joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x44139c]
sub eax, 0x1a120c76
cmp eax, 0x9bcc90a7
jne 0x40e39f
xor dword [0x435710], 0x7f64a646
add dword [0x43adf8], 0xe3ce83f9
mov eax, dword [0x438734]
mov edx, dword [ebp + 8]
and eax, 0xfe1af785
shl eax, 6
sub dword [0x435d7c], eax
mov eax, dword [ebp + 0xc]
mov dword [0x43fa9c], 0x1ba88125
push esi
lea esi, [edx + eax*4]
movzx eax, word [0x44c956]
sub eax, 0x365de66a
mov word [0x44c956], ax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
dec dword [0x435ab8]
mov ecx, dword [0x435ab8]
mov eax, dword [0x437968]
add eax, 0xbcff6882
add eax, ecx
mov dword [0x437968], eax
cmp edx, esi
je 0x40e4bc
push edi
mov edi, 0xffff8b90
jmp 0x40e420
movsx ecx, word [0x4505c8]
movsx eax, word [0x44fd28]
sar ecx, 6
sub ecx, eax
movzx eax, word [0x44f502]
or ecx, 0x7f35c268
imul eax, ecx
mov word [0x44f502], ax
mov eax, dword [ebp - 4]
xor dword [edx], eax
add edx, 4
imul eax, dword [0x446868], 0x20140aa1
ror dword [ebp - 4], 1
mov dword [0x446868], eax
mov word [0x450060], di
movzx eax, word [0x44f538]
xor eax, 0x2c030184
mov word [0x44f538], ax
mov eax, dword [ebp - 4]
shr eax, 8
add al, byte [ebp - 4]
mov byte [ebp - 3], al
imul eax, dword [0x439f9c], 0xef02e8f9
mov dword [0x439f9c], eax
mov al, byte [ebp - 3]
add byte [ebp - 4], al
mov eax, dword [0x447094]
add eax, 0xd8b6ca30
xor dword [0x43c0e0], eax
dec dword [0x447094]
cmp edx, esi
jne 0x40e420
pop edi
add dword [0x4443dc], 0xcc7c150a
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4419d8]
not eax
and eax, 0xaa2c76dc
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [0x44148c], eax
movzx eax, word [0x447f06]
push esi
and eax, 0xfaa44781
xor esi, esi
mov word [0x447f06], ax
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x413ed3
lea esp, [esp]
or dword [0x4475b8], 0x32dc3f0b
test esi, esi
je 0x413e78
call fcn.00428150
movzx eax, al
mov ecx, 0xa
cdq
idiv ecx
test edx, edx
jne 0x413e78
movzx eax, word [0x4494c0]
imul eax, eax, 0xc75c80b6
mov word [0x4494c0], ax
call fcn.00428150
movzx eax, al
mov ecx, 0xa
cdq
idiv ecx
add dl, 0x30
mov byte [esi + edi], dl
mov eax, dword [0x4449dc]
and eax, 0xa8706aa6
cmp eax, 0x4c925a98
jg 0x413ea7
add dword [0x445e14], 0x81abd128
jmp 0x413ea7
mov dword [0x4444ec], 0xfe6db851
call fcn.00428150
movzx eax, al
mov ecx, 0x1a
cdq
idiv ecx
add dl, 0x61
mov byte [esi + edi], dl
imul eax, dword [0x43e27c], 0xa582ffde
mov dword [0x43e27c], eax
dec dword [0x445018]
inc esi
mov ecx, dword [0x445018]
movzx eax, word [0x44c826]
and ecx, 0x6458f75f
imul ecx, eax
mov word [0x44c826], cx
cmp esi, ebx
jne 0x413e10
mov ecx, dword [0x4396d0]
mov eax, dword [0x444134]
xor ecx, eax
mov eax, dword [0x441e48]
inc dword [0x4396d0]
or eax, ecx
dec dword [0x441e48]
cmp eax, 0xef8ec9c0
jl 0x413f09
imul eax, dword [0x44076c], 0x22d32a8c
mov dword [0x44076c], eax
mov byte [esi + edi], 0
inc dword [0x4453e0]
mov ecx, dword [0x4453e0]
mov edx, dword [0x43db1c]
mov eax, dword [0x436cf4]
add eax, ecx
pop edi
add edx, eax
pop esi
mov word [0x44f3fe], dx
dec dword [0x43db1c]
pop ebx
pop ebp
ret

Function at 0x41a0b0
Capabilities:
Hash data with md5

Disassembly:
xor dword [0x4355ac], 0x7500416
mov dword [ecx], 0
mov eax, dword [0x436650]
not eax
imul eax, eax, 0xa61fee76
xor eax, 0x575942cf
cmp eax, 0xa500e32f
jne 0x41a101
movsx eax, word [0x4484c6]
sub eax, 0x6df05d92
cmp eax, 0x2f344483
jle 0x41a101
mov eax, dword [0x444f6c]
sub eax, 0x792c511
or eax, 0xf5ee2105
and dword [0x438780], eax
mov dword [ecx + 4], 0
mov eax, dword [0x4462d0]
not eax
or eax, 0x2443a53f
and dword [0x435a94], eax
mov dword [ecx + 8], 0x67452301
imul eax, dword [0x439374], 0x5c76c05e
add eax, 0x44871a49
cmp eax, 0x3031a909
je 0x41a141
add dword [0x43b3c8], 0xdc0ad32c
mov dword [ecx + 0xc], 0xefcdab89
mov eax, 0x3300
and dword [0x447600], 0x8f71efcb
mov dword [ecx + 0x10], 0x98badcfe
mov word [0x44d218], ax
mov dword [ecx + 0x14], 0x10325476
movsx eax, word [0x4478a6]
shl eax, 9
cmp eax, 0x3649c255
jl 0x41a1a1
mov eax, dword [0x437958]
lea eax, [eax*4 - 0x6a2df387]
cmp eax, 0xfd9f7dfe
jge 0x41a197
inc word [0x44ec1a]
ret
add dword [0x43dda4], 0x6ac472ae
ret
Function at 0x42afc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x438670]
sub esp, 8
movsx ecx, word [0x45071c]
and eax, 0xfc302b0a
xor ecx, eax
mov eax, dword [0x43861c]
imul eax, ecx
push esi
push edi
push 0
mov dword [0x43861c], eax
inc word [0x45071c]
mov eax, dword [0x437328]
not eax
imul eax, eax, 0xe21826ee
and eax, 0xa2e808ae
xor dword [0x446480], eax
call fcn.0041a1c0
imul ecx, dword [0x436ee8], 0xc3412c2d
add esp, 4
cmp dword [0x4509e0], 0
mov esi, eax
mov edi, edx
mov dword [0x436ee8], ecx
jne 0x42b0dc
cmp dword [0x4511f8], 0
jne 0x42b0dc
add dword [0x43e4bc], 0xac9f0ff1
push 0
call fcn.0041a1c0
add esp, 4
sub eax, esi
sbb edx, edi
test edx, edx
jg 0x42b0b7
jl 0x42b061
test eax, eax
jae 0x42b0b7
mov ecx, dword [0x43cf70]
movzx eax, word [0x44c4a4]
add ecx, 0x50ca9f6
and ecx, 0x134ed7c9
imul eax, ecx
push 0x3e8
mov word [0x44c4a4], ax
inc dword [0x43cf70]
call dword [0x451400]
xor dword [0x43fc7c], 0x23b628f6
push 0
call fcn.0041a1c0
add esp, 4
sub eax, esi
sbb edx, edi
mov dword [ebp - 4], edx
js 0x42b061
jg 0x42b0b7
test eax, eax
jb 0x42b061
movsx eax, word [0x44f76c]
movsx ecx, word [0x44f75e]
imul eax, eax, 0x9605bde1
or ecx, eax
movzx eax, word [0x4477c6]
and eax, ecx
mov word [0x4477c6], ax
movzx eax, word [0x4507f4]
sub eax, 0x38fda673
pop edi
mov word [0x4507f4], ax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40428b
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x649474]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0xfffffffffffffff5
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x404325
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x404325
movsx eax, word [ebp - 0x1c]
push edi
movsx edi, word [ebp - 0x1a]
imul edi, eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push edi
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
je 0x404324
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push edi
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
je 0x404324
push dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push 0x10
pop edi
push edi
call fcn.00482b1b
mov esi, eax
pop ecx
push esi
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_GetConsoleHistoryInfo]
test eax, eax
je 0x404324
and dword [esi + 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004828de
leave
ret

Function at 0x4054a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4054cb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405bd3
jmp 0x405580
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x4054ed
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x4054ef
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x405574
jg 0x405504
test esi, esi
je 0x405574
test ecx, ecx
jl 0x405557
jg 0x40550e
test eax, eax
je 0x405557
cmp edi, ecx
jg 0x405522
jl 0x405518
cmp esi, eax
jae 0x405522
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.00485250
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
mov eax, dword [ebp + 8]
add eax, ecx
test edi, edi
jl 0x405574
jg 0x40555a
test esi, esi
je 0x405574
jmp 0x40555a
mov eax, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x405574
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.004a39b6
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405589
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x10], esi
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x4055b4
jl 0x4055ab
test edi, edi
jne 0x4055b4
xor eax, eax
xor edx, edx
jmp 0x405679
cmp dword [esi + 0x38], 0
je 0x4055c9
push eax
push edi
push dword [ebp + 8]
call fcn.00405cb1
jmp 0x405679
mov eax, dword [esi + 0x1c]
mov ebx, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40560d
mov eax, dword [esi + 0x2c]
cmp dword [eax], 0
jbe 0x40560d
cmp dword [eax], edi
mov esi, edi
mov ebx, dword [ebp + 8]
cmovb esi, dword [eax]
push esi
push ecx
push ebx
call fcn.00485250
mov ecx, dword [esp + 0x20]
add ebx, esi
mov dword [esp + 0x1c], ebx
add esp, 0xc
mov ebx, edi
sub ebx, esi
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, ecx
jmp 0x405614
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
cmp dword [esi + 0x4c], 0
mov ecx, ebx
je 0x40566f
mov ecx, esi
call fcn.0040640e
mov edx, dword [esp + 0x10]
mov ecx, ebx
jmp 0x40564f
push dword [esi + 0x4c]
push eax
push 1
push edx
call fcn.004a3c1c
mov edx, dword [esp + 0x20]
sub ebx, eax
add edx, eax
add esp, 0x10
mov dword [esp + 0x10], edx
mov ecx, ebx
cmp eax, 0xfff
jne 0x405682
mov eax, 0xfff
cmp ebx, eax
ja 0x40562b
test ecx, ecx
je 0x40566f
push dword [esi + 0x4c]
push ebx
push 1
push edx
call fcn.004a3c1c
mov ecx, ebx
add esp, 0x10
sub ecx, eax
sub edi, ecx
mov edx, dword [ebp + 0x10]
mov eax, edi
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
sub edi, ebx
jmp 0x405671
Function at 0x4058de
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x649474]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x405904
xor eax, eax
jmp 0x4059ca
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x40592d
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x40592d
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x4059ca
cmp dword [esi + 0x4c], 0
je 0x4059c8
mov ecx, esi
call fcn.0040640e
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x405959
push dword [esi + 0x4c]
push eax
call fcn.0040851c
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x4059c8
mov byte [ebp - 0x28], al
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x405997
sub eax, 1
je 0x405997
dec eax
sub eax, 1
jne 0x4059c8
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x40594b
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x4059ba
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.004a39b6
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x4059c8
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x4059ca
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004828de
leave
ret 4

Function at 0x40645c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x649474]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x4064b5
cmp byte [esi + 0x3d], bl
je 0x4064b5
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4064ee
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, ebx
je 0x4064c6
sub eax, 1
je 0x4064c9
dec eax
sub eax, 1
jne 0x4064ee
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004828de
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4064e6
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004a39b6
add esp, 0x10
cmp edi, eax
jne 0x4064ee
cmp byte [esi + 0x3d], bl
sete al
jmp 0x4064b7
xor al, al
jmp 0x4064b7
Function at 0x408d67
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004837d0
mov eax, dword [0x649474]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
push 0x1000
lea ecx, [ebp - 0x1004]
lea edi, [esi + 0xc]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [edi]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 8]
push ecx
mov dword [edi + 0xc], ebx
push eax
mov byte [esi], 1
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x408deb
lea ebx, [ebp - 0x1004]
mov byte [esi + 8], 1
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408dc7
sub ecx, edx
lea eax, [ecx + 1]
mov ecx, edi
push eax
call fcn.0040a9b6
push dword [esi + 0x18]
push ebx
push dword [edi]
call fcn.00485250
add esp, 0xc
jmp 0x408dee
mov byte [esi + 8], bl
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004828de
leave
ret 4
Function at 0x408fdb
Capabilities:
Read file on windows

Disassembly:
push 0x58
mov eax, 0x4e53f3
call fcn.00483d11
mov eax, ecx
mov dword [ebp - 0x14], eax
push 0x62f5b0
push eax
call fcn.004a5e8a
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x409184
xor ebx, ebx
mov esi, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
push 2
push ebx
push edi
mov dword [ebp - 4], ebx
call fcn.004a3697
push edi
call fcn.004a6655
add esp, 0x10
mov dword [ebp - 0x24], ebx
add eax, 1
mov dword [ebp - 0x10], eax
je 0x40904b
push eax
lea ecx, [ebp - 0x30]
call fcn.0040ab5f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
push ebx
call fcn.0040ab95
mov esi, dword [ebp - 0x30]
push ebx
push ebx
push edi
call fcn.004a3697
mov eax, dword [ebp - 0x24]
push edi
dec eax
push eax
push 1
push esi
call fcn.004a3c1c
push edi
call fcn.004a4218
mov eax, dword [ebp - 0x24]
add esp, 0x20
mov byte [eax + esi - 1], bl
call fcn.00428393
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
mov edx, 0x62f563
test eax, eax
je 0x40909a
push edx
mov ecx, eax
call fcn.00425a9d
mov edi, eax
mov edx, 0x62f563
mov dword [ebp - 0x10], edi
jmp 0x40909f
mov edi, ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x409178
mov eax, dword [ebp - 0x14]
mov ecx, edx
test eax, eax
cmovne ecx, eax
push ecx
push edx
push edx
push str.KeyValues::LoadFromBuffer__s_s_s_:_Begin
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.tier0.dll_COM_TimestampedLog]
mov ecx, esi
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4090cd
sub ecx, edx
push ecx
push ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x64]
push esi
call fcn.0042fd8c
cmp dword [ebp - 0x18], 2
mov byte [ebp - 4], 2
jle 0x409130
cmp byte [esi], 0xff
jne 0x409130
cmp byte [esi + 1], 0xfe
jne 0x409130
push ecx
lea ebx, [esi + 2]
xor esi, esi
push esi
push esi
mov ecx, ebx
call fcn.0042ee56
mov edi, eax
push edi
call fcn.004830c7
add esp, 0xc
mov esi, eax
mov ecx, ebx
push edi
push esi
call fcn.0042ee56
pop ecx
pop ecx
push edi
push edi
push esi
lea ecx, [ebp - 0x64]
call fcn.0042fe5b
mov edi, dword [ebp - 0x10]
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x64]
mov ecx, edi
push eax
push dword [ebp - 0x14]
call fcn.004278bd
push dword [ebp - 0x1c]
mov bl, al
mov eax, 0x62f563
push eax
push eax
push str.KeyValues::LoadFromBuffer__s_s_s_:_End
call dword [sym.imp.tier0.dll_COM_TimestampedLog]
add esp, 0x10
mov dword [ebp - 0x64], 0x634ed8
lea ecx, [ebp - 0x60]
call fcn.00428cb1
test bl, bl
jne 0x409178
mov ecx, edi
call fcn.004275f4
xor esi, esi
jmp 0x40917a
mov esi, edi
lea ecx, [ebp - 0x30]
call fcn.0040a870
mov eax, esi
call fcn.00483cdf
ret
Function at 0x40de94
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [0x6ae3ec]
lea eax, [ebp - 4]
push eax
push 0x40
push 0x7f
push dword [ebp + 8]
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0x7f
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.00421d3e
push 0
push dword [ebp - 4]
push 0x7f
push dword [ebp + 8]
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov al, 1
pop edi
leave
ret 8

Function at 0x40df07
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [0x6ae3ec]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push dword [ebp + 8]
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 1
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.00421d3e
push 0
push dword [ebp - 4]
push 1
push dword [ebp + 8]
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov al, 1
pop edi
leave
ret 8

Function at 0x40e6d3
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x4e59bc
call fcn.00483d11
mov esi, ecx
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
call fcn.0040e95c
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
push 0x40e985
push ebx
push ebx
call fcn.004aae03
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x40e719
call fcn.00483cdf
ret 8
push 6
mov dword [edi], ebx
call fcn.00468510
int3

Function at 0x40e729
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x4e59e6
call fcn.00483d11
mov esi, ecx
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
call fcn.0040e9d7
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
push 0x40ea00
push ebx
push ebx
call fcn.004aae03
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x40e76f
call fcn.00483cdf
ret 8
push 6
mov dword [edi], ebx
call fcn.00468510
int3
Function at 0x40fd12
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [0x6ae3ec]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push dword [ebp + 8]
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 4
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.00421d3e
push 0
push dword [ebp - 4]
push 4
push dword [ebp + 8]
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov al, 1
pop edi
leave
ret 8

Function at 0x41054a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x649474]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0x202444c7
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], 0x6e5a3d62
lea edx, [esi + 0x21562]
call fcn.004109fa
lea edx, [esi + 0x2156a]
mov dword [ebp - 0x14], 0x242444c7
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0x4a257a46
call fcn.004109fa
lea edx, [esi + 0x21572]
mov dword [ebp - 0x1c], 0x282444c7
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x4c585774
call fcn.004109fa
lea edx, [esi + 0x2157a]
mov dword [ebp - 0x24], 0x2c2444c7
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x20], 0x2b21265f
call fcn.004109fa
lea edx, [esi + 0x21582]
mov dword [ebp - 0x2c], 0x302444c7
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x716b2635
call fcn.004109fa
lea edx, [esi + 0x2158a]
mov dword [ebp - 0x34], 0x342444c7
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x30], 0x4a2434
call fcn.004109fa
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004828de
leave
ret

Function at 0x4119d3
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [0x6ae3ec]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push dword [ebp + 8]
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 4
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.00421d3e
push 0
push dword [ebp - 4]
push 4
push dword [ebp + 8]
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov al, 1
pop edi
leave
ret 8
Function at 0x416139
Capabilities:
Hide graphical window

Disassembly:
push 0x5c
mov eax, 0x4e6a76
call fcn.00483d44
mov dword [ebp - 0x60], edx
mov esi, ecx
mov byte [ebp - 0x5c], 0
lea edx, [ebp - 0x60]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.00416369
pop ecx
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x40]
call fcn.004167d0
push ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
push ecx
mov ecx, eax
call fcn.004168bd
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.0040ee82
push str.engine.dll
lea ecx, [ebp - 0x28]
call fcn.004072a3
test al, al
je 0x4161b7
mov ecx, esi
call fcn.0040fa67
lea ecx, [ebp - 0x28]
call fcn.00403cab
lea ecx, [ebp - 0x40]
call fcn.0040ee82
call fcn.00483cf3
ret
push str.filesystem_stdio.dll
lea ecx, [ebp - 0x28]
call fcn.004072a3
test al, al
je 0x4161d1
mov ecx, esi
call fcn.00410772
jmp 0x4161a1
push str.server.dll
lea ecx, [ebp - 0x28]
call fcn.004072a3
test al, al
je 0x4161eb
mov ecx, esi
call fcn.004119a6
jmp 0x4161a1
push str.vgui2.dll
lea ecx, [ebp - 0x28]
call fcn.004072a3
test al, al
je 0x416205
mov ecx, esi
call fcn.0041570b
jmp 0x4161a1
push str.client.dll
lea ecx, [ebp - 0x28]
call fcn.004072a3
test al, al
je 0x41621f
mov ecx, esi
call fcn.0040d535
jmp 0x4161a1
push str.vaudio_miles.dll
lea ecx, [ebp - 0x28]
call fcn.004072a3
test al, al
je 0x4161a1
call fcn.00403eca
call fcn.0040c3f4
call dword [sym.imp.tier0.dll_CommandLine_Tier0]
push 0
push str._debug_console
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov ecx, eax
call edx
test eax, eax
je 0x4161a1
push 5
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x40449f
lea ecx, [ebp - 0x68]
call fcn.004163be
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 4
call fcn.0040ae2c
cmp dword [ebp - 0x64], 0
je 0x4161a1
call fcn.004a8416
int3

Function at 0x4163be
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x4e6ad4
call fcn.00483d11
mov esi, ecx
push 4
call fcn.00482b1b
mov edx, dword [ebp + 8]
mov dword [ebp + 8], eax
mov dword [eax], edx
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push eax
push 0x41645c
push ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.004aae03
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x416403
call fcn.00483cdf
ret 4
push 6
mov dword [edi], ebx
call fcn.00468510
int3