joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468d30
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x415434]
call fcn.00404a54
xor eax, eax
push ebp
push 0x468e74
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c7fa4], 0
jne 0x468d83
mov ecx, dword [0x4cac90]
mov dl, 1
mov eax, dword [0x407660]
call fcn.0040c4b4
call fcn.00403a34
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402c70
mov eax, ebx
call fcn.00404904
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x468e84
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405b9c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404914
test eax, eax
jle 0x468e1b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x468e14
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404324
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0040430c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040850c
test eax, eax
jne 0x468e14
mov ebx, 0x15
jmp 0x468e20
mov ebx, 0x10
jmp 0x468e20
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4c7fa4]
call fcn.00468c88
mov eax, dword [ebp - 8]
call fcn.00468c88
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405bb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468e7b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004040c0
lea eax, [ebp - 0x10]
mov edx, dword [0x415434]
call fcn.00404b24
ret

Function at 0x46a554
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 5
ja 0x46a580
cmp dword [esp + 4], 5
jne 0x46a57c
cmp dword [esp + 8], 1
jae 0x46a580
xor eax, eax
jmp 0x46a582
mov al, 1
add esp, 0x94
ret

Function at 0x4739d4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040455c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4739ed
test al, 0x10
jne 0x4739f1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4739f8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.0040454c
xor eax, eax
push ebp
push 0x473be5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.00402cac
mov edi, eax
lea eax, [ebp - 0x178]
xor ecx, ecx
mov edx, 0x160
call fcn.00402c70
cmp dword [ebp + 0x20], 0
je 0x473ab3
cmp dword [ebp - 0x10], 0
je 0x473ab3
mov eax, dword [ebp + 0x20]
call fcn.00408f38
test al, al
jne 0x473a69
mov eax, dword [ebp + 0x20]
call fcn.004739d4
test al, al
je 0x473a8c
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.0040455c
push eax
call sub.shell32.dll_SHGetFileInfoA
jmp 0x473aad
push 0x4010
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.0040455c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, dword [ebp - 0x174]
cmp byte [ebp + 0x1c], 0
je 0x473ada
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x473bf8
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
jmp 0x473af9
push 0x4001
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x473bf8
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.004170e8
test bl, bl
je 0x473b39
cmp byte [ebp + 0x14], 0
jne 0x473b39
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00423b44
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
test byte [ebp + 0x14], bl
je 0x473bcf
mov dl, 1
mov eax, dword [0x42182c]
call fcn.00427f44
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0
push 0
push 0
mov eax, ebx
call fcn.0042850c
call fcn.00423b44
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x184], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.00402a2c
add eax, dword [ebp - 8]
mov dword [ebp - 0x180], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.00402a2c
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x17c], eax
mov ecx, ebx
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 4]
call fcn.004738f8
mov eax, ebx
call fcn.004032a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473bec
lea eax, [ebp + 0x20]
call fcn.0040409c
ret

Function at 0x47816c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 5
ja 0x478198
cmp dword [esp + 4], 5
jne 0x478194
cmp dword [esp + 8], 1
jae 0x478198
xor eax, eax
jmp 0x47819a
mov al, 1
add esp, 0x94
ret
Function at 0x4788c4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x4788d7
add esp, 0xfffffff0
call fcn.004035cc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00430120
mov dl, 1
mov eax, dword [0x46dfe8]
call fcn.0046e150
mov dword [ebx + 0x22c], eax
mov dl, 1
mov eax, dword [0x470fbc]
call fcn.004801d0
mov esi, eax
mov dword [ebx + 0x234], esi
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], 0x47fca8
mov dword [esi + 0x64], ebx
mov dword [esi + 0x60], 0x47fcbc
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], 0x47fcb0
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x78], 0x47d378
mov eax, dword [esi + 0x10]
mov edx, 0x478ad4
call fcn.00422a00
mov eax, dword [ebx + 0x22c]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4788bc
mov dword [ebx + 0x23c], 0xff0000
mov dword [ebx + 0x29c], 0x1fffffff
mov dword [ebx + 0x2a0], 0x1fffffff
mov dword [ebx + 0x2a8], 0x808080
mov dword [ebx + 0x2a4], 2
mov ecx, ebx
mov dl, 1
mov eax, dword [0x470c84]
call fcn.0048058c
mov dword [ebx + 0x2d0], eax
mov dl, 1
mov eax, dword [0x46f6ac]
call fcn.00403278
mov dword [ebx + 0x308], eax
mov byte [ebx + 0x1f8], 1
mov dl, 1
mov eax, dword [0x42182c]
call fcn.00427f44
mov dword [ebx + 0x310], eax
mov byte [ebx + 0x316], 0
mov dword [ebx + 0x320], 0x14
mov dword [ebx + 0x328], 0x808080
mov byte [ebx + 0x340], 1
mov dword [ebx + 0x360], 0xffffffff
mov dword [ebx + 0x364], 0xffffffff
mov byte [ebx + 0x390], 1
call sub.kernel32.dll_GetVersion_1
mov esi, eax
mov eax, esi
mov edi, eax
and edi, 0xff
mov eax, esi
call fcn.00407014
and eax, 0xff
cmp edi, 5
ja 0x478a2e
cmp edi, 5
jne 0x478a2a
cmp eax, 1
jae 0x478a2e
xor eax, eax
jmp 0x478a30
mov al, 1
mov byte [ebx + 0x314], al
mov ecx, ebx
mov dl, 1
mov eax, dword [0x471760]
call fcn.004812f4
mov dword [ebx + 0x32c], eax
mov byte [ebx + 0x330], 1
mov byte [ebx + 0x331], 1
mov eax, dword [ebx + 0x70]
mov dword [ebx + 0x240], eax
mov dword [ebx + 0x334], 0x1fffffff
mov dword [ebx + 0x388], 0x1fffffff
mov dword [ebx + 0x38c], 0x1fffffff
mov dl, 1
mov eax, dword [0x471534]
call fcn.00482b1c
mov esi, eax
mov dword [ebx + 0x384], esi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], 0x47d370
mov eax, dword [ebx + 0x68]
mov edx, 0x478ad4
call fcn.00422a00
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x478ac1
call fcn.00403624
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x490998
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4909a0
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x490b92
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x490ba8
mov eax, esi
call fcn.0048e824
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004040f0
lea ecx, [ebp - 0x10]
mov edx, 0x490bbc
mov eax, esi
call fcn.0048e824
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004040f0
lea ecx, [ebp - 0x14]
mov edx, 0x490bd4
mov eax, esi
call fcn.0048e824
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004040f0
lea ecx, [ebp - 0x18]
mov edx, 0x490bf0
mov eax, esi
call fcn.0048e824
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004040f0
lea ecx, [ebp - 0x1c]
mov edx, 0x490c0c
mov eax, esi
call fcn.0048e824
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004040f0
lea ecx, [ebp - 0x24]
mov edx, 0x490c24
mov eax, esi
call fcn.0048e824
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040857c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408ac4
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x490c3c
mov eax, esi
call fcn.0048e824
mov eax, dword [ebp - 0x28]
call fcn.004882fc
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x490c4c
mov eax, esi
call fcn.0048e824
mov eax, dword [ebp - 0x2c]
call fcn.004882fc
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x490c64
mov eax, esi
call fcn.0048e824
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408ac4
inc eax
je 0x490b35
lea ecx, [ebp - 0x34]
mov edx, 0x490c64
mov eax, esi
call fcn.0048e824
mov eax, dword [ebp - 0x34]
call fcn.00408a88
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a0e0
fstp qword [ebp - 0x3c]
wait
call fcn.0040a520
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x490b50
lea ecx, [ebp - 0x40]
mov edx, 0x490c64
mov eax, esi
call fcn.0048e824
mov eax, dword [ebp - 0x40]
call fcn.004882fc
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x490c74
mov eax, esi
call fcn.0048e824
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004040f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490b99
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004040c0
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004040c0
ret
Function at 0x4a9060
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4a90b1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4a9098
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4a9088
jmp 0x4a90b1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4a9099
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bd7a4
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4cd4b0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4bd7c6
shr eax, 1
xor eax, 0xedb88320
jmp 0x4bd7c8
shr eax, 1
dec edx
jne 0x4bd7b4
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4bd7ad
mov byte [0x4cd8b0], 1
pop esi
pop ebx
ret

Function at 0x4bd7e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4cd8b0], 0
jne 0x4bd7fb
call fcn.004bd7a4
mov eax, edi
dec eax
test eax, eax
jl 0x4bd824
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4cd4b0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4bd805
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4bfdc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4bfdf1
dec al
je 0x4bfe2d
dec al
je 0x4bfe71
dec al
je 0x4bfedc
jmp 0x4bff66
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4bff66
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4bfe01
jmp 0x4bff66
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4bff66
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4bfe3d
jmp 0x4bff66
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4bff66
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4bfe9f
xor ebp, ebp
jmp 0x4bfeb0
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4bfeb9
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4bfe81
jmp 0x4bff66
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4bff66
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4bff34
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004bd82c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4bfef0
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x401850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x405f35
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x4111dc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x18]
call dword [sym.imp.xf_Os.dll_public:_void___thiscall_XtremeFramework::cXF_Error::constructor_void_]
mov eax, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x1c]
push ecx
xor ebx, ebx
lea ecx, [esi + 0x2a]
mov dword [esp + 0x40], ebx
call sym.ScczServer.exe_public:_class_XtremeFramework::cXF_MsgOut____thiscall_cXF_ProtoCli_ScczSrv2Cli::To_ScczSrv2Cli_SendTrData_class_XtremeFramework::cXF_Error___class_XtremeFramework::cXF_MsgBuf_const__
mov dword [esp + 0xc], eax
cmp eax, ebx
je 0x4018ec
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
lea edx, [esp + 0x10]
push edx
mov ecx, eax
mov byte [esp + 0x3c], 1
call dword [sym.imp.xf_Msg.dll_public:_bool___thiscall_XtremeFramework::cXF_MsgOut::ToBuffer_class_XtremeFramework::cXF_MsgBuf__const]
mov ecx, dword [esi + 0x20]
mov eax, dword [ecx]
mov eax, dword [eax + 0x50]
lea edx, [esp + 0x10]
push edx
push ebx
lea edx, [esp + 0x20]
push edx
call eax
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.xf_Msg.dll_public:_static_void___cdecl_XtremeFramework::cXF_MsgOut::Delete_class_XtremeFramework::cXF_MsgOut___]
add esp, 4
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call dword [sym.imp.xf_Msg.dll_public:_void___thiscall_XtremeFramework::cXF_MsgBuf::destructor_void_]
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.xf_Os.dll_public:_void___thiscall_XtremeFramework::cXF_Error::destructor_void_]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret 4
Function at 0x401920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x405f62
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x4111dc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x18]
call dword [sym.imp.xf_Os.dll_public:_void___thiscall_XtremeFramework::cXF_Error::constructor_void_]
mov eax, dword [esp + 0x44]
push eax
lea ecx, [esp + 0x1c]
push ecx
xor ebx, ebx
lea ecx, [esi + 0x2a]
mov dword [esp + 0x40], ebx
call sym.ScczServer.exe_public:_class_XtremeFramework::cXF_MsgOut____thiscall_cXF_ProtoCli_ScczSrv2Cli::To_ScczSrv2Cli_SendTrData_class_XtremeFramework::cXF_Error___class_XtremeFramework::cXF_MsgBuf_const__
mov dword [esp + 0xc], eax
cmp eax, ebx
je 0x4019c2
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
lea edx, [esp + 0x10]
push edx
mov ecx, eax
mov byte [esp + 0x3c], 1
call dword [sym.imp.xf_Msg.dll_public:_bool___thiscall_XtremeFramework::cXF_MsgOut::ToBuffer_class_XtremeFramework::cXF_MsgBuf__const]
mov ecx, dword [esi + 0x20]
mov eax, dword [ecx]
mov eax, dword [eax + 0x50]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x44]
neg edx
push edx
lea edx, [esp + 0x20]
push edx
call eax
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.xf_Msg.dll_public:_static_void___cdecl_XtremeFramework::cXF_MsgOut::Delete_class_XtremeFramework::cXF_MsgOut___]
add esp, 4
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call dword [sym.imp.xf_Msg.dll_public:_void___thiscall_XtremeFramework::cXF_MsgBuf::destructor_void_]
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.xf_Os.dll_public:_void___thiscall_XtremeFramework::cXF_Error::destructor_void_]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret 8
Function at 0x401bf0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x405fb3
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4111dc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [sym.imp.xf_Os.dll_public:_char_const____thiscall_XtremeFramework::cXF_String::operator_char_const__void_const]
lea ecx, [esi + 8]
call ebx
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.xf_Os.dll_class_XtremeFramework::cXF_String___cdecl_XtremeFramework::osExtractFilepath_char_const__]
add esp, 8
push str.ScczSrvWrk_
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0
call dword [sym.imp.xf_Os.dll_public:_class_XtremeFramework::cXF_String____thiscall_XtremeFramework::cXF_String::operator_char_const__]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.xf_Os.dll_void___cdecl_XtremeFramework::osEnsureCorrectDirSlash_class_XtremeFramework::cXF_String__]
add esp, 4
push 0
lea ecx, [esp + 0x18]
call ebx
mov edx, dword [ebp + 8]
push eax
push edx
call dword [sym.imp.xf_Os.dll_bool___cdecl_XtremeFramework::osCreateDirectory_class_XtremeFramework::cXF_Error___char_const___bool_]
add esp, 0xc
test al, al
jne 0x401ca0
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.xf_Os.dll_public_virtual:_void___thiscall_XtremeFramework::cXF_String::destructor_void_]
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0x14]
lea edi, [esi + 0x2c]
push eax
mov ecx, edi
call dword [0x408158]
add esi, 0x38
push edi
mov ecx, esi
call dword [0x408158]
push str.ScczPerfLog
mov ecx, esi
call dword [sym.imp.xf_Os.dll_public:_class_XtremeFramework::cXF_String____thiscall_XtremeFramework::cXF_String::operator_char_const__]
mov ecx, dword [sym.imp.xf_Os.dll_const_XtremeFramework::cXF_String::vftable]
xor edi, edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edi
mov byte [esp + 0x30], 1
mov edi, edi
push edi
mov ecx, esi
call ebx
push eax
lea edx, [esp + 0x24]
push str._s_02d.dat
push edx
call dword [sym.imp.xf_Os.dll_public:_int___cdecl_XtremeFramework::cXF_String::Format_char_const__]
add esp, 0x10
lea ecx, [esp + 0x1c]
call ebx
push eax
call dword [sym.imp.xf_Os.dll_bool___cdecl_XtremeFramework::osFileIsExist_char_const__]
add esp, 4
test al, al
je 0x401d13
inc edi
cmp edi, 0x64
jl 0x401ce0
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call dword [0x408158]
mov esi, dword [sym.imp.xf_Os.dll_public_virtual:_void___thiscall_XtremeFramework::cXF_String::destructor_void_]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0
call esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call esi
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x403ed0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x406327
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
mov eax, dword [0x4111dc]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea ecx, [esp + 0x14]
call dword [sym.imp.xf_Msg.dll_public:_void___thiscall_XtremeFramework::cXF_ProEncoder::constructor_void_]
mov eax, dword [sym.ScczServer.exe_class_XtremeFramework::cXF_Protocol_const__const_cXF_ProtoCli_ScczBr2Cli::_proto]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x4c], 0
call dword [sym.imp.xf_Msg.dll_public:_bool___thiscall_XtremeFramework::cXF_ProEncoder::Init_class_XtremeFramework::cXF_Protocol_const__]
mov esi, dword [sym.imp.xf_Msg.dll_public:_bool___thiscall_XtremeFramework::cXF_ProEncoder::EncSet_Begin_void_]
lea ecx, [esp + 0x14]
call esi
push 0
lea ecx, [esp + 0x18]
call dword [sym.imp.xf_Msg.dll_public:_bool___thiscall_XtremeFramework::cXF_ProEncoder::EncSet_set_int_]
lea ecx, [esp + 0x14]
call esi
mov ecx, dword [esp + 0x54]
push ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.xf_Os.dll_public:_void___thiscall_XtremeFramework::cXF_String::constructor_char_const__]
lea edx, [esp + 0xc]
push edx
push 0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x50], 1
call dword [sym.imp.xf_Msg.dll_public:_bool___thiscall_XtremeFramework::cXF_ProEncoder::EncSet_str_int__class_XtremeFramework::cXF_String_const__]
lea ecx, [esp + 0xc]
mov byte [esp + 0x48], 0
call dword [sym.imp.xf_Os.dll_public_virtual:_void___thiscall_XtremeFramework::cXF_String::destructor_void_]
mov esi, dword [sym.imp.xf_Msg.dll_public:_bool___thiscall_XtremeFramework::cXF_ProEncoder::EncSet_End_void_]
lea ecx, [esp + 0x14]
call esi
lea ecx, [esp + 0x14]
call esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], 0
call dword [sym.imp.xf_Msg.dll_public:_bool___thiscall_XtremeFramework::cXF_ProEncoder::EncodeEnd_class_XtremeFramework::cXF_MsgOut___]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x54]
call dword [sym.imp.xf_Os.dll_public:_class_XtremeFramework::cXF_Error____thiscall_XtremeFramework::cXF_Error::operator_class_XtremeFramework::cXF_Error_const__]
mov esi, dword [esp + 8]
lea ecx, [esp + 0x30]
mov dword [esp + 0x48], 2
call dword [sym.imp.xf_Msg.dll_public:_void___thiscall_XtremeFramework::cXF_ProDataIter::End_void_]
lea ecx, [esp + 0x14]
mov dword [esp + 0x48], 0xffffffff
call dword [sym.imp.xf_Os.dll_public:_void___thiscall_XtremeFramework::cXF_Error::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x44
ret 8