joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457530
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x45753b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x45763e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x114827c]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x114827c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x114827c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x114827c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x114827c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x114827c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x114827c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x114827c]
xor eax, edx
inc ecx
dec edi
jne 0x457556
pop edi
test esi, esi
je 0x457660
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x114827c]
xor eax, edx
inc ecx
dec esi
jne 0x457642
pop esi
pop ebx
not eax
ret
Function at 0x565770
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x108000]
push edi
jmp 0x56578a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x565791
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x565780
mov eax, 1
add ebx, ebx
jne 0x5657a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5657b4
jne 0x5657d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5657d3
dec eax
add ebx, ebx
jne 0x5657c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x565798
add ebx, ebx
jne 0x5657cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x565825
xor ecx, ecx
sub eax, 3
jb 0x5657eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x56585a
sar eax, 1
mov ebp, eax
jmp 0x5657f6
add ebx, ebx
jne 0x5657f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5657c4
inc ecx
add ebx, ebx
jne 0x565804
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5657c4
add ebx, ebx
jne 0x565811
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x565806
jne 0x565822
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x565806
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x565844
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x565836
jmp 0x565786
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x565844
add edi, ecx
jmp 0x565786
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x565862
cmp byte [edi], 0x11
jne 0x565862
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x565867
lea edi, [esi + 0x15e000]
mov eax, dword [edi]
or eax, eax
je 0x5658df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e5a04]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1e5b80]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x565894
mov ecx, edi
jns 0x5658c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e5b84]
or eax, eax
je 0x5658d9
mov dword [ebx], eax
add ebx, 4
jmp 0x5658b1
call dword [esi + 0x1e5b94]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x565910
cmp al, 0xef
ja 0x565903
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5658e5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5658f2
mov ebp, dword [esi + 0x1e5b88]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x565944
sub esp, 0xffffff80
jmp 0x420577
Function at 0x435c38
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [0x99fffff9], al
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.0043510f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004350c4
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.0043510f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004350c4
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.004350ff
xchg ebp, eax
inc edi
push edx
clc
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.0043510f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004350c4
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.004350ff
invalid

Function at 0x439544
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x439490
call sub.user32.dll_EnumWindows
ret

Function at 0x439668
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4396e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004390b4
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x43968d
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00438d0c
cmp dword [ebp - 4], 0
je 0x4396cf
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404744
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4396ec
lea eax, [ebp - 4]
call fcn.00404284
ret
Function at 0x406739
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x469c7c], 0
jne 0x406777
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40674d
mov dword [ecx*4 + 0x469c78], eax
inc ecx
cmp ecx, 0x100
jl 0x406748
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4067a4
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x469c78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406785
not eax
pop ebp
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x17b611a5
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x2a927c5b
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4061a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e51f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [0x519fc8]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], eax
xor ebx, ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], ebx
call fcn.004c9878
mov ecx, dword [0x519fc8]
mov dword [esp + 0x30], ecx
push ebx
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 2
mov dword [esp + 0x24], vtable.CFileException.0
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0xffffffff
call fcn.004c83a4
lea edx, [esp + 0xc]
mov ecx, esi
push edx
mov byte [esp + 0x40], 3
call fcn.00406380
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 4
call fcn.004c8354
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 3
call fcn.004c821b
lea ecx, [esp + 0x10]
call fcn.004c9c9f
mov ecx, dword [esp + 8]
lea eax, [esp + 0x20]
push eax
push ebx
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x48], 5
call fcn.004c9e51
cmp eax, ebx
je 0x4062fc
push edi
lea edx, [esi + 0x40]
push 0x1c
push edx
lea ecx, [esp + 0x1c]
call fcn.004c9f6e
lea ebx, [esi + 0x3c]
push 4
push ebx
lea ecx, [esp + 0x1c]
call fcn.004c9f6e
lea edi, [esi + 0x38]
push 4
push edi
lea ecx, [esp + 0x1c]
call fcn.004c9f6e
mov eax, dword [edi]
mov ecx, 1
cmp eax, 0x418
pop edi
jne 0x40629f
mov dword [esi + 4], 2
jmp 0x4062a2
mov dword [esi + 4], ecx
mov eax, dword [ebx]
cmp eax, ecx
jne 0x4062af
push 0x5164b0
jmp 0x4062e9
cmp eax, 2
jne 0x4062bb
push 0x5164a8
jmp 0x4062e9
cmp eax, 3
jne 0x4062c7
push 0x51649c
jmp 0x4062e9
cmp eax, 4
jne 0x4062d3
push 0x51648c
jmp 0x4062e9
cmp eax, 5
jne 0x4062df
push 0x516484
jmp 0x4062e9
cmp eax, 6
jne 0x4062f1
push 0x51647c
lea ecx, [esi + 0x5c]
call fcn.004c83a4
lea ecx, [esp + 0x10]
call fcn.004ca06c
jmp 0x40632c
mov ecx, 1
push 0x516484
mov byte [esi + 0x54], cl
mov dword [esi + 4], ecx
lea ecx, [esi + 0x5c]
mov dword [esi + 0x44], 0x2580
mov byte [esi + 0x52], 8
mov byte [esi + 0x53], bl
mov dword [esi + 0x38], 0x417
mov dword [esi + 0x3c], ebx
call fcn.004c83a4
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 3
call fcn.004c9d94
mov dword [esp + 0x20], vtable.CFileException.0
lea ecx, [esp + 0x30]
mov byte [esp + 0x3c], 6
call fcn.004c821b
lea ecx, [esp + 8]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004c821b
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x40f770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x4e67a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x95c]
mov dword [esp + 0x10], 0x24
call fcn.004d675c
lea ecx, [esi + 0x920]
mov byte [esp + 0x10], 0x23
call fcn.004d675c
lea ecx, [esi + 0x8e4]
mov byte [esp + 0x10], 0x22
call fcn.004d675c
lea ecx, [esi + 0x8a8]
mov byte [esp + 0x10], 0x21
call fcn.004d675c
lea ecx, [esi + 0x86c]
mov byte [esp + 0x10], 0x20
call fcn.004d675c
lea ecx, [esi + 0x830]
mov byte [esp + 0x10], 0x1f
call fcn.004d675c
lea ecx, [esi + 0x7f4]
mov byte [esp + 0x10], 0x1e
call fcn.004d675c
lea ecx, [esi + 0x7b8]
mov byte [esp + 0x10], 0x1d
call fcn.004d675c
lea ecx, [esi + 0x77c]
mov byte [esp + 0x10], 0x1c
call fcn.004d675c
lea ecx, [esi + 0x740]
mov byte [esp + 0x10], 0x1b
call fcn.004d675c
lea ecx, [esi + 0x704]
mov byte [esp + 0x10], 0x1a
call fcn.004d675c
lea ecx, [esi + 0x6c8]
mov byte [esp + 0x10], 0x19
call fcn.004d6843
lea ecx, [esi + 0x68c]
mov byte [esp + 0x10], 0x18
call fcn.004d6843
mov byte [esp + 0x10], 0x17
lea ecx, [esi + 0x650]
call fcn.004d6843
lea ecx, [esi + 0x614]
mov byte [esp + 0x10], 0x16
call fcn.004d6843
lea ecx, [esi + 0x5d8]
mov byte [esp + 0x10], 0x15
call fcn.004d6843
lea ecx, [esi + 0x59c]
mov byte [esp + 0x10], 0x14
call fcn.004d6843
lea ecx, [esi + 0x560]
mov byte [esp + 0x10], 0x13
call fcn.004d6843
lea ecx, [esi + 0x524]
mov byte [esp + 0x10], 0x12
call fcn.004d6843
lea ecx, [esi + 0x4e8]
mov byte [esp + 0x10], 0x11
call fcn.004d6843
lea ecx, [esi + 0x4ac]
mov byte [esp + 0x10], 0x10
call fcn.004d6843
lea ecx, [esi + 0x470]
mov byte [esp + 0x10], 0xf
call fcn.004d6843
lea ecx, [esi + 0x434]
mov byte [esp + 0x10], 0xe
call fcn.004d6843
lea ecx, [esi + 0x3f8]
mov byte [esp + 0x10], 0xd
call fcn.004d6843
lea ecx, [esi + 0x3bc]
mov byte [esp + 0x10], 0xc
call fcn.004d6843
lea ecx, [esi + 0x380]
mov byte [esp + 0x10], 0xb
call fcn.004d6843
lea ecx, [esi + 0x344]
mov byte [esp + 0x10], 0xa
call fcn.004d6843
lea ecx, [esi + 0x308]
mov byte [esp + 0x10], 9
call fcn.004d6843
lea ecx, [esi + 0x2cc]
mov byte [esp + 0x10], 8
call fcn.004d6843
lea ecx, [esi + 0x290]
mov byte [esp + 0x10], 7
call fcn.004d6843
lea ecx, [esi + 0x254]
mov byte [esp + 0x10], 6
call fcn.004d6843
lea ecx, [esi + 0x218]
mov byte [esp + 0x10], 5
call fcn.004d6843
lea ecx, [esi + 0x1dc]
mov byte [esp + 0x10], 4
call fcn.004d6843
lea ecx, [esi + 0x1a0]
mov byte [esp + 0x10], 3
call fcn.004d6843
lea ecx, [esi + 0x164]
mov byte [esp + 0x10], 2
call fcn.004d6843
lea ecx, [esi + 0x128]
mov byte [esp + 0x10], 1
call fcn.004d6843
lea ecx, [esi + 0xec]
mov byte [esp + 0x10], 0
call fcn.004d65d7
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.004c8a14
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4136c0
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e6e50
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.004c9206
xor ebp, ebp
cmp eax, ebp
je 0x4136f8
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
mov ebx, eax
mov dword [esp + 0x14], ebx
jmp 0x4136fe
mov dword [esp + 0x14], ebp
mov ebx, ebp
mov eax, dword [edi + 0x12c]
mov esi, dword [0x56fe34]
push ebp
push 1
push 0xf1
push eax
call esi
cmp dword [ebx + 0xed254], ebp
jle 0x41384c
mov ecx, dword [ebx + 0xed250]
cmp ecx, ebp
jl 0x41384c
cmp ecx, 0x64
jge 0x41384c
mov edx, dword [edi + 0x168]
mov eax, ecx
shl eax, 5
add eax, ecx
push ebp
push ebp
push 0x184
lea ecx, [eax + eax*4]
push edx
lea ebx, [ebx + ecx*4 + 0x1b2ac0]
call esi
mov esi, dword [ebx + 0x28c]
test esi, esi
je 0x413812
mov eax, dword [0x519fc8]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x1c]
push 0xa
push ecx
push ebp
mov dword [esp + 0x44], 0
call fcn.004b41ce
add esp, 0xc
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push edx
call fcn.004c83a4
push 0x516a1c
lea ecx, [esp + 0x14]
call fcn.004c85f7
mov eax, dword [esp + 0x14]
push esi
lea edx, [esp + 0x1c]
mov ecx, dword [eax + 0xed250]
push ecx
push edx
mov ecx, ebx
call fcn.0044eca0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 1
call fcn.004c8633
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 0
call fcn.004c821b
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x168]
push eax
push 0
push 0x180
push ecx
nop
call fcn.00566d8e
mov esi, dword [esi + 0x274]
lea ecx, [esp + 0x10]
inc ebp
mov dword [esp + 0x38], 0xffffffff
call fcn.004c821b
test esi, esi
jne 0x413767
mov edx, dword [ebx + 0x284]
mov eax, dword [edi + 0x168]
push 0
push edx
push 0x186
push eax
nop
call fcn.00566d97
mov ebx, dword [ebx + 0x284]
push 1
lea ecx, [edi + 0x14c]
mov dword [edi + 0x188], ebx
mov dword [edi + 0x198], ebx
call fcn.004c6c07
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x416fa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e7430
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
push edi
mov edi, ecx
call fcn.004db262
mov esi, dword [eax + 4]
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x74]
mov ebp, dword [eax + 0x14f8]
mov ecx, esi
call fcn.0041ef50
mov ecx, dword [0x519fc8]
mov dword [esp + 0xc], ecx
add eax, 0x14
push str.Piece.ini
lea edx, [esp + 0x14]
push eax
push edx
mov dword [esp + 0x3c], 0
call fcn.004c84b0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 1
call fcn.004c8354
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 0
call fcn.004c821b
mov eax, dword [edi + 0x78]
push 0
push 0
push 0xf0
push eax
nop
call fcn.00566f1a
test eax, eax
je 0x417048
lea ecx, [esp + 0x14]
push 0x51671c
mov dword [ebp + 0x42c], 1
push ecx
jmp 0x41705c
lea edx, [esp + 0x14]
push 0x5167d8
mov dword [ebp + 0x42c], 0
push edx
nop
call fcn.00566f23
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0x516b14
push 0x516b08
nop
call fcn.00566f2c
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004c821b
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x43ec48
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ea5e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
call fcn.004db262
mov ecx, dword [eax + 4]
call fcn.0041ef50
mov ecx, dword [0x519fc8]
mov dword [esp + 4], ecx
add eax, 0xc
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x2c], 0
call fcn.004c8354
mov edx, dword [esp + 4]
lea ecx, [esp + 4]
mov eax, dword [edx - 8]
add eax, 0xfffffffc
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004c1774
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 1
call fcn.004c8354
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.004c821b
push str.Garment_size.exe
lea ecx, [esp + 8]
call fcn.004c85f7
mov eax, dword [0x519fc8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [esi + 0xed250]
mov byte [esp + 0x28], 3
test eax, eax
jl 0x43ed00
cmp eax, dword [esi + 0xed254]
jge 0x43ed00
lea ecx, [esi + eax*4 + 0x1c65dc]
push ecx
lea ecx, [esp + 0x10]
call fcn.004c8354
mov edx, dword [esi + 0xed250]
lea eax, [esi + edx*4 + 0x1c67bc]
push eax
jmp 0x43ed17
lea ecx, [esi + 0x1c65c8]
push ecx
lea ecx, [esp + 0x10]
call fcn.004c8354
lea edx, [esi + 0x1c65cc]
push edx
lea ecx, [esp + 0xc]
call fcn.004c8354
mov eax, dword [0x519fc8]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0xc]
push 0x518230
lea edx, [esp + 0x20]
push ecx
push edx
mov byte [esp + 0x34], 4
call fcn.004c84b0
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
mov byte [esp + 0x34], 5
call fcn.004c844a
push 0x51822c
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x30], 6
push eax
call fcn.004c84b0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 7
call fcn.004c8354
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 6
call fcn.004c821b
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 5
call fcn.004c821b
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 4
call fcn.004c821b
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 4]
push 1
push 0
push ecx
push edx
push str.open
push 0
nop
call fcn.00567c40
lea ecx, [esp + 0x10]
mov dword [esi + 0x2064], 1
mov byte [esp + 0x28], 3
call fcn.004c821b
lea ecx, [esp + 8]
mov byte [esp + 0x28], 2
call fcn.004c821b
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.004c821b
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0xffffffff
call fcn.004c821b
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
jmp 0x43ec30
Function at 0x43ee38
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ea630
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
call fcn.004db262
mov ecx, dword [eax + 4]
call fcn.0041ef50
mov ecx, dword [0x519fc8]
mov dword [esp + 4], ecx
add eax, 0xc
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x2c], 0
call fcn.004c8354
mov edx, dword [esp + 4]
lea ecx, [esp + 4]
mov eax, dword [edx - 8]
add eax, 0xfffffffc
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004c1774
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 1
call fcn.004c8354
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.004c821b
push str.Garmentgrade.exe
lea ecx, [esp + 8]
call fcn.004c85f7
mov eax, dword [0x519fc8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [esi + 0xed250]
mov byte [esp + 0x28], 3
test eax, eax
jl 0x43eef0
cmp eax, dword [esi + 0xed254]
jge 0x43eef0
lea ecx, [esi + eax*4 + 0x1c65dc]
push ecx
lea ecx, [esp + 0x10]
call fcn.004c8354
mov edx, dword [esi + 0xed250]
lea eax, [esi + edx*4 + 0x1c67bc]
push eax
jmp 0x43ef07
lea ecx, [esi + 0x1c65c8]
push ecx
lea ecx, [esp + 0x10]
call fcn.004c8354
lea edx, [esi + 0x1c65cc]
push edx
lea ecx, [esp + 0xc]
call fcn.004c8354
mov eax, dword [0x519fc8]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0xc]
push 0x518230
lea edx, [esp + 0x20]
push ecx
push edx
mov byte [esp + 0x34], 4
call fcn.004c84b0
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
mov byte [esp + 0x34], 5
call fcn.004c844a
push 0x51822c
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x30], 6
push eax
call fcn.004c84b0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 7
call fcn.004c8354
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 6
call fcn.004c821b
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 5
call fcn.004c821b
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 4
call fcn.004c821b
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 4]
push 1
push 0
push ecx
push edx
push str.open
push 0
nop
call fcn.00567c49
lea ecx, [esp + 0x10]
mov dword [esi + 0x2068], 1
mov byte [esp + 0x28], 3
call fcn.004c821b
lea ecx, [esp + 8]
mov byte [esp + 0x28], 2
call fcn.004c821b
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.004c821b
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0xffffffff
call fcn.004c821b
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret