joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61c770
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x78377e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov eax, dword [esp + 0x24]
push ebx
mov dword [esi], eax
mov eax, 1
push 0x25
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov eax, 0x64
push str..CControlGroup.cpp
push 0x44
mov dword [esp + 0x2c], ebx
mov dword [esi + 0x14], 0x12
mov dword [esi + 0x44], ebx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], ebx
call sub.Storm.dll_Ordinal_401
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x1c], 1
je 0x61c80e
mov ecx, dword [esi]
push ebx
push 0xffffffffffffffff
push ecx
mov ecx, eax
call fcn.00414610
jmp 0x61c810
xor eax, eax
push ebx
push 0x29
push str..CControlGroup.cpp
push 0x44
mov dword [esi + 0x38], eax
call sub.Storm.dll_Ordinal_401
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x1c], 2
je 0x61c846
mov edx, dword [esi]
push 0x40000
push 0xffffffffffffffff
push edx
mov ecx, eax
call fcn.00414610
jmp 0x61c848
xor eax, eax
push ebx
mov ecx, eax
mov byte [esp + 0x20], bl
mov dword [esi + 0x3c], eax
call fcn.0040ad30
push ebx
push 0x2c
push str..CControlGroup.cpp
push 0x40
call sub.Storm.dll_Ordinal_401
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x1c], 3
je 0x61c88d
mov ecx, dword [esp + 0x28]
mov edx, dword [esi]
push 0x30000
push ecx
push edx
mov ecx, eax
call fcn.00414df0
jmp 0x61c88f
xor eax, eax
push esi
push 0x61c740
mov ecx, eax
mov byte [esp + 0x24], bl
mov dword [esi + 0x40], eax
call fcn.0040abf0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x628a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7840fb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor eax, eax
mov dword [esi], vtable.CAIPane.0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x28], edx
mov edx, 1
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], edx
mov dword [esi + 0xc], eax
xor edx, edx
mov dword [esi + 0x10], edx
mov dword [esp + 0x1c], eax
mov dword [esi + 8], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x3c], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x14], edi
xor ebx, ebx
mov dword [esi + 4], ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x54]
call edx
mov ecx, dword [esi + 4]
mov dword [esi + 0x48], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x5c]
call edx
mov dword [esi + 0x4c], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x642d00
Capabilities:
Get graphical window text

Disassembly:
mov eax, ecx
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x642d0e
jmp fcn.004132b0
mov eax, dword [eax + 8]
test eax, eax
je 0x642d1c
mov ecx, eax
jmp fcn.004132b0
ret 8
Function at 0x64f3d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x786608
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov byte [esp + 0x1c], 1
call fcn.004ba3a0
mov dword [esi + 0x70], eax
call fcn.004ba550
mov dword [esi + 0x74], eax
call fcn.004ba8b0
mov dword [esi + 0x78], eax
call fcn.004ba940
mov dword [esi + 0x7c], eax
call fcn.004ba9d0
mov dword [esi + 0x80], eax
call fcn.004ba430
mov dword [esi + 0x84], eax
call fcn.004ba4c0
mov cx, word [esp + 0x28]
mov dword [esi + 0x88], eax
mov eax, dword [esp + 0x24]
mov dword [esi], eax
mov eax, dword [esp + 0x2c]
mov word [esi + 0x20], cx
mov edx, dword [eax]
mov dword [esi + 4], edx
mov ecx, dword [eax + 4]
mov dword [esi + 8], ecx
mov edx, dword [eax + 8]
mov ecx, dword [esp + 0x30]
push edi
push 0x3b
mov dword [esi + 0xc], edx
mov eax, dword [eax + 0xc]
mov edx, dword [esp + 0x3c]
or ebp, 0xffffffff
push str..CTriggerFunctionDisplay.cpp
push 0x44
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x14], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x54], ebp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x60], ebp
mov dword [esi + 0x64], ebp
mov dword [esi + 0x4c], ebp
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
call sub.Storm.dll_Ordinal_401
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
cmp eax, edi
mov byte [esp + 0x1c], 2
je 0x64f4f5
mov ecx, dword [esi]
push 0x10000
push ebp
push ecx
mov ecx, eax
call fcn.00414370
jmp 0x64f4f7
xor eax, eax
push edi
mov ecx, eax
mov byte [esp + 0x20], 1
mov dword [esi + 0x44], eax
call fcn.0040ee40
mov ecx, dword [esi + 0x44]
push 1
mov dword [ecx + 0x40], edi
call fcn.0040abd0
mov ecx, dword [esi + 0x44]
push 1
mov dword [ecx + 0x3c], 0xff606060
call fcn.0040abd0
push edi
push 0x41
push str..CTriggerFunctionDisplay.cpp
push 0x44
call sub.Storm.dll_Ordinal_401
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
cmp eax, edi
mov byte [esp + 0x1c], 3
je 0x64f557
mov edx, dword [esi]
push 0x20000
push ebp
push edx
mov ecx, eax
call fcn.00414610
jmp 0x64f559
xor eax, eax
mov ecx, esi
mov byte [esp + 0x1c], 1
mov dword [esi + 0x48], eax
call fcn.0064e5f0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 0x14
Function at 0x6527c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x4c]
mov ecx, esi
call fcn.004cb930
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [edi + 0x5c], eax
mov ecx, edi
pop edi
pop esi
jmp fcn.00652090

Function at 0x652f70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x786a31
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov eax, dword [esp + 0x20]
mov cx, word [esp + 0x24]
mov dword [esi + 0x34], eax
or eax, 0xffffffff
mov word [esi + 0x38], cx
mov edx, str.Default
mov ecx, str.ItemTable
mov byte [esp + 0x18], 2
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
call fcn.005b0130
mov edx, str.Default
mov ecx, str.ItemTable
mov dword [esi + 0x44], eax
call fcn.005b0130
mov ecx, esi
mov dword [esi + 0x48], eax
mov dword [esi + 0x88], edi
call fcn.00652e70
mov eax, 1
push edi
mov edx, str.MaxUnitLevel
mov ecx, str.Misc
mov dword [esi + 0x5c], edi
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x60], eax
call fcn.004b8a40
mov ecx, esi
mov dword [esi + 0x64], eax
call fcn.006518e0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8

Function at 0x6663e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x788096
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 4]
push eax
mov dword [esp + 0x18], 1
call fcn.004156a0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x666432
push 0
push 0xfffffffffffffffe
push 0x829be4
push eax
call sub.Storm.dll_Ordinal_403
mov esi, dword [esi + 0x20]
test esi, esi
je 0x666448
push 0
push 0xfffffffffffffffe
push 0x828734
push esi
call sub.Storm.dll_Ordinal_403
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x667e30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x78825e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CItemDialog.0
mov ecx, dword [esi + 0x30]
test ecx, ecx
mov dword [esp + 0x18], 2
je 0x667e7d
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x30], 0
mov edi, dword [esi + 0x34]
test edi, edi
je 0x667ea1
mov ecx, edi
call fcn.00642c80
push 0
push 0xffffffffffffffff
push 0x7987b8
push edi
call sub.Storm.dll_Ordinal_403
mov dword [esi + 0x34], 0
mov eax, dword [esi + 0x70]
test eax, eax
je 0x667eb7
push 0
push 0xfffffffffffffffe
push 0x828734
push eax
call sub.Storm.dll_Ordinal_403
lea ecx, [esi + 0x58]
call fcn.004cb9f0
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.004df3b0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x6687a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7883c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CUpgradeDialog.0
mov ecx, dword [esi + 0x30]
test ecx, ecx
mov dword [esp + 0x14], 0
je 0x6687ec
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x30], 0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004df3b0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x669260
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x788568
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CAbilityDialog.0
mov edi, dword [esi + 0x30]
test edi, edi
mov dword [esp + 0x18], 0
je 0x6692bb
mov ecx, edi
call fcn.006663e0
push 0
push 0xffffffffffffffff
push 0x7987b8
push edi
call sub.Storm.dll_Ordinal_403
mov dword [esi + 0x30], 0
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.004df3b0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x669540
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x7885e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CBuffDialog.0
mov edi, dword [esi + 0x30]
test edi, edi
mov dword [esp + 0x18], 0
je 0x66959b
mov ecx, edi
call fcn.00669750
push 0
push 0xffffffffffffffff
push 0x7987b8
push edi
call sub.Storm.dll_Ordinal_403
mov dword [esi + 0x30], 0
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.004df3b0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x66adf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x788899
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x20]
push 4
push eax
call fcn.004df260
mov ecx, dword [esi + 4]
push 0
mov edx, str.NewObjectDialog
mov dword [esp + 0x1c], 0
mov dword [esi], vtable.CNewObjectDialog.0
mov dword [esi + 0x30], 0
call fcn.005b0170
mov ecx, dword [esi + 4]
call fcn.004bf860
push 1
mov ecx, esi
call fcn.004df3f0
mov ecx, dword [esi + 4]
push 3
push str.WESTRING_NAME
push 1
push 0
xor edx, edx
call fcn.005b0470
push str.NameLabel
mov edx, str.NewObjectDialog
mov ecx, eax
call fcn.005b0220
push 0
push 0x2a
push str..CNewObjectDialog.cpp
push 0x40
call sub.Storm.dll_Ordinal_401
mov dword [esp + 0x20], eax
mov dword [esp + 0xc], eax
test eax, eax
mov byte [esp + 0x18], 1
je 0x66aeb3
mov ecx, dword [esi + 4]
push 0
push 0xc
push ecx
mov ecx, eax
call fcn.004156c0
jmp 0x66aeb5
xor eax, eax
push str.NameEdit
mov edx, str.NewObjectDialog
mov ecx, eax
mov byte [esp + 0x1c], 0
mov dword [esi + 0x30], eax
call fcn.005b0220
mov ecx, dword [esi + 0x30]
push 0x60
call fcn.0040b090
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 4
Function at 0x674250
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x78957f
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x84dea4]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
mov eax, dword [esp + 0x134]
mov ebx, dword [esp + 0x130]
push 5
mov esi, ecx
push eax
mov dword [esp + 0x1c], esi
call fcn.004df260
xor edi, edi
mov dword [esi], vtable.CTriggerParameterDialog.0
mov dword [esp + 0x128], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xe4], edi
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf0], edi
mov byte [esp + 0x128], 4
call fcn.004ba3a0
mov dword [esi + 0xf4], eax
call fcn.004ba550
mov dword [esi + 0xf8], eax
call fcn.004ba8b0
mov dword [esi + 0xfc], eax
call fcn.004ba940
mov dword [esi + 0x100], eax
call fcn.004ba9d0
mov dword [esi + 0x104], eax
call fcn.004ba430
mov dword [esi + 0x108], eax
call fcn.004ba4c0
mov ecx, dword [esp + 0x13c]
mov dword [esi + 0x10c], eax
mov eax, dword [esp + 0x138]
push Ordinal_2
push ebx
lea ebp, [esi + 0x64]
push ebp
mov dword [esi + 0xc8], 1
mov dword [esi + 0xdc], eax
mov dword [esi + 0xc0], ecx
mov dword [esi + 0xe0], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0xc4], 0xffffffff
mov dword [esi + 0xd4], edi
mov dword [esi + 0xd8], edi
call sub.Storm.dll_Ordinal_501
mov ecx, ebp
call fcn.005c07c0
mov edx, dword [esi + 4]
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], 0xffffffff
mov dword [edx + 0x60], 1
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov edx, dword [eax]
push edi
push 0xc8
push 0x1c2
call edx
lea ebp, [esi + 0x84]
push ebp
push ebx
mov ecx, esi
call fcn.00671850
mov ecx, eax
call fcn.004f1220
test eax, eax
je 0x674421
mov eax, dword [ebp]
push eax
mov ecx, esi
call fcn.00671850
mov ecx, eax
call fcn.004f10e0
push eax
jmp 0x674441
push edi
push 0x104
lea edx, [esp + 0x20]
mov ecx, str.WESTRING_UNKNOWN
mov dword [ebp], 0xffffffff
call fcn.004da2f0
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 4]
call fcn.004131e0
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0xcc], edi
mov eax, esi
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.00735f58
add esp, 0x118
ret 0x10
Function at 0x67dac0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0
push 0xffffffffffffffff
mov esi, ecx
lea edi, [eax + 1]
push str.new__
push edi
mov dword [esi], vtable.mdl_scan.0
mov dword [esi + 8], eax
call sub.Storm.dll_Ordinal_401
mov dword [esi + 0x28], eax
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
push 0
push 0xffffffffffffffff
push str.new__
neg ecx
or ecx, eax
push ecx
call sub.Storm.dll_Ordinal_401
cmp dword [esi + 0x28], 0
mov dword [esi + 4], eax
je 0x67db55
test eax, eax
je 0x67db55
mov eax, dword [esp + 0xc]
mov edi, 1
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xa
mov dword [esi + 0x2c], eax
call dword [sym.imp.MSVCR80.dll___iob_func]
add eax, 0x20
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], eax
pop edi
mov dword [esi + 0x38], 0
mov eax, esi
pop esi
ret 8
push str.No_space_for_scanner_
push esi
call fcn.0067d920
add esp, 8
push 1
call dword [sym.imp.MSVCR80.dll_exit]
int3

Function at 0x6a63f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x78a588
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00422100
xor edi, edi
mov dword [esi], vtable.CLayer.0
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea eax, [esi + 0x18]
mov dword [eax + 4], edi
mov dword [eax], eax
not eax
mov dword [esp + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
fldz
mov eax, dword [esp + 0x24]
fst dword [esi + 0x34]
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
fst dword [esi + 0x6c]
fstp dword [esi + 0x70]
lea eax, [esi + 0x78]
mov dword [eax + 4], edi
mov dword [eax], eax
not eax
mov dword [esi + 0x74], edi
mov dword [esi + 0x7c], eax
lea ecx, [esi + 0x80]
call fcn.006a6100
mov eax, dword [esp + 0x20]
cmp eax, edi
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x18], 7
mov dword [esi + 0xa8], ecx
mov byte [esi + 0xac], 0xff
mov dword [esi + 0x44], esi
mov dword [esi + 0x68], esi
je 0x6a64d4
test byte [eax + 0xb0], 3
jne 0x6a64c9
lea ecx, [edi + 1]
jmp 0x6a64cb
xor ecx, ecx
xor edx, edx
cmp ecx, edi
sete dl
mov edi, edx
mov ecx, dword [esi + 0xb0]
and edi, 1
or edi, 6
push 1
and ecx, 0xffffffcc
add edi, edi
or edi, ecx
push 1
push eax
mov ecx, esi
mov dword [esi + 0xb0], edi
call fcn.006a53a0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc
Function at 0x6d9840
Capabilities:
Write file on windows

Disassembly:
push esi
push 0x79c170
push eax
call dword [sym.imp.MSVCR80.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x6d9858
pop esi
ret
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
push ebx
push esi
push eax
push 1
push ecx
call dword [sym.imp.MSVCR80.dll_fwrite]
push esi
mov ebx, eax
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 0x14
test eax, eax
je 0x6d987f
pop ebx
xor eax, eax
pop esi
ret
xor eax, eax
cmp ebx, dword [edi + 4]
pop ebx
sete al
pop esi
ret

Function at 0x6e24d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x78c569
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
lea edi, [esi + 0x10]
mov ecx, edi
mov dword [esi + 4], ebx
mov dword [esi], vtable.CDatabaseBase.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.006e1890
mov dword [edi], vtable.CDatabaseHashTable.0
lea edi, [esi + 0x38]
mov ecx, edi
call fcn.006e1890
mov dword [edi], vtable.CDatabaseHashTable.0
push ebx
push 0x13a
push str..Database.cpp
push 0x34
mov dword [esp + 0x38], ebx
mov dword [esi], vtable.CSLKDatabase.0
call sub.Storm.dll_Ordinal_401
mov edi, eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
cmp edi, ebx
mov ebp, dword [esp + 0x30]
mov byte [esp + 0x28], 1
je 0x6e256b
push ebp
mov ecx, edi
call fcn.006e1df0
jmp 0x6e256d
xor edi, edi
mov ecx, esi
mov byte [esp + 0x28], bl
mov dword [esi + 0x60], edi
mov dword [esi + 8], ebp
call fcn.006e2370
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x6ea9e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x78cbf6
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 6
call fcn.006ea850
fldz
lea eax, [esi + 0xdc]
fst dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
fst dword [esp + 0x14]
mov edx, dword [esp + 0x14]
fst dword [esp + 0x18]
mov dword [esi], vtable.COmniLight.0
xor ebx, ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
fstp dword [eax + 0x18]
mov dword [eax + 0x1c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 0x20], edx
mov dword [esp + 0x24], ebx
mov byte [eax + 0xc], bl
mov byte [eax + 0xd], bl
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov dword [eax], vtable.TManaged_class_NTempest::C3Vector_.0
mov dword [eax + 0x24], ecx
push ebx
push 5
push eax
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.006eb610
mov ecx, dword [esi + 0x20]
call fcn.0075d6b0
mov dword [eax + 4], 1
mov dword [eax], ebx
mov ecx, dword [esi + 0x20]
call fcn.0075d6d0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x6f55a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [ecx]
test ebx, ebx
mov eax, 0x7fed7fed
mov edx, 0xeeeeeeee
je 0x6f55e6
push esi
push edi
movzx ecx, bl
mov esi, ecx
shr esi, 4
mov esi, dword [esi*4 + 0x7f8658]
mov edi, ecx
and edi, 0xf
sub esi, dword [edi*4 + 0x7f8658]
add eax, edx
xor eax, esi
mov esi, edx
shl esi, 5
add esi, ecx
add esi, edx
shr ebx, 8
lea edx, [esi + eax + 3]
jne 0x6f55b3
pop edi
pop esi
pop ebx
ret