joyce8/EMBER2024-capa huggingface dataset:
Function at 0x589630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x668b30
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x70903c]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, dword [esp + 0x74]
mov eax, dword [esp + 0x78]
mov ebp, ecx
push 0xa
mov ecx, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
call fcn.00494770
mov esi, dword [edi + 0x10]
cmp dword [edi + 0xc], esi
jbe 0x58968a
call fcn.00615e0c
mov ebx, dword [edi]
mov edi, dword [edi + 0xc]
mov ecx, dword [esp + 0x14]
cmp edi, dword [ecx + 0x10]
jbe 0x5896a1
call fcn.00615e0c
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
push esi
push ebx
push edi
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.004504d0
xor esi, esi
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], esi
mov byte [esp + 0x44], 0
mov eax, dword [esp + 0x70]
push eax
mov ecx, ebp
mov dword [esp + 0x6c], esi
call fcn.005892a0
mov edi, eax
xor ebp, ebp
jmp 0x5896e0
mov ebx, dword [esp + 0x18]
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5896f0
sub eax, edx
push eax
push ebp
push ebx
mov ecx, edi
call fcn.00496150
mov esi, eax
test esi, esi
jl 0x5897fd
cmp esi, dword [edi + 0x14]
jbe 0x589717
call fcn.00615e0c
mov ebp, 0x10
cmp dword [edi + 0x18], ebp
jb 0x589726
mov eax, dword [edi + 4]
jmp 0x589729
lea eax, [edi + 4]
cmp byte [eax + esi], 0x22
jne 0x58974c
push 1
inc esi
push esi
push 0x6b51d0
mov ecx, edi
call fcn.004499e0
test eax, eax
jl 0x589815
lea ebp, [eax + 1]
jmp 0x589766
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x589751
sub eax, edx
push eax
push esi
push ebx
mov ecx, edi
call fcn.004499e0
mov ebp, eax
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
call fcn.00494720
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x6c], 1
call fcn.0044fd10
mov esi, 0x10
mov byte [esp + 0x68], 0
cmp dword [esp + 0x3c], esi
jb 0x5897a2
mov edx, dword [esp + 0x28]
push edx
call fcn.00613a18
add esp, 4
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5897a7
sub eax, edx
push eax
push ebp
push ebx
mov ecx, edi
call fcn.00496150
test eax, eax
jl 0x5897c7
cmp ebp, dword [edi + 0x14]
jb 0x5896e0
cmp dword [esp + 0x58], esi
jb 0x5897da
mov edx, dword [esp + 0x44]
push edx
call fcn.00613a18
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00613e6e
add esp, 0x58
ret 0xc
cmp dword [esp + 0x58], 0x10
jb 0x589811
mov eax, dword [esp + 0x44]
push eax
call fcn.00613a18
add esp, 4
xor al, al
jmp 0x5897dc
cmp dword [esp + 0x58], ebp
jb 0x589811
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00613a18
add esp, 4
xor al, al
jmp 0x5897dc
Function at 0x58c250
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor eax, eax
mov esi, 0x20
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
add ebx, edx
mov ebp, eax
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebp, eax
xor ebx, ebp
add ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
sub eax, 0x61c88647
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
dec esi
add edx, ebx
test esi, esi
ja 0x58c267
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret

Function at 0x58c2c0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, 0xc6ef3720
mov esi, 0x20
lea ebx, [ebx]
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebp, eax
add ebx, edx
xor ebx, ebp
sub ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
add eax, 0x61c88647
mov ebp, eax
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
dec esi
sub edx, ebx
test esi, esi
ja 0x58c2e0
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
ret
Function at 0x58c410
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
push esi
cmp edx, 0x10
jb 0x58c593
movsx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 1]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 2]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 3]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 4]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 5]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 6]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 7]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 8]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 9]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 0xa]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 0xb]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 0xc]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 0xd]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 0xe]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
movsx esi, byte [ecx + 0xf]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
add ecx, 0x10
sub edx, 0x10
cmp edx, 0x10
jae 0x58c425
test edx, edx
je 0x58c5bb
jmp 0x58c5a0
movsx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6f0b80]
inc ecx
sub edx, 1
jne 0x58c5a0
not eax
pop esi
ret
Function at 0x58c8c0
Capabilities:
Get file size
Get system information on windows
Read file via mapping

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
push edi
xor ebp, ebp
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esp + 0x2c]
push ebp
push esi
push ebp
push 2
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
je 0x58c93a
xor eax, eax
xor edx, edx
div edi
imul eax, edi
add edx, esi
push edx
push eax
push ebp
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
push esi
push edi
call fcn.0058c410
add esp, 8
mov esi, eax
test edi, edi
je 0x58c929
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x24
ret

Function at 0x58c9a0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0x80
push 3
push 0
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x58c9c9
xor eax, eax
pop esi
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x58cda0
Capabilities:
Get file size

Disassembly:
push ebp
push esi
push edi
mov esi, ecx
call fcn.0058cd80
mov ebp, dword [esp + 0x10]
push 0x104
lea eax, [esi + 8]
push ebp
push eax
call fcn.00616c70
mov edi, dword [esp + 0x20]
add esp, 0xc
mov eax, 1
cmp edi, 2
jne 0x58cdd8
mov ecx, 0xc0000000
lea eax, [edi + 1]
jmp 0x58cddd
mov ecx, connect
xor edx, edx
cmp edi, 1
setne dl
push 0
push 0x80
add edx, 3
push edx
push 0
push eax
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x110], eax
cmp eax, 0xffffffff
je 0x58ce23
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 4], edi
pop edi
mov dword [esi + 0x114], eax
pop esi
mov eax, 1
pop ebp
ret 8
pop edi
mov dword [esi + 0x110], 0
pop esi
xor eax, eax
pop ebp
ret 8
Function at 0x58f1f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6692f3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 0x40]
mov ecx, edi
call fcn.0058e930
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0041fe60
lea ecx, [edi + 4]
mov dword [esi], 0x690404
mov dword [esi + 4], 0x6903c4
mov dword [esi + 0x18], 0x690390
mov dword [esi + 0x28], 0x690360
mov dword [esi + 8], edi
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push 0
mov byte [esp + 0x40], 1
call edx
push eax
mov eax, dword [esp + 0x54]
push eax
lea ecx, [esp + 0x28]
call fcn.00401f20
push 1
push eax
lea ecx, [esp + 0x18]
push 0x6b45fc
push ecx
mov byte [esp + 0x4c], 2
call fcn.004146d0
add esp, 0x10
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x48]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x48], 3
call fcn.00417800
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 2
call fcn.004146c0
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, edi
xor al, al
push edx
mov byte [esp + 0x40], 1
rep stosb byte es:[edi], al
call fcn.00419a20
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 0xc

Function at 0x58f7a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x669053
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 0x40]
mov ecx, edi
call fcn.0058dc60
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0041fe60
lea ecx, [edi + 4]
mov dword [esi], 0x6905f4
mov dword [esi + 4], 0x6905b4
mov dword [esi + 0x18], 0x690580
mov dword [esi + 0x28], 0x690550
mov dword [esi + 8], edi
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push 0
mov byte [esp + 0x40], 1
call edx
push eax
mov eax, dword [esp + 0x54]
push eax
lea ecx, [esp + 0x28]
call fcn.00401f20
push 1
push eax
lea ecx, [esp + 0x18]
push 0x6b45fc
push ecx
mov byte [esp + 0x4c], 2
call fcn.004146d0
add esp, 0x10
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x48]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x48], 3
call fcn.00417800
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 2
call fcn.004146c0
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, edi
xor al, al
push edx
mov byte [esp + 0x40], 1
rep stosb byte es:[edi], al
call fcn.00419a20
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 0xc
Function at 0x58fd90
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x669133
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebp
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
lea edi, [esi + 0x40]
lea ebp, [edi + 4]
push 1
mov ecx, ebp
call fcn.004177c0
lea eax, [edi + 0x18]
mov dword [eax + 0x188], 0x60
mov byte [eax + 0x181], 1
mov dword [eax + 0x18c], eax
mov dword [edi], vtable.CryptoPP::BlockCipherFinal_0__class_CryptoPP::CAST256::Base_.0
mov dword [ebp], vtable.CryptoPP::BlockCipherFinal_0__class_CryptoPP::CAST256::Base_.1.0
mov ecx, esi
mov dword [esp + 0x40], 0
call fcn.0041fe60
lea ecx, [edi + 4]
mov dword [esi], 0x6907e4
mov dword [esi + 4], 0x6907a4
mov dword [esi + 0x18], 0x690770
mov dword [esi + 0x28], 0x690740
mov dword [esi + 8], edi
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push 0
mov byte [esp + 0x44], 1
call edx
push eax
mov eax, dword [esp + 0x58]
push eax
lea ecx, [esp + 0x2c]
call fcn.00401f20
push 1
push eax
lea ecx, [esp + 0x1c]
push 0x6b45fc
push ecx
mov byte [esp + 0x50], 2
call fcn.004146d0
add esp, 0x10
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x4c]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x4c], 3
call fcn.00417800
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 2
call fcn.004146c0
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, edi
xor al, al
push edx
mov byte [esp + 0x44], 1
rep stosb byte es:[edi], al
call fcn.00419a20
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x34
ret 0xc

Function at 0x590390
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x669213
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 0x40]
mov ecx, edi
call fcn.0058d3f0
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0041fe60
lea ecx, [edi + 4]
mov dword [esi], 0x6909d4
mov dword [esi + 4], 0x690994
mov dword [esi + 0x18], 0x690960
mov dword [esi + 0x28], 0x690930
mov dword [esi + 8], edi
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push 0
mov byte [esp + 0x40], 1
call edx
push eax
mov eax, dword [esp + 0x54]
push eax
lea ecx, [esp + 0x28]
call fcn.00401f20
push 1
push eax
lea ecx, [esp + 0x18]
push 0x6b45fc
push ecx
mov byte [esp + 0x4c], 2
call fcn.004146d0
add esp, 0x10
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x48]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x48], 3
call fcn.00417800
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 2
call fcn.004146c0
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, edi
xor al, al
push edx
mov byte [esp + 0x40], 1
rep stosb byte es:[edi], al
call fcn.00419a20
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 0xc
Function at 0x590680
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6692f3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 0x40]
mov ecx, edi
call fcn.0058df50
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0041fe60
lea ecx, [edi + 4]
mov dword [esi], 0x690acc
mov dword [esi + 4], 0x690a8c
mov dword [esi + 0x18], 0x690a58
mov dword [esi + 0x28], 0x690a28
mov dword [esi + 8], edi
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push 0
mov byte [esp + 0x40], 1
call edx
push eax
mov eax, dword [esp + 0x54]
push eax
lea ecx, [esp + 0x28]
call fcn.00401f20
push 1
push eax
lea ecx, [esp + 0x18]
push 0x6b45fc
push ecx
mov byte [esp + 0x4c], 2
call fcn.004146d0
add esp, 0x10
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x48]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x48], 3
call fcn.00417800
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 2
call fcn.004146c0
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, edi
xor al, al
push edx
mov byte [esp + 0x40], 1
rep stosb byte es:[edi], al
call fcn.00419a20
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 0xc

Function at 0x590ba0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6692f3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 0x40]
mov ecx, edi
call fcn.0058e9e0
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0041fe60
lea ecx, [edi + 4]
mov dword [esi], 0x690cbc
mov dword [esi + 4], 0x690c7c
mov dword [esi + 0x18], 0x690c48
mov dword [esi + 0x28], 0x690c18
mov dword [esi + 8], edi
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push 0
mov byte [esp + 0x40], 1
call edx
push eax
mov eax, dword [esp + 0x54]
push eax
lea ecx, [esp + 0x28]
call fcn.00401f20
push 1
push eax
lea ecx, [esp + 0x18]
push 0x6b45fc
push ecx
mov byte [esp + 0x4c], 2
call fcn.004146d0
add esp, 0x10
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x48]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x48], 3
call fcn.00417800
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 2
call fcn.004146c0
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, edi
xor al, al
push edx
mov byte [esp + 0x40], 1
rep stosb byte es:[edi], al
call fcn.00419a20
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 0xc
Function at 0x596a40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6697a8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [0x712418], esi
lea eax, [esp + 0xf]
push eax
lea ecx, [esp + 0x13]
xor edi, edi
push ecx
lea ecx, [esi + 0x6c]
mov dword [esp + 0x24], edi
mov dword [esi], vtable.CSoundManager.0
call fcn.0059a810
fldz
fst dword [esi + 0xc]
mov dword [esi + 4], edi
fst dword [esi + 0x10]
mov dword [esi + 8], edi
fst dword [esi + 0x14]
mov eax, esi
fld dword [0x68d78c]
fstp dword [esi + 0x18]
fld dword [0x6763b8]
fstp dword [esi + 0x1c]
fld1
fst dword [esi + 0x20]
fstp dword [esi + 0x24]
fst dword [esi + 0x28]
fst dword [esi + 0x2c]
mov dword [esi + 0x30], edi
fst dword [esi + 0x38]
mov dword [esi + 0x44], edi
fst dword [esi + 0x40]
mov dword [esi + 0x34], edi
mov dword [esi + 0x48], edi
fst dword [esi + 0x4c]
fst dword [esi + 0x54]
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
fst dword [esi + 0x60]
fstp dword [esi + 0x68]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret

Function at 0x599250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6699fb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0xa0
call fcn.00613a23
add esp, 4
mov dword [esp + 8], eax
xor esi, esi
mov dword [esp + 0x24], esi
cmp eax, esi
je 0x599298
mov ecx, eax
call fcn.00596e20
mov esi, eax
mov eax, dword [esp + 0x30]
push eax
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.00596ba0
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0xc], ecx
push eax
mov ecx, 0x754afc
mov dword [esp + 0x14], esi
call fcn.0051fa20
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8
Function at 0x5a7d80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x669e16
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.UI::CWindow.0
xor ebx, ebx
mov dword [esi + 0x1c], 0xf
mov dword [esi + 0x18], ebx
mov byte [esi + 8], bl
mov eax, dword [esp + 0x20]
lea ecx, [esi + 0x68]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x59], bl
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], ebx
call fcn.005d2cc0
lea ecx, [esi + 0x88]
mov byte [esp + 0x18], 1
mov dword [esi + 0x84], ebx
call fcn.005d2cc0
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x54], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x5beae0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x667e58
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
push eax
call fcn.0056b090
xor ebx, ebx
lea ecx, [esi + 0x38]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.CEffectMesh.0
call fcn.0051c710
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x50], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x5c2900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x664c58
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0051c710
mov ecx, dword [esp + 0x30]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x34], 0
call fcn.00597ee0
add esp, 0xc
test al, al
je 0x5c297e
add esi, 0x4c
lea edx, [esp + 8]
push esi
push edx
call fcn.005984a0
add esp, 8
lea ecx, [esp + 8]
call fcn.00531ef0
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4
lea ecx, [esp + 8]
call fcn.00531ef0
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4
Function at 0x5c4f00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66b54e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.005cef00
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CParticleSystemInstance.0
call fcn.0051c710
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 1
call fcn.0051c710
mov ecx, esi
mov byte [esp + 0x14], 2
call fcn.005ceeb0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5d2a70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0x10
jb 0x5d2a7f
mov edx, dword [eax + 4]
jmp 0x5d2a82
lea edx, [eax + 4]
push esi
mov esi, dword [eax + 0x14]
add esi, edx
xor eax, eax
cmp edx, esi
jae 0x5d2aa1
push edi
nop
movzx edi, byte [edx]
imul eax, eax, 0x1000193
inc edx
xor eax, edi
cmp edx, esi
jb 0x5d2a90
pop edi
xor edx, edx
div dword [ecx + 4]
pop esi
mov eax, edx
ret 4