joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4328f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4bdd9b
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0xac
mov dword [ebx], 0x4c8b88
mov dword [ebx + 8], esi
call fcn.004901f0
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
mov dword [ebp - 4], 0
je 0x432944
mov ecx, dword [esi + 0x254]
push ecx
mov ecx, eax
call fcn.00453bd0
jmp 0x432946
xor eax, eax
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov dword [ebx + 4], eax
mov dword [eax + 4], esi
mov edx, dword [ebx + 4]
mov dword [edx + 8], edi
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
push edi
push esi
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x44]
mov ecx, dword [ebx + 4]
mov byte [ecx + 0x19], 0
mov edx, dword [ebx + 4]
mov byte [edx + 0x1a], 1
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
call dword [eax + 0x48]
mov ecx, esi
mov esi, dword [ebp + 0xc]
imul ecx, edi
shl ecx, 2
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [ebx + 0xc], ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [ebx + 0x10], edx
mov byte [ebx + 0x14], 0
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x432bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
push esi
push edi
mov dword [ebp - 4], ebx
call dword [eax + 0x48]
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 4]
mov edx, dword [ecx]
mov esi, eax
call dword [edx + 0x48]
mov ecx, dword [ebx + 0xc]
imul ecx, dword [ebp + 0x10]
add ecx, dword [ebp + 0xc]
lea edx, [esi + ecx*4]
mov ecx, dword [edi + 0x10]
test ecx, ecx
mov dword [ebp + 0x10], 0
jle 0x432c5b
mov ecx, dword [edi + 0xc]
nop
xor esi, esi
test ecx, ecx
mov dword [ebp + 0xc], edx
jle 0x432c46
lea esp, [esp]
mov ecx, dword [edx]
mov edi, dword [eax]
shr edi, 8
and edi, 0xffff0000
mov ebx, ecx
shr ebx, 0x18
imul edi, ebx
mov ebx, dword [eax]
xor edi, ecx
shr ebx, 8
shr ecx, 0x18
and ebx, 0xff0000
imul ebx, ecx
and edi, 0xffffff
xor edi, ebx
mov dword [edx], edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0xc]
add edx, 4
add eax, 4
inc esi
cmp esi, ecx
jl 0x432c00
mov ebx, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
mov edx, dword [ebx + 0xc]
lea edx, [esi + edx*4]
mov esi, dword [ebp + 0x10]
inc esi
cmp esi, dword [edi + 0x10]
mov dword [ebp + 0x10], esi
jl 0x432bf0
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
call dword [eax + 0x30]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x434650
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4bde66
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, edi
call fcn.004140a0
fstp dword [esi + 0xc]
mov ecx, edi
call fcn.004140a0
fstp dword [esi + 0x10]
mov ecx, edi
call fcn.00414080
mov dword [esi + 0x14], eax
push 8
lea eax, [esi + 0x18]
push eax
mov ecx, edi
call fcn.00414100
mov ecx, edi
call fcn.00414050
mov ecx, edi
mov byte [esi + 0x28], al
call fcn.00414080
mov ecx, edi
mov dword [esi + 0x2c], eax
call fcn.00414050
mov ecx, edi
mov byte [esi + 0x30], al
call fcn.00414080
mov ecx, edi
mov dword [esi + 0x34], eax
call fcn.00414050
mov ecx, edi
mov byte [esi + 0x38], al
call fcn.00414050
mov ecx, edi
mov byte [esi + 0x39], al
call fcn.00414050
mov ecx, dword [esi + 0x20]
test ecx, ecx
mov byte [esi + 0x3a], al
je 0x4346f4
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esi + 0x20], 0
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x434708
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x24], 0
mov ecx, edi
call fcn.00414050
cmp al, 1
jne 0x434788
push 0x20
call fcn.004901f0
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
mov dword [ebp - 4], 0
je 0x434734
mov ecx, eax
call fcn.00401000
jmp 0x434736
xor eax, eax
mov ecx, dword [esi + 4]
push 0
push ecx
mov ecx, dword [esi + 8]
mov dword [esi + 0x20], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call dword [edx + 8]
mov ecx, edi
call fcn.00414080
mov edx, dword [esi + 0x20]
mov ecx, edi
mov dword [edx + 4], eax
call fcn.00414080
mov ecx, dword [esi + 0x20]
mov dword [ecx + 8], eax
mov ecx, edi
call fcn.004140a0
mov edx, dword [esi + 0x20]
fstp dword [edx + 0xc]
mov eax, dword [esi + 0x20]
push 8
add eax, 0x18
push eax
mov ecx, edi
call fcn.00414100
mov ecx, edi
call fcn.00414050
cmp al, 1
jne 0x434808
push 0x20
call fcn.004901f0
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
mov dword [ebp - 4], 1
je 0x4347b4
mov ecx, eax
call fcn.00401000
jmp 0x4347b6
xor eax, eax
mov ecx, dword [esi + 4]
push 0
push ecx
mov ecx, dword [esi + 8]
mov dword [esi + 0x24], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call dword [edx + 8]
mov ecx, edi
call fcn.00414080
mov edx, dword [esi + 0x24]
mov ecx, edi
mov dword [edx + 4], eax
call fcn.00414080
mov ecx, dword [esi + 0x24]
mov dword [ecx + 8], eax
mov ecx, edi
call fcn.004140a0
mov edx, dword [esi + 0x24]
fstp dword [edx + 0xc]
mov eax, dword [esi + 0x24]
push 8
add eax, 0x18
push eax
mov ecx, edi
call fcn.00414100
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43e7d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x4e6440]
cmp eax, 0x270
jl 0x43e88b
xor eax, eax
push esi
mov esi, dword [ecx + eax*4]
mov edx, dword [ecx + eax*4 + 4]
xor edx, esi
and edx, 0x7fffffff
xor edx, esi
mov esi, edx
and esi, 1
mov esi, dword [esi*4 + 0x4e6444]
shr edx, 1
xor esi, edx
xor esi, dword [ecx + eax*4 + 0x634]
mov dword [ecx + eax*4], esi
inc eax
cmp eax, 0xe3
jl 0x43e7e3
cmp eax, 0x26f
jge 0x43e853
lea ecx, [ecx]
mov esi, dword [ecx + eax*4]
mov edx, dword [ecx + eax*4 + 4]
xor edx, esi
and edx, 0x7fffffff
xor edx, esi
mov esi, edx
and esi, 1
mov esi, dword [esi*4 + 0x4e6444]
shr edx, 1
xor esi, edx
xor esi, dword [ecx + eax*4 - 0x38c]
mov dword [ecx + eax*4], esi
inc eax
cmp eax, 0x26f
jl 0x43e820
mov eax, dword [ecx + 0x9bc]
mov edx, dword [ecx]
mov esi, dword [ecx + 0x630]
xor eax, edx
mov edx, dword [ecx + 0x9bc]
and eax, 0x7fffffff
xor eax, edx
mov edx, eax
and edx, 1
mov edx, dword [edx*4 + 0x4e6444]
xor edx, esi
shr eax, 1
xor edx, eax
mov dword [ecx + 0x9bc], edx
xor eax, eax
pop esi
mov ecx, dword [ecx + eax*4]
inc eax
mov dword [0x4e6440], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
and eax, 0x7fffffff
ret
Function at 0x441230
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4bec9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], vtable.Sexy::Widget.0
mov dword [esp + 8], esi
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
lea ecx, [esi + 0x38]
mov dword [esp + 0x14], ebx
call fcn.00452370
mov ecx, dword [esp + 0xc]
mov al, 1
mov byte [esi + 0x19], al
mov byte [esi + 0x1a], al
mov byte [esi + 0x18], al
mov dword [esi + 0x24], ebx
mov dword [esi + 4], ebx
mov byte [esi + 0x1c], bl
mov byte [esi + 0x1e], bl
mov byte [esi + 0x1f], bl
mov byte [esi + 0x48], bl
mov byte [esi + 0x1b], bl
mov byte [esi + 0x1d], bl
mov byte [esi + 0x20], bl
mov byte [esi + 0x21], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4423f0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4bed16
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x30]
mov ecx, edi
mov dword [esp + 0xc], esi
mov dword [esi], vtable.Sexy::WidgetManager.0
call fcn.00441ed0
xor ebx, ebx
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov eax, dword [esp + 0x20]
mov dword [esi + 0x60], ebx
push 0x5c
mov dword [esp + 0x1c], ebx
mov dword [esi + 0xc], eax
mov byte [esi + 0x50], bl
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov byte [esi + 0x18], bl
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov byte [esi + 0x3c], 1
call fcn.004901f0
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0x18], 1
je 0x44247d
mov ecx, eax
call fcn.0046c590
jmp 0x44247f
xor eax, eax
mov dword [esi + 0x28], eax
mov dword [esi + 4], ebx
mov dword [esi + 0x164], ebx
mov dword [esi + 0x168], ebx
xor eax, eax
lea edi, [esi + 0x64]
mov ecx, 0x3f
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
stosw word es:[edi], ax
stosb byte es:[edi], al
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4433d0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x234]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 0x220], 1
pop esi
ret
Function at 0x444e10
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword [ecx + 0x234]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x444f00
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x14]
push edi
inc eax
push eax
push 0x2002
call ebp
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi + 0x18], 0x10
lea ecx, [esi + 4]
mov dword [esp + 0x14], ecx
jb 0x444e57
mov ecx, dword [ecx]
mov edx, eax
lea esp, [esp]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x444e60
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, dword [sym.imp.USER32.dll_SetClipboardData]
push edi
push 1
call ebx
push edi
push 7
call ebx
push edi
push 0x10
call ebx
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
cmp ecx, 0x10
mov ecx, dword [esp + 0x14]
jb 0x444e97
mov ecx, dword [ecx]
push 0
push 0
push eax
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
lea edx, [edi + edi + 2]
push edx
push 0x2002
call ebp
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 0x18]
mov ebp, eax
mov eax, dword [esi + 0x14]
cmp ecx, 0x10
mov ecx, dword [esp + 0x14]
jb 0x444ed1
mov ecx, dword [ecx]
push edi
push ebp
push eax
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
mov word [ebp + edi*2], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x449ee0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x338]
test al, al
push edi
mov edi, dword [esp + 0xc]
je 0x449f29
cmp dword [esi + 0x354], 0x10
mov ecx, dword [esi + 0x350]
jb 0x449f09
mov eax, dword [esi + 0x340]
jmp 0x449f0f
lea eax, [esi + 0x340]
push ecx
push eax
mov eax, dword [edi + 0x14]
push eax
push 0
mov ecx, edi
call fcn.00408a60
test eax, eax
jne 0x449f29
pop edi
mov al, 1
pop esi
ret 8
mov cl, byte [esp + 0x10]
push 0xffffffffffffffff
push 0
mov byte [esi + 0x339], cl
push edi
lea ecx, [esi + 0x33c]
mov byte [esi + 0x338], 1
call fcn.004065c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x358], eax
cmp dword [edi + 0x18], 0x10
jb 0x449f61
mov eax, dword [edi + 4]
jmp 0x449f64
lea eax, [edi + 4]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x449f22
mov edx, dword [esi]
push edi
mov ecx, esi
call dword [edx + 0x44]
pop edi
xor al, al
pop esi
ret 8

Function at 0x449f90
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x4bef88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
push esi
push edi
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov edi, dword [esp + 0x40]
cmp dword [edi + 0x18], 0x10
mov dword [esp + 0x34], ebx
lea esi, [edi + 4]
jb 0x449fd6
mov eax, dword [esi]
jmp 0x449fd8
mov eax, esi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, ebx
mov dword [esp + 0x40], eax
jbe 0x44a07e
push ebp
push eax
call fcn.00490214
mov ebp, eax
mov eax, dword [edi + 0x18]
add esp, 4
cmp eax, 0x10
jb 0x44a001
mov esi, dword [esi]
mov eax, dword [esp + 0x44]
push ebp
push eax
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x14]
push edx
push str.StringFileInfo040904B0ProductVersion
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x44a039
mov edx, dword [esp + 0x10]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x44a030
jmp 0x44a067
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x14]
push ecx
push str.StringFileInfo040904E4ProductVersion
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x44a074
mov edx, dword [esp + 0x10]
mov eax, edx
lea esi, [eax + 1]
jmp 0x44a060
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x44a060
sub eax, esi
push eax
lea ecx, [esp + 0x18]
push edx
call fcn.00406680
push ebp
call fcn.0049f22c
add esp, 4
pop ebp
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x18]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push edx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.004065c0
cmp dword [esp + 0x28], 0x10
jb 0x44a0b2
mov eax, dword [esp + 0x14]
push eax
call fcn.0049f22c
add esp, 4
mov ecx, dword [esp + 0x2c]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x44b8c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x4bef88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
xor ebx, ebx
push esi
mov dword [esp + 8], ebx
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov eax, dword [ecx + 0x234]
push eax
mov dword [esp + 0x34], ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x44b946
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
cmp esi, ebx
je 0x44b940
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
je 0x44b940
mov ecx, eax
push edi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x44b924
sub ecx, edi
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00406680
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esi, dword [esp + 0x38]
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x14]
push ecx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.004065c0
cmp dword [esp + 0x24], 0x10
jb 0x44b97a
mov edx, dword [esp + 0x10]
push edx
call fcn.0049f22c
add esp, 4
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x452098
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4bfca0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push esi
mov esi, ecx
mov ecx, dword [esi + 0x70]
push edi
mov edi, dword [esi + 0x90]
xor eax, eax
cmp edi, ecx
mov dword [esp + 0xc], eax
jge 0x4521a1
push ebx
lea eax, [edi + 1]
push ebp
lea ebx, [esi + 0x5c]
mov dword [esp + 0x10], eax
nop
mov ecx, dword [esi + 0x90]
push edi
push ecx
lea edx, [esp + 0x3c]
push edx
mov ecx, ebx
call fcn.00440550
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x90]
push eax
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, ebx
mov dword [esp + 0x64], 0
call fcn.00440550
mov ecx, dword [esi + 0x78]
mov eax, dword [ecx]
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0x5c], 1
call dword [eax + 0x1c]
mov ecx, dword [esi + 0x78]
lea edx, [esp + 0x18]
mov ebp, eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x1c]
mov ecx, dword [esp + 0x60]
add eax, ebp
cdq
sub eax, edx
sar eax, 1
add eax, 5
cmp ecx, eax
jl 0x45212f
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x30], 0x10
jb 0x452143
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0049f22c
add esp, 4
cmp dword [esp + 0x4c], 0x10
mov ebp, 0xf
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
mov dword [esp + 0x58], 0xffffffff
jb 0x452175
mov edx, dword [esp + 0x38]
push edx
call fcn.0049f22c
add esp, 4
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x70]
inc edi
inc ecx
cmp edi, eax
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
mov dword [esp + 0x10], ecx
jl 0x4520c0
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x4c
ret 8
Function at 0x4521d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4bfca0
push eax
mov dword fs:[0], esp
sub esp, 0x40
push esi
mov esi, ecx
mov eax, dword [esi + 0x84]
cmp eax, dword [esi + 0x90]
jge 0x452236
lea esp, [esp]
mov al, byte [esp + 0x54]
test al, al
mov eax, dword [esi + 0x90]
je 0x45220d
add eax, 0xfffffff6
xor ecx, ecx
test eax, eax
setl cl
dec ecx
and eax, ecx
jmp 0x452218
dec eax
xor edx, edx
test eax, eax
setl dl
dec edx
and eax, edx
mov dword [esi + 0x90], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xa8]
mov ecx, dword [esi + 0x84]
cmp ecx, dword [esi + 0x90]
jl 0x4521f0
mov eax, dword [esi + 0x78]
test eax, eax
je 0x452355
mov edx, dword [esi + 0x10]
sub edx, 8
test edx, edx
jle 0x452355
push ebx
push ebp
push edi
lea ebx, [esi + 0x5c]
mov eax, dword [esi + 0x84]
push eax
push 0
lea ecx, [esp + 0x3c]
push ecx
mov ecx, ebx
call fcn.00440550
mov ebp, eax
mov edx, dword [esi + 0x90]
push edx
push 0
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x64], 0
call fcn.00440550
mov ecx, dword [esi + 0x78]
mov edi, ecx
mov edx, dword [edi]
push eax
mov byte [esp + 0x5c], 1
mov dword [esp + 0x18], ecx
call dword [edx + 0x1c]
mov edx, dword [edi]
push ebp
mov ecx, edi
mov dword [esp + 0x18], eax
call dword [edx + 0x1c]
mov ecx, dword [esp + 0x14]
sub eax, ecx
mov ecx, dword [esi + 0x10]
sub ecx, 8
cmp eax, ecx
mov eax, dword [esp + 0x30]
mov edi, 0x10
setge byte [esp + 0x13]
cmp eax, edi
jb 0x4522d6
mov edx, dword [esp + 0x1c]
push edx
call fcn.0049f22c
add esp, 4
cmp dword [esp + 0x4c], edi
mov ebp, 0xf
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
mov dword [esp + 0x58], 0xffffffff
jb 0x452307
mov eax, dword [esp + 0x38]
push eax
call fcn.0049f22c
add esp, 4
mov al, byte [esp + 0x13]
test al, al
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
je 0x452352
mov al, byte [esp + 0x60]
test al, al
mov eax, dword [esi + 0x90]
je 0x452333
add eax, 0xa
jmp 0x452334
inc eax
mov edx, dword [esi]
mov ecx, esi
mov dword [esi + 0x90], eax
call dword [edx + 0xa8]
mov eax, dword [esi + 0x10]
sub eax, 8
test eax, eax
jg 0x452255
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
pop esi
mov dword fs:[0], ecx
add esp, 0x4c
ret 4
Function at 0x4631c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c037e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], vtable.Sexy::ImageFont.0
mov ecx, dword [edi + 0x14]
mov dword [esp + 0x1c], 2
call fcn.0045f0e0
mov eax, dword [edi + 0x34]
lea esi, [edi + 0x30]
xor ebx, ebx
cmp eax, ebx
mov byte [esp + 0x1c], 1
jne 0x46320c
xor ecx, ecx
jmp 0x46320e
mov ecx, dword [eax]
push eax
push ecx
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.0045ff60
mov eax, dword [esi + 4]
push eax
call fcn.0049f22c
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [edi + 0x20]
lea esi, [edi + 0x1c]
add esp, 4
cmp eax, ebx
je 0x463254
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 8]
push edx
push esi
push ecx
push eax
call fcn.00406790
mov eax, dword [esi + 4]
push eax
call fcn.0049f22c
add esp, 0x14
mov ecx, edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x1c], 0xffffffff
call fcn.00476fd0
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4652b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov dl, byte [eax + 4]
test dl, dl
je 0x4652c4
mov dword [esp + 4], eax
jmp fcn.00464f90
add eax, 8
push eax
call fcn.004600b0
test eax, eax
je 0x4652e7
mov cl, byte [eax + 4]
test cl, cl
je 0x4652e7
mov ecx, dword [esp + 8]
push eax
call fcn.00464cc0
mov al, 1
ret 8
xor al, al
ret 8
Function at 0x468b40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c09f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00476f80
xor ebp, ebp
mov dword [esi], vtable.Sexy::ImageFont.0
mov dword [esp + 0x1c], ebp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebp
lea edi, [esi + 0x30]
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.0045f6c0
mov dword [edi + 4], eax
mov dword [edi + 8], ebp
push 0x198
mov byte [esp + 0x20], 2
call fcn.004901f0
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebp
mov byte [esp + 0x1c], 3
je 0x468bb8
mov ecx, eax
call fcn.00468740
jmp 0x468bba
xor eax, eax
mov ecx, eax
mov byte [esp + 0x1c], 2
mov dword [esi + 0x14], eax
call fcn.0045f0d0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov ecx, dword [esi + 0x14]
call fcn.004682c0
mov edx, dword [esi + 0x14]
mov eax, dword [edx + 0x10]
mov ecx, esi
mov dword [esi + 0x18], eax
call fcn.00463750
mov ecx, dword [esp + 0x14]
pop edi
mov byte [esi + 0x2c], 1
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret 8