joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50e868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.0041b6e0
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00401a40
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x430212
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x433470
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x50ed56
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00420110
lea ebp, [esi + 0xe0]
push 0x1d8
mov dword [esp + 0x34], 0
mov dword [esi], 0x526808
mov dword [esi + 0x20], 0x5267f8
mov byte [ebp], 0
call fcn.004fd765
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
test edi, edi
mov byte [esp + 0x30], 1
je 0x43355f
mov eax, dword [0x55cd0c]
mov ecx, dword [eax + 0x868]
mov edx, dword [ecx + 0x38]
push 0
sub edx, 0x64
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
push 0x430c0000
sub esp, 8
fstp dword [esp + 4]
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x5245f0
call fcn.00402110
mov eax, dword [0x55cd0c]
mov ecx, dword [eax + 0x868]
mov eax, dword [ecx + 0x3c]
cdq
sub eax, edx
sar eax, 1
neg eax
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
sub esp, 0xc
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x38]
mov edx, esp
fstp dword [esp + 0x3c]
mov ecx, dword [esp + 0x3c]
mov dword [edx], eax
mov dword [edx + 4], ecx
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x40]
mov ecx, edi
mov dword [edx + 8], eax
call fcn.00479570
jmp 0x433561
xor eax, eax
push eax
mov ecx, esi
mov byte [esp + 0x34], 0
call fcn.00403010
push 0x3f0
call fcn.004fd765
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
test edi, edi
mov byte [esp + 0x30], 2
je 0x433618
push 0x19
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x5245f0
call fcn.00402110
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Send_chat_message:
mov byte [esp + 0x44], 3
call fcn.00402110
mov ecx, dword [0x55cd0c]
mov edx, dword [ecx + 0x868]
mov eax, dword [edx + 0x3c]
cdq
sub eax, edx
sar eax, 1
mov ecx, 0x1e
sub ecx, eax
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x1c]
sub esp, 0xc
mov dword [esp + 0x38], 0x42960000
mov eax, dword [esp + 0x38]
mov edx, esp
fstp dword [esp + 0x3c]
mov ecx, dword [esp + 0x3c]
mov dword [edx], eax
mov dword [edx + 4], ecx
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x40]
mov ecx, edi
mov byte [esp + 0x4c], 2
mov dword [edx + 8], eax
call fcn.0047bd90
mov edi, eax
jmp 0x43361a
xor edi, edi
mov ecx, dword [0x55cd0c]
mov edx, dword [ecx + 0x868]
mov eax, dword [edx + 0x38]
cdq
sub eax, edx
sar eax, 1
push eax
mov ecx, edi
mov byte [esp + 0x34], 0
call fcn.00479f80
push edi
mov ecx, esi
mov byte [edi + 0x1d8], 1
call fcn.00403010
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x28
ret
Function at 0x446590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50fb28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004947e0
fld dword [esp + 0x38]
fsin
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
lea eax, [esi + 0x1d0]
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [esi], 0x529710
mov dword [esi + 0x20], 0x5296fc
mov dword [esp + 0x20], 0
fld dword [esp + 0x38]
fcos
fld dword [esp + 0x34]
fmul dword [0x5448bc]
fstp dword [esp + 0x38]
fxch st(1)
fmul dword [esp + 0x34]
fstp dword [esp + 4]
fmul dword [esp + 0x34]
fstp dword [esp + 0xc]
fld dword [esp + 0x30]
fadd dword [esp + 0x38]
fld dword [esp + 0x2c]
fadd dword [esp + 4]
fld dword [esp + 0xc]
fadd dword [esp + 0x28]
fstp dword [esp + 0x28]
mov edx, dword [esp + 0x28]
mov dword [esi + 0x1dc], edx
mov edx, dword [esp + 0x3c]
fstp dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x1e0], eax
fstp dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x40]
mov dword [esi + 0x1e4], ecx
mov dword [esi + 0x1e8], edx
mov dword [esi + 0x1ec], eax
call fcn.004ed97f
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
push 1
push ecx
mov ecx, esp
fmul qword [0x51f780]
mov dword [esp + 0x3c], esp
push str.glint:0
mov byte [esi + 0x49], 1
fmul qword [0x51f770]
fstp dword [esi + 0x1f0]
call fcn.00402110
mov ecx, dword [0x55cd0c]
mov ecx, dword [ecx + 0x874]
call fcn.004960f0
cmp dword [esi + 0x7c], eax
je 0x4466bb
mov edx, dword [esi]
mov ecx, esi
mov dword [esi + 0x7c], eax
call dword [edx + 0x54]
mov ecx, dword [esp + 0x18]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 0x1c
Function at 0x448030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50fc48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.004947e0
fld dword [esp + 0x34]
fcos
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x1d0], eax
mov eax, dword [esp + 0x28]
lea ecx, [esi + 0x1d4]
mov dword [ecx], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
mov dword [esi], 0x529c30
mov dword [esi + 0x20], 0x529c20
lea eax, [esi + 0x1e0]
mov dword [esp + 0x1c], 0
fld dword [esp + 0x34]
fsin
fxch st(1)
fmul dword [esp + 0x30]
fstp dword [esp + 8]
fmul dword [esp + 0x30]
fld dword [esp + 0x30]
fmul dword [0x5448bc]
fld dword [esp + 8]
fadd dword [esp + 0x24]
fstp dword [esp + 8]
mov ecx, dword [esp + 8]
fld dword [esp + 0x28]
mov dword [eax], ecx
fadd st(2)
fstp dword [esp + 0xc]
fld dword [esp + 0x2c]
mov edx, dword [esp + 0xc]
fadd st(1)
mov dword [eax + 4], edx
mov edx, dword [esp + 0x38]
fstp dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
fstp st(0)
mov eax, dword [esp + 0x3c]
fstp st(0)
mov ecx, dword [esp + 0x44]
mov dword [esi + 0x1f0], edx
mov dword [esi + 0x1f4], eax
mov byte [esi + 0x49], 1
mov dword [esi + 0x78], ecx
call fcn.004ed97f
mov edx, dword [esi]
mov dword [esp + 0x30], eax
fild dword [esp + 0x30]
mov ecx, esi
fmul qword [0x51f780]
fmul qword [0x51f770]
fstp dword [esi + 0x94]
call dword [edx + 0x54]
mov eax, dword [esp + 0x40]
mov edx, dword [esi]
mov ecx, eax
mov dword [esi + 0x9c], ecx
mov ecx, esi
mov dword [esi + 0x98], eax
call dword [edx + 0x54]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x28

Function at 0x448710
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50fc88
push eax
mov dword fs:[0], esp
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [esp + 0x2c]
push eax
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.fontSmallOutline
mov dword [esp + 0x24], 0
call fcn.00402110
mov ecx, dword [0x55cd0c]
mov ecx, dword [ecx + 0x874]
call fcn.004960f0
mov edi, dword [esp + 0x2c]
push eax
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x38], esp
mov ebp, esp
push edi
call fcn.00401a40
mov ecx, dword [esp + 0x30]
add eax, 0x10
mov dword [ebp], eax
mov eax, dword [esp + 0x2c]
sub esp, 8
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x3c]
mov dword [edx + 4], ecx
mov ecx, esi
mov dword [edx + 8], eax
call fcn.00495860
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [esi + 0x1e0], ecx
mov dword [esi], 0x529dd8
mov dword [esi + 0x20], 0x529dc4
mov byte [esi + 0x1d1], 0
mov dword [esi + 0x1e4], edx
mov dword [esi + 0x1f0], 0
mov dword [esi + 0x1f4], 0x3fd00000
mov dword [esi + 0x1f8], 0x20001
mov dword [esp + 0x14], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4487fb
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0xc
ret 0x1c
Function at 0x449a80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50fda8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004947e0
fld dword [esp + 0x38]
fsin
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
lea eax, [esi + 0x1d0]
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [esi], 0x52a2c0
mov dword [esi + 0x20], 0x52a2ac
mov dword [esp + 0x20], 0
fld dword [esp + 0x38]
fcos
fld dword [esp + 0x34]
fmul dword [0x5448bc]
fstp dword [esp + 0x38]
fxch st(1)
fmul dword [esp + 0x34]
fstp dword [esp + 4]
fmul dword [esp + 0x34]
fstp dword [esp + 0xc]
fld dword [esp + 0x30]
fadd dword [esp + 0x38]
fld dword [esp + 0x2c]
fadd dword [esp + 4]
fld dword [esp + 0xc]
fadd dword [esp + 0x28]
fstp dword [esp + 0x28]
mov edx, dword [esp + 0x28]
mov dword [esi + 0x1dc], edx
mov edx, dword [esp + 0x3c]
fstp dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x1e0], eax
fstp dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x40]
mov dword [esi + 0x1e4], ecx
mov dword [esi + 0x1e8], edx
mov dword [esi + 0x1ec], eax
call fcn.004ed97f
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
push 1
push ecx
mov dword [esi + 0x78], ecx
fmul qword [0x51f780]
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.particle1:0
fmul qword [0x51f770]
fstp dword [esi + 0x1f0]
mov byte [esi + 0x49], 1
call fcn.00402110
mov edx, dword [0x55cd0c]
mov ecx, dword [edx + 0x874]
call fcn.004960f0
cmp dword [esi + 0x7c], eax
je 0x449bb2
mov dword [esi + 0x7c], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x54]
mov ecx, dword [esp + 0x18]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 0x20
Function at 0x44ce20
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x510070
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov eax, dword [0x55cd0c]
mov ecx, dword [eax + 0x868]
test ecx, ecx
mov dword [esp + 0x18], 0
je 0x44cee5
push str.CI3Xmas
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push str.crash._s.jpg
call fcn.00402110
mov edx, dword [0x55cd0c]
lea ecx, [esp + 0xc]
push ecx
push edx
call fcn.004a7680
add esp, 0x10
mov eax, dword [esp + 4]
push 0
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x10], esp
mov esi, esp
push eax
mov byte [esp + 0x24], 1
call fcn.00401a40
add eax, 0x10
mov dword [esi], eax
mov eax, dword [0x55cd0c]
mov ecx, dword [eax + 0x868]
add esp, 4
call fcn.004ac340
mov ecx, dword [0x55cd0c]
mov ecx, dword [ecx + 0x868]
call fcn.004abde0
mov eax, dword [esp + 4]
add eax, 0xfffffff0
mov byte [esp + 0x18], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44cee5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
call fcn.004fd868
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.00401dc0
mov esi, dword [esp + 4]
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push 0x53fa40
call fcn.00402110
mov eax, dword [0x55cd0c]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.004a7680
add esp, 0x10
mov ecx, dword [eax]
push ecx
push str.ErrorManager::error
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str._s__:__s
mov byte [esp + 0x28], 3
call fcn.00402110
mov edx, dword [0x55cd0c]
mov eax, dword [edx + 0x85c]
push eax
call fcn.00475320
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
add esp, 0x10
mov byte [esp + 0x18], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44cf8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
call fcn.0050953d
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + 0x1c]
push 0x10010
push str.Error
push esi
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Forced_exit.
push str.ErrorManager::error
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str._s__:__s
call fcn.00402110
mov edx, dword [0x55cd0c]
mov eax, dword [edx + 0x85c]
push eax
call fcn.00475320
mov ecx, dword [0x55cd0c]
mov ecx, dword [ecx + 0x85c]
add esp, 0x10
call fcn.00475800
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x44dd60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51010b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xec
push ebx
push esi
push edi
mov ebx, ecx
push 4
lea ecx, [esp + 0x74]
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x70], 0x3f800000
mov dword [esp + 0x5c], 0x3f800000
mov dword [esp + 0x48], 0x3f800000
mov dword [esp + 0x34], 0x3f800000
call fcn.004bb380
fld dword [ebx + 4]
mov eax, dword [ebx]
fstp dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0xe8]
mov ecx, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x108]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov ecx, 6
lea esi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
fld dword [ebx + 4]
fstp dword [esp + 0x10]
mov ecx, dword [ebx + 8]
mov edi, dword [esp + 0xe8]
mov edx, ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
add edi, 0x18
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov ecx, 6
lea esi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
fld dword [ebx + 0xc]
fstp dword [esp + 0x10]
mov ecx, dword [ebx]
mov edi, dword [esp + 0xe8]
mov edx, ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x100], 0
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
add edi, 0x30
mov ecx, 6
lea esi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
fld dword [ebx + 0xc]
fstp dword [esp + 0x10]
mov ecx, dword [ebx + 8]
mov edi, dword [esp + 0xe8]
mov edx, ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
add edi, 0x48
mov ecx, 6
lea esi, [esp + 0x18]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x70]
call fcn.004baf30
mov eax, dword [0x55cd0c]
mov ecx, dword [eax + 0x868]
mov eax, dword [ecx + 0xc]
mov edx, dword [eax]
lea ecx, [esp + 0x30]
push ecx
push 1
push eax
call dword [edx + 0x2c]
push 0xffffffffffffffff
push 0
push 5
push 0
lea ecx, [esp + 0x80]
call fcn.004bafa0
lea ecx, [esp + 0x70]
mov dword [esp + 0x100], 0xffffffff
call fcn.004baea0
mov ecx, dword [esp + 0xf8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xf8
ret 4
Function at 0x450050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x510313
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push ebx
push ebp
push esi
push edi
mov ebp, ecx
lea ecx, [esp + 0x50]
mov dword [esp + 0x228], 0
mov dword [esp + 0x30], 0
call fcn.004947e0
mov ebx, dword [esp + 0x230]
mov al, 1
mov byte [esp + 0x99], al
lea esi, [ebx + 0x134]
mov ecx, 0x10
lea edi, [esp + 0x140]
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0x228], al
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x50]
call dword [eax + 0x54]
mov ecx, dword [ebx + 0x78]
mov ebx, dword [esp + 0x234]
mov dword [esp + 0xc8], ecx
mov eax, dword [ebx - 0xc]
xor edi, edi
test eax, eax
jle 0x45018e
mov al, byte [edi + ebx]
mov byte [esp + 0x20], al
movzx eax, al
lea edx, [eax + eax*4]
mov ecx, dword [ebp + edx*4 + 0x98]
test ecx, ecx
lea esi, [ebp + edx*4]
je 0x450157
fild dword [esi + 0xa4]
lea eax, [eax + eax*4 + 0x28]
fild dword [ebp + eax*4]
push 0
push 0
mov dword [esp + 0x20], 0
fst dword [esp + 0x44]
fadd dword [esp + 0x38]
fstp dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x20]
fstp dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x2c]
push eax
push ecx
lea ecx, [esp + 0x60]
mov dword [esp + 0x3c], edx
call fcn.00495210
lea ecx, [esp + 0x50]
call fcn.00494a80
mov ecx, dword [esp + 0x20]
push ecx
lea edx, [esp + 0x4c]
push edx
mov ecx, ebp
call fcn.0044fe20
mov edx, dword [eax]
mov ecx, dword [esi + 0x9c]
mov eax, dword [ebx - 0xc]
add ecx, edx
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x1c]
inc edi
cmp edi, eax
fadd dword [esp + 0x30]
fstp dword [esp + 0x30]
jl 0x4500e1
lea ecx, [esp + 0x50]
mov byte [esp + 0x228], 0
call fcn.00494a10
lea eax, [ebx - 0x10]
mov dword [esp + 0x228], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
pop edi
pop esi
pop ebp
pop ebx
jg 0x4501c8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x210]
mov dword fs:[0], ecx
add esp, 0x21c
ret 8
Function at 0x456ba0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x510980
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov esi, ecx
push 2
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0
call fcn.00493cd0
mov dword [esp + 8], 0x52b620
call fcn.004fd868
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x40]
push eax
push ecx
add esi, 0xfffffff0
mov dword [esp + 0x4c], esp
mov edi, esp
push esi
mov byte [esp + 0x3c], 1
call fcn.00401a40
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
add esp, 4
push ecx
add eax, 0x10
push edx
lea ecx, [esp + 0x18]
mov dword [edi], eax
call fcn.00456b20
lea ecx, [esp + 8]
call fcn.00493f80
lea ecx, [esp + 8]
call fcn.00493db0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x30], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x456c5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov dword [esp + 0x30], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x456c7b
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0x28]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x2c
ret 0x10
Function at 0x475800
Capabilities:
Copy file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x512448
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x475830
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [esi + 8], 0
lea ecx, [esp + 8]
push ecx
call fcn.0041b8c0
push str.crash.CI3Xmas.log
push eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x24], 0
call fcn.0041b800
mov eax, dword [eax]
mov ecx, dword [esi + 4]
add esp, 0x10
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop esi
jg 0x475883
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 4]
add eax, 0xfffffff0
mov dword [esp + 0x10], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4758a9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4767f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5125c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebp
push esi
push edi
mov edi, dword [esp + 0x40]
push 0x1011
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], 0
call fcn.004fe203
mov esi, dword [esp + 0x48]
mov ebp, dword [esp + 0x4c]
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
push 0x12
lea ecx, [esp + 0x20]
mov al, 0x20
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 1
mov byte [esp + 0x26], 2
mov word [esp + 0x30], si
mov word [esp + 0x32], bp
mov byte [esp + 0x34], al
mov byte [esp + 0x35], al
call fcn.004fdb96
imul esi, ebp
mov edx, dword [esp + 0x44]
shl esi, 2
push esi
push edx
lea ecx, [esp + 0x14]
call fcn.004fdb96
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 0
call fcn.004fde88
lea eax, [edi - 0x10]
mov dword [esp + 0x38], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
jg 0x4768bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x477790
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x512740
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x30]
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x18], esp
mov ebp, esp
push edi
mov dword [esp + 0x2c], 1
call fcn.00401a40
add eax, 0x10
mov dword [ebp], eax
mov ebp, dword [esp + 0x34]
add ebp, 0xfffffff0
mov dword [esp + 0x20], esp
mov ebx, esp
push ebp
mov byte [esp + 0x30], 2
call fcn.00401a40
add eax, 0x10
mov dword [ebx], eax
add esp, 4
lea eax, [esp + 0x18]
push eax
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.004776e0
mov eax, dword [eax]
push eax
lea ecx, [esi + 0x10]
mov byte [esp + 0x28], 3
call fcn.004fcfd6
test eax, eax
mov eax, dword [esp + 0x10]
setne bl
add eax, 0xfffffff0
mov byte [esp + 0x24], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x477839
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov byte [esp + 0x24], 0
lea eax, [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x477856
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
mov dword [esp + 0x24], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x477875
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov al, bl
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 8