joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b38c0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x64c890
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6a9fa4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push edi
mov eax, dword [0x6a9fa4]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x10], ebx
cmp dword [edi + 0x188], 2
jne 0x5b3921
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x660950
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00405590
jmp 0x5b3a35
mov ebp, 0xf
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x3c], ebx
cmp byte [edi + 0x15c], bl
je 0x5b39f6
lea eax, [edi + 0x18c]
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov byte [esp + 0x3c], 1
mov eax, dword [edi + 0x158]
push eax
call fcn.006257d9
mov ebp, eax
mov eax, dword [esp + 0x2c]
add esp, 4
cmp ebp, eax
ja 0x5b397f
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x1c]
call fcn.00405740
jmp 0x5b398e
mov ecx, ebp
sub ecx, eax
push ebx
push ecx
lea ecx, [esp + 0x1c]
call fcn.00443dd0
mov edx, dword [edi + 0x158]
push ebx
push ebx
push edx
call fcn.006255bc
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [esp + 0x2c], 0x10
jae 0x5b39ae
lea eax, [esp + 0x18]
mov ecx, dword [edi + 0x158]
push ecx
push ebp
push 1
push eax
call fcn.00625156
add esp, 0x10
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x1c]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push edx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00405660
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
cmp dword [esp + 0x2c], 0x10
jb 0x5b3a35
mov ecx, dword [esp + 0x18]
push ecx
jmp 0x5b3a2d
push 0xffffffffffffffff
push ebx
add edi, 0x160
push edi
lea ecx, [esp + 0x20]
call fcn.00405660
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x1c]
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
push edx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00405660
cmp dword [esp + 0x2c], 0x10
jb 0x5b3a35
mov eax, dword [esp + 0x18]
push eax
call fcn.0062414c
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00626d59
add esp, 0x30
ret

Function at 0x5b3fc0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [esi + 0x188], 2
jne 0x5b4011
mov al, 1
mov byte [esi + 0x184], al
mov byte [esi + 0x185], al
lea eax, [esp]
push eax
push 0
push esi
push 0x5b3a60
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
jne 0x5b400a
mov byte [esi + 0x184], al
mov byte [esi + 0x185], al
mov dword [esi + 0x188], 0xb
pop ecx
ret
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
pop ecx
ret
Function at 0x5b5490
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x202c
call fcn.0063fe40
mov eax, dword [0x6a9fa4]
xor eax, esp
mov dword [esp + 0x2028], eax
cmp byte [0x6ba0e7], 0
push ebx
push esi
push edi
je 0x5b56a0
push 0x76aa14
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
push 0x68338c
push str.mem_leaks.txt
mov dword [esp + 0x18], 0
call fcn.00624db9
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 0x14], esi
je 0x5b5695
push 0
call fcn.0062603f
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x2c], edx
call fcn.00626340
push eax
call fcn.00627d55
push eax
lea ecx, [esp + 0x40]
push str.Memory_Leak_Report_for__s_n
push ecx
call fcn.0062549e
lea edx, [esp + 0x48]
push edx
push esi
call fcn.00626802
mov ebx, dword [sym.imp.kernel32.dll_OutputDebugStringA]
add esp, 0x20
push 0x6833bc
call ebx
lea eax, [esp + 0x30]
push eax
call ebx
mov ecx, dword [0x76aa0c]
mov esi, dword [ecx]
mov edi, 0x76aa08
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], esi
jmp 0x5b5560
test edi, edi
mov edx, dword [0x76aa0c]
mov dword [esp + 0x2c], edx
je 0x5b5576
cmp edi, 0x76aa08
je 0x5b557b
call fcn.0062472f
cmp esi, dword [esp + 0x2c]
je 0x5b5632
test edi, edi
jne 0x5b558e
call fcn.0062472f
cmp esi, dword [edi + 4]
jne 0x5b5598
call fcn.0062472f
cmp dword [esi + 0x10], 1
mov ebx, 0x6833c0
jg 0x5b55a8
mov ebx, 0x660950
cmp esi, dword [edi + 4]
jne 0x5b55c6
call fcn.0062472f
cmp esi, dword [edi + 4]
jne 0x5b55c6
call fcn.0062472f
cmp esi, dword [edi + 4]
jne 0x5b55c6
call fcn.0062472f
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x11c]
push ebx
push eax
push ecx
lea edx, [esi + 0x14]
push edx
lea eax, [esp + 0x40]
push str._s__d__:_Leak__d_byte_s_n
push eax
call fcn.0062549e
add esp, 0x18
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x30]
push edx
push eax
call fcn.00626802
add esp, 8
cmp esi, dword [edi + 4]
jne 0x5b560f
call fcn.0062472f
mov ecx, dword [esi + 0x10]
add dword [esp + 0x10], ecx
lea esi, [esp + 0x18]
call fcn.005c93a0
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x5b5560
lea edx, [esp + 0x30]
push str.____________________________________________________________n
push edx
call fcn.0062549e
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x38]
push eax
push esi
call fcn.00626802
add esp, 0x10
lea ecx, [esp + 0x30]
push ecx
call ebx
mov ecx, dword [esp + 0x10]
mov eax, ecx
cdq
and edx, 0x3ff
add eax, edx
sar eax, 0xa
push eax
push ecx
lea edx, [esp + 0x38]
push str.Total_Unfreed:__d_bytes___dKB__n_n
push edx
call fcn.0062549e
add esp, 0x10
lea eax, [esp + 0x30]
push eax
call ebx
lea ecx, [esp + 0x30]
push ecx
push esi
call fcn.00626802
add esp, 8
push 0x76aa14
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x2034]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00626d59
mov esp, ebp
pop ebp
ret
Function at 0x5b56c0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x64e028
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x6a9fa4]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push edi
mov eax, dword [0x6a9fa4]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x5c]
lea eax, [esp + 0x60]
push eax
push ecx
lea ebx, [esp + 0x18]
call fcn.005b73d0
add esp, 8
mov ebx, eax
lea edi, [esp + 0x2c]
mov dword [esp + 0x54], 0
call fcn.005b6000
cmp dword [esp + 0x28], 8
jb 0x5b572d
mov edx, dword [esp + 0x14]
push edx
call fcn.0062414c
add esp, 4
cmp dword [esp + 0x44], 0x10
mov eax, dword [esp + 0x30]
jae 0x5b573c
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp dword [esp + 0x44], 0x10
jb 0x5b5757
mov eax, dword [esp + 0x30]
push eax
call fcn.0062414c
add esp, 4
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00626d59
add esp, 0x4c
ret

Function at 0x5b57a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, 0x76aa30
jmp fcn.005afc90
jmp 0x5afc80

Function at 0x5b57d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x76aa30
jmp fcn.005afc20

Function at 0x5b5890
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x6a9fa4]
xor eax, esp
mov dword [esp + 0x9c], eax
cmp byte [0x6b5f71], 0
push esi
je 0x5b5919
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call fcn.0062e530
mov esi, dword [sym.imp.kernel32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x9c
call esi
test eax, eax
jne 0x5b5906
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x94
call esi
test eax, eax
jne 0x5b5906
xor al, al
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.00626d59
add esp, 0xa0
ret
cmp dword [esp + 8], 6
mov byte [0x6b5f71], 0
setae byte [0x76b9be]
mov ecx, dword [esp + 0xa0]
mov al, byte [0x76b9be]
pop esi
xor ecx, esp
call fcn.00626d59
add esp, 0xa0
ret
Function at 0x5b6a70
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x48
mov eax, dword [0x6a9fa4]
xor eax, esp
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x4c]
push ebx
push ebp
push esi
push edi
push str.advapi32.dll
mov dword [esp + 0x2c], eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x5b6c2e
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SetFileSecurityA
push edi
call esi
push str.SetSecurityDescriptorDacl
push edi
mov dword [esp + 0x24], eax
call esi
push str.InitializeSecurityDescriptor
push edi
mov dword [esp + 0x20], eax
call esi
push str.AllocateAndInitializeSid
push edi
mov dword [esp + 0x2c], eax
call esi
push str.SetEntriesInAclA
push edi
mov ebp, eax
call esi
push str.FreeSid
push edi
mov dword [esp + 0x1c], eax
call esi
cmp dword [esp + 0x1c], ebx
je 0x5b6c27
cmp dword [esp + 0x18], ebx
je 0x5b6c27
cmp dword [esp + 0x24], ebx
je 0x5b6c27
cmp ebp, ebx
je 0x5b6c27
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x5b6c27
cmp eax, ebx
je 0x5b6c27
lea ecx, [esp + 0x20]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea edx, [esp + 0x74]
push edx
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x78], bl
mov byte [esp + 0x79], bl
mov byte [esp + 0x7a], bl
mov byte [esp + 0x7b], bl
mov byte [esp + 0x7c], bl
mov byte [esp + 0x7d], 1
call ebp
test eax, eax
je 0x5b6c0b
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x34]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x28]
push edx
push 1
mov dword [esp + 0x3c], 0x1fffff
mov dword [esp + 0x40], 2
mov dword [esp + 0x44], 3
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], 5
mov dword [esp + 0x58], eax
mov dword [esp + 0x24], ebx
call esi
test eax, eax
jne 0x5b6c0b
push 0x14
call fcn.00612a1b
add esp, 4
mov ebp, eax
push 1
push ebp
call dword [esp + 0x2c]
test eax, eax
je 0x5b6c0b
mov eax, dword [esp + 0x14]
push ebx
push eax
push 1
push ebp
call dword [esp + 0x28]
test eax, eax
je 0x5b6c0b
mov eax, dword [esp + 0x28]
cmp dword [eax + 0x18], 0x10
jb 0x5b6bfa
mov eax, dword [eax + 4]
jmp 0x5b6bfd
add eax, 4
push ebp
push 4
push eax
call dword [esp + 0x28]
test eax, eax
je 0x5b6c0b
mov bl, 1
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00626d59
add esp, 0x48
ret
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor al, al
call fcn.00626d59
add esp, 0x48
ret
Function at 0x5b7eb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x64de43
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6a9fa4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
lea esi, [edi + 0x28]
mov dword [edi], vtable.Sexy::BetaSupport.0
call fcn.005b3460
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov eax, 0xf
mov dword [edi + 0x1e8], eax
mov dword [edi + 0x1e4], ebx
mov byte [edi + 0x1d4], bl
mov dword [edi + 0x204], eax
mov dword [edi + 0x200], ebx
mov byte [edi + 0x1f0], bl
mov dword [edi + 0x220], eax
mov dword [edi + 0x21c], ebx
mov byte [edi + 0x20c], bl
mov dword [edi + 0x23c], eax
mov dword [edi + 0x238], ebx
mov byte [edi + 0x228], bl
mov byte [esp + 0x1c], 4
call fcn.005c9730
mov dword [edi + 0x248], eax
mov cl, 1
mov byte [eax + 0x49], cl
mov eax, dword [edi + 0x248]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x248]
mov dword [eax], eax
mov eax, dword [edi + 0x248]
mov dword [eax + 8], eax
mov eax, dword [esp + 0x28]
mov dword [edi + 0x24c], ebx
mov dword [edi + 4], eax
mov dword [edi + 0x14], ebx
mov dword [edi + 0x1c], ebx
mov byte [edi + 0x1cc], bl
mov byte [edi + 0x1cd], cl
mov dword [edi + 0x18], ebx
call dword [sym.imp.user32.dll_GetDesktopWindow]
mov esi, eax
push esi
call dword [sym.imp.user32.dll_GetDC]
mov ebp, dword [sym.imp.kernel32.dll_MulDiv]
push 0x48
push 0x60
push 8
mov dword [esp + 0x30], eax
call ebp
push str.Tahoma
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x190
push ebx
push ebx
neg eax
push ebx
push eax
call dword [sym.imp.gdi32.dll_CreateFontA]
push 0x48
push 0x60
push 8
mov dword [edi + 8], eax
call ebp
push str.Arial
push ebx
push ebx
push ebx
push ebx
push ebx
neg eax
push ebx
push ebx
push ebx
push 0x190
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.gdi32.dll_CreateFontA]
push 0x48
push 0x60
push 0xa
mov dword [edi + 0xc], eax
call ebp
push str.Tahoma
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x2bc
push ebx
push ebx
neg eax
push ebx
push eax
call dword [sym.imp.gdi32.dll_CreateFontA]
mov ecx, dword [esp + 0x24]
push ecx
push esi
mov dword [edi + 0x10], eax
call dword [sym.imp.user32.dll_ReleaseDC]
mov byte [edi + 0x240], bl
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x5b8640
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x6a9fa4]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esi + 4]
cmp byte [eax + 0x511], 0
jne 0x5b875b
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
push str.SoftwarePopCapBeta
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5b875b
push edi
push 0xff
push eax
lea edx, [esp + 0x19]
push edx
mov byte [esp + 0x1c], al
call fcn.0062e530
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
add esp, 0xc
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push str.Name
push eax
mov dword [esp + 0x1c], pe_nt_image_headers32
call edi
test eax, eax
jne 0x5b86fc
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x5b86e0
sub eax, edx
push eax
lea edx, [esp + 0x14]
push edx
lea ecx, [esi + 0x208]
call fcn.00405590
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push str.Password
push eax
mov dword [esp + 0x1c], pe_nt_image_headers32
call edi
test eax, eax
pop edi
jne 0x5b8750
mov ecx, dword [esp]
mov byte [esp + ecx + 0xc], al
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x5b8734
sub eax, edx
push eax
lea edx, [esp + 0x10]
push edx
lea ecx, [esi + 0x224]
call fcn.00405590
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.00626d59
add esp, 0x110
ret

Function at 0x5b8770
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
mov esi, eax
mov eax, dword [esi + 4]
cmp byte [eax + 0x511], 0
jne 0x5b8825
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push 0
push 0xf003f
push 0
push 0x67f160
push 0
push str.SoftwarePopCapBeta
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x5b8825
cmp dword [esi + 0x220], 0x10
mov ecx, dword [esi + 0x21c]
jb 0x5b87cb
mov eax, dword [esi + 0x20c]
jmp 0x5b87d1
lea eax, [esi + 0x20c]
push edi
mov edi, dword [sym.imp.advapi32.dll_RegSetValueExA]
push ecx
push eax
mov eax, dword [esp + 0x10]
push 1
push 0
push str.Name
push eax
call edi
cmp dword [esi + 0x23c], 0x10
mov eax, dword [esi + 0x238]
jb 0x5b8801
mov esi, dword [esi + 0x228]
jmp 0x5b8807
add esi, 0x228
mov ecx, dword [esp + 8]
push eax
push esi
push 1
push 0
push str.Password
push ecx
call edi
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
add esp, 8
ret
Function at 0x5ba090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65214b
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x6a9fa4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], vtable.Sexy::ResourceManager.0
call fcn.005c92e0
mov dword [esi + 8], eax
mov byte [eax + 0x29], 1
mov eax, dword [esi + 8]
mov dword [eax + 4], eax
mov eax, dword [esi + 8]
mov dword [eax], eax
mov eax, dword [esi + 8]
xor ebx, ebx
mov dword [eax + 8], eax
mov dword [esi + 0xc], ebx
mov dword [esp + 0x14], ebx
call fcn.005c9a80
mov dword [esi + 0x14], eax
mov byte [eax + 0x2d], 1
mov eax, dword [esi + 0x14]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x14]
mov dword [eax], eax
mov eax, dword [esi + 0x14]
mov dword [eax + 8], eax
mov dword [esi + 0x18], ebx
mov byte [esp + 0x14], 1
call fcn.005c9a80
mov dword [esi + 0x20], eax
mov byte [eax + 0x2d], 1
mov eax, dword [esi + 0x20]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x20]
mov dword [eax], eax
mov eax, dword [esi + 0x20]
mov dword [eax + 8], eax
mov dword [esi + 0x24], ebx
mov byte [esp + 0x14], 2
call fcn.005c9a80
mov dword [esi + 0x2c], eax
mov byte [eax + 0x2d], 1
mov eax, dword [esi + 0x2c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x2c]
mov dword [eax], eax
mov eax, dword [esi + 0x2c]
mov dword [eax + 8], eax
mov dword [esi + 0x30], ebx
mov eax, 0xf
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ebx
mov byte [esi + 0x60], bl
mov dword [esi + 0x90], eax
mov dword [esi + 0x8c], ebx
mov byte [esi + 0x7c], bl
mov dword [esi + 0xac], eax
mov dword [esi + 0xa8], ebx
mov byte [esi + 0x98], bl
mov byte [esp + 0x14], 7
call fcn.005c8b00
mov dword [esi + 0xb8], eax
mov byte [eax + 0x35], 1
mov eax, dword [esi + 0xb8]
mov dword [eax + 4], eax
mov eax, dword [esi + 0xb8]
mov dword [eax], eax
mov eax, dword [esi + 0xb8]
mov dword [eax + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0x58], eax
mov byte [esi + 0x54], bl
mov dword [esi + 0x34], ebx
mov byte [esi + 0xb0], bl
mov byte [esi + 0xb1], bl
mov dword [esi + 0xc0], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 8
Function at 0x5c14f0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x64f8bb
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x6a9fa4]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov eax, dword [0x6a9fa4]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov ebx, edx
cmp dword [0x76b41c], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
jne 0x5c154d
xor al, al
jmp 0x5c16d2
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
lea edx, [esp + 0x38]
push str.SexyCacheReq_d
push edx
call fcn.0062549e
add esp, 0xc
lea eax, [esp + 0x34]
push eax
push 0x304
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
push 0x304
push 0
push 0
mov esi, eax
push 0xf001f
push esi
mov dword [esp + 0x30], esi
call dword [sym.imp.kernel32.dll_MapViewOfFile]
cmp dword [ebx + 0x18], 0x10
mov edi, eax
jb 0x5c15a6
mov ecx, dword [ebx + 4]
jmp 0x5c15a9
lea ecx, [ebx + 4]
mov edx, edi
jmp 0x5c15b0
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x5c15b0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0x10
jb 0x5c15cc
mov ecx, dword [ecx + 4]
jmp 0x5c15cf
add ecx, 4
lea edx, [edi + 0x100]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x5c15d5
mov dword [edi + 0x300], 0
mov byte [esp + 0x13], al
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov ecx, dword [0x76b41c]
mov edx, dword [0x76b410]
push eax
push 0
push ecx
push edx
call dword [sym.imp.user32.dll_SendMessageA]
test eax, eax
je 0x5c16c0
push eax
lea eax, [esp + 0x138]
push str.SexyCacheData_d
push eax
call fcn.0062549e
add esp, 0xc
lea ecx, [esp + 0x134]
push ecx
push 0
push 0xf001f
call dword [sym.imp.kernel32.dll_OpenFileMappingA]
mov ebx, eax
test ebx, ebx
je 0x5c16b4
mov edx, dword [edi + 0x300]
push edx
push 0
push 0
push 0xf001f
push ebx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov esi, eax
mov eax, dword [esp + 0x14]
push 0x76b3f4
mov dword [eax], esi
mov dword [esp + 0x18], 0x76b3f4
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
lea ecx, [esp + 0x20]
mov dword [esp + 0x248], 0
push ecx
lea edx, [esp + 0x2c]
mov dword [esp + 0x28], ebx
push edx
mov ebx, 0x76b420
mov dword [esp + 0x28], esi
call fcn.005c3c40
push 0x76b3f4
mov byte [esp + 0x17], 1
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov esi, dword [esp + 0x1c]
mov eax, dword [edi + 0x300]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
push edi
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00626d59
mov esp, ebp
pop ebp
ret 8
Function at 0x5c1850
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x64f87b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x6a9fa4]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push esi
mov eax, dword [0x6a9fa4]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
cmp dword [0x76b41c], 0
jne 0x5c189f
xor eax, eax
jmp 0x5c1989
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
lea eax, [esp + 0x28]
push str.SexyCacheReq_d
push eax
call fcn.0062549e
mov esi, dword [ebp + 0xc]
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
add esi, 0x304
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
push esi
push 0
push 0
mov ebx, eax
push 0xf001f
push ebx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
cmp dword [edi + 0x18], 0x10
mov esi, eax
jb 0x5c18f5
mov ecx, dword [edi + 4]
jmp 0x5c18f8
lea ecx, [edi + 4]
mov edx, esi
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x5c1900
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0x10
jb 0x5c191c
mov ecx, dword [ecx + 4]
jmp 0x5c191f
add ecx, 4
lea edx, [esi + 0x100]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x5c1925
mov edx, dword [ebp + 0xc]
push 0x76b3f4
mov dword [esi + 0x300], edx
mov dword [esp + 0x18], 0x76b3f4
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
lea eax, [esp + 0xc]
mov dword [esp + 0x138], 0
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], ebx
add esi, 0x304
push ecx
mov ebx, 0x76b420
mov dword [esp + 0x14], esi
call fcn.005c3c40
push 0x76b3f4
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00626d59
mov esp, ebp
pop ebp
ret 8
Function at 0x5cc710
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x104
mov eax, dword [0x6a9fa4]
xor eax, esp
mov dword [esp + 0x100], eax
cmp dword [0x6ba108], 0
jne 0x5cc78d
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 4]
push str.gPakInterfaceP__d
push eax
call fcn.0062549e
add esp, 0xc
lea ecx, [esp]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x6ba108], eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [0x6ba10c], eax
mov eax, dword [eax]
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00626d59
add esp, 0x104
ret
mov ecx, dword [esp + 0x100]
mov edx, dword [0x6ba10c]
mov eax, dword [edx]
xor ecx, esp
call fcn.00626d59
add esp, 0x104
ret

Function at 0x5cc8b0
Capabilities:
Read file on windows

Disassembly:
call fcn.005cc710
test eax, eax
je 0x5cc8dc
mov eax, dword [0x6ba10c]
mov ecx, dword [eax]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 0x14]
push eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
call edx
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
jmp fcn.00625156