joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10038e1d
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x18], 0
push esi
push edi
mov edi, edx
je 0x10038e74
cmp byte [ebp + 0x14], 0
je 0x10038e52
mov esi, dword [ebp + 8]
mov dword [esi], 2
jmp 0x10038e4b
push edi
push ecx
push ecx
xor dl, dl
call fcn.10037182
add esp, 0xc
dec dword [esi]
cmp dword [esi], 0
jge 0x10038e3c
jmp 0x10038ea2
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10038ea2
mov esi, dword [ebp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esi]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 3
jl 0x10038e63
jmp 0x10038ea2
cmp byte [ebp + 0x1c], 0
je 0x10038e8b
cmp byte [ecx], 0
je 0x10038ea2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x10038ea2
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10038ea2
push 1
push 0x1fe5
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
pop edi
pop esi
pop ecx
pop ebp
ret
Function at 0x10039b44
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x10039bc6
mov dword [ebp - 8], 0x23
cmp dword [ebp - 8], 0x338
jle 0x10039bab
xor esi, esi
xor edi, edi
mov ebx, 0x8000
mov eax, edi
lea ecx, [ebp - 0x20]
cdq
push edx
push eax
call fcn.10001abf
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10039b83
mov eax, dword [eax]
push eax
call fcn.10044453
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.1000e569
add edi, esi
dec ebx
jne 0x10039b6c
inc esi
cmp esi, 0x14b2
jl 0x10039b65
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 8], 0xfffffdc4
jge 0x10039bbf
push str.uycjnbnhv_fauglmgjd_dfpgnl_accu_zuegtcr_efcrfry_iczbybfvv_grdzol_javjro_rqxgwm_skda_xkicurwj_oqrivt_xflrae
call fcn.10044453
pop ecx
mov eax, dword [ebp + 0x18]
dec dword [eax]
jmp 0x10039bf3
cmp byte [ecx], 0
je 0x10039bf3
push 1
push ecx
push 0
push 0x4edf
push 0x61a9
push 0x6aa2
push ecx
push ecx
push 0x6cc8
mov ecx, 0x3b74
call fcn.1003948e
add esp, 0x24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a1f1
Capabilities:
Encode data using xor
Resume thread

Disassembly:
mov eax, 0x1005df9f
call fcn.1005c588
sub esp, 0x18
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x18], cl
je 0x1003a2f8
xor ebx, ebx
test cl, cl
je 0x1003a270
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x20], 0xd491
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x1003a265
mov eax, dword [ebp - 0x20]
lea ecx, [ebp + 0xb]
push 0x39dc
push 1
push ebx
push 1
push 0x6140
push 0x4022
mov dword [ebp - 0x24], eax
mov edx, 0x615f
mov byte [ebp + 0xb], bl
push 0x2ce5
call fcn.10038e1d
add esp, 0x1c
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff1
jge 0x1003a230
jmp 0x1003a319
mov dword [ebp - 0x1c], 0x6a66
cmp dword [ebp - 0x1c], 0x6d22
jle 0x1003a2ba
mov esi, ebx
mov edi, esi
mov dword [ebp + 8], 0x38cd
mov dword [ebp - 0x24], ebx
mov eax, edi
mov ecx, 0x10079cf8
xor eax, ebx
cdq
push edx
push eax
call fcn.1000dad0
inc ebx
cmp ebx, 0x6277
jl 0x1003a28e
dec edi
dec dword [ebp + 8]
push 0
pop ebx
jne 0x1003a28b
inc esi
cmp esi, 0x7a1f
jl 0x1003a282
push ebx
call dword [sym.imp.USER32.dll_CreateIconIndirect]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x69f0
jge 0x1003a26b
mov edx, str.wdzoinhhp_lmzg_kkvcfv_vxecwqz_gefh_lprmdsgkj_rdohrzr_uidlbh
mov ecx, 0x10079cf8
call fcn.1001081c
jmp 0x1003a26b
test dl, dl
je 0x1003a30e
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1003a319
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1003a319
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4044a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47edcd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4ad288]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x14], 4
call fcn.00412470
lea ecx, [esi + 0xb0]
mov byte [esp + 0x14], 3
call fcn.0040b020
lea ecx, [esi + 0x90]
mov byte [esp + 0x14], 2
call fcn.0040b020
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 1
call fcn.0040b020
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 0
call fcn.0040b020
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0xffffffff
call fcn.0040b020
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x407060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47ef2b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4ad288]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x51c
mov dword [esi + 8], 0
call fcn.0045119d
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x4070b1
mov ecx, eax
call fcn.00442d50
jmp 0x4070b3
xor eax, eax
push 0
mov ecx, eax
mov dword [esp + 0x18], 0xffffffff
mov dword [esi + 4], eax
call fcn.0043d690
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
push 0xb8b0
mov dword [esi + 0x44], eax
push eax
add esi, 0x48
push esi
call fcn.00450b20
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4094e0
Capabilities:
Create thread

Disassembly:
cmp dword [0x4b0c48], 0
jne 0x409540
mov eax, dword [0x4b1b1c]
push 0
push 0
push 0
mov dword [eax + 0x124], 1
push 0
mov dword [0x4a108c], 0
call dword [0x4811ac]
push 0
push 0
push 0x409350
mov dword [0x4b0c14], eax
call fcn.00451f5d
mov ecx, dword [0x4b1b1c]
mov dword [ecx + 0x120], 1
add esp, 0xc
mov dword [0x4b0c48], 1
ret

Function at 0x409730
Capabilities:
Create thread

Disassembly:
cmp dword [0x4b0c48], 0
jne 0x409790
mov eax, dword [0x4b1b1c]
push 0
push 0
push 0
mov dword [eax + 0x124], 1
push 0
mov dword [0x4a1090], 0
call dword [0x4811ac]
push 0
push 0
push 0x409550
mov dword [0x4b0c10], eax
call fcn.00451f5d
mov ecx, dword [0x4b1b1c]
mov dword [ecx + 0x120], 1
add esp, 0xc
mov dword [0x4b0c48], 1
ret

Function at 0x40c520
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x138bc
call fcn.00450af0
mov eax, dword [0x4ad288]
xor eax, esp
mov dword [esp + 0x138b8], eax
push esi
push edi
mov edi, dword [esp + 0x138cc]
push 0x137b4
push 0
push edi
call fcn.00450b20
mov eax, dword [esp + 0x138d4]
push eax
push 0x481878
push 0x4b1770
lea ecx, [esp + 0x137d4]
push str._sPRE_s_02d.dat
push ecx
call fcn.00450b9a
push 0
lea edx, [esp + 0x137e0]
push 0x8000
push edx
call fcn.0045298e
mov esi, eax
add esp, 0x2c
cmp esi, 0xffffffff
jne 0x40c595
or eax, 0xffffffff
jmp 0x40c5cf
push ebx
push 0x137b4
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00452f7d
push esi
mov ebx, eax
call fcn.004520b2
add esp, 0x10
cmp ebx, 0x137b4
pop ebx
jne 0x40c590
push 0x137b4
lea ecx, [esp + 0xc]
push ecx
push edi
call fcn.00450cb0
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x138c0]
pop edi
pop esi
xor ecx, esp
call fcn.00450ada
add esp, 0x138bc
ret 8

Function at 0x40c680
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x138bc
call fcn.00450af0
mov eax, dword [0x4ad288]
xor eax, esp
mov dword [esp + 0x138b8], eax
push esi
push edi
mov edi, dword [esp + 0x138cc]
push 0x137b4
push 0
push edi
call fcn.00450b20
mov eax, dword [esp + 0x138d4]
push eax
push 0x481878
push 0x4b1770
lea ecx, [esp + 0x137d4]
push str._s_s_02d.dat
push ecx
call fcn.00450b9a
push 0
lea edx, [esp + 0x137e0]
push 0x8000
push edx
call fcn.0045298e
mov esi, eax
add esp, 0x2c
cmp esi, 0xffffffff
jne 0x40c6f5
or eax, 0xffffffff
jmp 0x40c72f
push ebx
push 0x137b4
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00452f7d
push esi
mov ebx, eax
call fcn.004520b2
add esp, 0x10
cmp ebx, 0x137b4
pop ebx
jne 0x40c6f0
push 0x137b4
lea ecx, [esp + 0xc]
push ecx
push edi
call fcn.00450cb0
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x138c0]
pop edi
pop esi
xor ecx, esp
call fcn.00450ada
add esp, 0x138bc
ret 8
Function at 0x40c750
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x138bc
call fcn.00450af0
mov eax, dword [0x4ad288]
xor eax, esp
mov dword [esp + 0x138b8], eax
mov eax, dword [esp + 0x138c0]
push ebx
push esi
push eax
push 0x481878
push 0x4b1770
mov ebx, ecx
lea ecx, [esp + 0x137c8]
push str._s_s_02d.dat
push ecx
call fcn.00450b9a
push 0
lea edx, [esp + 0x137d4]
push 0x8000
push edx
call fcn.0045298e
mov esi, eax
add esp, 0x20
cmp esi, 0xffffffff
jne 0x40c7b3
or eax, 0xffffffff
jmp 0x40c7f3
push edi
push 0x137b4
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00452f7d
push esi
mov edi, eax
call fcn.004520b2
add esp, 0x10
cmp edi, 0x137b4
pop edi
jne 0x40c7ae
push 0x137b4
lea ecx, [esp + 0xc]
push ecx
add ebx, 0x4b6c
push ebx
call fcn.00450cb0
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x138c0]
pop esi
pop ebx
xor ecx, esp
call fcn.00450ada
add esp, 0x138bc
ret 4

Function at 0x40c810
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4ad288]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
push edi
push str..DAT
push str.NAMES
lea eax, [esp + 0x14]
push 0x481900
push eax
mov edi, ecx
call fcn.004066b0
push 0
lea ecx, [esp + 0x20]
push 0x8000
push ecx
call fcn.0045298e
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x40c87c
push 4
lea edx, [esp + 0xc]
push edx
push esi
call fcn.00452f7d
add esp, 0xc
cmp dword [esp + 8], 7
je 0x40c896
push esi
call fcn.004520b2
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.00450ada
add esp, 0x10c
ret
push ebx
push 0xe0
lea eax, [edi + 0x48404]
push eax
push esi
call fcn.00452f7d
push 4
lea ebx, [edi + 0x56c24]
push ebx
push esi
call fcn.00452f7d
mov eax, dword [ebx]
add esp, 0x18
cmp eax, 0x190
jg 0x40c953
lea ecx, [eax + eax*2]
shl ecx, 4
push ecx
lea edx, [edi + 0x3f2b4]
push edx
push esi
call fcn.00452f7d
push 4
lea ebx, [edi + 0x56c28]
push ebx
push esi
call fcn.00452f7d
mov eax, dword [ebx]
add esp, 0x18
cmp eax, 0x1f4
jg 0x40c953
lea eax, [eax + eax*8]
add eax, eax
add eax, eax
push eax
lea ecx, [edi + 0x43db4]
push ecx
push esi
call fcn.00452f7d
push 4
lea ebx, [edi + 0x56c2c]
push ebx
push esi
call fcn.00452f7d
mov eax, dword [ebx]
add esp, 0x18
cmp eax, 0x4b0
jg 0x40c953
shl eax, 5
push eax
lea edx, [edi + 0x484e4]
push edx
push esi
call fcn.00452f7d
push 4
lea ebx, [edi + 0x56c30]
push ebx
push esi
call fcn.00452f7d
mov eax, dword [ebx]
add esp, 0x18
cmp eax, 0x28a
jle 0x40c977
push esi
call fcn.004520b2
add esp, 4
pop ebx
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.00450ada
add esp, 0x10c
ret
shl eax, 5
push eax
add edi, 0x51ae4
push edi
push esi
call fcn.00452f7d
push esi
call fcn.004520b2
mov ecx, dword [esp + 0x124]
add esp, 0x10
pop ebx
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00450ada
add esp, 0x10c
ret
Function at 0x40e130
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x546c
call fcn.00450af0
mov eax, dword [0x4ad288]
xor eax, esp
mov dword [esp + 0x5468], eax
push esi
push edi
mov edi, ecx
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x4b1770]
mov byte [esp + eax + 0x536c], cl
inc eax
test cl, cl
jne 0x40e150
lea eax, [esp + 0x536c]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40e170
mov ecx, dword [str._system.dat]
mov edx, dword [0x4818d4]
mov dword [eax], ecx
mov ecx, dword [0x4818d8]
mov dword [eax + 4], edx
push 0
lea edx, [esp + 0x5370]
push 0x8000
push edx
mov dword [eax + 8], ecx
call fcn.0045298e
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x40e1d2
push 1
mov ecx, edi
call fcn.0040dfb0
pop edi
or eax, esi
pop esi
mov ecx, dword [esp + 0x5468]
xor ecx, esp
call fcn.00450ada
add esp, 0x546c
ret
push 0x4b6c
lea eax, [esp + 0x804]
push eax
push esi
call fcn.00452f7d
push 0x7f8
lea ecx, [esp + 0x18]
push ecx
push esi
call fcn.00452f7d
push esi
call fcn.004520b2
push 0x4b6c
lea edx, [esp + 0x820]
push edx
push edi
call fcn.00450cb0
add edi, 0x56c50
add esp, 0x28
mov ecx, 0x1fe
lea esi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x5470]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00450ada
add esp, 0x546c
ret

Function at 0x410930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47f21e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4ad288]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov ecx, 0xf
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov byte [esi + 4], al
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x20], al
mov dword [esi + 0x50], ecx
mov dword [esi + 0x4c], eax
mov byte [esi + 0x3c], al
mov ecx, esi
mov byte [esp + 0x14], 2
call fcn.0044dcf0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x411de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47f2cb
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4ad288]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push 0x48
push 0
push esi
call fcn.00450b20
mov edi, dword [esp + 0x2c]
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0x18]
mov dword [esi + 0x18], edx
mov eax, dword [edi + 0x1c]
add esp, 0xc
mov dword [esi + 0x1c], eax
cmp dword [edi + 0x30], 0
je 0x411ec4
push 0x51c
call fcn.0045119d
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x411e6d
mov ecx, eax
call fcn.00442d50
jmp 0x411e6f
xor eax, eax
fild dword [esi + 8]
mov dword [esi], eax
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
mov edx, dword [edi + 0x20]
sub esp, 8
fstp dword [esp + 4]
mov dword [esi + 0x20], edx
mov ecx, dword [edi + 0x24]
fild dword [esi + 4]
mov dword [esi + 0x24], ecx
mov ecx, eax
fstp dword [esp]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0043d6a0
mov edx, dword [esi + 0x30]
mov ecx, dword [esi]
push edx
call fcn.0043d510
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
push eax
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esi]
push edx
push eax
call fcn.0043d760
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x434f80
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x4ad288]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push ebx
push ebp
push esi
push str..mes
push eax
lea eax, [esp + 0x14]
push 0x4846fc
push eax
mov esi, ecx
call fcn.004066b0
mov ebx, dword [esp + 0x130]
mov ebp, dword [esp + 0x12c]
add esp, 0x10
test ebx, ebx
je 0x434ffc
push 0x1ba60
call fcn.004516a4
add esp, 4
mov dword [esi + 0x36df0], eax
test eax, eax
jne 0x435002
push 0x42000
push str.DSIF_claude_3_opus_by
push 0x4846dc
push eax
call dword [0x4812f4]
or eax, 0xffffffff
jmp 0x43505c
mov dword [esi + 0x36df0], ebp
push edi
push 0
lea ecx, [esp + 0x14]
push 0x8000
push ecx
call fcn.0045298e
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
jne 0x435036
test ebx, ebx
je 0x435031
mov edx, dword [esi + 0x36df0]
push edx
call fcn.00450c17
add esp, 4
or eax, 0xffffffff
jmp 0x43505b
mov eax, dword [esi + 0x36df0]
push 0x1ba60
push eax
push edi
call fcn.00452f7d
push edi
mov ebx, eax
call fcn.004520b2
add esp, 0x10
mov dword [esi + 0x36df4], ebp
mov eax, ebx
pop edi
mov ecx, dword [esp + 0x110]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00450ada
add esp, 0x108
ret 0xc

Function at 0x435e70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x38
lea eax, [esi + 0x24]
push 0
push eax
call fcn.00450b20
mov ecx, dword [esi]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov eax, 1
mov dword [esi + 0x30], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], eax
mov edx, dword [0x4a70f8]
add esp, 0xc
mov dword [esi + 0x58], edx
xor edi, edi
lea esp, [esp]
mov edx, dword [edi*4 + 0x4a70dc]
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax]
push 1
push edx
mov edx, dword [esp + 0x30]
push edx
push ebx
push ebp
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
jge 0x435ed8
inc edi
cmp edi, 3
jb 0x435eb0
jmp 0x435ee2
mov ecx, dword [edi*4 + 0x4a70dc]
mov dword [esi + 0x2c], ecx
test eax, eax
jl 0x435f77
push 0x38
lea edi, [esi + 0x5c]
push 0
push edi
call fcn.00450b20
mov edx, dword [esi]
mov eax, 1
mov dword [esi + 0x68], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], edx
mov dword [esi + 0x7c], 0
mov eax, dword [0x4a70f8]
add esp, 0xc
mov dword [edi], 0x500
mov dword [esi + 0x90], eax
mov dword [esi + 0x60], 0x2d0
xor edi, edi
jmp 0x435f30
mov ecx, dword [edi*4 + 0x4a70dc]
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
push 0
push ecx
push ecx
push ebx
push ebp
push eax
mov eax, dword [edx + 0x24]
call eax
test eax, eax
jge 0x435f63
inc edi
cmp edi, 3
jb 0x435f30
xor edx, edx
test eax, eax
setge dl
pop edi
pop esi
pop ebp
pop ebx
dec edx
and eax, edx
ret 0x18
mov ecx, dword [edi*4 + 0x4a70dc]
xor edx, edx
test eax, eax
setge dl
mov dword [esi + 0x64], ecx
dec edx
and eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
Function at 0x437a80
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x40
mov eax, dword [0x4ad288]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
mov ebx, dword [esp + 0x4c]
push esi
push edi
mov edi, dword [esp + 0x50]
push 0x485b48
push edi
call fcn.00453ce1
mov esi, eax
add esp, 8
test esi, esi
jne 0x437ab8
push edi
push 0x485b20
jmp 0x437be8
push esi
push 0x3c
lea eax, [esp + 0x14]
push 1
push eax
call fcn.00454605
add esp, 0x10
cmp eax, 0x2c
jge 0x437adf
push esi
call fcn.00453a92
push 0x485ae4
jmp 0x437be8
cmp dword [esp + 0xc], 0x46464952
jne 0x437bdd
cmp dword [esp + 0x14], 0x45564157
jne 0x437bdd
cmp dword [esp + 0x18], 0x20746d66
jne 0x437bdd
mov eax, dword [esp + 0x1c]
cmp eax, 0x10
je 0x437b1b
cmp eax, 0x12
jne 0x437bdd
cmp word [esp + 0x20], 1
je 0x437b33
push esi
call fcn.00453a92
push 0x485ac0
jmp 0x437be8
cmp eax, 0x10
jne 0x437b5c
mov eax, dword [esp + 0x30]
cmp eax, 0x74636166
jne 0x437b4a
mov edi, 0x38
jmp 0x437b7f
cmp eax, 0x61746164
jne 0x437bdd
mov edi, 0x2c
jmp 0x437b7f
cmp eax, 0x12
jne 0x437bdd
mov eax, dword [esp + 0x32]
cmp eax, 0x74636166
jne 0x437b73
mov edi, 0x3a
jmp 0x437b7f
cmp eax, 0x61746164
jne 0x437bdd
mov edi, 0x2e
cmp dword [esp + edi + 8], 0
jne 0x437b93
push 0x485a9c
call fcn.00454191
add esp, 4
mov ecx, dword [esp + 0x58]
push 0
add edi, ecx
push edi
push esi
call fcn.004542e0
mov edi, dword [esp + 0x68]
mov edx, dword [ebx]
push esi
push edi
push 1
push edx
call fcn.00454605
add esp, 0x1c
push esi
cmp eax, edi
jne 0x437ad0
call fcn.00453a92
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00450ada
add esp, 0x40
ret
push esi
call fcn.00453a92
push 0x485a70
call fcn.00454191
mov ecx, dword [esp + 0x50]
add esp, 8
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00450ada
add esp, 0x40
ret
Function at 0x43b1a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
fld dword [esp + 0x18]
push ebx
push ebp
push esi
mov esi, ecx
fstp dword [esi + 0x3c]
push edi
fld dword [esp + 0x2c]
xor eax, eax
fstp dword [esi + 0x40]
mov ecx, dword [esi + 0x90]
mov ebp, dword [ecx]
mov edi, dword [esi + 0x78]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
mov ebx, dword [esi + 0x90]
mov eax, dword [esi + 0x78]
test edi, edi
je 0x43b1e5
cmp edi, eax
je 0x43b1ea
call fcn.00451172
cmp ebp, ebx
je 0x43b28f
mov ebx, 0x20
cmp dword [esi + 0x34], ebx
jge 0x43b225
test edi, edi
jne 0x43b221
call fcn.00451172
cmp ebp, dword [edi + 0x18]
jne 0x43b20f
call fcn.00451172
fild dword [esp + 0x14]
fadd dword [esp + 0x2c]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
jmp 0x43b254
mov edi, dword [edi]
jmp 0x43b205
test edi, edi
jne 0x43b28b
call fcn.00451172
cmp ebp, dword [edi + 0x18]
jne 0x43b238
call fcn.00451172
mov edx, dword [esi + 0x34]
imul edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
fadd dword [esp + 0x2c]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
mov ecx, dword [ebp + 0x118]
sub esp, 8
fstp dword [esp + 4]
fld dword [esp + 0x30]
fstp dword [esp]
call fcn.0043d6a0
inc dword [esp + 0x10]
add dword [esp + 0x14], ebx
lea ecx, [esp + 0x1c]
call fcn.0043aa20
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
jmp 0x43b1d4
mov edi, dword [edi]
jmp 0x43b22e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x43c030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47f6ae
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x4ad288]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
mov eax, dword [0x4ad288]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [esp + 0x150]
mov edi, ecx
push eax
mov dword [esp + 0x30], edi
call fcn.00439b40
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x43c1d7
push 0x51c
call fcn.0045119d
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x270], esi
cmp eax, esi
je 0x43c0be
mov ecx, eax
call fcn.00442d50
mov esi, eax
mov dword [esp + 0x18], esi
jmp 0x43c0c2
mov dword [esp + 0x18], esi
push ebx
mov ecx, esi
mov dword [esp + 0x274], 0xffffffff
call fcn.0043e580
push 1
mov ecx, esi
call fcn.0043d690
mov ecx, dword [edi + 0x90]
mov edx, dword [ecx]
mov esi, dword [edi + 0x78]
lea ebx, [edi + 0x78]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], 0
lea esp, [esp]
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [ebx]
test esi, esi
je 0x43c111
cmp esi, eax
je 0x43c116
call fcn.00451172
mov ecx, dword [esp + 0x34]
cmp dword [esp + 0x20], ecx
je 0x43c16b
test esi, esi
jne 0x43c167
call fcn.00451172
mov edx, dword [esp + 0x20]
cmp edx, dword [esi + 0x18]
jne 0x43c137
call fcn.00451172
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [edx + 0x118]
call fcn.0043d8a0
mov eax, dword [esp + 0x24]
add dword [esp + 0x14], eax
lea ecx, [esp + 0x1c]
call fcn.0043aa20
mov esi, dword [esp + 0x1c]
jmp 0x43c100
mov esi, dword [esi]
jmp 0x43c129
fld dword [edi + 0x40]
mov esi, dword [esp + 0x18]
fiadd dword [esp + 0x14]
sub esp, 8
mov ecx, esi
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 4]
fld dword [edi + 0x3c]
fstp dword [esp]
call fcn.0043d6a0
mov ecx, dword [edi + 0x54]
mov edx, dword [edi + 0x60]
mov dword [edi + 0x70], ecx
mov dword [edi + 0x6c], 0
mov dword [esp + 0x254], esi
mov dword [esp + 0x3c], edx
mov ecx, 0x43
lea esi, [esp + 0x14c]
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, ebx
call fcn.0043bdc0
mov eax, dword [esp + 0x28]
inc dword [eax + 0x60]
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.00450ada
mov esp, ebp
pop ebp
ret 4