp 0x430bc5
call fcn.00430c10
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x43aa70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4fb498
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0046b880
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x34], ecx
lea ecx, [esi + 0x24]
mov dword [esi + 0xb8], eax
lea ebx, [esi + 0x20]
add eax, 0x8c0
push ecx
xor ebp, ebp
push ebx
push eax
mov dword [esp + 0x28], ebp
mov dword [esi], 0x5025c8
mov dword [esi + 8], str.spellicon_gump
mov dword [esi + 0x64], ebp
mov dword [esi + 0xa8], ebp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x38], ebp
mov dword [esi + 0x58], eax
mov dword [esi + 0x54], ebp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x4c], ebp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x44], ebp
call fcn.004a9760
mov eax, dword [ebx]
push str.framedata_for_CStatusGump
add eax, 7
push 8
and al, 0xf8
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], eax
mov dword [ebx], eax
mov dword [esi + 0x18], 1
call fcn.004b9f50
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x40], edi
push str.status_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx]
imul eax, dword [esi + 0x24]
lea ecx, [eax + eax + 4]
push ecx
call fcn.004b9f50
mov edx, dword [esi + 0x40]
mov dword [edx + 4], eax
mov ecx, dword [ebx]
imul ecx, dword [esi + 0x24]
mov edx, dword [esi + 0x40]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x40]
mov dx, word [ebx]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
mov word [ecx + 2], dx
mov eax, dword [esi + 0x40]
xor ecx, ecx
xor edx, edx
mov eax, dword [eax + 4]
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
add eax, 4
push edx
push eax
mov eax, dword [esi + 0x58]
push ebp
push ebp
push eax
push fcn.004d52c0
call fcn.004a97c0
mov ecx, dword [esp + 0x4c]
add esp, 0x38
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x43aea0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4fb4ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046b880
mov eax, 2
xor ebx, ebx
mov dword [esi + 0xcc], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xd0], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x58], eax
mov ecx, 0x280
mov eax, 0x1e0
push str.framedata_for_CBritMapGump
push 8
mov dword [esp + 0x20], ebx
mov dword [esi], 0x50278c
mov dword [esi + 8], str.map_gump
mov dword [esi + 0x64], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ecx
mov dword [esi + 0xc8], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call fcn.004b9f50
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x40], edi
push str.text_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x20]
imul eax, dword [esi + 0x24]
lea ecx, [eax + eax + 4]
push ecx
call fcn.004b9f50
mov edx, dword [esi + 0x40]
push 0xf0
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x20]
imul ecx, dword [esi + 0x24]
mov edx, dword [esi + 0x40]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
mov word [ecx + 2], dx
call fcn.004ed8ee
add esp, 0x14
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x18], 1
je 0x43affc
push ebx
push 0x15a6
push 0x15a4
push fcn.004a0a40
push ebx
push ebx
push esi
push 0x1bd
push 0x262
mov ecx, eax
call fcn.0043ba10
jmp 0x43affe
xor eax, eax
mov dword [esi + 0x118], eax
mov dword [eax + 0xb0], 0x15a5
mov ecx, dword [esi + 0x118]
push 1
push esi
mov byte [esp + 0x20], bl
call fcn.0046af30
push 0xf0
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x18], 2
je 0x43b060
push ebx
push 0x15a3
push 0x15a1
push 0x4a0a10
push ebx
push ebx
push esi
push 0x1bd
push 0x24a
mov ecx, eax
call fcn.0043ba10
jmp 0x43b062
xor eax, eax
mov dword [esi + 0x114], eax
mov dword [eax + 0xb0], 0x15a2
mov ecx, dword [esi + 0x114]
push 1
push esi
mov byte [esp + 0x20], bl
call fcn.0046af30
mov ecx, esi
call fcn.0043b900
mov ecx, esi
call fcn.0043b190
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x43b0d0
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x4fb508
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x50278c
xor edi, edi
mov dword [0x80c318], edi
mov eax, dword [esi + 0x40]
mov dword [esp + 0x14], edi
mov eax, dword [eax + 4]
cmp eax, edi
je 0x43b11e
push str.CityChoice_frame0_pBMP
push eax
call fcn.004b9f90
mov ecx, dword [esi + 0x40]
add esp, 8
mov dword [ecx + 4], edi
mov eax, dword [esi + 0x40]
cmp eax, edi
je 0x43b136
push str.CityChoice_framedata
push eax
call fcn.004b9f90
add esp, 8
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x114]
cmp ecx, edi
je 0x43b146
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esi + 0x118]
cmp ecx, edi
je 0x43b156
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esi + 0xb8]
cmp ecx, edi
je 0x43b166
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.0046b940
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x43b340
Capabilities:
Get geographical location

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4fb543
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
push esi
push esi
push str.citytext
call fcn.004b3650
push eax
push str.citytext
call fcn.004b3cb0
mov ebx, eax
add esp, 0x18
cmp ebx, esi
jne 0x43b386
xor eax, eax
jmp 0x43b4da
push 0x10
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x40], esi
je 0x43b3ab
mov ecx, eax
call fcn.004de330
mov ebp, eax
mov dword [esp + 0x14], ebp
jmp 0x43b3b1
mov dword [esp + 0x14], esi
mov ebp, esi
mov eax, dword [esp + 0x48]
mov dword [esp + 0x40], 0xffffffff
inc eax
mov dword [esp + 0x10], esi
cmp eax, esi
mov dword [esp + 0x48], eax
jle 0x43b42e
mov eax, esi
push 0
push eax
mov ecx, ebx
inc esi
call fcn.004b4f80
push str..END
lea ecx, [esp + 0x1c]
mov edi, eax
call fcn.004de510
lea ecx, [esp + 0x18]
mov dword [esp + 0x40], 1
push ecx
mov ecx, edi
call fcn.004de920
lea ecx, [esp + 0x18]
mov ebp, eax
mov dword [esp + 0x40], 0xffffffff
call fcn.004de3d0
test ebp, ebp
je 0x43b416
inc dword [esp + 0x10]
test edi, edi
je 0x43b37f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x48]
cmp edx, eax
jl 0x43b3ca
mov ebp, dword [esp + 0x14]
mov eax, esi
push 0
push eax
mov ecx, ebx
inc esi
call fcn.004b4f80
push eax
mov ecx, ebp
call fcn.004de800
mov eax, esi
push 0
push eax
mov ecx, ebx
inc esi
call fcn.004b4f80
push str..END
lea ecx, [esp + 0x1c]
mov edi, eax
call fcn.004de510
lea eax, [esp + 0x18]
mov ecx, edi
push eax
mov dword [esp + 0x44], 2
call fcn.004de920
test eax, eax
jne 0x43b481
test edi, edi
mov byte [esp + 0x48], 1
jne 0x43b486
mov byte [esp + 0x48], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x40], 0xffffffff
call fcn.004de3d0
mov al, byte [esp + 0x48]
test al, al
je 0x43b4d8
push 0x51c56c
lea ecx, [esp + 0x2c]
call fcn.004de510
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 3
push ecx
mov ecx, ebp
call fcn.004de800
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xffffffff
call fcn.004de3d0
push edi
jmp 0x43b43c
mov eax, ebp
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x43bb90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fb598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046b880
mov ebx, dword [esp + 0x34]
mov ecx, dword [esp + 0x20]
xor eax, eax
mov dword [esi], 0x50290c
mov dword [esi + 8], str.Button_gump
mov dword [esp + 0x18], eax
mov dword [esi + 0xe4], eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xd0], eax
mov dword [esi + 0xc4], eax
mov dword [esi + 0xd4], eax
mov dword [esi + 0xe8], eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xec], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0xac], eax
mov word [esi + 0xb4], ax
mov dword [esi + 0xb0], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov dword [esi + 0xa0], ebx
mov ebx, dword [esp + 0x3c]
sub eax, ecx
mov dword [esi + 0xe0], ebx
mov ebx, dword [esp + 0x40]
mov dword [esi + 0x30], ecx
lea ecx, [eax + 1]
mov dword [esi + 0xcc], ebx
mov ebx, ecx
mov edi, 1
and ebx, reloc.DSOUND.dll_DirectSoundCreate
mov dword [esi + 0xd8], edi
mov dword [esi + 0xb8], 0xa
mov dword [esi + 0xbc], edi
mov dword [esi + 0x34], edx
jns 0x43bc7e
dec ebx
or ebx, 0xfffffffe
inc ebx
cmp ebx, edi
jne 0x43bc8d
add eax, 2
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
jmp 0x43bc93
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
sub eax, edx
push str.framedata_for_CButtonGump
inc eax
push 0x10
mov dword [esi + 0x24], eax
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], 2
call fcn.004b9f50
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x40], edi
add esp, 8
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x24