joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463dd0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5c00ab
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.0042aba0
xor ebx, ebx
lea ecx, [esi + 0x228]
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.CMiniMapDlg.0
call fcn.004645a0
mov dword [esi + 0x2a0], ebx
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2a8], ebx
mov dword [esi + 0x2ac], ebx
mov dword [esi + 0x2b0], ebx
mov dword [esi + 0x2b4], ebx
mov dword [esi + method.CMemoryPoolTempl_class_CMiniMapIcon_.virtual_0], vtable.CMemoryPoolTempl_class_CMiniMapIcon_.0
mov dword [esi + 0x2c8], ebx
mov dword [esi + 0x2cc], ebx
mov byte [esi + 0x2d4], bl
push 0x464710
push 0x426ed0
push 0x11
push 0xc
lea eax, [esi + 0x454]
push eax
mov byte [esp + 0x30], 3
call fcn.00589f40
push 0x4623a0
push 0x462390
push 2
push 0x28
lea ecx, [esi + 0x524]
push ecx
mov byte [esp + 0x30], 4
call fcn.00589f40
lea ecx, [esi + 0x574]
mov byte [esp + 0x1c], 5
call fcn.00430640
mov byte [esp + 0x1c], 6
lea eax, [esi + 0x5b4]
lea ecx, [ebx + 0xa]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
add eax, 0xc
dec ecx
jns 0x463eb2
mov eax, 0x63
lea ecx, [esi + 0x740]
mov dword [esi + 0x69c], eax
mov dword [esi + 0x6a0], ebx
mov byte [esi + 0x6a4], bl
mov dword [esi + 0x6a8], eax
mov dword [esi + 0x6ac], ebx
mov byte [esi + 0x6b0], bl
mov dword [esi + 0x6b4], eax
mov dword [esi + 0x6b8], ebx
mov byte [esi + 0x6bc], bl
mov dword [esi + 0x6c0], eax
mov dword [esi + 0x6c4], ebx
mov byte [esi + 0x6c8], bl
mov dword [esi + 0x6cc], eax
mov dword [esi + 0x6d0], ebx
mov byte [esi + 0x6d4], bl
mov dword [esi + 0x6d8], eax
mov dword [esi + 0x6dc], ebx
mov byte [esi + 0x6e0], bl
mov dword [esi + 0x6e4], eax
mov dword [esi + 0x6e8], ebx
mov byte [esi + 0x6ec], bl
mov dword [esi + 0x6f0], eax
mov dword [esi + 0x6f4], ebx
mov byte [esi + 0x6f8], bl
mov dword [esi + 0x6fc], eax
mov dword [esi + 0x700], ebx
mov byte [esi + 0x704], bl
call fcn.00464730
push fcn.00430650
push fcn.00430640
push 6
push 0x20
lea edx, [esi + 0x7ac]
push edx
mov byte [esp + 0x30], 7
call fcn.00589f40
push 0x40
lea ecx, [esi + 0x2a0]
mov byte [esp + 0x20], 8
mov dword [esi + 0x218], ebx
mov dword [esi + 0x21c], ebx
mov dword [esi + 0x220], ebx
call fcn.0053d2d0
fld dword [0x5d6c18]
fstp dword [esi + 0x5ac]
push 0x80
fld dword [0x5d6c14]
lea eax, [esi + 0x2d4]
fstp dword [esi + 0x5b0]
push 0x5d6b58
fldz
push eax
fst dword [esi + 0x5a4]
fstp dword [esi + 0x5a8]
mov dword [esi + 0x548], ebx
mov dword [esi + 0x544], ebx
mov dword [esi + 0x570], ebx
mov dword [esi + 0x56c], ebx
call fcn.00589a30
lea edi, [esi + 0x2c8]
add esp, 0xc
mov dword [esi + 0x2d0], 0xa
cmp dword [edi], ebx
jne 0x464033
push 0x64
push edi
call fcn.00462190
mov ecx, dword [edi]
add esp, 8
mov dword [esi + 0x2cc], ecx
fldz
mov dword [esi + 0x720], ebx
fst dword [esi + 0x728]
mov dword [esi + 0x724], ebx
fstp dword [esi + 0x72c]
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x465950
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5c0230
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CMunpaMarkManager.0
mov dword [esp + 0x18], 1
call fcn.004658d0
lea ecx, [esi + 0x28]
call fcn.0050c9b0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4659ab
push eax
call fcn.00586ef0
add esp, 4
mov dword [esi + 0x30], 0
lea ecx, [esi + 4]
call fcn.0050c9b0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4659ca
push eax
call fcn.00586ef0
add esp, 4
mov dword [esi + 0xc], 0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x46e760
Capabilities:
Get number of processors

Disassembly:
mov ecx, dword [ecx + 0x228]
jmp 0x46e760
push 0xffffffffffffffff
push 0x5c08f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x14], ebp
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x46e91a
cmp dword [ebx + 0x40], 0
lea ecx, [ebp + 0x2e4]
jne 0x46e894
call fcn.00580a50
mov dword [esp + 0x30], eax
test eax, eax
je 0x46e7e5
jmp 0x46e7c0
lea eax, [esp + 0x30]
push eax
lea ecx, [ebp + 0x2e4]
call fcn.00580ab0
mov esi, dword [eax]
test esi, esi
je 0x46e7e5
mov eax, dword [ebx + 0x3c]
cmp dword [esi + 8], eax
je 0x46e7f2
cmp dword [esp + 0x30], 0
jne 0x46e7c0
push ebx
mov ecx, ebp
call fcn.0046d520
jmp 0x46e913
lea ecx, [esi + 0x10]
call fcn.00580a50
mov dword [esp + 0x18], eax
test eax, eax
je 0x46e822
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 0x10]
call fcn.00580ab0
mov eax, dword [eax]
cmp dword [eax + 0x40], 0
je 0x46e91a
cmp dword [esp + 0x18], 0
jne 0x46e802
mov ebp, 1
push ebx
lea ecx, [esi + 0x10]
mov dword [esi], ebp
call fcn.00580470
add dword [esi + 4], ebp
push 0x48
call fcn.00586f10
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 0
test eax, eax
je 0x46e858
mov ecx, eax
call fcn.004f6c90
jmp 0x46e85a
xor eax, eax
mov edx, dword [ebx + 0x3c]
mov ecx, edx
imul ecx, ecx, 0x64
add ecx, 0x63
mov dword [eax + 0x44], ecx
push eax
lea ecx, [esi + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [eax + 0x3c], edx
mov dword [eax + 0x40], 0x63
call fcn.00580500
mov eax, dword [esp + 0x14]
add dword [esi + 4], ebp
add dword [eax + 0x2e0], ebp
mov ebp, eax
jmp 0x46e913
call fcn.00580a50
mov dword [esp + 0x1c], eax
test eax, eax
je 0x46e90b
lea edx, [esp + 0x1c]
push edx
lea ecx, [ebp + 0x2e4]
call fcn.00580ab0
mov esi, dword [eax]
test esi, esi
je 0x46e90b
mov eax, dword [esi + 8]
cmp eax, dword [ebx + 0x3c]
je 0x46e8c8
cmp dword [esp + 0x1c], 0
jne 0x46e8a1
jmp 0x46e90b
lea ecx, [esi + 0x10]
call fcn.00580a80
mov ebp, eax
test ebp, ebp
je 0x46e907
lea ecx, [esi + 0x10]
call fcn.00580a00
mov eax, dword [eax]
cmp dword [eax + 0x40], 0x63
push ebx
lea ecx, [esi + 0x10]
jne 0x46e8f9
push ebp
call fcn.005806d0
inc dword [esi + 4]
mov ebp, dword [esp + 0x14]
jmp 0x46e913
call fcn.00580500
inc dword [esi + 4]
mov ebp, dword [esp + 0x14]
jmp 0x46e913
mov ebp, dword [esp + 0x14]
push ebx
mov ecx, ebp
call fcn.0046d620
mov ecx, ebp
call fcn.0046e300
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
mov ecx, dword [0x70c4fc]
jmp 0x46d070
Function at 0x474870
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx]
push edi
mov edi, ecx
test eax, eax
jne 0x474890
push str.Item_DB_idx__0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop ebx
ret 4
push esi
push eax
mov ecx, 0x71ae70
call fcn.004aa820
mov esi, eax
test esi, esi
je 0x4748af
mov ax, word [ebx + 6]
mov word [esi + 0x28e], ax
jmp 0x4748dd
push str.CItemShopGridDialog::AddItem
push ebx
mov ecx, 0x71ae70
call fcn.004ad8c0
mov esi, eax
test esi, esi
jne 0x4748cb
pop esi
pop edi
pop ebx
ret 4
push esi
mov ecx, 0x71ae70
mov dword [esi + 0x24], 1
call fcn.004b6f20
mov edx, dword [esi]
mov eax, dword [edx + 0x7c]
mov ecx, esi
call eax
movzx ecx, ax
push ecx
mov ecx, edi
call fcn.00474790
movzx eax, ax
push esi
push eax
mov ecx, edi
call fcn.004302b0
pop esi
pop edi
pop ebx
ret 4

Function at 0x476a80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c0e50
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebp
push esi
push edi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], esi
call fcn.0042aba0
xor ebp, ebp
lea edi, [esi + 0x234]
mov dword [esi], vtable.CGuildDialog.0
mov dword [esp + 0x38], ebp
mov dword [esp + 0x1c], edi
mov dword [edi], ebp
push 8
mov byte [esp + 0x3c], 1
call fcn.00586f10
add esp, 4
cmp eax, ebp
je 0x476b42
lea ecx, [esp + 0x1c]
push ecx
push eax
lea edx, [esp + 0x1b]
push edx
mov dword [edi], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.0040a7e0
mov eax, dword [edi]
mov dword [eax], edi
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
mov dword [edi + 0xc], ebp
mov ecx, 0x61
add esp, 0xc
mov word [esi + 0xc], cx
mov dword [esi + 0x2b0], 0xffffffff
mov dword [esi + 0x2c0], 1
mov dword [esi + 0x2c4], 1
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x2c
ret
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], ebp
call fcn.00587ed0
push 0x6077d0
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], vtable.std::bad_alloc.0
call fcn.00588850
int3
Function at 0x476c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5c0eac
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x70a108]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push esi
push edi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, dword [esp + 0x80]
push 0x3e
mov ebx, ecx
lea ecx, [esp + 0x32]
mov eax, 0x20
push 0
push ecx
mov word [esp + 0x38], ax
call fcn.00585ff0
add esp, 0xc
push edi
lea ecx, [ebx + 0x234]
call fcn.00479f70
push 0x11
lea esi, [edi + 4]
lea edx, [esp + 0x1c]
push esi
push edx
call fcn.00528b30
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x476cd0
sub eax, edx
cmp eax, 0x10
jge 0x476cf5
mov edx, 0x10
sub edx, eax
push edx
lea ecx, [esp + eax + 0x1c]
push 0x20
push ecx
call fcn.00585ff0
add esp, 0xc
test byte [0x70bfb4], 1
jne 0x476d2c
or dword [0x70bfb4], 1
mov ecx, 0x70be28
mov dword [esp + 0x78], 0
call fcn.004fffd0
push 0x5cdbe0
call fcn.00587160
add esp, 4
mov dword [esp + 0x78], 0xffffffff
movzx eax, byte [edi + 0x17]
push 7
push eax
mov ecx, 0x70be28
call fcn.00501980
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00528b30
lea eax, [esp + 0x1c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x476d52
sub eax, edx
cmp eax, 6
jge 0x476d77
mov edx, 6
sub edx, eax
push edx
lea ecx, [esp + eax + 0x14]
push 0x20
push ecx
call fcn.00585ff0
add esp, 0xc
movzx eax, word [edi + 0x15]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push str._s__10s__4d
push eax
call fcn.00586b40
mov ecx, dword [ebx + 0x230]
add esp, 0x14
cmp dword [edi + 0x18], 1
push 0
push 0
push 0xffffffffffffffff
jne 0x476dba
mov edx, dword [ecx]
mov edx, dword [edx + 0x6c]
push 0xffffffffffffffff
lea eax, [esp + 0x3c]
push eax
call edx
jmp 0x476dcb
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
push 0xffacb6c7
lea edx, [esp + 0x3c]
push edx
call eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.00586d40
add esp, 0x6c
ret 4

Function at 0x48e1a5
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
lea ecx, [esi + 0x284]
cmp ebx, 1
jne 0x48e1e7
mov eax, dword [0x71b194]
add eax, 0x1d4c0
push edi
mov dword [esi + 0x238], eax
call fcn.0044ab10
push str.ANRaster.tga
lea ecx, [esi + 0x284]
call fcn.0044ab40
pop edi
push ebx
mov ecx, esi
call fcn.0042b1a0
pop esi
pop ebx
ret 4
call fcn.0044ab10
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
mov ecx, esi
call fcn.0042b1a0
pop esi
pop ebx
ret 4
Function at 0x48e210
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
lea ecx, [esi + 0x284]
cmp ebx, 1
jne 0x48e25d
mov eax, dword [esp + 0x10]
imul eax, eax, 0x3e8
add eax, dword [0x71b194]
push edi
mov dword [esi + 0x238], eax
call fcn.0044ab10
push str.ANRaster.tga
lea ecx, [esi + 0x284]
call fcn.0044ab40
pop edi
push ebx
mov ecx, esi
call fcn.0042b1a0
pop esi
pop ebx
ret 8
call fcn.0044ab10
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
mov ecx, esi
call fcn.0042b1a0
pop esi
pop ebx
ret 8

Function at 0x48fed0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c212b
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
push 0xa
lea ecx, [esp + 0x18]
call fcn.00580120
sub edi, 0xffffff80
mov ecx, edi
mov dword [esp + 0x38], 0
call fcn.00580a50
mov dword [esp + 0xc], eax
test eax, eax
je 0x48ff89
lea esp, [esp]
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call fcn.00580ab0
mov esi, dword [eax]
test esi, esi
je 0x48ff82
fld dword [esi + 0x28c]
push ecx
fstp dword [esp + 0x14]
lea ecx, [esi + 0x284]
fld dword [esp + 0x14]
fcom qword [0x5dabd8]
fnstsw ax
test ah, 1
jne 0x48ff6c
fstp st(0)
fld1
fstp dword [esp]
call fcn.00549e60
push esi
lea ecx, [esp + 0x18]
call fcn.00580500
jmp 0x48ff82
fadd qword [0x5dabd0]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp]
call fcn.00549e60
cmp dword [esp + 0xc], 0
jne 0x48ff20
lea ecx, [esp + 0x14]
call fcn.00580a50
mov dword [esp + 0xc], eax
test eax, eax
je 0x48ffc3
lea ebx, [ebx]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x18]
call fcn.00580ab0
mov eax, dword [eax]
test eax, eax
je 0x48ffbc
push eax
mov ecx, edi
call fcn.00580bb0
cmp dword [esp + 0xc], 0
jne 0x48ffa0
lea ecx, [esp + 0x14]
call fcn.00580200
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.00580280
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x4951f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c274c
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x38], eax
lea ebx, [ebx]
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x49529f
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + 4]
mov edx, dword [eax]
mov dword [ebx + 0x38], edx
test ecx, ecx
je 0x49529f
mov ecx, dword [ecx + 0x538]
test ecx, ecx
je 0x49528b
test byte [0x70b878], 1
movzx esi, word [ecx + 0x3b]
jne 0x49527b
or dword [0x70b878], 1
mov ecx, 0x70b708
mov dword [esp + 0x14], 0
call fcn.0053bb10
push 0x5cdbd0
call fcn.00587160
add esp, 4
mov dword [esp + 0x14], 0xffffffff
push esi
mov ecx, 0x70b708
call fcn.0053a5a0
cmp eax, 1
jne 0x495220
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x49f450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c2d40
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
cmp dword [ecx + 0x120], 1
je 0x49f4a6
push 0
push 0x23e
push str.Object.cpp
call fcn.00529940
add esp, 0xc
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4
mov ebx, dword [esp + 0x38]
lea esi, [ecx + 0x18]
xor edx, edx
mov eax, ebx
div dword [esi + 4]
mov eax, dword [esi + 8]
push 0xa
mov ecx, dword [eax + edx*4]
mov dword [esi + 0x18], ecx
lea ecx, [esp + 0x10]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], ebx
call fcn.00580120
mov dword [esp + 0x30], 0
lea ebx, [ebx]
cmp dword [esi + 0x18], 0
je 0x49f501
mov ecx, dword [esi + 0x20]
lea esp, [esp]
mov eax, dword [esi + 0x18]
cmp dword [eax], ecx
je 0x49f55f
mov edx, dword [eax + 0xc]
mov dword [esi + 0x18], edx
test edx, edx
jne 0x49f4f0
lea ecx, [esp + 0xc]
call fcn.00580a50
mov dword [esp + 0x38], eax
test eax, eax
je 0x49f531
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x10]
call fcn.00580ab0
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.0050a740
cmp dword [esp + 0x38], 0
jne 0x49f512
lea ecx, [esp + 0xc]
call fcn.00580200
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00580280
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4
mov dword [esi + 0x1c], eax
mov eax, dword [eax + 0xc]
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x49f501
push eax
mov ecx, 0x747fd8
call fcn.00562910
cmp eax, 1
jne 0x49f4e0
push ebx
lea ecx, [esp + 0x10]
call fcn.00580500
jmp 0x49f4e0
Function at 0x4ad8c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5c32bd
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x70a108]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0x17c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x18c]
movzx esi, word [ebx + 4]
mov ebp, dword [esp + 0x190]
push esi
mov edi, ecx
call fcn.004aad20
test eax, eax
jne 0x4ad955
mov ecx, dword [0x71a258]
push ebp
push esi
push ecx
lea edx, [esp + 0x84]
push str.NoItemInfo__d____d____s
push edx
call fcn.00586b40
lea eax, [esp + 0x8c]
push eax
push 0x166
push str.ItemManager.cpp
call fcn.00529940
add esp, 0x20
xor eax, eax
jmp 0x4ada69
mov ebp, dword [ebx]
test ebp, ebp
je 0x4ad94e
push ebp
call fcn.004aa820
mov esi, eax
test esi, esi
jne 0x4ada40
push 0x3b8
call fcn.00586f10
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x184], esi
cmp eax, esi
je 0x4ad991
push ebx
mov ecx, eax
call fcn.004a7af0
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 0x74]
mov ecx, esi
mov dword [esp + 0x184], 0xffffffff
call eax
push eax
push esi
lea ecx, [edi + 0x1c]
call fcn.0053e110
lea ecx, [esp + 0x18]
call fcn.00430640
mov ebx, dword [esi]
lea ecx, [edi + 0x264]
mov dword [esp + 0x184], 1
call fcn.00580d40
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x78]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call eax
movzx ecx, ax
push ecx
mov ecx, edi
call fcn.004ad890
mov edx, dword [ebx + 0x10]
push eax
push 0x28
push 0x28
push 0
push 0
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x78]
mov ecx, esi
mov dword [esi + 0x21c], 1
call edx
movzx eax, ax
mov dword [esi + 0x220], eax
xor eax, eax
push esi
mov ecx, 0x719958
mov word [esi + 0x2a8], ax
call fcn.004054d0
lea ecx, [esp + 0x18]
mov dword [esp + 0x184], 0xffffffff
call fcn.00430650
jmp 0x4ada67
push ebp
lea ecx, [esp + 0x3c]
push str.__DBIndex:__d
push ecx
call fcn.00586b40
lea edx, [esp + 0x44]
push edx
push 0x18e
push str.ItemManager.cpp
call fcn.00529940
add esp, 0x18
mov eax, esi
mov ecx, dword [esp + 0x17c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.00586d40
add esp, 0x174
ret 8
Function at 0x4b24c0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x70a108]
xor eax, esp
mov dword [esp + 0x1a8], eax
push ebx
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
push esi
mov esi, ecx
call ebx
cmp dword [esi + 0xf8], 0
jne 0x4b24ef
mov dword [esi + 0xf8], eax
sub eax, dword [esi + 0xf8]
cmp eax, 0x1388
jbe 0x4b25cb
mov ecx, dword [esi + 0xd4]
mov eax, dword [esi + 0xe0]
mov dword [esi + 0xe8], eax
test ecx, ecx
jle 0x4b2525
test eax, eax
je 0x4b2522
mov eax, dword [eax]
mov dword [esi + 0xe8], eax
dec ecx
jne 0x4b2516
push edi
push 0
push 2
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4b25ca
lea ecx, [esp + 0xc]
push ecx
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4b25bb
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x138]
push 0x5d0664
push eax
call fcn.00586b40
add esp, 0xc
lea ecx, [esp + 0x134]
push ecx
mov ecx, esi
call fcn.004ad690
test eax, eax
je 0x4b25ac
mov ecx, 0x72a6f8
call fcn.00527ba0
push 0x230
mov ecx, 0x71c268
call fcn.004d3c70
push eax
push 1
push 0x179e
push 0x719958
call fcn.004471e0
add esp, 0x10
lea edx, [esp + 0xc]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4b2551
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov dword [esi + 0xf8], eax
pop edi
mov ecx, dword [esp + 0x1b0]
pop esi
pop ebx
xor ecx, esp
call fcn.00586d40
add esp, 0x1ac
ret
Function at 0x4c1f70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c3c00
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x70a108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push 0x34
call fcn.00586f10
mov esi, eax
xor eax, eax
add esp, 4
mov dword [ebp - 0x14], esi
cmp esi, eax
je 0x4c2009
mov ecx, dword [edi + 8]
mov dword [esi], ecx
mov edx, dword [edi + 8]
mov dword [esi + 4], edx
mov ecx, dword [edi + 8]
mov edx, dword [ebp + 8]
mov word [esi + 0x30], ax
mov dword [ebp - 4], eax
push edx
lea eax, [esi + 0xc]
push eax
add edi, 0x11
push edi
mov dword [esi + 8], ecx
call fcn.004c1f10
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp + 8], eax
call fcn.00587ed0
push 0x6077d0
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call fcn.00588850
int3

Function at 0x4c5730
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x705ba5], 0
push esi
mov esi, ecx
je 0x4c5753
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xc], eax
mov dword [0x71b1a8], eax
mov byte [0x705ba5], 0
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xc]
mov edx, eax
sub edx, ecx
mov dword [0x71b1a8], eax
cmp eax, ecx
jae 0x4c576a
dec edx
mov dword [0x71b190], edx
mov dword [esi + 0xc], eax
mov eax, dword [0x71b190]
add dword [0x71b194], eax
add dword [esi + 8], eax
cmp dword [esi + 8], 0x5265c00
jb 0x4c5794
inc dword [esi + 4]
add dword [esi + 8], 0xfad9a400
pop esi
ret
Function at 0x4cdeb0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4cdedf
pop edi
xor eax, eax
pop esi
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x520
lea edx, [edi + 0x524]
push edx
push esi
call ebx
test eax, eax
jne 0x4cdf0f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
ret 4
push 0
lea eax, [esp + 0x14]
push eax
push 0xc0
add edi, 0xb04
push edi
push esi
call ebx
push esi
test eax, eax
je 0x4cdf01
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 1
pop esi
ret 4