joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e8cb7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x74c0db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], esi
mov dword [esi + 8], edx
call fcn.00455f20
mov ecx, dword [edi + 0x48]
push fcn.004553d0
push fcn.00455f20
push 0xa
push 0x3c
lea edx, [edi + 0x4c]
push edx
lea eax, [esi + 0x4c]
push eax
mov dword [esp + 0x30], 0
mov dword [esi + 0x48], ecx
call fcn.0072068a
lea eax, [edi + 0x2a4]
lea ecx, [esi + 0x2a4]
mov edx, eax
mov ebx, dword [edx]
mov edi, ecx
mov dword [edi], ebx
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov edx, dword [edx + 8]
mov dword [edi + 8], edx
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x600080
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x74d28b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], esi
mov dword [esi + 8], edx
call fcn.00455f20
mov ecx, dword [edi + 0x48]
push fcn.004553d0
push fcn.00455f20
push 0xa
push 0x3c
lea edx, [edi + 0x4c]
push edx
lea eax, [esi + 0x4c]
push eax
mov dword [esp + 0x30], 0
mov dword [esi + 0x48], ecx
call fcn.0072068a
lea eax, [edi + 0x2a4]
lea ecx, [esi + 0x2a4]
mov edx, eax
mov ebx, dword [edx]
mov edi, ecx
mov dword [edi], ebx
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov edx, dword [edx + 8]
mov dword [edi + 8], edx
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x600097
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x74d28b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], esi
mov dword [esi + 8], edx
call fcn.00455f20
mov ecx, dword [edi + 0x48]
push fcn.004553d0
push fcn.00455f20
push 0xa
push 0x3c
lea edx, [edi + 0x4c]
push edx
lea eax, [esi + 0x4c]
push eax
mov dword [esp + 0x30], 0
mov dword [esi + 0x48], ecx
call fcn.0072068a
lea eax, [edi + 0x2a4]
lea ecx, [esi + 0x2a4]
mov edx, eax
mov ebx, dword [edx]
mov edi, ecx
mov dword [edi], ebx
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov edx, dword [edx + 8]
mov dword [edi + 8], edx
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x604810
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x74d5ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
xor ebx, ebx
cmp dword [esp + 0x1c], ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
je 0x604859
mov dword [esi + 4], 0x7ba240
mov dword [esi + 0xf8], vtable.CBRTTIObject.0
mov dword [esp + 0x18], ebx
mov dword [esp + 8], 1
push ebx
mov ecx, esi
call fcn.005df7e0
mov eax, dword [esi + 4]
mov dword [esi], vtable.CMapObjDef.0
mov dword [esi + 8], vtable.CMapObjDef.2.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 4], vtable.CMapObjDef.1.0
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
lea ecx, [eax - 0xf4]
mov dword [eax + esi], ecx
lea ecx, [esi + 0x28]
mov dword [esp + 0x18], 1
call fcn.00412d40
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 2
call fcn.00412d40
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 3
call fcn.00412d40
mov dword [esi + 0x40], vtable.CBArray_struct_TBPoint_long_int__.0
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 1
mov dword [esi + 0x50], ebx
lea ecx, [esi + 0x64]
mov byte [esp + 0x18], 5
call fcn.005ff730
mov dword [esi + 0x84], ebx
mov dword [esi + 0x80], vtable.CBSList_struct_CMapObjDef::TObjSnd_.0
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x90], ebx
lea ecx, [esi + 0x94]
mov byte [esp + 0x18], 7
call fcn.00412d40
xor edx, edx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x60], ebx
mov byte [esi + 0x24], bl
mov byte [esi + 0x25], bl
mov byte [esi + 0x26], 3
mov eax, 0x32
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
lea eax, [esi + 0xc8]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], edx
xor ecx, ecx
lea edx, [esi + 0xa0]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
mov dword [edx + 0x18], ecx
mov dword [edx + 0x1c], ecx
mov dword [edx + 0x20], ecx
mov dword [edx + 0x24], ecx
mov byte [esi + 0xf0], bl
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x6076a7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x74dd7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], esi
mov dword [esi + 8], edx
call fcn.00455f20
mov ecx, dword [edi + 0x48]
push fcn.004553d0
push fcn.00455f20
push 0xa
push 0x3c
lea edx, [edi + 0x4c]
push edx
lea eax, [esi + 0x4c]
push eax
mov dword [esp + 0x30], 0
mov dword [esi + 0x48], ecx
call fcn.0072068a
lea eax, [edi + 0x2a4]
lea ecx, [esi + 0x2a4]
mov edx, eax
mov ebx, dword [edx]
mov edi, ecx
mov dword [edi], ebx
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov edx, dword [edx + 8]
mov dword [edi + 8], edx
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x6117c8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x74df48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00412d40
movzx eax, word [esp + 0x1c]
push eax
lea ecx, [esp + 8]
push str.ksp_d
push ecx
mov dword [esp + 0x20], 0
call fcn.00413950
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
add esp, 4
mov eax, esp
mov dword [eax + 4], ecx
mov dword [eax], edx
mov eax, dword [esp + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x24], esp
push eax
mov ecx, esi
call dword [edx + 0x3c]
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00412de0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 0xc
Function at 0x61d5a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x74e653
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x80]
call fcn.0043bca0
xor ebx, ebx
lea ecx, [esp + 0x38]
mov dword [esp + 0xb4], ebx
call fcn.0043bca0
mov eax, dword [esi + 0x84]
mov ecx, dword [esi + 0x80]
push ebx
push 4
add eax, 1
add ecx, 1
push eax
push ecx
lea ecx, [esp + 0x90]
mov byte [esp + 0xc4], 1
call fcn.00439ba0
mov edx, dword [esi + 0x84]
mov eax, dword [esi + 0x80]
push ebx
push 4
add edx, 1
push edx
add eax, 1
push eax
lea ecx, [esp + 0x48]
call fcn.00439ba0
lea ecx, [esp + 0x80]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0043bdf0
mov ecx, dword [esi + 0x84]
mov edx, dword [esi + 0x80]
push 0xff
push ebx
sub esp, 0x10
mov eax, esp
mov dword [eax + 0xc], ecx
lea ecx, [esp + 0x30]
mov byte [esp + 0xcc], 2
mov dword [esp + 0x28], esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], edx
call fcn.0043d320
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x64]
call fcn.0043bdf0
mov ecx, dword [esi + 0x84]
mov edx, dword [esi + 0x80]
push 0xff
push ebx
sub esp, 0x10
mov eax, esp
mov dword [eax + 0xc], ecx
lea ecx, [esp + 0x78]
mov byte [esp + 0xcc], 3
mov dword [esp + 0x28], esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], edx
call fcn.0043d320
cmp dword [esi + 0x84], ebx
jl 0x61d744
xor ebp, ebp
cmp dword [esi + 0x80], ebp
jl 0x61d739
nop
mov eax, dword [esi + 0x5c]
mov ecx, eax
imul eax, ebp
imul ecx, ebx
push 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x20], ecx
call fcn.0065f120
add esp, 0xc
test ax, ax
je 0x61d72e
movzx edi, al
mov ecx, edi
imul ecx, ecx, 0x659d01
add ecx, 0x663a00
push ecx
push ebx
push ebp
lea ecx, [esp + 0x24]
call fcn.0043b570
mov eax, edi
shl eax, 8
add eax, edi
shl eax, 8
add eax, edi
push eax
push ebx
push ebp
lea ecx, [esp + 0x6c]
call fcn.0043b570
add ebp, 1
cmp ebp, dword [esi + 0x80]
jle 0x61d6d0
add ebx, 1
cmp ebx, dword [esi + 0x84]
jle 0x61d6c5
push 0
lea edx, [esp + 0x84]
push str.c:_temp_realmsexp.bmp
push edx
call fcn.0043bb70
push 0
lea eax, [esp + 0x48]
push str.c:_temp_realmsexpid.bmp
push eax
call fcn.0043bb70
add esp, 0x18
lea ecx, [esp + 0x60]
mov byte [esp + 0xb4], 2
call fcn.00437a90
lea ecx, [esp + 0x18]
mov byte [esp + 0xb4], 1
call fcn.00437a90
lea ecx, [esp + 0x38]
mov byte [esp + 0xb4], 0
call fcn.0043b050
lea ecx, [esp + 0x80]
mov dword [esp + 0xb4], 0xffffffff
call fcn.0043b050
mov ecx, dword [esp + 0xac]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x61ed00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x74e750
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
mov ebx, ecx
mov eax, dword [ebx + 0x5c]
push esi
mov esi, eax
imul esi, dword [esp + 0x48]
push edi
mov edi, eax
imul eax, dword [esp + 0x48]
imul edi, dword [esp + 0x44]
mov edx, eax
mov dword [esp + 0x48], eax
add eax, esi
mov dword [esp + 0x1c], eax
xor eax, eax
mov ecx, edi
sub ecx, esi
lea ebp, [edi + esi]
sub edx, esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], vtable.CBSList_class_CMapObj__.0
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
push eax
push eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x28]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x38]
mov dword [eax + 4], edx
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ecx
mov ebp, dword [ebx]
mov dword [esp + 0x68], esp
call fcn.005e4ed0
push eax
mov ecx, ebx
call dword [ebp + 0x168]
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x61edd1
imul esi, esi
mov eax, ebx
mov edx, dword [eax]
mov eax, dword [esp + 0x48]
sub eax, dword [edx + 0x2c]
mov ebx, dword [ebx + 4]
mov ecx, edi
sub ecx, dword [edx + 0x28]
mov ebp, ecx
imul ebp, ecx
mov ecx, eax
imul ecx, eax
add ebp, ecx
cmp ebp, esi
jg 0x61edcd
push edx
call fcn.00600b30
add esp, 4
test ebx, ebx
jne 0x61eda1
mov dword [esp + 0x20], vtable.CBSList_class_CMapObj__.0
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], 1
call fcn.00548f00
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x30
ret 0xc
Function at 0x61ee00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x74e750
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x5c]
mov eax, ecx
imul eax, dword [esp + 0x4c]
mov esi, ecx
imul ecx, dword [esp + 0x48]
imul esi, dword [esp + 0x44]
mov ebp, ecx
xor ecx, ecx
mov ebx, eax
imul ebx, eax
mov dword [esp + 0x48], ebp
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], vtable.CBSList_class_CMapObj__.0
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], ecx
lea edx, [esi + eax]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x18], edx
mov edx, ebp
add ebp, eax
sub edx, eax
push 0
mov ecx, esi
sub ecx, eax
push 0
lea eax, [esp + 0x28]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x34]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ebp
mov ebp, dword [edi]
mov dword [esp + 0x68], esp
call fcn.005e4d30
push eax
mov ecx, edi
call dword [ebp + 0x168]
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x61eee4
mov eax, ebp
mov edi, dword [eax]
mov ebp, dword [ebp + 4]
push edi
call fcn.0061c330
add esp, 4
test eax, eax
je 0x61eee0
mov ecx, dword [edi + 0x28]
mov eax, dword [edi + 0x2c]
sub eax, dword [esp + 0x48]
sub ecx, esi
mov edx, ecx
imul edx, ecx
mov ecx, eax
imul ecx, eax
add edx, ecx
cmp edx, ebx
jge 0x61eee0
push edi
call fcn.00600b30
add esp, 4
test ebp, ebp
jne 0x61eea7
mov dword [esp + 0x20], vtable.CBSList_class_CMapObj__.0
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], 1
call fcn.00548f00
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x30
ret 0xc
Function at 0x62470e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x74e86c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
xor eax, eax
cmp dword [esp + 0x2c], eax
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 4], eax
je 0x624735
mov dword [esi + 4], 0x7e3800
mov dword [esi + 0x4c], vtable.CBRTTIObject.0
mov dword [esp + 0x14], eax
mov dword [esp + 4], 1
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x30]
push eax
push ecx
push edx
mov ecx, esi
call fcn.006236b0
mov eax, dword [esi + 4]
mov dword [esi], vtable.COS_MoveToH.2.0
mov dword [esi + 8], vtable.COS_MoveToH.1.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 4], vtable.COS_MoveToH.0
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
mov edx, dword [esp + 0x24]
lea ecx, [eax - 0x48]
mov dword [eax + esi], ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], edx
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x18
Function at 0x626b30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
push eax
call fcn.00622a80
add esp, 4
test eax, eax
jne 0x626b65
cmp dword [esi + 0x14], eax
je 0x626b5d
mov ecx, esi
call fcn.00622970
mov ecx, eax
call fcn.00629020
cmp eax, 0x3e8
jb 0x626b65
mov ecx, esi
pop esi
jmp fcn.006261f0
pop esi
ret

Function at 0x627640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x74e94b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], esi
mov dword [esi + 8], edx
call fcn.00455f20
mov ecx, dword [edi + 0x48]
push fcn.004553d0
push fcn.00455f20
push 0xa
push 0x3c
lea edx, [edi + 0x4c]
push edx
lea eax, [esi + 0x4c]
push eax
mov dword [esp + 0x30], 0
mov dword [esi + 0x48], ecx
call fcn.0072068a
lea eax, [edi + 0x2a4]
lea ecx, [esi + 0x2a4]
mov edx, eax
mov ebx, dword [edx]
mov edi, ecx
mov dword [edi], ebx
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov edx, dword [edx + 8]
mov dword [edi + 8], edx
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x627657
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x74e94b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], esi
mov dword [esi + 8], edx
call fcn.00455f20
mov ecx, dword [edi + 0x48]
push fcn.004553d0
push fcn.00455f20
push 0xa
push 0x3c
lea edx, [edi + 0x4c]
push edx
lea eax, [esi + 0x4c]
push eax
mov dword [esp + 0x30], 0
mov dword [esi + 0x48], ecx
call fcn.0072068a
lea eax, [edi + 0x2a4]
lea ecx, [esi + 0x2a4]
mov edx, eax
mov ebx, dword [edx]
mov edi, ecx
mov dword [edi], ebx
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov edx, dword [edx + 8]
mov dword [edi + 8], edx
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x62ed30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x74f43b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
mov dword [esp + 0xc], esi
call fcn.00412d40
xor ebx, ebx
mov edx, 0xffff
mov dword [esi], ebx
mov word [esi + 0xe], dx
mov word [esi + 0xc], bx
xor eax, eax
mov ecx, 0xb
lea edi, [esi + 0x34]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
or edi, 0xffffffff
push ebx
push ebx
mov ecx, esi
mov dword [esp + 0x24], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov word [esi + 0x32], bx
mov word [esi + 0x1c], bx
mov word [esi + 0x1e], dx
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], ebx
mov byte [esi + 0x6c], bl
mov word [esi + 0x6e], bx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x74], ebx
mov byte [esi + 0x72], bl
mov word [esi + 0x70], bx
mov word [esi + 0x82], bx
mov dword [esi + 0x7c], ebx
mov byte [esi + 0x80], 0xff
mov byte [esi + 0x96], bl
mov byte [esi + 0xa5], bl
mov byte [esi + 0x84], bl
mov byte [esi + 0xa4], bl
mov dword [esi + 0xa8], ebx
mov word [esi + 0xac], bx
mov byte [esi + 0xae], bl
mov dword [esi + 0x8c], edi
mov word [esi + 0x94], bx
call fcn.0062dbf0
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov word [esi + 0xb0], bx
mov byte [esi + 0xb2], bl
mov byte [esi + 0xb3], bl
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov byte [esi + 0xaf], bl
mov byte [esi + 0x10], bl
mov word [esi + 0x98], bx
mov dword [esi + 0xb4], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x6313c0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x74f5e0
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
mov edi, dword [esp + 0x34]
test edi, edi
mov esi, ecx
jne 0x6313f9
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4
push ebp
push 0
push 2
mov ecx, esi
call fcn.0062f070
mov ecx, dword [0x894420]
push eax
call fcn.00414e70
test eax, eax
jne 0x63141c
mov ecx, esi
call fcn.0062efc0
lea ecx, [esp + 0xc]
mov ebp, eax
call fcn.00412d40
push 1
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.00630f20
mov eax, dword [esp + 0xc]
test eax, eax
je 0x63144b
cmp word [eax], 0
jne 0x631457
push ebp
push edi
call fcn.0071e658
add esp, 8
jmp 0x6314c6
lea ecx, [esp + 0x14]
call fcn.004179a0
push 0
push 0
push 0
push ebp
push str.NAME
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 1
call fcn.00415a70
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0
push ecx
push str.FULLTITLE
lea ecx, [esp + 0x28]
call fcn.00415a70
mov ecx, dword [0x894420]
push 0
lea edx, [esp + 0x18]
push edx
push 0
push 0
push str.titlesfmt_name_fulltitle
call fcn.00414e70
push eax
push edi
call fcn.00415f60
add esp, 0x10
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.004179c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00412de0
mov ecx, dword [esp + 0x28]
pop ebp
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x63db70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x74fe64
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x24], edi
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov eax, 1
je 0x63dbb4
mov dword [esi + 0x18], 0x7e7c6c
mov dword [esi + 0x38], vtable.CBRTTIObject.0
mov dword [esp + 0xc], eax
mov dword [esi + 4], edi
mov dword [esi], vtable.CBSList_struct_TPathNode_.0
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
lea ebx, [esi + 0x14]
push edi
mov ecx, ebx
mov dword [esp + 0x20], eax
call fcn.00412520
mov eax, dword [esi + 0x18]
mov dword [esi], vtable.CPath.2.0
mov dword [ebx], vtable.CPath.1.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x18], vtable.CPath.0
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 4]
lea ecx, [eax - 0x20]
mov dword [eax + esi + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x63f5f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x74fef1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x24]
push edi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov word [esi + 0x1c], di
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esp + 0xc], esi
mov dword [esi + 0x34], vtable.CBArray_class_CPathFinder::CArea__.0
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 1
mov dword [esi + 0x44], edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x48], vtable.CBArray_long_int_.0
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], 1
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], vtable.CBArray_struct_CPassabilityInfo::TPortal__.0
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], 1
mov dword [esi + 0x6c], edi
mov ebx, dword [esp + 0x20]
mov dword [esi + 0x70], ebx
mov eax, dword [ebx + 4]
mov ecx, dword [0x86fb70]
mov edx, dword [ecx]
push edi
add eax, eax
push edi
add eax, eax
push eax
mov byte [esp + 0x24], 2
call dword [edx + 8]
mov dword [esi + 0x28], eax
xor eax, eax
cmp dword [ebx + 4], edi
jle 0x63f6be
mov edi, edi
mov ecx, dword [esi + 0x28]
mov dword [ecx + eax*4], edi
add eax, 1
cmp eax, dword [ebx + 4]
jl 0x63f6b0
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc