joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401080
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
push section..text
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x6b5374], eax
ret 4

Function at 0x4011c0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
mov ecx, 0x6b7a78
call fcn.00419590
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
mov dword [0x6b4e54], ebp
call ebx
mov edi, eax
push 7
add edi, edi
call ebx
mov esi, eax
push 4
add esi, esi
call ebx
lea ecx, [esi + eax]
mov esi, dword [0x6efe44]
xor edx, edx
mov eax, esi
div dword [0x6ef3d0]
mov eax, dword [0x6ef3d4]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x40121d
cmp dword [edx], esi
je 0x401261
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x401212
push 0
push ebp
push 0
push 0
add ecx, 0x300
push ecx
add edi, 0x400
push edi
push 0
push 0x80000000
push 0x2ca0000
push 0x6b4e58
push 0x6b5070
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x6b4e40], esi
test esi, esi
jne 0x40127d
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [edx + 4]
test edx, edx
je 0x40121d
mov eax, dword [edx + 8]
push 0
push ebp
push 0
add eax, ecx
mov ecx, dword [edx + 4]
push 0
push eax
add ecx, edi
push ecx
jmp 0x401232
mov edx, dword [esp + 0x18]
push edx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x6b5ca8
call fcn.00402020
cmp dword [0x6c6030], 0
push 0
mov ecx, 0x6b5ca8
push 0
jne 0x4012ce
push 1
call fcn.00401de0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
push 2
call fcn.00401de0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x401680
Capabilities:
Create directory
Delete file

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push esi
call fcn.00401080
mov eax, dword [esp + 0x2c]
mov dword [0x6b4e38], 0
mov ecx, str.gvkc9jw0ot0Ut
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4016c1
test dl, dl
je 0x4016bd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4016c1
add eax, 2
add ecx, 2
test dl, dl
jne 0x4016a1
xor eax, eax
jmp 0x4016c6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4016e7
push 0
push str.Error__
push 0x591748
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
call fcn.004877c0
test eax, eax
je 0x4016de
push esi
call fcn.00401080
push str.._Log_Debug.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x591734
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str._______________________________________________________
push 0x6d4984
call fcn.00519220
push str._____________________Client_Start______________________
push 0x6d4984
call fcn.00519220
push str._______________________________________________________
push 0x6d4984
call fcn.00519220
add esp, 0x18
call fcn.004010a0
mov ecx, 0x6d5e58
call fcn.00529490
push 0x6ef2a2
push 0x6b4e58
call fcn.0056d39f
push 0x6ef2a2
push 0x6b5070
call fcn.0056d39f
push esi
call fcn.00401610
add esp, 0x14
mov ecx, 0x6d5e58
call fcn.00524690
push str.._Resource_QuestScript_QuestString.bin
mov ecx, 0x6cfab0
call fcn.004de1a0
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x6cfab0
call fcn.004dedf0
push str.._Resource_QuestScript_NewbieGuide.bin
mov ecx, 0x6cfab0
call fcn.004dcf50
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x6cfab0
call fcn.004de380
mov ecx, 0x6c36d8
call fcn.004275a0
mov eax, dword [esp + 0x30]
push eax
push esi
call fcn.004011c0
add esp, 8
test eax, eax
jne 0x4017e4
call fcn.00401170
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
call esi
test eax, eax
je 0x40181b
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esp + 0xc]
push eax
call ebx
jmp 0x4017f8
mov ecx, 0x6b5ca8
call fcn.004023b0
cmp eax, 0xffffffff
jne 0x4017f8
call fcn.00401170
mov eax, dword [esp + 0x14]
pop edi
pop ebx
pop esi
add esp, 0x1c
ret 0x10
Function at 0x4145a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x130
mov eax, dword [0x6b3854]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
mov esi, dword [esp + 0x13c]
xor ebx, ebx
mov dword [esp + 0x24], esi
cmp esi, ebx
je 0x414752
cmp byte [esi], bl
je 0x414752
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414752
mov edx, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x414624
mov dword [esp + 0xc], 0x64
push edi
xor edi, edi
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x10], ebx
jbe 0x414740
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea esp, [esp]
xor eax, eax
push edi
push str._04u
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], al
lea eax, [esp + 0x38]
push 5
push eax
call fcn.00411240
mov eax, dword [esp + 0x28]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x3c]
push edx
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414719
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 0x104
call ebp
test eax, eax
je 0x4146bf
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x414719
push esi
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4146dc
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x414719
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push str.Characteristics
push edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], 4
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x414737
mov esi, dword [esp + 0x2c]
inc edi
cmp edi, dword [esp + 0x14]
jb 0x414640
mov edx, dword [esp + 0x18]
pop ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x414754
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
pop ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x414754
xor eax, eax
mov ecx, dword [esp + 0x134]
pop esi
pop ebx
xor ecx, esp
call fcn.0056ca39
add esp, 0x130
ret 4
Function at 0x414770
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 8
push ebp
push edi
lea eax, [esp + 8]
xor edi, edi
push eax
push edi
mov ebp, ecx
mov dword [esp + 0x10], edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x4147b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push ecx
call fcn.00411240
add esp, 0x10
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
mov edx, dword [esp + 8]
push esi
push edx
call fcn.0056e027
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
cmp esi, edi
jne 0x4147e5
mov eax, dword [esp + 0x18]
push str.GetMAC_Failed__Because_malloc_failed_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x414820
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x18]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push edx
call fcn.00411240
push esi
call fcn.0056dfed
add esp, 0x14
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [esi + 0x190]
cmp eax, 6
jb 0x41485b
cmp eax, 8
ja 0x41485b
push eax
lea eax, [esi + 0x194]
push eax
push ebx
call fcn.0056d640
mov edi, dword [esi + 0x190]
add esp, 0xc
lea ecx, [esi + 8]
push ecx
mov ecx, ebp
call fcn.004145a0
test al, 4
jne 0x414861
mov esi, dword [esi]
test esi, esi
jne 0x414825
mov edx, dword [esp + 0x14]
push edx
call fcn.0056dfed
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
add esp, 8
ret 4
Function at 0x41ec50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x584693
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x6b3854]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0xa4]
mov dword fs:[0], eax
mov ecx, dword [esp + 0xbc]
xor ebx, ebx
mov eax, ecx
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x41ecb0
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x34]
call fcn.0041eae0
mov dword [esp + 0xac], ebx
cmp dword [esp + 0x3c], ebx
jbe 0x41ee52
mov ebp, dword [esp + 0xb8]
xor esi, esi
cmp esi, dword [esp + 0x3c]
jae 0x41ee52
push 1
push esi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x20], 0x7c
call fcn.0041e050
mov esi, eax
cmp esi, ebx
jl 0x41ee52
push 2
lea ecx, [esi + 1]
push ecx
lea edx, [esp + 0x6c]
push edx
lea ecx, [esp + 0x38]
call fcn.0041ebd0
push esi
push ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0xb8], 1
call fcn.0041ebd0
cmp dword [esp + 0x78], 0x10
mov eax, dword [esp + 0x64]
mov byte [esp + 0xac], 2
jae 0x41ed4b
lea eax, [esp + 0x64]
push eax
call fcn.0056deea
mov edi, eax
add esp, 4
cmp edi, 0x37
ja 0x41ee05
lea ecx, [esp + 0x80]
call fcn.004222f0
fld1
mov eax, dword [esp + 0x58]
fst dword [esp + 0x20]
lea ecx, [ebp - 2]
fstp dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
fild dword [esp + 0x18]
lea edx, [eax + eax*2]
add edx, edx
mov dword [esp + 0x18], edx
fstp dword [esp + 0x28]
mov byte [esp + 0xac], 3
fild dword [esp + 0x18]
jns 0x41eda5
fadd dword [0x591970]
fild dword [esp + 0xb4]
push ebx
lea eax, [esp + 0x84]
push eax
fadd qword [0x593bf0]
add edi, 0x94
push edi
mov ecx, 0x6c36d8
faddp st(1)
fstp dword [esp + 0x30]
call fcn.00426e50
fldz
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
push ecx
push ecx
fstp dword [esp]
push ebx
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x94]
call fcn.00422330
lea ecx, [esp + 0x80]
mov byte [esp + 0xac], 2
call fcn.00422300
mov edi, 0x10
add esi, 2
cmp dword [esp + 0x5c], edi
jb 0x41ee20
mov eax, dword [esp + 0x48]
push eax
call fcn.0056d635
add esp, 4
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
mov byte [esp + 0xac], bl
cmp dword [esp + 0x78], edi
jb 0x41ee4a
mov ecx, dword [esp + 0x64]
push ecx
call fcn.0056d635
add esp, 4
cmp esi, ebx
jge 0x41ecde
cmp dword [esp + 0x40], 0x10
jb 0x41ee66
mov edx, dword [esp + 0x2c]
push edx
call fcn.0056d635
add esp, 4
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.0056ca39
add esp, 0x9c
ret 0xc
Function at 0x4332e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x585c73
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.00426110
xor edi, edi
lea ecx, [esi + 0x50]
mov dword [esp + 0x1c], edi
mov dword [esi], vtable.cWindow.0
call fcn.00425410
mov ebx, 1
lea ecx, [esi + 0x194]
mov byte [esp + 0x1c], bl
call fcn.004222f0
fldz
fst dword [esi + 0x1e4]
xor eax, eax
fstp dword [esi + 0x1e8]
mov ecx, ebx
fld1
xor edx, edx
fst dword [esi + 0x1f0]
mov word [esi + 0x1c], ax
fstp dword [esi + 0x1f4]
mov dword [esi + 8], edi
mov word [esi + 0xc], cx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edi
mov dword [esi + 0x1ec], edx
mov dword [esi + 0x1b4], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 4], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x1b8], 0xffffff
mov dword [esi + 0x1bc], 0xff
mov dword [esi + 0x1c0], 0x64
mov dword [esi + 0x18], fcn.00407d10
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x434be0
Capabilities:
Delete file

Disassembly:
push esi
push edi
push 0x59195c
push str.._image_InterfaceScript_AdvancedSetDlg.bin
mov edi, ecx
call fcn.004346a0
mov ecx, dword [edi + 0x18]
mov esi, eax
push esi
call fcn.0056aac0
mov ecx, esi
call fcn.004fb960
pop edi
mov dword [0x6b667c], esi
mov ecx, esi
pop esi
jmp fcn.004fc150

Function at 0x435ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0x59195c
push str.._image_InterfaceScript_21.bin
mov edi, ecx
call fcn.004346a0
fild dword [0x6ef208]
mov esi, eax
mov eax, dword [0x6ef208]
test eax, eax
jns 0x435ade
fadd dword [0x591970]
movzx ecx, word [esi + 0x1ec]
mov ebx, dword [esi]
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
fsubp st(1)
fsub qword [0x591d80]
fstp dword [esp + 0xc]
fld dword [esi + 0x1c8]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
call fcn.0056dc70
fld dword [esp + 0xc]
push eax
call fcn.0056dc70
mov edx, dword [ebx + 0x24]
push eax
mov ecx, esi
call edx
mov ecx, dword [edi + 0x18]
push esi
call fcn.0056aac0
mov ecx, esi
mov dword [0x6b6400], esi
call fcn.004bd250
call fcn.004fdc50
pop edi
pop esi
mov ecx, eax
pop ebx
add esp, 8
jmp fcn.004fdcd0

Function at 0x43b200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x585ebb
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x6b3854]
xor eax, esp
mov dword [esp + 0xc0], eax
push esi
push edi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.004222f0
push 0
lea eax, [esp + 0x10]
push eax
push 0x3f
mov ecx, 0x6c36d8
mov dword [esp + 0xe4], 0
call fcn.00426e50
push 0x166
mov ecx, 0x6c3648
call fcn.004264a0
lea edx, [esp + 0x4c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43b277
mov eax, dword [0x6c5f84]
lea ecx, [eax + eax*4]
shl ecx, 7
add ecx, 0x6c5544
push ecx
mov ecx, dword [0x6b63f8]
lea edx, [esp + 0x30]
push edx
call fcn.004b9260
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x50]
push ecx
mov edx, ecx
push str._s__s_
push edx
call edi
add esp, 0x10
push 0x33517d
lea eax, [esp + 0x10]
push eax
push 0xffffff
lea ecx, [esp + 0x58]
push ecx
mov ecx, dword [esi + 0x21c]
call fcn.00433690
push 0x168
mov ecx, 0x6c3648
call fcn.004264a0
lea edx, [esp + 0x4c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43b2f4
mov eax, dword [0x6c5f84]
mov ecx, dword [0x6b63f8]
lea eax, [eax + eax*4]
shl eax, 7
add eax, 0x6c5594
push eax
lea edx, [esp + 0x30]
push edx
call fcn.004b9260
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x50]
push ecx
mov edx, ecx
push str._s__s_
push edx
call edi
add esp, 0x10
push 0x33517d
lea eax, [esp + 0x10]
push eax
push 0xffffff
lea ecx, [esp + 0x58]
push ecx
mov ecx, dword [esi + 0x224]
call fcn.00433690
lea ecx, [esp + 0xc]
mov dword [esp + 0xd8], 0xffffffff
call fcn.00422300
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0056ca39
add esp, 0xd0
ret
Function at 0x43cf00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5860df
mov eax, dword fs:[0]
push eax
sub esp, 0x104
mov eax, dword [0x6b3854]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
movzx esi, word [esp + 0x128]
mov eax, 0x74
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov eax, 0x62
mov edi, ecx
xor ebp, ebp
mov ebx, 1
lea ecx, [esp + 0x38]
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ebp
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], 2
mov dword [esp + 0x9c], 3
mov dword [esp + 0xa0], 4
mov dword [esp + 0xa4], 5
mov dword [esp + 0xa8], 6
mov dword [esp + 0xac], 7
mov dword [esp + 0xb0], 8
mov dword [esp + 0xb4], 9
mov dword [esp + 0xb8], 0xa
mov dword [esp + 0xbc], 0xb
mov dword [esp + 0xc0], 0xc
mov dword [esp + 0xc4], 0xd
mov dword [esp + 0xc8], 0xe
mov dword [esp + 0xcc], 0xf
mov dword [esp + 0xd0], 0x10
mov dword [esp + 0xd4], 0x11
mov dword [esp + 0xd8], 0x12
mov dword [esp + 0xdc], 0x13
mov dword [esp + 0xe0], 0x14
mov dword [esp + 0xe4], 0x15
mov dword [esp + 0xe8], 0x16
mov dword [esp + 0xec], 0x17
mov dword [esp + 0xf0], 0x18
mov dword [esp + 0xf4], 0x19
mov dword [esp + 0xf8], 0x1a
mov dword [esp + 0xfc], 0x1b
mov dword [esp + 0x100], 0x1c
mov dword [esp + 0x104], 0x1d
mov dword [esp + 0x108], 0x4d
mov dword [esp + 0x10c], 0x4e
mov dword [esp + 0x110], 0x4f
call fcn.004222f0
lea ecx, [esp + 0x18]
mov dword [esp + 0x120], ebp
call fcn.004222f0
lea ecx, [esp + 0x58]
mov byte [esp + 0x120], bl
call fcn.004222f0
mov eax, esi
lea esi, [eax + eax*2]
add esi, esi
push ebp
lea eax, [esp + 0x1c]
add esi, esi
mov ecx, dword [esp + esi + 0x7c]
push eax
push ecx
mov ecx, 0x6c36d8
mov byte [esp + 0x12c], 2
call fcn.00426e50
mov eax, dword [esp + esi + 0x7c]
push ebp
lea edx, [esp + 0x5c]
push edx
push eax
mov ecx, 0x6c36d8
call fcn.00426e50
mov edx, dword [esp + esi + 0x80]
push ebp
lea ecx, [esp + 0x3c]
push ecx
push edx
mov ecx, 0x6c36d8
call fcn.00426e50
push 0x3d8
call fcn.0056dadb
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x120], 3
cmp eax, ebp
je 0x43d181
mov ecx, eax
call fcn.00438f20
mov esi, eax
jmp 0x43d183
xor esi, esi
mov ebp, dword [esi]
lea ecx, [edi + 0x284]
mov byte [esp + 0x120], 2
call fcn.0056b300
push eax
push 0
lea eax, [esp + 0x60]
push eax
movzx eax, word [edi + 0x23e]
lea ecx, [esp + 0x24]
push ecx
movzx ecx, word [edi + 0x23c]
lea edx, [esp + 0x48]
push edx
mov edx, dword [ebp + 0x40]
push eax
push ecx
push 0
push 0
mov ecx, esi
call edx
lea ecx, [esp + 0x58]
mov dword [esi + 0x24], ebx
mov byte [esp + 0x120], bl
call fcn.00422300
lea ecx, [esp + 0x18]
mov byte [esp + 0x120], 0
call fcn.00422300
lea ecx, [esp + 0x38]
mov dword [esp + 0x120], 0xffffffff
call fcn.00422300
mov eax, esi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0056ca39
add esp, 0x110
ret 4
Function at 0x44fbd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x58cdd8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6b3854]
xor eax, esp
mov dword [esp + 0x18], eax
push ebp
push esi
push edi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
movzx ebp, word [esp + 0x3c]
push ebp
mov edi, ecx
call fcn.0044ef10
mov esi, eax
test esi, esi
js 0x44fde0
cmp esi, 3
jg 0x44fde0
mov eax, dword [0x6c414c]
cmp byte [eax + 0x450], 0
je 0x44fdf4
lea ecx, [esp + 0x10]
call fcn.00538ac0
lea ecx, [esi + esi*4]
push ebp
lea ecx, [edi + ecx*4 + 0x2b8]
mov dword [esp + 0x38], 0
call fcn.004508c0
test eax, eax
je 0x44fdcd
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x78]
call eax
movzx eax, ax
push eax
call fcn.00402f70
mov ecx, eax
call fcn.0052f150
mov esi, eax
test esi, esi
je 0x44fdcd
movzx eax, word [esi + 0x1c]
mov ecx, dword [0x6c414c]
push eax
call fcn.0048a510
mov edi, eax
test edi, edi
je 0x44fdcd
mov ecx, dword [0x6c414c]
cmp dword [ecx + 0x404], 0
je 0x44fcbb
movzx eax, word [esi + 0x1c]
push eax
call fcn.00402f70
mov ecx, eax
call fcn.0052f150
mov esi, eax
movzx eax, word [esi + 0x1c]
mov ecx, dword [0x6c414c]
push eax
call fcn.0048a560
movzx ecx, ax
xor eax, eax
test cx, cx
je 0x44fce2
push ecx
call fcn.00402f70
mov ecx, eax
call fcn.0044f2c0
movzx ecx, word [esi + 0x86b]
test cx, cx
mov ecx, dword [0x6c414c]
jne 0x44fd21
cmp byte [ecx + 0x149], 0
je 0x44fd21
push 0x531
mov ecx, 0x6c6100
call fcn.004c00d0
push eax
push 0x1d
push 0x6c6100
call fcn.004c13e0
add esp, 0xc
jmp 0x44fdcd
push eax
push edi
push ecx
mov ecx, esi
call fcn.0052e170
test eax, eax
jne 0x44fd40
mov edx, dword [0x6c414c]
mov dword [edx + 0x978], eax
jmp 0x44fdcd
movzx eax, word [esi + 0x41]
test ax, ax
jne 0x44fd95
mov ecx, 0x6c4148
call fcn.00490010
mov edi, eax
test edi, edi
je 0x44fd8b
cmp dword [edi + 0x31c], 0
jne 0x44fdcd
mov ecx, edi
call fcn.0048d6b0
cmp al, 0x14
je 0x44fdcd
push 0
push edi
lea ecx, [esp + 0x18]
call fcn.005387e0
mov ecx, dword [0x6c414c]
lea eax, [esp + 0x10]
push eax
call fcn.0044ecb0
jmp 0x44fdac
push 0x190
jmp 0x44fd02
cmp eax, 1
jne 0x44fdac
mov ecx, dword [0x6c414c]
push 0
push ecx
lea ecx, [esp + 0x18]
call fcn.005387e0
call fcn.00402f70
push 1
lea edx, [esp + 0x14]
mov dword [eax + 0x64], esi
mov eax, dword [0x6c414c]
push edx
push eax
call fcn.00402f70
mov ecx, eax
call fcn.00531700
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0xffffffff
call fcn.00407d10
jmp 0x44fdf4
push 0
push 0x384
push str.MugongDialog.cpp
call fcn.0051eca0
add esp, 0xc
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0056ca39
add esp, 0x28
ret 4
Function at 0x4518b0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x586976
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.0041d210
xor ebx, ebx
lea ecx, [esi + 0x218]
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.CBigMapDlg.0
call fcn.00453bc0
mov dword [esi + 0x290], ebx
mov dword [esi + 0x294], ebx
mov dword [esi + 0x298], ebx
mov dword [esi + 0x29c], ebx
mov dword [esi + 0x2a0], ebx
mov dword [esi + 0x2a4], ebx
mov dword [esi + method.CMemoryPoolTempl_class_CMiniMapIcon_.virtual_0], vtable.CMemoryPoolTempl_class_CMiniMapIcon_.0
mov dword [esi + 0x2b8], ebx
mov dword [esi + 0x2bc], ebx
mov byte [esi + 0x2c4], bl
push 0x453d30
push 0x450d10
push 0x14
push 0xc
lea eax, [esi + 0x444]
push eax
mov byte [esp + 0x30], 3
call fcn.0056e17c
lea ecx, [esi + 0x538]
mov byte [esp + 0x1c], 4
call fcn.0043b470
lea ecx, [esi + 0x55c]
mov byte [esp + 0x1c], 5
call fcn.004222f0
push 0x40
lea ecx, [esi + 0x290]
mov byte [esp + 0x20], 6
call fcn.0048db10
push 0x80
lea ecx, [esi + 0x2c4]
push 0x5971dc
push ecx
call fcn.0056ddb0
lea edi, [esi + 0x2b8]
add esp, 0xc
mov dword [esi + 0x2c0], 0xa
cmp dword [edi], ebx
jne 0x4519c7
push 0x64
push edi
call fcn.00451640
mov edx, dword [edi]
add esp, 8
mov dword [esi + 0x2bc], edx
mov eax, esi
mov dword [esi + 0x1b8], 0x78ffffff
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x454c40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x586c66
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CMunpaMarkManager.0
mov dword [esp + 0x18], 1
call fcn.00454bc0
lea ecx, [esi + 0x28]
call fcn.00426b10
mov eax, dword [esi + 0x30]
test eax, eax
je 0x454c9b
push eax
call fcn.0056dc07
add esp, 4
mov dword [esi + 0x30], 0
lea ecx, [esi + 4]
call fcn.00426b10
mov eax, dword [esi + 0xc]
test eax, eax
je 0x454cba
push eax
call fcn.0056dc07
add esp, 4
mov dword [esi + 0xc], 0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret