joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f020
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ebf28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
call fcn.0045ae70
xor edi, edi
mov dword [esi], 0x4f5430
mov dword [0xb65cbc], edi
push esi
mov dword [esp + 0x30], edi
mov dword [esi + 8], str.generic_drag_gump
mov dword [esi + 0x60], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0x9c], edi
call fcn.00479d00
push str.framedata_for_CDragGump
push 8
mov dword [esi + 0x38], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 1
call fcn.00479630
xor ecx, ecx
mov dword [esi + 0x3c], eax
mov dword [eax], ecx
add esp, 0xc
mov dword [eax + 4], ecx
mov al, byte [0x547584]
test al, al
je 0x43f0b9
mov dword [esi + 0xa0], edi
mov eax, dword [esp + 0x34]
lea ebp, [esi + 0x24]
lea ebx, [esi + 0x20]
and eax, 0xffff
push ebp
push ebx
push eax
mov dword [esp + 0x40], eax
call fcn.004447f0
mov eax, dword [ebx]
mov edx, dword [ebp]
imul edx, eax
mov dword [esi + 0x1c], eax
push str.drag_gump
lea eax, [edx + edx + 4]
push eax
call fcn.00479630
mov ecx, dword [esi + 0x3c]
mov dword [ecx + 4], eax
mov edx, dword [esi + 0x3c]
mov cx, word [ebx]
mov eax, dword [edx + 4]
mov word [eax], cx
mov edx, dword [esi + 0x3c]
mov cx, word [ebp]
mov eax, dword [edx + 4]
mov word [eax + 2], cx
mov ecx, dword [ebp]
imul ecx, dword [ebx]
mov edx, dword [esi + 0x3c]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp]
mov edx, dword [esi + 0x3c]
mov ecx, dword [ebx]
push eax
mov eax, dword [edx + 4]
push ecx
mov ecx, dword [esp + 0x50]
add eax, 4
push eax
push 0
push 0
push ecx
push fcn.004c00b0
call fcn.00444850
lea edx, [esp + 0x44]
lea eax, [esp + 0x40]
push edx
push eax
call fcn.0047a250
mov eax, dword [ebx]
mov ecx, dword [esp + 0x48]
cdq
sub eax, edx
add esp, 0x38
sar eax, 1
sub ecx, eax
mov eax, dword [ebp]
cdq
sub eax, edx
mov edx, dword [esp + 0x14]
sar eax, 1
mov dword [esi + 0x30], ecx
sub edx, eax
push 1
push 0
mov ecx, esi
mov dword [esi + 0x34], edx
call fcn.0045a530
push 0
call fcn.004d7db0
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], ecx
push edx
push eax
mov ecx, esi
call fcn.00459ab0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.0043f2f0
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x441b80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, 0x400
push edi
push esi
call fcn.004ddf8e
mov dword [0x93fef8], eax
add esp, 4
mov byte [eax], 0
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SOFTWAREOrigin_Worlds_OnlineUltima_Online1.0
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x441c2a
mov ecx, dword [0x93fef8]
lea edx, [esp + 8]
push edx
mov byte [ecx], al
mov eax, dword [0x93fef8]
mov ecx, dword [esp + 0x10]
push eax
push 0
push 0
push str.InstCDPath
push ecx
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x441c2a
cmp dword [esp + 8], esi
jb 0x441bfc
push str.FileManager::setCDPath:_temp___MAX_CD_PATH_LENGTH._n
call fcn.004cea60
add esp, 4
jmp 0x441c2a
mov edi, str.client_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [0x93fef8]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x93fef8]
test eax, eax
je 0x441d15
cmp byte [eax], 0
je 0x441d15
push eax
push str.FileManager::setCDPath:_set_CDPath_to__s_n
call fcn.004ceb30
mov esi, dword [0x93fef8]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x200
jb 0x441c75
push str.FileManager::addSearchPath:_strlen_new_path____SearchPathInfo::MAX_PATH_LENGTH._UO_startup_code_needs_to_be_re_designed_so_we_can_allocate_memory_here__n
call fcn.004cea60
add esp, 4
push ebx
mov ebx, dword [0x93fef0]
mov edx, ebx
mov edi, esi
shl edx, 8
add edx, ebx
or ecx, 0xffffffff
xor eax, eax
push ebp
shl edx, 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebp, [edx + 0x93cad8]
mov eax, ecx
mov esi, edi
mov edi, ebp
pop ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov byte [edx + 0x93ccd8], 1
mov dword [0x93fef0], ebx
cmp ebx, 0xa
mov byte [edx + 0x93ccd9], 0
pop ebx
jl 0x441cd4
push str.FileManager::addSearchPath:_numSearchPaths___MAX_SEARCH_PATHS._UO_startup_code_needs_to_be_re_designed_so_we_can_allocate_memory_here__n
call fcn.004cea60
add esp, 4
push str.FileManager::addSearchPath:_search_paths_are:_n
call fcn.004ceb30
mov eax, dword [0x93fef0]
add esp, 4
xor esi, esi
test eax, eax
jle 0x441d22
mov edi, 0x93cad8
push edi
push str.__s_n
call fcn.004ceb30
mov eax, dword [0x93fef0]
add esp, 8
inc esi
add edi, 0x202
cmp esi, eax
jl 0x441cf1
pop edi
pop esi
add esp, 8
ret
push str.FileManager::setCDPath:_CDPath_not_set_n
call fcn.004ceaa0
add esp, 4
pop edi
pop esi
add esp, 8
ret
Function at 0x441d30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
push eax
push 1
push 0
push str.SOFTWAREOrigin_Worlds_OnlineUltima_Online1.0
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x441d63
push str.Ultima_Online_does_not_appear_to_be_installed_correctly_on_your_system._Please_re_install_UO_by_running_the_setup.exe_program_located_on_your_UO_CD_ROM_n
call fcn.004cea60
add esp, 4
pop esi
add esp, 8
ret
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 4]
mov dword [esp + 4], 0
push ecx
push 0
push 0
push 0
push str.ExePath
push edx
call esi
test eax, eax
je 0x441d9e
push str.Ultima_Online_does_not_appear_to_be_installed_correctly_on_your_system._Please_re_install_UO_by_running_the_setup.exe_program_located_on_your_UO_CD_ROM._n
call fcn.004cea60
add esp, 4
pop esi
add esp, 8
ret
mov eax, dword [esp + 4]
inc eax
push eax
call fcn.004ddf8e
mov edx, dword [esp + 0xc]
add esp, 4
lea ecx, [esp + 4]
mov dword [0x93fef4], eax
push ecx
push eax
push 0
push 0
push str.ExePath
push edx
call esi
test eax, eax
je 0x441ddd
push str.Ultima_Online_does_not_appear_to_be_installed_correctly_on_your_system._Please_re_install_UO_by_running_the_setup.exe_program_located_on_your_UO_CD_ROM._n
call fcn.004cea60
add esp, 4
pop esi
add esp, 8
ret
mov esi, dword [0x93fef4]
push 0x5c
push esi
call fcn.004df5b0
add esp, 8
test eax, eax
je 0x441e0c
push 0x5c
push esi
call fcn.004df5b0
inc eax
push 0x5c
mov esi, eax
push esi
call fcn.004df5b0
add esp, 0x10
test eax, eax
jne 0x441df2
mov byte [esi], 0
pop esi
add esp, 8
ret
Function at 0x4461d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ec14b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
test edi, edi
mov dword [esp + 0xc], 0
jne 0x446201
lea ebx, [ecx + 0xc0]
jmp 0x446274
mov ebx, dword [ecx + 0xc0]
test ebx, ebx
je 0x4462f8
cmp dword [ebx + 0x10], edi
je 0x44625d
mov esi, dword [ebx + 0x2c]
test esi, esi
je 0x446242
cmp dword [esi + 0x10], edi
je 0x44623c
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x446233
push edi
mov ecx, esi
call fcn.00446f30
test eax, eax
jne 0x446263
mov esi, dword [esi + 0x30]
test esi, esi
jne 0x44621b
jmp 0x446242
mov eax, esi
test eax, eax
jne 0x446263
mov ebx, dword [ebx + 0x30]
test ebx, ebx
jne 0x44620f
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
mov dword [esp + 0xc], ebx
jmp 0x446269
mov dword [esp + 0xc], eax
mov ebx, eax
test ebx, ebx
je 0x4462f8
add ebx, 0x2c
mov eax, dword [ebx]
test eax, eax
je 0x446284
lea ebx, [eax + 0x30]
mov eax, dword [eax + 0x30]
test eax, eax
jne 0x44627a
push ebp
mov ebp, dword [esp + 0x2c]
xor esi, esi
xor edi, edi
lea eax, [ebp + 0x4000]
push eax
call fcn.004bfa50
add esp, 4
test eax, eax
je 0x4462a8
mov si, word [eax + 4]
mov di, word [eax + 6]
push 0x4c
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x2c], eax
test eax, eax
mov dword [esp + 0x1c], 0
je 0x4462f3
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push 0
push ebp
push edi
push esi
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push 2
push ecx
mov ecx, eax
call fcn.00446de0
jmp 0x4462f5
xor eax, eax
mov dword [ebx], eax
pop ebp
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x44a100
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4ec3c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045ae70
xor eax, eax
mov ebx, 1
push str.ChatBorder_framedata
push 8
mov dword [esp + 0x20], eax
mov dword [esi], 0x4f5a60
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
call fcn.00479630
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x3c], edi
push str.ChatBorder_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.00479630
mov edx, dword [esi + 0x3c]
add esp, 0x10
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x3c]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
push ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x24]
push eax
mov word [ecx + 2], dx
mov ecx, esi
call fcn.0045a530
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x44a500
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4ec408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045ae70
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x9c], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0xa0], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0xa4], ecx
mov ecx, dword [esp + 0x34]
xor eax, eax
mov ebx, 1
push str.ChatTextBox_framedata
push 8
mov dword [esp + 0x20], eax
mov dword [esi + 0xa8], edx
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], 0xffffffff
mov dword [esi + 0xbc], ecx
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
mov dword [esi], 0x4f5bf8
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
call fcn.00479630
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x3c], edi
push str.ChatTextBox_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.00479630
mov edx, dword [esi + 0x3c]
add esp, 0x10
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x3c]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + 4]
mov dx, word [esi + 0x24]
mov eax, dword [esp + 0x20]
mov word [ecx + 2], dx
push ebx
push eax
mov ecx, esi
call fcn.0045a530
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x44b480
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ec469
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0045ae70
xor ebx, ebx
mov ebp, 1
push str.ChatScrollBar_framedata
push 8
mov dword [esp + 0x28], ebx
mov dword [esi], 0x4f5d90
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
call fcn.00479630
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x3c], edi
push str.ChatScrollBar_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.00479630
mov edx, dword [esi + 0x3c]
push 0xec
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x3c]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
mov word [ecx + 2], dx
mov dword [esi + 0xa4], ebx
mov byte [esi + 0xac], bl
call fcn.004ddf8e
add esp, 0x14
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 1
je 0x44b5a1
push ebx
push 0xfb
push 0xfa
push fcn.00421c30
push ebx
push 2
push esi
push ebx
push ebx
mov ecx, eax
call fcn.00422990
jmp 0x44b5a3
xor eax, eax
mov dword [esi + 0x9c], eax
mov dword [eax + 0xa4], ebx
mov eax, dword [esi + 0x9c]
push ebp
push esi
mov byte [esp + 0x28], bl
mov dword [eax + 0xc0], ebp
mov ecx, dword [esi + 0x9c]
call fcn.0045a530
push 0xec
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 2
je 0x44b605
push ebx
push 0xfd
push 0xfc
push fcn.00421c30
push ebx
push 2
push esi
push ebx
push ebx
mov ecx, eax
call fcn.00422990
jmp 0x44b607
xor eax, eax
mov dword [esi + 0xa0], eax
mov dword [eax + 0xa4], ebp
mov ecx, dword [esi + 0xa0]
push ebp
push esi
mov byte [esp + 0x28], bl
mov dword [ecx + 0xc0], ebp
mov ecx, dword [esi + 0xa0]
call fcn.0045a530
push 0xbc
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 3
je 0x44b65d
push 0xfe
push esi
push ebx
push ebp
push ebx
push ebx
mov ecx, eax
call fcn.004231c0
jmp 0x44b65f
xor eax, eax
push ebp
push esi
mov ecx, eax
mov byte [esp + 0x28], bl
mov dword [esi + 0xa8], eax
call fcn.0045a530
mov edx, dword [esp + 0x28]
push ebp
push edx
mov ecx, esi
call fcn.0045a530
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x451cb0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4ec928
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0044b940
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x28]
lea ebx, [esi + 0x2c]
lea ebp, [esi + 0x28]
mov dword [esi + 0xf4c], ecx
mov ecx, dword [esp + 0x2c]
push ebx
xor eax, eax
push ebp
push 0xfa1
mov dword [esp + 0x28], eax
mov dword [esi], 0x4f6c28
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 2
call fcn.004447f0
mov edx, dword [esi + 0x18]
mov eax, 1
shl edx, 3
push str.ChatGump_framedata
push edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
call fcn.00479630
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x3c], edi
push str.ChatGump_frame1
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx]
imul eax, dword [ebp]
lea ecx, [eax + eax + 4]
push ecx
call fcn.00479630
mov edx, dword [esi + 0x3c]
mov dword [edx + 0xc], eax
mov ecx, dword [ebx]
imul ecx, dword [ebp]
mov edx, dword [esi + 0x3c]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 0xc]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x3c]
mov dx, word [ebp]
mov ecx, dword [eax + 0xc]
mov word [ecx], dx
mov eax, dword [esi + 0x3c]
mov dx, word [ebx]
mov ecx, dword [eax + 0xc]
mov word [ecx + 2], dx
mov eax, dword [ebx]
mov edx, dword [esi + 0x3c]
mov ecx, dword [ebp]
push eax
push ecx
mov eax, dword [edx + 0xc]
add eax, 4
push eax
push 0
push 0
push 0xfa1
push fcn.004c00b0
call fcn.00444850
mov ecx, dword [esp + 0x74]
push 0x100
lea edx, [esi + 0x316]
push ecx
push edx
call fcn.004cb040
add esp, 0x44
mov ecx, esi
push 1
push 3
call fcn.0044bb20
push 5
push 4
mov ecx, esi
call fcn.0044bb20
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
test eax, eax
mov dword [esi + 0xf30], 0x96
mov dword [esi + 0xf34], 0x64
jg 0x451e1b
mov eax, dword [esi + 0x20]
test ecx, ecx
jg 0x451e22
mov ecx, dword [esi + 0x24]
cmp eax, 0x96
jge 0x451e2e
mov eax, 0x96
cmp ecx, 0x64
jge 0x451e38
mov ecx, 0x64
mov dword [esi + 0x24], ecx
mov ecx, esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
call fcn.0044c260
mov ecx, esi
call fcn.0044c9d0
mov eax, dword [esp + 0x24]
push 1
push eax
mov ecx, esi
call fcn.0045a530
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x451f70
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4ec948
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0044b940
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x28]
lea ebx, [esi + 0x2c]
lea ebp, [esi + 0x28]
mov dword [esi + 0xf4c], ecx
mov ecx, dword [esp + 0x2c]
push ebx
xor eax, eax
push ebp
push 0xfa1
mov dword [esp + 0x28], eax
mov dword [esi], 0x4f6dc8
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 2
call fcn.004447f0
mov edx, dword [esi + 0x18]
mov eax, 1
shl edx, 3
push str.ChatGump_framedata
push edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
call fcn.00479630
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x3c], edi
push str.ChatGump_frame1
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx]
imul eax, dword [ebp]
lea ecx, [eax + eax + 4]
push ecx
call fcn.00479630
mov edx, dword [esi + 0x3c]
mov dword [edx + 0xc], eax
mov ecx, dword [ebx]
imul ecx, dword [ebp]
mov edx, dword [esi + 0x3c]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 0xc]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x3c]
mov dx, word [ebp]
mov ecx, dword [eax + 0xc]
mov word [ecx], dx
mov eax, dword [esi + 0x3c]
mov dx, word [ebx]
mov ecx, dword [eax + 0xc]
mov word [ecx + 2], dx
mov eax, dword [ebx]
mov edx, dword [esi + 0x3c]
mov ecx, dword [ebp]
push eax
push ecx
mov eax, dword [edx + 0xc]
add eax, 4
push eax
push 0
push 0
push 0xfa1
push fcn.004c00b0
call fcn.00444850
mov ecx, dword [esp + 0x74]
push 0x100
lea edx, [esi + 0x316]
push ecx
push edx
call fcn.004cb040
add esp, 0x44
mov ecx, esi
push 2
push 3
call fcn.0044bb20
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
test eax, eax
mov dword [esi + 0xf30], 0x96
mov dword [esi + 0xf34], 0x64
jg 0x4520d0
mov eax, dword [esi + 0x20]
test ecx, ecx
jg 0x4520d7
mov ecx, dword [esi + 0x24]
cmp eax, 0x96
jge 0x4520e3
mov eax, 0x96
cmp ecx, 0x64
jge 0x4520ed
mov ecx, 0x64
mov dword [esi + 0x24], ecx
mov ecx, esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
call fcn.0044c260
mov ecx, esi
call fcn.0044c9d0
mov eax, dword [esp + 0x24]
push 1
push eax
mov ecx, esi
call fcn.0045a530
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x45d3c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ed0c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x10], ebx
call fcn.0045ae70
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x30]
mov dword [ebx + 0xa4], eax
mov eax, dword [esp + 0x34]
xor ebp, ebp
push str.framedata_for_CDumbGump
push 8
mov dword [esp + 0x24], ebp
mov dword [ebx], 0x4f744c
mov dword [ebx + 0x9c], ebp
mov dword [ebx + 0xa0], ebp
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x34], edx
mov dword [ebx + 8], str.dumb_gump
mov dword [ebx + 0x60], ebp
mov dword [ebx + 0x54], ebp
mov dword [ebx + 0x64], ebp
mov dword [ebx + 0x50], ebp
mov dword [ebx + 0x4c], ebp
mov dword [ebx + 0x48], ebp
mov dword [ebx + 0x44], ebp
mov dword [ebx + 0x40], ebp
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x14], ebp
mov dword [ebx + 0x18], 1
call fcn.00479630
mov ecx, dword [ebx + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x3c], edi
push str.dumb_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 0x24]
imul eax, dword [ebx + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.00479630
mov edx, dword [ebx + 0x3c]
add esp, 0x10
mov dword [edx + 4], eax
mov eax, dword [ebx + 0x3c]
mov dx, word [ebx + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [ebx + 0x3c]
mov dx, word [ebx + 0x24]
mov ecx, dword [eax + 4]
xor eax, eax
mov word [ecx + 2], dx
mov ecx, dword [ebx + 0x24]
imul ecx, dword [ebx + 0x20]
mov edx, dword [ebx + 0x3c]
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x3c]
cmp eax, ebp
je 0x45d4f9
mov ecx, esi
mov esi, eax
imul ecx, dword [esp + 0x34]
mov eax, dword [ebx + 0x3c]
shl ecx, 1
mov edi, dword [eax + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x40]
cmp ecx, 0xffffffff
je 0x45d52a
mov eax, dword [ebx + 0x3c]
xor edx, edx
mov eax, dword [eax + 4]
mov dx, word [eax + 2]
add eax, 4
push edx
xor edx, edx
mov dx, word [eax - 4]
push edx
push eax
push ebp
push ebp
push ecx
push fcn.004bfae0
call fcn.00444850
add esp, 0x1c
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20