joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ecdc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00415fe2
and dword [ebp - 0x14], 0
cmp dword [0x46b270], 0
mov dword [ebp - 0x18], eax
jne 0x41ed8f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41ee37
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41ee37
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46b270], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46b274], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46b278], eax
call edi
push eax
call esi
mov dword [0x46b280], eax
test eax, eax
je 0x41ed8f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46b27c], eax
mov eax, dword [0x46b27c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41ede8
cmp dword [0x46b280], ecx
je 0x41ede8
push eax
call esi
push dword [0x46b280]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ede8
test ebx, ebx
je 0x41ede8
call edi
test eax, eax
je 0x41eddf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41eddf
test byte [ebp - 8], 1
jne 0x41ede8
or dword [ebp + 0x10], 0x200000
jmp 0x41ee1b
mov eax, dword [0x46b274]
cmp eax, dword [ebp - 0x18]
je 0x41ee1b
push eax
call esi
test eax, eax
je 0x41ee1b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41ee1b
mov eax, dword [0x46b278]
cmp eax, dword [ebp - 0x18]
je 0x41ee1b
push eax
call esi
test eax, eax
je 0x41ee1b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46b270]
call esi
test eax, eax
je 0x41ee37
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41ee39
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410717
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x37f94285
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x58105f1
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x408744
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x18
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esp + 4], esi
xor esi, esi
mov dword [esp + 8], ecx
mov dword [esp], ebx
mov dword [esp + 0x10], 0x84222325
mov dword [esp + 0x14], 0xcbf29ce4
mov dword [esp + 0xc], edx
cmp dword [esp + 8], esi
je 0x4087b4
mov eax, dword [esp + 0x20]
mov ebx, dword [eax + esi*4]
xor ecx, ecx
xor dword [esp + 0x10], ebx
mov ebx, 0x1b3
mov eax, dword [esp + 0x10]
xor dword [esp + 0x14], ecx
mov ecx, 0x100
mov edx, dword [esp + 0x14]
imul ecx, eax
imul edx, ebx
add ecx, edx
mul ebx
add edx, ecx
inc esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
cmp esi, dword [esp + 8]
jb 0x408776
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp]
mov esi, dword [esp + 4]
add esp, 0x18
ret 8
Function at 0x41fa40
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
mov dword [esp], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x14]
and esi, 0xfffffffc
mov dword [esp + 8], edi
add esi, ecx
cmp ecx, esi
mov dword [esp + 0xc], eax
je 0x41fa9e
mov ecx, dword [ebx]
add ebx, 4
imul edx, ecx, 0xcc9e2d51
mov ecx, edx
rol edx, 0xf
mov ecx, edx
imul edx, ecx, 0x1b873593
mov ecx, edx
xor dword [esp + 0xc], ecx
mov edx, dword [esp + 0xc]
rol edx, 0xd
lea edx, [edx + edx*4 - 0x19ab949c]
cmp ebx, esi
mov dword [esp + 0xc], edx
jne 0x41fa6a
mov eax, dword [esp + 0x14]
xor ecx, ecx
and eax, 3
cmp eax, 1
je 0x41faca
cmp eax, 2
je 0x41fac1
cmp eax, 3
je 0x41faba
jmp 0x41fae8
movzx ecx, byte [ebx + 2]
shl ecx, 0x10
movzx esi, byte [ebx + 1]
shl esi, 8
xor ecx, esi
movzx edi, byte [ebx]
xor ecx, edi
imul edx, ecx, 0xcc9e2d51
mov ecx, edx
rol edx, 0xf
mov ecx, edx
imul eax, ecx, 0x1b873593
mov ecx, eax
xor dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 8]
xor dword [esp + 0xc], ecx
mov bx, word [esp + 0xe]
and ebx, 0xffff
xor ebx, dword [esp + 0xc]
imul esi, ebx, 0x85ebca6b
mov ebx, dword [esp]
mov dword [esp + 0xc], esi
shr esi, 0xd
xor esi, dword [esp + 0xc]
imul edx, esi, 0xc2b2ae35
mov esi, dword [esp + 4]
mov dword [esp + 0xc], edx
mov ax, word [esp + 0xe]
and eax, 0xffff
xor dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add esp, 0x10
ret 8

Function at 0x41fb50
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
mov dword [esp], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x14]
and esi, 0xfffffffc
mov dword [esp + 8], edi
add esi, ecx
cmp ecx, esi
mov dword [esp + 0xc], eax
je 0x41fbae
mov ecx, dword [ebx]
add ebx, 4
imul edx, ecx, 0xcc9e2d51
mov ecx, edx
rol edx, 0xf
mov ecx, edx
imul edx, ecx, 0x1b873593
mov ecx, edx
xor dword [esp + 0xc], ecx
mov edx, dword [esp + 0xc]
rol edx, 0xd
lea edx, [edx + edx*4 - 0x19ab949c]
cmp ebx, esi
mov dword [esp + 0xc], edx
jne 0x41fb7a
mov eax, dword [esp + 0x14]
xor ecx, ecx
and eax, 3
cmp eax, 1
je 0x41fbda
cmp eax, 2
je 0x41fbd1
cmp eax, 3
je 0x41fbca
jmp 0x41fbf8
movzx ecx, byte [ebx + 2]
shl ecx, 0x10
movzx esi, byte [ebx + 1]
shl esi, 8
xor ecx, esi
movzx edi, byte [ebx]
xor ecx, edi
imul edx, ecx, 0xcc9e2d51
mov ecx, edx
rol edx, 0xf
mov ecx, edx
imul eax, ecx, 0x1b873593
mov ecx, eax
xor dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 8]
xor dword [esp + 0xc], ecx
mov bx, word [esp + 0xe]
and ebx, 0xffff
xor ebx, dword [esp + 0xc]
imul esi, ebx, 0x85ebca6b
mov ebx, dword [esp]
mov dword [esp + 0xc], esi
shr esi, 0xd
xor esi, dword [esp + 0xc]
imul edx, esi, 0xc2b2ae35
mov esi, dword [esp + 4]
mov dword [esp + 0xc], edx
mov ax, word [esp + 0xe]
and eax, 0xffff
xor dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add esp, 0x10
ret 8
Function at 0x42a728
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], edi
mov ebx, dword [ecx + 0x3c]
mov edx, dword [ecx + 0x40]
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0x20]
mov dword [esp + 0x24], edx
mov edi, dword [esp + 0x24]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.0042a82c
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
cmp dword [esp + 0x10], 0
je 0x42a7d1
mov edx, dword fs:[0x2c]
mov esi, dword [edx]
cmp dword [esi + 0x30], 0
jne 0x42a7b2
mov dword [esp], 0x4cd330
call fcn.00462d20
mov ebx, eax
test eax, eax
je 0x42a7a2
lea ecx, [ebx + 8]
jmp 0x42a7a4
xor ecx, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov dword [edx + 0x30], ecx
mov ebx, dword fs:[0x2c]
mov esi, dword [ebx]
mov eax, dword [esi + 0x30]
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x2c
ret
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
cmp dword [ecx + 0x40], 0
jne 0x42a80a
mov dword [esp], 0x4cd6c0
call fcn.00462d20
mov ebx, eax
test eax, eax
je 0x42a7f9
lea edx, [ebx + 8]
jmp 0x42a7fb
xor edx, edx
mov esi, dword fs:[0x2c]
mov eax, dword [esi]
mov dword [eax + 0x40], edx
mov ecx, dword fs:[0x2c]
mov ebx, dword [ecx]
mov eax, dword [ebx + 0x40]
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x2c
ret
Function at 0x43cf08
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
mov ecx, dword [ebx]
push esi
xor esi, esi
mov eax, ebx
call dword [ecx + 0x10]
xor al, 1
je 0x43cf2c
mov edx, dword [ebx]
inc esi
mov eax, ebx
call dword [edx + 0xc]
mov ecx, dword [ebx]
mov eax, ebx
call dword [ecx + 0x10]
xor al, 1
jne 0x43cf19
mov eax, esi
pop esi
pop ebx
ret
Function at 0x44268c
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
mov dword [esp], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
call fcn.00443020
movsx ecx, word [ebx]
test cx, cx
js 0x44277b
cmp word [ebx], 0x2710
jge 0x44271b
push esi
mov ecx, 0x4ce4e0
push ecx
push 0xc
push dword [ebx]
movzx edx, byte [ebx + 2]
mov byte [esp + 0x1b], dl
and edx, 0xff
dec edx
cmp edx, 0xc
jb 0x4426f8
push 0xc
movzx ecx, byte [esp + 0x1f]
dec ecx
push ecx
mov edx, 0x4cc290
push 0
push 0x28f5
push edx
call fcn.00462c8c
movzx ecx, byte [esp + 0x1b]
mov edx, dword [ecx*8 + 0x4ed4bc]
push edx
mov eax, dword [ecx*8 + 0x4ed4b8]
push eax
movzx eax, byte [ebx + 3]
call fcn.0044306c
jmp 0x442834
push esi
mov ecx, 0x4ce4f0
push ecx
push 0xd
push dword [ebx]
movzx edx, byte [ebx + 2]
mov ecx, 0xc
mov byte [esp + 0x18], dl
and edx, 0xff
dec edx
cmp edx, ecx
jb 0x442758
push ecx
movzx edx, byte [esp + 0x1c]
dec edx
push edx
mov ecx, 0x4cc290
push 0
push 0x28f5
push ecx
call fcn.00462c8c
movzx edx, byte [esp + 0x18]
mov eax, dword [edx*8 + 0x4ed4b8]
mov edx, dword [edx*8 + 0x4ed4bc]
push edx
push eax
movzx eax, byte [ebx + 3]
call fcn.0044306c
jmp 0x442834
cmp cx, 0xd8f0
jle 0x4427dc
push esi
mov ecx, 0x4ce500
push ecx
push 0xc
push dword [ebx]
movzx edx, byte [ebx + 2]
mov byte [esp + 0x19], dl
and edx, 0xff
dec edx
cmp edx, 0xc
jb 0x4427bc
push 0xc
movzx ecx, byte [esp + 0x1d]
dec ecx
push ecx
mov edx, 0x4cc290
push 0
push 0x28f5
push edx
call fcn.00462c8c
movzx ecx, byte [esp + 0x19]
mov edx, dword [ecx*8 + 0x4ed4bc]
push edx
mov eax, dword [ecx*8 + 0x4ed4b8]
push eax
movzx eax, byte [ebx + 3]
call fcn.0044306c
jmp 0x442834
push esi
mov edx, 0x4ce510
push edx
push 0xc
push dword [ebx]
movzx ecx, byte [ebx + 2]
mov byte [esp + 0x1a], cl
and ecx, 0xff
dec ecx
cmp ecx, 0xc
jb 0x442816
push 0xc
movzx edx, byte [esp + 0x1e]
dec edx
push edx
mov ecx, 0x4cc290
push 0
push 0x28f5
push ecx
call fcn.00462c8c
movzx edx, byte [esp + 0x1a]
mov eax, dword [edx*8 + 0x4ed4b8]
mov edx, dword [edx*8 + 0x4ed4bc]
push edx
push eax
movzx eax, byte [ebx + 3]
call fcn.0044306c
push esi
mov ecx, 0x4ce520
push ecx
push 0xf
push dword [ebx + 4]
push dword [ebx + 5]
movzx eax, byte [ebx + 6]
call fcn.00443834
mov ebx, dword [esp]
mov esi, dword [esp + 4]
add esp, 0x10
ret 8
Function at 0x448cc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
lea eax, [ebp - 0x11c]
push 0x448df9
push edx
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x114
push dword [ebp + 0xc]
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x120], edi
push dword [ebp + 8]
call fcn.00448e04
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x11c]
mov edx, 0xffffffff
cmp ecx, edx
lea edi, [ebp - 0x11c]
jne 0x448d29
lea esi, [ebp - 0x114]
jmp 0x448d2b
mov esi, ecx
push esi
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
cmp eax, 0xffffffff
setne cl
lea edx, [ebp - 0x11c]
push ecx
mov ecx, dword [ebp - 0x11c]
cmp ecx, 0xffffffff
push dword [ebp + 0xc]
push dword [ebp + 8]
jne 0x448d59
lea edx, [ebp - 0x114]
jmp 0x448d5b
mov edx, ecx
mov ecx, 0x4ce650
mov eax, 0x7f1
push edx
push ecx
push 0x35
call fcn.00449aac
mov eax, ebx
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.00448daa
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x128]
mov esi, dword [ebp - 0x124]
mov edi, dword [ebp - 0x120]
mov esp, ebp
pop ebp
ret 8

Function at 0x44ccd8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x10c
mov dword [esp], ebx
push dword [esp + 0x114]
push dword [esp + 0x114]
lea eax, [esp + 0xc]
call fcn.00448e04
mov ecx, dword [esp + 4]
cmp ecx, 0xffffffff
jne 0x44cd07
lea edx, [esp + 0xc]
jmp 0x44cd09
mov edx, ecx
push edx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne bl
lea eax, [esp + 4]
call fcn.00449124
mov eax, ebx
mov ebx, dword [esp]
add esp, 0x10c
ret 8

Function at 0x44cd2c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
lea eax, [ebp - 0x11c]
push 0x44ce47
push edx
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x114
push dword [ebp + 0xc]
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x120], edi
push dword [ebp + 8]
call fcn.00448e04
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x11c]
mov edx, 0xffffffff
cmp ecx, edx
lea esi, [ebp - 0x11c]
jne 0x44cd95
lea ebx, [ebp - 0x114]
jmp 0x44cd97
mov ebx, ecx
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
lea edi, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x11c]
cmp ecx, 0xffffffff
push dword [ebp + 0xc]
push dword [ebp + 8]
jne 0x44cdbf
lea edx, [ebp - 0x114]
jmp 0x44cdc1
mov edx, ecx
mov ecx, 0x4ce650
mov eax, 0xb92
push edx
push ecx
push 0x35
call fcn.0044ce54
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc]
push 0xffffffffffffffff
push ecx
push 0x4cab30
call fcn.004669c8
add esp, 0xc
call fcn.0044cdf8
jmp 0x44ce22
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x128]
mov esi, dword [ebp - 0x124]
mov edi, dword [ebp - 0x120]
mov esp, ebp
pop ebp
ret 8
Function at 0x44d264
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov dword [esp + 4], esi
mov esi, dword [esp + 0x14]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
movzx ecx, byte [esi]
mov byte [esp + 8], cl
mov bl, byte [esp + 8]
and bl, byte [esp + 0xc]
mov al, bl
push esi
lea edx, [esp + 0xc]
push edx
call fcn.0044d2a8
xor al, 1
jne 0x44d27d
mov al, bl
mov ebx, dword [esp]
mov esi, dword [esp + 4]
add esp, 0x10
ret 4
Function at 0x453c94
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], 0x4cae70
mov dword [esp + 0x1c], 3
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], 0x4cae70
push dword [esp + 0x28]
push dword [esp + 0x28]
call fcn.0046e0d0
mov ecx, 0x4d7070
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov edx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edi, dword [esi + edx*4]
mov edx, dword [edi + 0x80]
mov dword [esp], edx
call fcn.00469d90
test eax, eax
je 0x453d67
mov dword [esp + 8], 0xc
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x4d7070
mov ecx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edi, dword [esi + ecx*4]
mov edx, dword [edi + 0x80]
mov dword [esp], edx
call fcn.0046e258
mov ecx, 0x455790
mov esi, 0x4555dc
mov dword [esp + 0x38], esi
mov edx, dword [esp + 0x38]
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0x34]
push edx
push esi
call fcn.00455a90
jmp 0x453e04
lea eax, [esp + 0x1c]
mov edi, 0xc
mov dword [esp + 0xc], eax
mov ecx, 0x4d3c20
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov edx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edx, dword [esi + edx*4]
lea esi, [edx + 0x80]
mov dword [esp], esi
call fcn.00466894
mov esi, 0x4cf2d0
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0x4d3c20
mov ecx, dword [0x50a40c]
mov edx, dword fs:[0x2c]
mov esi, dword [edx + ecx*4]
lea edi, [esi + 0x80]
mov dword [esp], edi
call fcn.00466894
mov ebx, eax
mov eax, 0x455790
mov dword [esp + 0x2c], eax
mov ecx, 0x4555dc
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x30]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov byte [ebx + 8], 0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x3c
ret
Function at 0x453e1c
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], 0x4cf9d0
mov dword [esp + 0x1c], 3
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], 0x4cf9d0
push dword [esp + 0x28]
push dword [esp + 0x28]
call fcn.0046e0d0
mov ecx, 0x4d7070
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov edx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edi, dword [esi + edx*4]
mov edx, dword [edi + 0x80]
mov dword [esp], edx
call fcn.00469d90
test eax, eax
je 0x453eef
mov dword [esp + 8], 0xc
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x4d7070
mov ecx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edi, dword [esi + ecx*4]
mov edx, dword [edi + 0x80]
mov dword [esp], edx
call fcn.0046e258
mov ecx, 0x455d24
mov esi, 0x455c38
mov dword [esp + 0x38], esi
mov edx, dword [esp + 0x38]
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0x34]
push edx
push esi
call fcn.00455a90
jmp 0x453f8c
lea eax, [esp + 0x1c]
mov edi, 0xc
mov dword [esp + 0xc], eax
mov ecx, 0x4d3c20
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov edx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edx, dword [esi + edx*4]
lea esi, [edx + 0x80]
mov dword [esp], esi
call fcn.00466894
mov esi, 0x4cf2d0
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0x4d3c20
mov ecx, dword [0x50a40c]
mov edx, dword fs:[0x2c]
mov esi, dword [edx + ecx*4]
lea edi, [esi + 0x80]
mov dword [esp], edi
call fcn.00466894
mov ebx, eax
mov eax, 0x455d24
mov dword [esp + 0x2c], eax
mov ecx, 0x455c38
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x30]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov byte [ebx + 8], 0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x3c
ret
Function at 0x454450
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], 0x4d0920
mov dword [esp + 0x1c], 5
mov dword [esp + 0x24], 5
mov dword [esp + 0x28], 0x4d0920
push dword [esp + 0x28]
push dword [esp + 0x28]
call fcn.0046e0d0
mov ecx, 0x4d7070
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov edx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edi, dword [esi + edx*4]
mov edx, dword [edi + 0xa0]
mov dword [esp], edx
call fcn.00469d90
test eax, eax
je 0x454523
mov dword [esp + 8], 0xc
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x4d7070
mov ecx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edi, dword [esi + ecx*4]
mov edx, dword [edi + 0xa0]
mov dword [esp], edx
call fcn.0046e258
mov ecx, 0x456ac8
mov esi, 0x456aac
mov dword [esp + 0x38], esi
mov edx, dword [esp + 0x38]
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0x34]
push edx
push esi
call fcn.00456cd4
jmp 0x4545c0
lea eax, [esp + 0x1c]
mov edi, 0xc
mov dword [esp + 0xc], eax
mov ecx, 0x4d4350
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov edx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edx, dword [esi + edx*4]
lea esi, [edx + 0xa0]
mov dword [esp], esi
call fcn.00466894
mov esi, 0x4cf3d0
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0x4d4350
mov ecx, dword [0x50a40c]
mov edx, dword fs:[0x2c]
mov esi, dword [edx + ecx*4]
lea edi, [esi + 0xa0]
mov dword [esp], edi
call fcn.00466894
mov ebx, eax
mov eax, 0x456ac8
mov dword [esp + 0x2c], eax
mov ecx, 0x456aac
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x30]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov byte [ebx + 8], 0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x3c
ret