joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c530
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c93f1
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push edi
mov eax, dword [0x5920a4]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
push str.eatRatioText
lea ecx, [esp + 0x10]
call fcn.0044be60
lea eax, [esp + 0xc]
push eax
xor ebx, ebx
mov eax, esi
mov dword [esp + 0x54], ebx
call fcn.0046de50
or dword [esp + 0x50], 0xffffffff
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1d0], eax
call fcn.00448860
push str.eatPctText
lea ecx, [esp + 0x10]
call fcn.0044be60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], edi
call fcn.0046de50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1d4], eax
call fcn.00448860
push str.timeBonusGrp
lea ecx, [esp + 0x10]
call fcn.0044be60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], 2
call fcn.0046de50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1d8], eax
call fcn.00448860
push str.noTimeBonusGrp
lea ecx, [esp + 0x10]
call fcn.0044be60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], 3
call fcn.0046de50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1f4], eax
call fcn.00448860
push str.timeLeftText
lea ecx, [esp + 0x10]
call fcn.0044be60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], 4
call fcn.0046de50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1dc], eax
call fcn.00448860
push str.timeBonusText
lea ecx, [esp + 0x10]
call fcn.0044be60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], 5
call fcn.0046de50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1e0], eax
call fcn.00448860
push str.finalScoreText
lea ecx, [esp + 0x10]
call fcn.0044be60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], 6
call fcn.0046de50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1e4], eax
call fcn.00448860
push str.foodBankCount
lea ecx, [esp + 0x10]
call fcn.0044be60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], 7
call fcn.0046de50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1f0], eax
call fcn.00448860
push str.foodBankRank
lea ecx, [esp + 0x10]
call fcn.0044be60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], 8
call fcn.0046de50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1ec], eax
call fcn.00448860
push str.foodBankRankHeader
lea ecx, [esp + 0x2c]
call fcn.0044be60
lea eax, [esp + 0x28]
push eax
mov eax, esi
mov dword [esp + 0x54], 9
call fcn.0046de50
push ebx
push edi
lea ecx, [esp + 0x30]
mov dword [esi + 0x1e8], eax
call fcn.00448860
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48fc00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x330]
cmp eax, 2
push ecx
je 0x48fc36
cmp eax, 1
mov eax, dword [esi + 0xc]
je 0x4edf4a
mov ecx, dword [eax + 0x28]
fldz
fstp dword [esp]
push dword [eax + 0x24]
call fcn.004098b0
mov ecx, esi
pop esi
jmp fcn.00419fc0
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x84]
jmp 0x48fc21
mov ecx, dword [eax + 0x8c]
jmp 0x48fc21

Function at 0x493a30
Capabilities:
Get file version info
Identify system language via api

Disassembly:
push 0x48
mov eax, 0x4ccd7d
call fcn.004acfbc
and dword [ebp - 0x10], 0
mov edi, 0x800
push edi
mov esi, 0x5abde8
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x1c]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x493b9e
lea eax, [ebx + 1]
push eax
call fcn.004ab14e
pop ecx
push eax
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
push esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x493b95
mov ebx, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call ebx
movzx eax, ax
push eax
push str.StringFileInfo_04X04B0ProductName
push edi
push esi
call fcn.004bf2d9
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 0x14]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x493ac9
mov ecx, dword [ebp + 8]
push dword [ebp - 0x10]
add ecx, 0x1f4
call fcn.004633e0
call ebx
movzx eax, ax
push eax
push str.StringFileInfo_04X04B0ProductVersion
push edi
push esi
call fcn.004bf2d9
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 0x14]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x493b04
mov ecx, dword [ebp + 8]
push dword [ebp - 0x10]
add ecx, 0x210
call fcn.004633e0
call ebx
movzx eax, ax
push eax
push str.StringFileInfo_04X04B0SpecialBuild
push edi
push esi
call fcn.004bf2d9
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 0x14]
call sub.VERSION.dll_VerQueryValueA
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
je 0x493b41
push dword [ebp - 0x10]
lea ecx, [esi + 0x22c]
call fcn.004633e0
push 0x5610d0
lea eax, [esi + 0x210]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00492140
lea ecx, [esi + 0x22c]
push ecx
push eax
lea edi, [ebp - 0x38]
mov dword [ebp - 4], ebx
call fcn.0044b480
add esp, 0x14
push eax
lea ecx, [esi + 0x248]
mov byte [ebp - 4], 1
call fcn.004547b0
push ebx
push 1
mov ecx, edi
call fcn.00448860
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.00448860
push dword [ebp - 0x14]
call fcn.004ab686
pop ecx
call fcn.004ad094
ret 4
Function at 0x49b030
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d08e4
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5920a4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
call fcn.0040a630
mov edi, dword [eax + 0x24]
call fcn.00481990
add eax, 0xc
mov dword [esp + 0x18], eax
call fcn.0049aff0
and dword [esp + 0x14], 0
xor esi, esi
lea edi, [esp + 0x14]
mov dword [esp + 0x1c], eax
call fcn.004a1e00
and dword [esp + 0x30], esi
and dword [esp + 0x10], esi
lea edi, [esp + 0x10]
call fcn.004a1e00
cmp dword [ebp + 0x10], esi
mov byte [esp + 0x30], 1
jle 0x49b159
mov eax, dword [ebp + 0xc]
sub eax, esi
jne 0x4eede1
push 0x3c
call fcn.004aa098
pop ecx
mov dword [esp + 0x20], eax
test eax, eax
mov byte [esp + 0x30], 2
je 0x4eee56
push dword [ebp + 0x14]
mov esi, eax
push dword [ebp + 0x10]
push dword [esp + 0x20]
call fcn.004a4090
mov esi, eax
lea edi, [esp + 0x14]
mov byte [esp + 0x30], 1
call fcn.004a1e00
mov esi, dword [esp + 0x14]
mov eax, dword [ebx + 0x1b8]
push esi
push eax
call fcn.00419ed0
test eax, eax
jle 0x49b159
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x1b8]
push esi
push eax
call fcn.00419bc0
push dword [ebx + 0x1b8]
mov edx, dword [esp + 0x20]
call fcn.004199d0
mov bl, 1
lea eax, [esp + 0x10]
mov byte [esp + 0x30], 0
call fcn.004a2630
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0x14]
call fcn.004a2630
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor bl, bl
jmp 0x49b126
dec eax
jne 0x49b159
push 0x3c
call fcn.004aa098
pop ecx
mov dword [esp + 0x20], eax
test eax, eax
mov byte [esp + 0x30], 3
je 0x4eee10
push dword [ebp + 0x14]
mov esi, eax
push dword [ebp + 0x10]
push dword [esp + 0x20]
call fcn.004a4090
jmp 0x4eee12
xor eax, eax
mov esi, eax
lea edi, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.004a1e00
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 0x1bc]
push esi
push eax
call fcn.00419ed0
test eax, eax
jle 0x49b159
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x1bc]
push esi
push eax
call fcn.00419bc0
push dword [ebx + 0x1bc]
jmp 0x49b11b
xor eax, eax
jmp 0x49b0e0
Function at 0x49db10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cafad
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push edi
mov eax, dword [0x5920a4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.body
lea ecx, [esp + 0x14]
call fcn.0044be60
and dword [esp + 0x38], 0
mov eax, dword [esi + 0xd8]
lea ecx, [esp + 0x10]
push ecx
call fcn.00461d30
or dword [esp + 0x38], 0xffffffff
push 0
push 1
lea ecx, [esp + 0x18]
mov edi, eax
call fcn.00448860
fld dword [0x54ddf8]
test edi, edi
fstp dword [esp + 0xc]
je 0x49db90
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x20]
fdivr qword [0x566c18]
fstp dword [esp + 0xc]
fld dword [0x5668b0]
push 1
sub esp, 0xc
fstp dword [esp + 8]
fld dword [esp + 0x1c]
fstp dword [esp + 4]
fld1
fstp dword [esp]
push esi
call fcn.00492470
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4a0450
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call fcn.004c1e10
mov dword [0x5ac608], eax
mov eax, dword [ebp - 8]
mov dword [0x5ac600], eax
mov eax, dword [ebp - 4]
mov dword [0x5ac604], eax
lea eax, [ebp - 8]
push eax
mov dword [0x5ac60c], edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [ebp - 8]
mov dword [0x5ac660], eax
mov eax, dword [ebp - 4]
push 1
mov dword [0x5ac664], eax
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [0x5a5ed8]
xor eax, eax
inc eax
call fcn.004a0400
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
cmp dword [ebp - 0x18], 1
push 4
setne cl
pop eax
inc ecx
call fcn.004a0400
xor eax, eax
pop edi
leave
ret
Function at 0x4a9c82
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5920a4]
jne 0x4a9c8c
repz ret
jmp fcn.004ad0c6

Function at 0x4b4163
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004ad54d
xor ebx, ebx
cmp dword [0x5ab898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4b4238
push 0x547234
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
jne 0x4b41a3
xor eax, eax
jmp 0x4b42fc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
cmp eax, ebx
je 0x4b419c
push eax
call fcn.004ad4ea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5ab898], eax
call esi
push eax
call fcn.004ad4ea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5ab89c], eax
call esi
push eax
call fcn.004ad4ea
mov dword [0x5ab8a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004aac07
test eax, eax
pop ecx
pop ecx
je 0x4b4206
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004a9dc6
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4b4238
push str.GetUserObjectInformationW
push edi
call esi
push eax
call fcn.004ad4ea
cmp eax, ebx
pop ecx
mov dword [0x5ab8a8], eax
je 0x4b4238
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004ad4ea
pop ecx
mov dword [0x5ab8a4], eax
mov eax, dword [0x5ab8a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4b42b1
cmp dword [0x5ab8a8], esi
je 0x4b42b1
push eax
call fcn.004ad556
pop ecx
call eax
cmp eax, ebx
je 0x4b427e
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x5ab8a8]
call fcn.004ad556
pop ecx
call eax
test eax, eax
je 0x4b427e
test byte [ebp - 0x18], 1
jne 0x4b42b1
lea eax, [ebp - 0xc]
push eax
call fcn.004aac3e
test eax, eax
pop ecx
je 0x4b4299
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004a9dc6
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4b42a8
or dword [ebp + 0x10], 0x200000
jmp 0x4b42e2
or dword [ebp + 0x10], 0x40000
jmp 0x4b42e2
mov eax, dword [0x5ab89c]
cmp eax, esi
je 0x4b42e2
push eax
call fcn.004ad556
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4b42e2
mov eax, dword [0x5ab8a0]
cmp eax, esi
je 0x4b42e2
push dword [ebp - 4]
push eax
call fcn.004ad556
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x5ab898]
call fcn.004ad556
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b60b5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004ad54d
xor ebx, ebx
cmp dword [0x5ab8b4], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4b618a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4b60f5
xor eax, eax
jmp 0x4b624e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x54737c
push edi
call esi
cmp eax, ebx
je 0x4b60ee
push eax
call fcn.004ad4ea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5ab8b4], eax
call esi
push eax
call fcn.004ad4ea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5ab8b8], eax
call esi
push eax
call fcn.004ad4ea
mov dword [0x5ab8bc], eax
lea eax, [ebp - 8]
push eax
call fcn.004aac07
test eax, eax
pop ecx
pop ecx
je 0x4b6158
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004a9dc6
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4b618a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004ad4ea
cmp eax, ebx
pop ecx
mov dword [0x5ab8c4], eax
je 0x4b618a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004ad4ea
pop ecx
mov dword [0x5ab8c0], eax
mov eax, dword [0x5ab8c0]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4b6203
cmp dword [0x5ab8c4], esi
je 0x4b6203
push eax
call fcn.004ad556
pop ecx
call eax
cmp eax, ebx
je 0x4b61d0
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x5ab8c4]
call fcn.004ad556
pop ecx
call eax
test eax, eax
je 0x4b61d0
test byte [ebp - 0x18], 1
jne 0x4b6203
lea eax, [ebp - 0xc]
push eax
call fcn.004aac3e
test eax, eax
pop ecx
je 0x4b61eb
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004a9dc6
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4b61fa
or dword [ebp + 0x10], 0x200000
jmp 0x4b6234
or dword [ebp + 0x10], 0x40000
jmp 0x4b6234
mov eax, dword [0x5ab8b8]
cmp eax, esi
je 0x4b6234
push eax
call fcn.004ad556
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4b6234
mov eax, dword [0x5ab8bc]
cmp eax, esi
je 0x4b6234
push dword [ebp - 4]
push eax
call fcn.004ad556
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x5ab8b4]
call fcn.004ad556
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4feb34
Capabilities:
Terminate process

Disassembly:
push ecx
cmp dword [esp + 0xc], 0
push esi
mov esi, dword [esp + 0xc]
jne 0x4feb45
mov eax, dword [esi]
jmp 0x4feb56
push dword [esp + 0x14]
call fcn.004fc7d0
pop ecx
call fcn.004fc7e1
mov dword [esi], eax
push 0x120
push 0
push eax
call fcn.004ad470
add esp, 0xc
pop esi
pop ecx
ret
Function at 0x4fecbc
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x4fecdb
xor al, al
jmp 0x4fed3c
push edi
mov edi, dword [ebp - 0x18]
push 0x104
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4fecf6
xor al, al
jmp 0x4fed3b
mov eax, dword [edi + 0x3c]
and dword [ebp + 8], 0
add eax, edi
movzx edx, word [eax + 6]
movzx ecx, word [eax + 0x14]
sub esi, edi
test edx, edx
push ebx
lea ecx, [ecx + eax + 0x18]
jbe 0x4fed38
lea eax, [ecx + 0x10]
mov edi, dword [eax]
mov ebx, dword [eax - 8]
cmp edi, ebx
mov ecx, dword [eax - 4]
ja 0x4fed23
mov edi, ebx
cmp esi, ecx
jb 0x4fed2d
add edi, ecx
cmp esi, edi
jbe 0x4fed41
inc dword [ebp + 8]
add eax, 0x28
cmp dword [ebp + 8], edx
jb 0x4fed15
xor al, al
pop ebx
pop edi
pop esi
leave
ret 0x10
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
inc eax
mov dword [edx], eax
mov eax, dword [ebp + 0x14]
sub esi, ecx
mov dword [eax], esi
mov al, 1
jmp 0x4fed3a
Function at 0x500b27
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x5920a4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 0xc]
jne 0x500b49
cmp dword [ebp + 8], 0
jne 0x500b7b
push eax
lea eax, [ebp - 0x404]
push str._s_function_not_found_in_bass.dll
push eax
call fcn.004aae66
add esp, 0xc
push 0x10
push str.Error
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.004aadda
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a9c82
leave
ret
Function at 0x50625c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
xor edi, edi
cmp ecx, edi
je 0x50633f
mov esi, dword [ecx + 0x1c]
cmp esi, edi
je 0x50633f
cmp dword [ecx + 0x20], edi
je 0x50633f
cmp dword [ecx + 0x24], edi
je 0x50633f
push ebx
push 2
mov dword [ecx + 0x14], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0x18], edi
pop ebx
mov dword [ecx + 0x2c], ebx
cmp dword [esi + 0x18], edi
mov eax, dword [esi + 8]
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], eax
jge 0x5062aa
mov dword [esi + 0x18], edi
mov eax, dword [esi + 0x18]
neg eax
sbb eax, eax
and eax, 0x47
add eax, 0x2a
mov dword [esi + 4], eax
mov dword [ecx + 0x30], 1
push esi
mov dword [esi + 0x20], edi
call fcn.00505c5b
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x3c]
add eax, eax
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x44]
mov word [ecx + eax*2 - 2], di
mov eax, dword [esi + 0x44]
lea eax, [eax + eax - 2]
push eax
push edi
push dword [esi + 0x3c]
call fcn.004ad470
mov eax, dword [esi + 0x7c]
imul eax, eax, 0xc
movzx ecx, word [eax + 0x549b6a]
mov dword [esi + 0x78], ecx
movzx ecx, word [eax + 0x549b68]
mov dword [esi + 0x84], ecx
movzx ecx, word [eax + 0x549b6c]
mov dword [esi + 0x88], ecx
movzx eax, word [eax + 0x549b6e]
add esp, 0x10
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x64], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x40], edi
xor eax, eax
pop ebx
jmp 0x506342
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
ret
Function at 0x5072ab
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x5920a4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 1
xor ecx, ecx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x70], method.Actor.virtual_236
mov dword [ebp - 0x6c], 0x51fb6d
mov dword [ebp - 0x64], str.1.2.5
call fcn.00463510
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
jne 0x5072f8
xor eax, eax
jmp 0x50742e
mov dword [eax + 0x23c], ebx
push ebx
mov byte [eax + 0x239], bl
push eax
mov byte [eax + 0x240], bl
call fcn.004c44bc
test eax, eax
pop ecx
pop ecx
je 0x507335
mov edi, dword [ebp - 0x60]
lea esi, [edi + 0xac]
push dword [esi]
mov ecx, edi
call fcn.004727c0
pop ecx
push edi
mov dword [esi], ebx
call fcn.004fc7d0
pop ecx
jmp 0x5072f1
mov esi, dword [ebp - 0x60]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x64]
mov dword [esi + 0x244], eax
mov eax, dword [ebp - 0x68]
mov dword [esi + 0x248], eax
mov eax, dword [ebp - 0x74]
mov dword [esi + 0x24c], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x48], eax
mov eax, dword [ebp - 0x6c]
mov dword [esi + 0x40], eax
mov eax, dword [ebp - 0x70]
mov edi, 0x549064
mov dword [esi + 0x44], eax
mov eax, edi
sub ecx, edi
mov dl, byte [ecx + eax]
cmp dl, byte [eax]
je 0x50737f
or dword [esi + 0x6c], 0x20000
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x507371
test dword [esi + 0x6c], 0x20000
je 0x5073ef
mov eax, dword [ebp - 0x64]
cmp eax, ebx
je 0x5073c3
cmp byte [eax], 0x31
jne 0x5073a1
cmp byte [eax + 2], 0x32
je 0x5073ef
cmp eax, ebx
je 0x5073c3
push eax
lea eax, [ebp - 0x5c]
push str.Application_was_compiled_with_png.h_from_libpng__.20s
push eax
call fcn.004aae66
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push esi
call fcn.004fc6ac
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x5c]
push str.Application__is__running_with_png.c_from_libpng__.20s
push eax
call fcn.004aae66
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push esi
call fcn.004fc6ac
pop ecx
pop ecx
push str.Incompatible_libpng_version_in_application_and_library
push esi
mov dword [esi + 0x6c], ebx
call fcn.004fc6ea
mov eax, 0x2000
push eax
mov dword [esi + 0xb0], eax
call fcn.00467250
pop ecx
push ebx
push ebx
push ebx
push esi
mov dword [esi + 0xac], eax
call fcn.0050724c
push esi
call fcn.004fe93a
add esp, 0x14
push ebx
push esi
call fcn.004c44bc
test eax, eax
pop ecx
pop ecx
je 0x50742b
call fcn.004adea0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a9c82
leave
ret
Function at 0x51fa7d
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
lea eax, [esp + 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 0xc]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x51faa8
mov eax, dword [esp + 4]
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.0051f9d2
push 0x57f114
lea eax, [esp + 0xc]
push eax
call fcn.004acbab
int3

Function at 0x523a65
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c96d6
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push esi
push edi
mov eax, dword [0x5920a4]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x74]
mov ecx, dword [eax + 0x124]
push dword [ecx + 0x488]
call fcn.004262e0
mov eax, dword [edi + 0x74]
mov ecx, dword [eax + 0x1a8]
mov eax, dword [ecx]
call dword [eax + 0x78]
mov edx, dword [eax]
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call dword [edx + 0x14]
mov ecx, dword [eax]
mov dword [edi + 0x68], ecx
mov eax, dword [eax + 4]
mov dword [edi + 0x6c], eax
mov eax, dword [edi + 0x74]
mov esi, dword [eax + 0x1a8]
add esi, 0x144
call fcn.0043cde0
fadd st(0), st(0)
push str.xPeriod
lea ecx, [esp + 0x30]
fstp dword [edi + 0x70]
call fcn.0044be60
and dword [esp + 0x70], 0
fld dword [0x566780]
mov eax, dword [edi + 0x74]
mov edx, dword [eax + 0x138]
push ecx
push ecx
fstp dword [esp + 4]
lea eax, [esp + 0x14]
fld dword [0x54a334]
fstp dword [esp]
call fcn.004677c0
push eax
lea ecx, [esp + 0x30]
lea esi, [esp + 0x18]
call fcn.00455d50
call fcn.00422cb0
fstp dword [edi + 0x50]
or dword [esp + 0x70], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.00416880
push str.yPeriod
lea ecx, [esp + 0x4c]
call fcn.0044be60
mov dword [esp + 0x70], 1
fld dword [0x566780]
mov eax, dword [edi + 0x74]
mov edx, dword [eax + 0x138]
push ecx
push ecx
fstp dword [esp + 4]
lea eax, [esp + 0x24]
fld dword [0x54a334]
fstp dword [esp]
call fcn.004677c0
push eax
lea ecx, [esp + 0x4c]
lea esi, [esp + 0x28]
call fcn.00455d50
call fcn.00422cb0
fstp dword [edi + 0x54]
lea ecx, [esp + 0x48]
call fcn.00416880
mov eax, dword [edi + 0x74]
fld dword [eax + 0x144]
fstp dword [edi + 0x58]
fld dword [eax + 0x148]
fstp dword [edi + 0x5c]
fld dword [edi + 0x50]
fld qword [0x566a80]
fmul st(1), st(0)
fxch st(1)
fstp dword [edi + 0x60]
fmul dword [edi + 0x54]
fstp dword [edi + 0x64]
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret