joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448ef0
Capabilities:
Hash data using crc32b

Disassembly:
mov byte [0x5eedf9], 1
xor ecx, ecx
lea esp, [esp]
mov eax, ecx
shl eax, 0x18
test eax, eax
jns 0x448f12
add eax, eax
xor eax, 0x4c11db7
jmp 0x448f14
add eax, eax
test eax, eax
jns 0x448f21
add eax, eax
xor eax, 0x4c11db7
jmp 0x448f23
add eax, eax
test eax, eax
jns 0x448f30
add eax, eax
xor eax, 0x4c11db7
jmp 0x448f32
add eax, eax
test eax, eax
jns 0x448f3f
add eax, eax
xor eax, 0x4c11db7
jmp 0x448f41
add eax, eax
test eax, eax
jns 0x448f4e
add eax, eax
xor eax, 0x4c11db7
jmp 0x448f50
add eax, eax
test eax, eax
jns 0x448f5d
add eax, eax
xor eax, 0x4c11db7
jmp 0x448f5f
add eax, eax
test eax, eax
jns 0x448f6c
add eax, eax
xor eax, 0x4c11db7
jmp 0x448f6e
add eax, eax
test eax, eax
jns 0x448f7b
add eax, eax
xor eax, 0x4c11db7
jmp 0x448f7d
add eax, eax
mov dword [ecx*4 + 0x5ca788], eax
add ecx, 1
cmp ecx, 0x100
jl 0x448f00
ret

Function at 0x448fa0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [0x5eedf9], 0
push esi
push edi
mov edi, eax
mov esi, ecx
mov edx, 0x4282
jne 0x448fb9
call fcn.00448ef0
test edi, edi
jle 0x448fe1
lea ecx, [ecx]
movzx ecx, byte [esi]
mov eax, edx
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shl edx, 8
xor edx, dword [eax*4 + 0x5ca788]
add esi, 1
sub edi, 1
jne 0x448fc0
pop edi
mov eax, edx
pop esi
ret
Function at 0x44b080
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esi + 0xa8]
sub esp, 0x1c
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [esi + 0x90]
push 0xffffffffffffffff
push ecx
call edi
push 0x5604fd
call fcn.0050b770
add esp, 4
push eax
lea edi, [esi + 0x28]
push 0x5604fd
mov ecx, edi
call fcn.0040b689
push str._RecvMutex
lea edx, [esp + 0xc]
push ebx
push edx
call fcn.0040dd15
add esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x44b0dc
mov eax, dword [eax + 4]
jmp 0x44b0df
add eax, 4
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp dword [esp + 0x20], 0x10
mov ebp, eax
jb 0x44b103
mov eax, dword [esp + 0xc]
push eax
call fcn.0050b609
add esp, 4
test ebp, ebp
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
je 0x44b12f
push 0xffffffffffffffff
push 0
push ebx
mov ecx, edi
call fcn.0040a999
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x90]
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ecx
call edi
mov edx, dword [esi + 0xa8]
push edx
call edi
xor eax, eax
test ebp, ebp
pop edi
setne al
pop ebp
add esp, 0x1c
ret
Function at 0x450b00
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
mov ebx, eax
push esi
mov esi, ecx
mov ebp, ebx
sub ebp, dword [esi + 0x1c]
cmp dword [ebx], 7
push edi
je 0x450b19
call fcn.004509f0
mov ebx, eax
mov eax, dword [esi + 0x14]
add eax, 0x1c
cmp eax, dword [esi + 0x24]
jne 0x450b5a
movzx eax, word [esi + 0x2c]
cmp ax, 0x1000
jbe 0x450b3a
mov edx, 5
mov ecx, esi
jmp 0x450590
movzx edi, ax
add edi, edi
call fcn.00450730
cmp word [esi + 0x2c], 0x1000
jbe 0x450b5a
push str.stack_overflow
push esi
call fcn.00455f40
add esp, 8
mov eax, dword [ebx + 8]
cmp byte [eax + 6], 0
jne 0x450c01
mov edi, dword [eax + 0xc]
cmp byte [edi + 0x4e], 0
je 0x450b83
movzx ecx, byte [edi + 0x4d]
add ebx, 0x10
push ebx
push ecx
mov eax, esi
call fcn.00450800
add esp, 8
movzx eax, byte [edi + 0x4f]
mov edx, dword [esi + 0x18]
sub edx, dword [esi + 8]
mov ecx, eax
shl ecx, 4
cmp edx, ecx
jg 0x450b9b
call fcn.004507b0
add dword [esi + 0x14], 0x1c
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x14]
lea ecx, [edx + ebp + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x14]
mov ecx, dword [edx]
mov dword [esi + 0xc], ecx
movzx edx, byte [edi + 0x4f]
shl edx, 4
add edx, ecx
mov dword [eax + 4], edx
mov ecx, dword [edi + 0xc]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], 0
mov dword [eax + 8], 8
mov edx, dword [esi + 8]
cmp edx, dword [eax + 4]
jae 0x450bf4
mov ecx, 0x10
mov edx, dword [esi + 8]
mov dword [edx], 0
add dword [esi + 8], ecx
mov edx, dword [esi + 8]
cmp edx, dword [eax + 4]
jb 0x450be0
mov eax, dword [eax + 4]
mov dword [esi + 8], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esi + 0x18]
sub ecx, dword [esi + 8]
cmp ecx, 0x140
jg 0x450c19
mov eax, 0x14
call fcn.004507b0
add dword [esi + 0x14], 0x1c
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x14]
lea ecx, [edx + ebp + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x14]
mov ecx, dword [edx]
mov edx, dword [esi + 8]
mov dword [esi + 0xc], ecx
add edx, 0x140
mov dword [eax + 4], edx
mov dword [eax + 8], 1
mov eax, dword [esi + 0xc]
mov ecx, dword [eax - 8]
mov edx, dword [ecx + 0xc]
push esi
call edx
add esp, 4
shl eax, 4
pop edi
mov ecx, eax
mov eax, dword [esi + 8]
pop esi
pop ebp
sub eax, ecx
pop ebx
ret

Function at 0x450d00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push edi
mov edi, dword [ebp + 8]
add word [edi + 0x2e], 1
movzx eax, word [edi + 0x2e]
cmp ax, 0xc8
jb 0x450d2a
jne 0x450d67
push str.C_stack_overflow
push edi
call fcn.00455f40
add esp, 8
mov eax, dword [ebp + 0xc]
mov ecx, edi
call fcn.00450b00
test eax, eax
jne 0x450d41
push edi
call fcn.0046e9f0
add esp, 4
mov ecx, dword [ebp + 0x10]
call fcn.00450c70
mov eax, dword [edi + 0x10]
add word [edi + 0x2e], 0xffff
mov ecx, dword [eax + 0x3c]
cmp ecx, dword [eax + 0x38]
jb 0x450d61
mov ebx, edi
call fcn.00463310
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ax, 0xe1
jb 0x450d2a
mov edx, 5
mov ecx, edi
jmp 0x450590
Function at 0x453e10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x53b3b0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x59099c]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push edi
mov eax, dword [0x59099c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], bx
mov dword [esp + 0x58], ebx
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov eax, edx
sub eax, ecx
sar eax, 4
cmp eax, 2
mov byte [esp + 0xc], 1
jle 0x453e7f
push str.2_parameters_max:_2nd_defaults_to_true_and_indicates_if_long_strings_should_be_clipped_using__..._
push esi
call fcn.00445230
jne 0x453eae
lea eax, [ecx + 0x10]
cmp eax, edx
jae 0x453ea3
cmp eax, ebx
je 0x453ea3
mov edi, dword [eax]
cmp edi, ebx
je 0x453ea3
cmp edi, 1
jne 0x453e9c
cmp dword [eax + 8], ebx
je 0x453ea3
mov eax, 1
jmp 0x453ea5
xor eax, eax
cmp eax, ebx
setne al
mov byte [esp + 0xc], al
cmp ecx, edx
lea edi, [edx - 0x10]
jae 0x453ebe
cmp ecx, ebx
je 0x453ebe
cmp dword [ecx], 6
je 0x453ed1
lea ecx, [esp + 0x2c]
push ecx
mov edx, edi
mov ecx, esi
call fcn.00453520
add esp, 4
jmp 0x453f41
call fcn.00440e10
mov dword [esp + 0x14], eax
mov byte [eax + 0x11], 1
mov eax, dword [esp + 0x14]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x14]
mov dword [eax], eax
mov eax, dword [esp + 0x14]
mov dword [eax + 8], eax
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x1c]
mov byte [esp + 0x58], 1
mov edx, dword [edi + 8]
push eax
lea ecx, [esp + 0x24]
push ecx
lea ebx, [esp + 0x18]
mov dword [esp + 0x24], edx
call fcn.00439c60
mov edx, dword [esp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
mov ecx, ebx
push ecx
lea edx, [esp + 0x38]
push edx
push 0
push 1
push esi
call fcn.00453900
add esp, 0x1c
mov eax, ebx
mov byte [esp + 0x58], 0
call fcn.0042b470
xor ebx, ebx
mov eax, dword [esi + 0xc]
push 0x564928
push esi
mov dword [esi + 8], eax
call fcn.00444340
push 0xffffd8ee
push esi
call fcn.00444480
mov eax, dword [esp + 0x40]
mov edi, 8
add esp, 0x10
cmp dword [esp + 0x44], edi
jae 0x453f73
lea eax, [esp + 0x30]
push eax
push esi
call fcn.00444340
mov ecx, dword [esi + 8]
push ebx
sub ecx, 0x20
push ecx
push esi
call fcn.00450d00
add esp, 0x14
cmp dword [esp + 0x44], edi
jb 0x453f9e
mov edx, dword [esp + 0x30]
push edx
call fcn.0050b609
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0050bc9c
mov esp, ebp
pop ebp
ret
Function at 0x456210
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x104
mov eax, dword [0x59099c]
xor eax, esp
mov dword [esp + 0x100], eax
cmp dword [0x5eee08], 0
jne 0x45628d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 4]
push str.gPakInterfaceP__d
push eax
call fcn.0050b433
add esp, 0xc
lea ecx, [esp]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x5eee08], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x5eee0c], eax
mov eax, dword [eax]
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0050bc9c
add esp, 0x104
ret
mov ecx, dword [esp + 0x100]
mov edx, dword [0x5eee0c]
mov eax, dword [edx]
xor ecx, esp
call fcn.0050bc9c
add esp, 0x104
ret
Function at 0x45cf50
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [eax + 0x34]
push esi
push edi
mov edi, dword [eax + 0x30]
mov esi, dword [edi]
xor ecx, ecx
cmp dword [esi + 0x3c], ecx
jle 0x45cf87
xor edx, edx
mov eax, dword [esi + 0x18]
cmp dword [edx + eax + 8], 0xffffffff
lea eax, [edx + eax + 8]
jne 0x45cf87
mov ebx, dword [edi + 0x18]
add ecx, 1
mov dword [eax], ebx
add edx, 0xc
cmp ecx, dword [esi + 0x3c]
jl 0x45cf69
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
cmp dword [eax + 0x34], 0
jle 0x45cfb7
add dword [eax + 0x34], 0xffffffff
mov ecx, dword [eax + 0x34]
mov ecx, dword [eax + ecx*4 + 0x2b8]
mov ebx, dword [eax + 0x18]
lea edx, [ecx + ecx*2]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x18]
mov dword [ecx + edx*4 + 8], ebx
cmp dword [eax + 0x34], 0
jg 0x45cf94
mov edx, dword [edi + 0xc]
mov eax, dword [edx + 8]
push eax
push 0x801d
mov eax, edi
call fcn.00475ad0
mov eax, dword [edi + 0x18]
mov ebx, dword [esi + 0x30]
mov ecx, dword [esi + 0xc]
add eax, eax
add ebx, ebx
add eax, eax
add ebx, ebx
push ebp
call fcn.004735f0
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x18]
lea ebx, [eax*8]
add esp, 0xc
test ebx, ebx
mov dword [esi + 0x30], eax
jne 0x45cffc
xor eax, eax
jmp 0x45d036
cmp ebx, 0xfffffffd
jb 0x45d00c
push str.memory_allocation_error:_block_too_big
push ebp
call fcn.00455f40
push 0
push 0
mov eax, ebx
call fcn.00475e00
add esp, 8
test eax, eax
jne 0x45d02c
test ebp, ebp
je 0x45cff8
lea edx, [eax + 4]
mov ecx, ebp
jmp 0x450590
test ebp, ebp
je 0x45d036
mov ecx, dword [ebp + 0x10]
add dword [ecx + 0x3c], ebx
mov ecx, dword [esi + 0x30]
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
push 0
push eax
mov dword [esi + 0x50], eax
call fcn.00509c30
mov eax, dword [edi + 0x18]
mov ebx, dword [esi + 0x34]
mov ecx, dword [esi + 0x14]
add eax, eax
add esp, 0xc
add ebx, ebx
add eax, eax
add ebx, ebx
push ebp
call fcn.004735f0
mov ebx, dword [esi + 0x2c]
mov ecx, dword [esi + 8]
mov dword [esi + 0x14], eax
mov edx, dword [edi + 0x18]
mov dword [esi + 0x34], edx
mov eax, dword [edi + 0x28]
add esp, 4
shl eax, 4
shl ebx, 4
push ebp
call fcn.004735f0
mov ebx, dword [esi + 0x38]
mov ecx, dword [esi + 0x10]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x2c]
add eax, eax
add esp, 4
add ebx, ebx
add eax, eax
add ebx, ebx
push ebp
call fcn.004735f0
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x38], ecx
mov ecx, dword [esi + 0x3c]
mov eax, dword [edi + 0x30]
lea eax, [eax + eax*2]
lea ebx, [ecx + ecx*2]
mov ecx, dword [esi + 0x18]
add eax, eax
add esp, 4
add ebx, ebx
add eax, eax
add ebx, ebx
push ebp
call fcn.004735f0
mov ebx, dword [esi + 0x28]
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x18], eax
movzx eax, byte [esi + 0x4c]
mov edx, dword [edi + 0x30]
add eax, eax
add esp, 4
add ebx, ebx
add eax, eax
add ebx, ebx
push ebp
mov dword [esi + 0x3c], edx
call fcn.004735f0
mov edx, dword [esp + 0x18]
mov dword [esi + 0x1c], eax
movzx eax, byte [esi + 0x4c]
add esp, 4
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 8]
pop edi
pop esi
mov dword [edx + 0x30], ecx
pop ebp
pop ebx
ret
Function at 0x469530
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
call fcn.004717e0
test eax, eax
je 0x469551
mov eax, dword [0x5eee20]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [esp + 0x24]
mov edx, dword [edx + 0x10]
push eax
call edx
jmp 0x469561
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 8]
push ecx
call fcn.0050c1ad
add esp, 4
xor edx, edx
test eax, eax
sete dl
push esi
mov esi, dword [esp + 0x30]
mov dword [esi], 1
mov dword [esp + 8], edx
call fcn.004717e0
test eax, eax
je 0x46959e
mov eax, dword [0x5eee20]
mov ecx, dword [eax]
mov eax, dword [esp + 0x28]
mov edx, dword [ecx]
mov edx, dword [edx + 0x14]
push eax
push 1
push 1
lea eax, [esp + 0x12]
push eax
call edx
jmp 0x4695b7
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 8]
push ecx
push 1
lea edx, [esp + 0xe]
push 1
push edx
call fcn.00508cbd
add esp, 0x10
cmp eax, 1
jne 0x46975c
push ebx
movzx ebx, byte [esp + 0xa]
test bl, bl
push ebp
push edi
jns case.default.0x4696a7
mov eax, ebx
and eax, 0xc0
cmp al, 0xc0
jne 0x4696bb
mov ecx, ebx
mov dword [esp + 0x18], ecx
lea edi, [esp + 0x1c]
xor esi, esi
jmp 0x4695f0
movzx eax, word [esi*2 + 0x563744]
lea edx, [eax + eax]
and edx, eax
and eax, ebx
cmp eax, edx
je 0x469615
add esi, 1
cmp esi, 5
jl 0x4695f0
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x20
ret
cmp esi, 5
jge 0x4696bb
movzx eax, word [esi*2 + 0x563744]
not eax
and ebx, eax
test esi, esi
lea ebp, [esi + 1]
jle 0x46969f
call fcn.004717e0
test eax, eax
mov eax, dword [esp + 0x34]
je 0x469659
mov ecx, dword [0x5eee20]
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov edx, dword [edx + 0x14]
push eax
push 1
push 1
lea eax, [esp + 0x1f]
push eax
call edx
jmp 0x46966e
mov ecx, dword [eax + 8]
push ecx
push 1
lea edx, [esp + 0x1b]
push 1
push edx
call fcn.00508cbd
add esp, 0x10
cmp eax, 1
jne 0x4696bb
movzx eax, byte [esp + 0x13]
mov ecx, eax
and ecx, 0xc0
cmp cl, 0x80
jne 0x4696bb
mov dword [edi], eax
shl ebx, 6
and eax, 0x3f
or eax, ebx
sub esi, 1
add edi, 4
test esi, esi
mov ebx, eax
jg 0x469631
mov ecx, dword [esp + 0x18]
lea eax, [ebp - 2]
cmp eax, 4
ja case.default.0x4696a7
jmp dword [eax*4 + 0x46976c]
and cl, 0x3e
neg cl
sbb ecx, ecx
neg ecx
test ecx, ecx
jne case.default.0x4696a7
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x20
ret
test cl, 0x1f
jne case.default.0x4696a7
test byte [esp + 0x1c], 0x20
je 0x4696bb
cmp ebx, 0xd800
jl 0x4696e1
cmp ebx, 0xdfff
jle 0x4696bb
lea edx, [ebx - 0xfffe]
cmp edx, 1
jbe 0x4696bb
cmp ebx, 0xfeff
jne 0x46973e
cmp dword [esp + 0x14], 0
je 0x46973e
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
call fcn.00469530
add esp, 0xc
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20
ret
test cl, 0xf
jne case.default.0x4696a7
test byte [esp + 0x1c], 0x30
jmp 0x4696cf
test cl, 7
jne case.default.0x4696a7
test byte [esp + 0x1c], 0x38
jmp 0x4696cf
test cl, 3
jne case.default.0x4696a7
test byte [esp + 0x1c], 0x3c
jmp 0x4696cf
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
pop edi
mov word [eax], bx
pop ebp
pop ebx
mov dword [ecx], 0
mov eax, 1
pop esi
add esp, 0x20
ret
mov dword [esi], 0
xor eax, eax
pop esi
add esp, 0x20
ret
Function at 0x469f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
push ebx
mov ebx, eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push edi
sar eax, 4
sub eax, 1
mov dword [esp + 0x1c], 1
je 0x46a135
sub eax, 1
test ebx, ebx
mov dword [esp + 0x2c], eax
jle 0x46a016
mov ecx, dword [esi + 0xc]
mov eax, ebx
shl eax, 4
lea eax, [eax + ecx - 0x10]
cmp eax, dword [esi + 8]
jb 0x46a066
push ebx
push esi
call fcn.00444100
add esp, 8
test eax, eax
mov dword [esp + 0x20], eax
je 0x46a173
mov eax, ebx
mov ecx, esi
call fcn.00444170
cmp dword [esp + 0x1c], 0
mov edi, eax
je 0x46a118
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x46a154
jmp 0x46a165
cmp ebx, 0xffffd8f0
jle 0x46a028
mov eax, ebx
shl eax, 4
add eax, dword [esi + 8]
jmp 0x46a066
cmp ebx, 0xffffd8ee
je 0x46a063
cmp ebx, 0xffffd8f0
je 0x46a05b
mov ecx, dword [esi + 0xc]
sub ecx, 0x10
mov ecx, dword [ecx + 8]
movzx edx, byte [ecx + 7]
mov eax, 0xffffd8ee
sub eax, ebx
cmp eax, edx
jg 0x46a057
shl eax, 4
add eax, ecx
jmp 0x46a066
xor eax, eax
jmp 0x46a066
mov eax, dword [esi + 0x10]
add eax, 0x58
jmp 0x46a066
lea eax, [esi + 0x40]
test eax, eax
je 0x469fd7
cmp dword [eax], 3
jne 0x469fd7
cmp dword [esp + 0x1c], 0
je 0x46a118
test ebx, ebx
mov eax, ebx
jle 0x46a0d3
mov ecx, dword [esi + 0xc]
shl eax, 4
lea eax, [eax + ecx - 0x10]
cmp eax, dword [esi + 8]
jb 0x46a0da
fldz
push 0
fstp qword [esp + 0x24]
push str._.14g
push 0
call fcn.00510c7b
add esp, 0xc
cmp eax, 0x4000
jae 0x46a0f5
push 0x4000
push str._.14g
push 0x5eab88
call fcn.00510c7b
add esp, 0xc
mov eax, 0x5eab88
jmp 0x46a0fa
mov ecx, esi
call fcn.00443bf0
test eax, eax
je 0x46a097
cmp dword [eax], 3
je 0x46a0f0
lea edi, [esp + 0x30]
call fcn.0046d310
test eax, eax
je 0x46a097
fld qword [eax + 8]
jmp 0x46a099
mov eax, 0x5604fd
fld qword [esp + 0x20]
mov edx, dword [ebp + 8]
sub esp, 8
fstp qword [esp]
push eax
mov eax, dword [edx + 8]
push eax
call fcn.0050ee0e
add esp, 0x10
test eax, eax
jg 0x46a169
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x2c]
add ebx, 1
test eax, eax
jne 0x469fb7
cmp dword [esp + 0x1c], eax
je 0x46a180
mov eax, dword [esi + 8]
mov dword [eax], 1
mov dword [eax + 8], 1
add dword [esi + 8], 0x10
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x20]
push eax
push edi
push 2
push edx
call fcn.00508f25
add esp, 0x10
cmp eax, edi
jne 0x46a118
mov dword [esp + 0x1c], 1
jmp 0x46a120
mov eax, dword [0x563864]
push eax
push ebx
push esi
call fcn.00444fd0
mov ecx, dword [esi + 8]
mov dword [ecx], 0
mov edi, 0x10
add dword [esi + 8], edi
call fcn.0050fb76
mov edx, dword [eax]
push edx
call fcn.0050facd
add esp, 4
push eax
push 0x566564
push esi
call fcn.004443b0
add esp, 0xc
call fcn.0050fb76
fild dword [eax]
mov eax, dword [esi + 8]
mov dword [eax], 3
fstp qword [eax + 8]
add dword [esi + 8], edi
lea eax, [edi - 0xd]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46bfe0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push edi
mov edi, eax
test edi, edi
jne 0x46bffa
mov dword [esi + 0x14], 0x5638c0
mov dword [esp + 0xc], eax
jmp 0x46c0b5
lea eax, [edi - 1]
or ecx, 0xffffffff
cmp eax, 0x100
jb 0x46c01d
jmp 0x46c010
shr eax, 8
add ecx, 8
cmp eax, 0x100
jae 0x46c010
movzx eax, byte [eax + 0x563f00]
lea ebx, [eax + ecx + 1]
cmp ebx, 0x18
mov dword [esp + 0xc], ebx
jle 0x46c043
mov ecx, dword [esp + 0x14]
push str.table_overflow
push ecx
call fcn.00455f40
add esp, 8
mov ecx, ebx
mov edi, 1
shl edi, cl
mov ebx, 0
lea ebp, [edi + edi*4]
add ebp, ebp
add ebp, ebp
add ebp, ebp
jne 0x46c060
xor edx, edx
jmp 0x46c087
cmp ebp, 0xfffffffd
jb 0x46c0cd
mov edx, dword [esp + 0x14]
push str.memory_allocation_error:_block_too_big
push edx
call fcn.00455f40
add esp, 8
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46c085
mov eax, dword [eax + 0x10]
add dword [eax + 0x3c], ebp
xor edx, edx
cmp edi, edx
mov dword [esi + 0x14], ebx
jle 0x46c0b5
xor eax, eax
mov ecx, edi
mov ebx, dword [esi + 0x14]
mov dword [eax + ebx + 0x24], edx
mov ebx, dword [esi + 0x14]
mov dword [eax + ebx], edx
mov ebx, dword [esi + 0x14]
mov dword [eax + ebx + 0x10], edx
mov ebx, dword [esi + 0x14]
mov dword [eax + ebx + 0x20], edx
add eax, 0x28
sub ecx, 1
jne 0x46c092
mov al, byte [esp + 0xc]
mov edx, dword [esi + 0x14]
lea ecx, [edi + edi*4]
pop edi
mov byte [esi + 8], al
lea eax, [edx + ecx*8]
pop ebp
mov dword [esi + 0x18], eax
pop ebx
pop ecx
ret
push 0
push 0
mov eax, ebp
call fcn.00475e00
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x46c077
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x46c0f1
lea edx, [eax + 4]
jmp 0x450590
xor ebx, ebx
jmp 0x46c085

Function at 0x46c400
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
push esi
push ebx
push ebx
lea eax, [ebx + 0x28]
call fcn.00475e00
add esp, 8
cmp eax, ebx
jne 0x46c42c
cmp ebp, ebx
je 0x46c428
lea edx, [ebx + 4]
mov ecx, ebp
jmp 0x450590
xor esi, esi
jmp 0x46c439
cmp ebp, ebx
je 0x46c437
mov ecx, dword [ebp + 0x10]
add dword [ecx + 0x3c], 0x28
mov esi, eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x14]
mov dword [esi], ecx
mov dl, byte [eax + 0x10]
mov dword [eax + 0x14], esi
and dl, 3
mov ecx, ebp
mov byte [esi + 5], dl
mov byte [esi + 4], 6
mov dword [esi + 0xc], ebx
mov dword [esi + 0x24], ebx
mov byte [esi + 6], 0xff
mov byte [esi + 7], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x20], ebx
mov byte [esi + 8], bl
mov dword [esi + 0x14], 0x5638c0
call fcn.0046bf90
mov eax, dword [esp + 0x14]
push ebp
call fcn.0046bfe0
add esp, 4
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x46cf20
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
lea esi, [edi*4]
xor ebx, ebx
test esi, esi
jne 0x46cf39
xor ebx, ebx
jmp 0x46cf62
cmp esi, 0xfffffffd
jb 0x46cffe
mov eax, dword [esp + 0x14]
push str.memory_allocation_error:_block_too_big
push eax
call fcn.00455f40
add esp, 8
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46cf62
mov eax, dword [eax + 0x10]
add dword [eax + 0x3c], esi
test edi, edi
mov ecx, dword [esp + 0x14]
mov esi, dword [ecx + 0x10]
mov dword [esp + 0xc], esi
jle 0x46cf79
mov ecx, edi
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
push ebp
xor ebp, ebp
cmp dword [esi + 8], ebp
jle 0x46cfbd
mov edx, dword [esi]
mov eax, dword [edx + ebp*4]
test eax, eax
je 0x46cfb5
mov edi, dword [esp + 0x1c]
add edi, 0xffffffff
mov edx, dword [eax + 8]
mov esi, dword [eax]
mov ecx, edi
and ecx, edx
cmp edx, 0x11d4a4f8
jne 0x46cfa3
nop
test esi, esi
mov edx, dword [ebx + ecx*4]
mov dword [eax], edx
mov dword [ebx + ecx*4], eax
mov eax, esi
jne 0x46cf91
mov esi, dword [esp + 0x10]
add ebp, 1
cmp ebp, dword [esi + 8]
jl 0x46cf81
mov edi, dword [esi + 8]
mov ecx, dword [esi]
add edi, edi
add edi, edi
test ecx, ecx
pop ebp
je 0x46cff0
cmp edi, 0x10
jg 0x46d02a
xor eax, eax
lea esi, [eax + eax*4]
push ecx
lea esi, [esi*4 + 0x5eef48]
call fcn.00475d40
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
sub dword [eax + 0x3c], edi
mov ecx, dword [esp + 0x18]
pop edi
mov dword [esi], ebx
mov dword [esi + 8], ecx
pop esi
pop ebx
pop ecx
ret
push 0
push 0
mov eax, esi
call fcn.00475e00
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x46cf54
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x46cf35
lea edx, [eax + 4]
jmp 0x450590
cmp edi, 0x20
jg 0x46d036
mov eax, 1
jmp 0x46cfd2
cmp edi, 0x40
jg 0x46d042
mov eax, 2
jmp 0x46cfd2
cmp edi, 0x80
jg 0x46d051
mov eax, 3
jmp 0x46cfd2
cmp edi, 0x100
jg 0x46d063
mov eax, 4
jmp 0x46cfd2
cmp edi, 0x180
jg 0x46d075
mov eax, 5
jmp 0x46cfd2
add dword [0x5eee48], 1
push ecx
call fcn.0050ce8b
add esp, 4
jmp 0x46cfe6