joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e095c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
mov eax, ebp
mov edx, dword [esp]
call fcn.004040cc
mov esi, ebx
mov eax, dword [ebp]
call fcn.00404338
test ax, ax
jbe 0x4e09c7
mov word [esp + 4], ax
mov bx, 1
mov eax, ebp
call fcn.00404590
movzx edi, bx
mov edx, dword [ebp]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xcad8
add ax, 0x566a
mov esi, eax
inc ebx
dec word [esp + 4]
jne 0x4e098c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4e2f34
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.004042e8
add esp, 0x108
pop ebx
ret

Function at 0x4e362c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.004042e8
add esp, 0x108
pop ebx
ret

Function at 0x4e824c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e82c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004046c4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404538
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4e82a4
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404598
jmp 0x4e82b0
mov eax, ebx
mov edx, 0x4e82dc
call fcn.004040cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e82cd
lea eax, [ebp - 4]
call fcn.00404078
ret

Function at 0x4e834c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.004042e8
add esp, 0x108
pop ebx
ret
Function at 0x4ea2e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push esi
push edi
xor edx, edx
push ebp
push 0x4ea400
push dword fs:[edx]
mov dword fs:[edx], esp
cmp al, 1
je 0x4ea3e5
cmp al, 2
je 0x4ea3e5
push pe_nt_image_headers32
push 0x4f21e4
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
mov eax, 0x4f20e4
mov edx, 0x4f21e4
mov ecx, pe_nt_image_headers32
call fcn.00402c20
je 0x4ea388
push 0
lea eax, [ebp - 8]
mov edx, 0x4f21e4
mov ecx, pe_nt_image_headers32
call fcn.004042e8
push dword [ebp - 8]
push 0x4ea418
lea eax, [ebp - 4]
mov edx, 3
call fcn.004043f8
mov edx, dword [ebp - 4]
mov eax, dword [0x4f20dc]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov esi, 0x4f21e4
mov edi, 0x4f20e4
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
call fcn.004323e4
lea edx, [ebp - 0xc]
call fcn.00431f74
cmp dword [ebp - 0xc], 0
je 0x4ea3e5
push 0x4ea444
call fcn.004323e4
lea edx, [ebp - 0x14]
call fcn.00431f74
push dword [ebp - 0x14]
push 0x4ea454
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004043f8
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4f20dc]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
call fcn.004323e4
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea407
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040409c
ret
Function at 0x401120
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor esi, esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ecx, eax
test ecx, ecx
mov dword [ebp - 4], ecx
je 0x4011e2
push edi
call section..text
mov edi, eax
push edi
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4011d8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4011d8
cmp dword [ebp - 4], 4
jb 0x4011d8
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x50]
push str.StringFileInfo_04x_04xArguments
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x50]
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4011d8
cmp dword [ebp - 8], esi
je 0x4011d8
mov eax, dword [ebp - 4]
test eax, eax
je 0x4011d8
lea ecx, [eax + 1]
call section..text
push dword [ebp - 4]
mov esi, eax
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp - 4]
mov byte [eax + esi], 0
mov ecx, edi
call fcn.00401010
mov eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x4013e4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push dword [ebp + 8]
call fcn.00401120
test eax, eax
mov dword [ebp - 4], eax
jne 0x401406
xor ecx, ecx
inc ecx
call section..text
mov dword [ebp - 4], eax
mov byte [eax], 0
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.004011e7
mov ebx, eax
test ebx, ebx
mov dword [ebp + 8], ebx
jne 0x40142a
xor ecx, ecx
inc ecx
call section..text
mov ebx, eax
mov dword [ebp + 8], ebx
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
mov cl, 0x20
jmp 0x401437
inc edi
cmp byte [edi], cl
je 0x401436
cmp byte [edi], 0x22
jne 0x40144e
inc edi
mov al, byte [edi]
test al, al
je 0x40145c
inc edi
cmp al, 0x22
jne 0x401441
jmp 0x40145c
mov al, byte [edi]
test al, al
je 0x40145c
inc edi
cmp al, cl
jne 0x40144e
jmp 0x40145c
inc edi
cmp byte [edi], cl
je 0x40145b
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call esi
push ebx
mov dword [ebp - 8], eax
call esi
mov ecx, dword [ebp - 8]
push dword [ebp - 4]
lea ebx, [ecx + eax]
call esi
mov ecx, dword [ebp + 0xc]
add eax, ebx
lea ecx, [eax + ecx + 0x20]
call section..text
push edi
push dword [ebp + 8]
mov esi, eax
push dword [ebp - 4]
push str._s__s__s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 4]
add esp, 0x14
call fcn.00401010
mov ecx, dword [ebp + 8]
call fcn.00401010
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x401797
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jae 0x4017aa
xor eax, eax
jmp 0x4017e0
mov eax, dword [esi + 4]
push edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov edi, 0x10000
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [esi + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4017e3
mov eax, dword [ebp - 4]
test eax, eax
je 0x4017eb
add dword [esi + 0xc], eax
sub edi, eax
jne 0x4017b9
xor eax, eax
pop edi
pop esi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4017df
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
sbb eax, eax
and eax, 0xffffffda
add eax, 0x26
jmp 0x4017df

Function at 0x4018d4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
mov edi, dword [esi + 8]
mov dword [esi + 8], eax
jmp 0x401907
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [esi + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401917
mov eax, dword [ebp - 4]
test eax, eax
je 0x40191f
add dword [esi + 8], eax
sub edi, eax
jne 0x4018e7
mov eax, dword [esi + 4]
mov dword [esi + 8], eax
xor eax, eax
pop edi
pop esi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401913
push 0x27
pop eax
jmp 0x401913
Function at 0x401a19
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp edi, ebx
mov esi, edx
mov dword [ebp - 0xc], esi
je 0x401bd1
cmp esi, ebx
je 0x401bd1
mov eax, dword [edi + 0x54]
cmp eax, ebx
je 0x401a6a
push dword [ebp + 8]
push ebx
push 0x1400
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea eax, [esi + 0x10]
push eax
push ebx
push 0x1401
push dword [edi + 0x54]
call dword [sym.imp.USER32.dll_PostMessageA]
call fcn.00401924
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401a85
and eax, 0xfffffffa
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, 0x10000
lea ecx, [ebp - 0x2c]
call fcn.0040188b
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x2c], eax
jne 0x401ac0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x401bc4
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x1c], 0x40184f
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ecx
ja 0x401b2c
cmp eax, ebx
ja 0x401b2c
lea eax, [esi + 0x20]
push eax
push ebx
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea ecx, [ebp - 0x2c]
call fcn.004018ab
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x401b05
push dword [esi + 0x28]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, dword [edi + 0x54]
cmp edi, ebx
je 0x401b21
push dword [ebp - 4]
push ebx
push 0x1403
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
call fcn.00401924
mov eax, dword [ebp - 4]
jmp 0x401bd4
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
sub esi, dword [ebp - 0x24]
cmp ebx, dword [ebp - 0x10]
jb 0x401b3f
ja 0x401b3d
cmp esi, eax
jbe 0x401b3f
mov esi, eax
sub eax, esi
sbb dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push eax
push dword [edi + 0x50]
call fcn.00401f56
add esp, 0x14
test eax, eax
jne 0x401bab
cmp dword [ebp - 8], esi
jne 0x401bb4
add dword [ebp - 0x24], esi
lea ecx, [ebp - 0x2c]
call fcn.004018d4
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x401bc4
mov eax, dword [edi + 0x54]
cmp eax, ebx
je 0x401b97
push esi
push ebx
push 0x1402
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
call fcn.00401924
test eax, eax
je 0x401bbd
cmp dword [ebp - 0x10], ebx
ja 0x401b29
jb 0x401ba3
cmp dword [ebp - 0x14], ebx
ja 0x401b29
mov esi, dword [ebp - 0xc]
jmp 0x401adb
mov dword [ebp - 4], 0x1e
jmp 0x401bc4
mov dword [ebp - 4], 0x26
jmp 0x401bc4
mov dword [ebp - 4], 0x4c7
lea ecx, [ebp - 0x2c]
call fcn.004018ab
jmp 0x401b05
push 0x57
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x106e1318
Capabilities:
Decompress data using aplib

Disassembly:
call 0x106e1468
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x106e133e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106e132a
add dl, dl
jne 0x106e1349
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106e139c
xor eax, eax
add dl, dl
jne 0x106e1356
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106e143d
add dl, dl
jne 0x106e1365
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106e1370
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106e137b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106e1386
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106e1392
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x106e1335
mov eax, 1
add dl, dl
jne 0x106e13aa
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106e13b5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106e13a1
sub eax, ebx
mov ebx, 1
jne 0x106e13e8
mov ecx, 1
add dl, dl
jne 0x106e13ce
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106e13d9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106e13c5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106e1335
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x106e13ff
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106e140a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106e13f6
cmp eax, 0x7d00
jae 0x106e142d
cmp eax, 0x500
jb 0x106e1428
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106e1335
cmp eax, 0x7f
ja 0x106e1430
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106e1335
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x106e145e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x106e1335
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0xbd8d00], 1
mov dword [0xbd8cfc], 1
mov dword [0xbd8cf8], 1
mov dword [0xbd8cf0], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x5d3014], eax
mov eax, dword [0xbd8d0c]
test eax, eax
je 0x4010b0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0xbd8d20]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0xbd8d08]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x58e8e4], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060
Function at 0x40955c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x409581
cmp dword [ebp - 0xc], 1
jne 0x40975e
jmp 0x409764
mov eax, dword [ebp + 0xcc]
mov dword [esp + 0xc4], eax
mov eax, dword [ebp + 0xc8]
mov dword [esp + 0xc0], eax
mov eax, dword [ebp + 0xc4]
mov dword [esp + 0xbc], eax
mov eax, dword [ebp + 0xc0]
mov dword [esp + 0xb8], eax
mov eax, dword [ebp + 0xbc]
mov dword [esp + 0xb4], eax
mov eax, dword [ebp + 0xb8]
mov dword [esp + 0xb0], eax
mov eax, dword [ebp + 0xb4]
mov dword [esp + 0xac], eax
mov eax, dword [ebp + 0xb0]
mov dword [esp + 0xa8], eax
mov eax, dword [ebp + 0xac]
mov dword [esp + 0xa4], eax
mov eax, dword [ebp + 0xa8]
mov dword [esp + 0xa0], eax
mov eax, dword [ebp + 0xa4]
mov dword [esp + 0x9c], eax
mov eax, dword [ebp + 0xa0]
mov dword [esp + 0x98], eax
mov eax, dword [ebp + 0x9c]
mov dword [esp + 0x94], eax
mov eax, dword [ebp + 0x98]
mov dword [esp + 0x90], eax
mov eax, dword [ebp + 0x94]
mov dword [esp + 0x8c], eax
mov eax, dword [ebp + 0x90]
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 0x8c]
mov dword [esp + 0x84], eax
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___super_fnc__2593
mov dword [ebp - 0xc], 1
jmp 0x40975f
nop
jmp 0x40956c
leave
ret
Function at 0x42f019
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x42f03e
cmp dword [ebp - 0xc], 1
je 0x42f135
jmp 0x42f130
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___super_fnc__3092
mov dword [ebp - 0xc], 1
nop
jmp 0x42f029
nop
leave
ret
Function at 0x432d87
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x432eb1
cmp dword [ebp - 0xc], 1
jne 0x432eab
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___super_fnc__2401
mov dword [ebp - 0xc], 0
jmp 0x432eac
nop
jmp 0x432d97
nop
leave
ret