joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fd900
Capabilities:
Decompress data using quicklz

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, esi
call fcn.004d5360
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.004d5280
mov edi, dword [esp + 0x30]
mov ebp, eax
mov eax, dword [edi + 4]
push eax
mov ecx, esi
call fcn.004d5640
mov esi, dword [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.004d5360
mov ecx, esi
mov dword [esp + 0x24], eax
call fcn.004d5280
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x30], eax
mov eax, dword [ebx + 4]
push eax
mov ecx, esi
call fcn.004d5640
push ebp
mov esi, eax
call fcn.0049a970
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
push eax
call fcn.0049a970
mov ebp, dword [ebx + 8]
cdq
and edx, 7
add eax, edx
lea ecx, [ebx + 8]
lea edx, [edi + 8]
add esp, 8
sar eax, 3
cmp ebp, dword [edx]
jl 0x4fd995
mov ecx, edx
mov edx, dword [ecx]
lea ecx, [ebx + 0xc]
mov ebx, dword [ecx]
add edi, 0xc
cmp ebx, dword [edi]
mov dword [esp + 0x1c], edx
jl 0x4fd9a9
mov ecx, edi
mov ecx, dword [ecx]
test ecx, ecx
jle 0x4fdb25
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x14], ecx
test edx, edx
jle 0x4fdb02
mov dword [esp + 0x30], edx
nop
mov ecx, 0xf000
or word [esi], cx
mov cx, word [ebp]
shr cx, 0xb
and cl, 0x1f
mov dl, cl
add cl, cl
add cl, cl
add cl, cl
shr dl, 2
or dl, cl
movzx cx, dl
shl cx, 8
movzx edx, dl
movzx ecx, cx
or ecx, edx
add ecx, 0x7ff
movzx edi, word [esi]
mov edx, ecx
and edx, 0xffff0000
add edx, 0x7fff0000
sar edx, 0x1f
shr cx, 0xc
shr dx, 0xc
or dl, cl
movzx cx, dl
shl cx, 8
and edi, 0xf0ff
or cx, di
mov word [esi], cx
mov dx, word [ebp]
shr dx, 5
and dl, 0x3f
mov bl, dl
add dl, dl
add dl, dl
shr bl, 4
or bl, dl
movzx dx, bl
shl dx, 8
movzx edi, dx
movzx edx, bl
or edi, edx
add edi, 0x7ff
mov edx, edi
and edx, 0xffff0000
add edx, 0x7fff0000
and ecx, 0xff0f
sar edx, 0x1f
mov bx, di
shr bx, 0xc
shr dx, 0xc
or dl, bl
movzx dx, dl
shl dx, 4
or dx, cx
mov word [esi], dx
mov cl, byte [ebp]
and cl, 0x1f
mov bl, cl
add cl, cl
add cl, cl
add cl, cl
shr bl, 2
or bl, cl
movzx cx, bl
shl cx, 8
movzx edi, cx
movzx ecx, bl
or edi, ecx
add edi, 0x7ff
mov ecx, edi
and ecx, 0xffff0000
add ecx, 0x7fff0000
sar ecx, 0x1f
shr cx, 0xc
mov bx, di
shr bx, 0xc
or cl, bl
movzx cx, cl
and edx, 0xfff0
add ebp, dword [esp + 0x18]
or cx, dx
mov word [esi], cx
add esi, eax
sub dword [esp + 0x30], 1
jne 0x4fd9d0
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0x10]
add ebp, dword [esp + 0x20]
add esi, dword [esp + 0x24]
sub dword [esp + 0x14], 1
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x10], esi
jne 0x4fd9c3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4fdb30
Capabilities:
Decompress data using quicklz

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, esi
call fcn.004d5360
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.004d5280
mov edi, dword [esp + 0x30]
mov ebp, eax
mov eax, dword [edi + 4]
push eax
mov ecx, esi
call fcn.004d5640
mov esi, dword [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.004d5360
mov ecx, esi
mov dword [esp + 0x24], eax
call fcn.004d5280
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x30], eax
mov eax, dword [ebx + 4]
push eax
mov ecx, esi
call fcn.004d5640
push ebp
mov esi, eax
call fcn.0049a970
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
push eax
call fcn.0049a970
mov ebp, dword [ebx + 8]
cdq
and edx, 7
add eax, edx
lea ecx, [ebx + 8]
lea edx, [edi + 8]
add esp, 8
sar eax, 3
cmp ebp, dword [edx]
jl 0x4fdbc5
mov ecx, edx
mov edx, dword [ecx]
lea ecx, [ebx + 0xc]
mov ebx, dword [ecx]
add edi, 0xc
cmp ebx, dword [edi]
mov dword [esp + 0x1c], edx
jl 0x4fdbd9
mov ecx, edi
mov ecx, dword [ecx]
test ecx, ecx
jle 0x4fdd5a
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x14], ecx
test edx, edx
jle 0x4fdd37
mov dword [esp + 0x30], edx
nop
mov ecx, 0xf000
or word [esi], cx
mov cx, word [ebp]
shr cx, 0xa
and cl, 0x1f
mov dl, cl
add cl, cl
add cl, cl
shr dl, 2
add cl, cl
or dl, cl
movzx cx, dl
shl cx, 8
movzx edx, dl
movzx ecx, cx
or ecx, edx
add ecx, 0x7ff
movzx edi, word [esi]
mov edx, ecx
and edx, 0xffff0000
add edx, 0x7fff0000
sar edx, 0x1f
shr cx, 0xc
shr dx, 0xc
or dl, cl
movzx cx, dl
shl cx, 8
and edi, 0xf0ff
or cx, di
mov word [esi], cx
mov dx, word [ebp]
shr dx, 5
and dl, 0x1f
mov bl, dl
add dl, dl
add dl, dl
add dl, dl
shr bl, 2
or bl, dl
movzx dx, bl
shl dx, 8
movzx edi, dx
movzx edx, bl
or edi, edx
add edi, 0x7ff
mov edx, edi
and edx, 0xffff0000
add edx, 0x7fff0000
and ecx, 0xff0f
sar edx, 0x1f
mov bx, di
shr bx, 0xc
shr dx, 0xc
or dl, bl
movzx dx, dl
shl dx, 4
or dx, cx
mov word [esi], dx
mov cl, byte [ebp]
add cl, cl
add cl, cl
add cl, cl
mov bl, cl
add cl, cl
add cl, cl
add cl, cl
shr bl, 2
or bl, cl
movzx cx, bl
shl cx, 8
movzx edi, cx
movzx ecx, bl
or edi, ecx
add edi, 0x7ff
mov ecx, edi
and ecx, 0xffff0000
add ecx, 0x7fff0000
sar ecx, 0x1f
mov bx, di
shr cx, 0xc
shr bx, 0xc
add ebp, dword [esp + 0x18]
or cl, bl
movzx cx, cl
and edx, 0xfff0
or cx, dx
mov word [esi], cx
add esi, eax
sub dword [esp + 0x30], 1
jne 0x4fdc00
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0x10]
add ebp, dword [esp + 0x20]
add esi, dword [esp + 0x24]
sub dword [esp + 0x14], 1
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x10], esi
jne 0x4fdbf3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4fdd70
Capabilities:
Decompress data using quicklz

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, esi
call fcn.004d5360
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.004d5280
mov edi, dword [esp + 0x30]
mov ebp, eax
mov eax, dword [edi + 4]
push eax
mov ecx, esi
call fcn.004d5640
mov esi, dword [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.004d5360
mov ecx, esi
mov dword [esp + 0x24], eax
call fcn.004d5280
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x30], eax
mov eax, dword [ebx + 4]
push eax
mov ecx, esi
call fcn.004d5640
push ebp
mov esi, eax
call fcn.0049a970
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
push eax
call fcn.0049a970
mov ebp, dword [ebx + 8]
cdq
and edx, 7
add eax, edx
lea ecx, [ebx + 8]
lea edx, [edi + 8]
add esp, 8
sar eax, 3
cmp ebp, dword [edx]
jl 0x4fde05
mov ecx, edx
mov edx, dword [ecx]
lea ecx, [ebx + 0xc]
mov ebx, dword [ecx]
add edi, 0xc
cmp ebx, dword [edi]
mov dword [esp + 0x1c], edx
jl 0x4fde19
mov ecx, edi
mov ecx, dword [ecx]
test ecx, ecx
jle 0x4fdfeb
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x14], ecx
test edx, edx
jle 0x4fdfc8
mov dword [esp + 0x30], edx
nop
mov cx, word [ebp]
shr cx, 0xf
and cl, 1
not cl
inc cl
movzx dx, cl
movzx ecx, cl
shl dx, 8
movzx edx, dx
or edx, ecx
add edx, 0x7ff
mov ecx, edx
and ecx, 0xffff0000
add ecx, 0x7fff0000
sar ecx, 0x1f
shr cx, 0xc
shr dx, 0xc
or cl, dl
movzx edx, word [esi]
movzx cx, cl
shl cx, 0xc
mov edi, 0xfff
and dx, di
or cx, dx
mov word [esi], cx
mov dx, word [ebp]
shr dx, 0xa
and dl, 0x1f
mov bl, dl
add dl, dl
add dl, dl
add dl, dl
shr bl, 2
or bl, dl
movzx dx, bl
shl dx, 8
movzx edi, dx
movzx edx, bl
or edi, edx
add edi, 0x7ff
mov edx, edi
and edx, 0xffff0000
add edx, 0x7fff0000
and ecx, 0xf0ff
sar edx, 0x1f
shr dx, 0xc
mov bx, di
shr bx, 0xc
or dl, bl
movzx dx, dl
shl dx, 8
or dx, cx
mov word [esi], dx
mov cx, word [ebp]
shr cx, 5
and cl, 0x1f
mov bl, cl
add cl, cl
add cl, cl
add cl, cl
shr bl, 2
or bl, cl
movzx cx, bl
shl cx, 8
movzx edi, cx
movzx ecx, bl
or edi, ecx
add edi, 0x7ff
mov ecx, edi
and ecx, 0xffff0000
add ecx, 0x7fff0000
sar ecx, 0x1f
shr cx, 0xc
mov bx, di
shr bx, 0xc
or cl, bl
movzx cx, cl
shl cx, 4
and edx, 0xff0f
or cx, dx
mov word [esi], cx
mov dl, byte [ebp]
add dl, dl
add dl, dl
add dl, dl
mov bl, dl
add dl, dl
add dl, dl
add dl, dl
shr bl, 2
or bl, dl
movzx dx, bl
shl dx, 8
movzx edi, dx
add ebp, dword [esp + 0x18]
movzx edx, bl
or edi, edx
add edi, 0x7ff
mov edx, edi
and edx, 0xffff0000
add edx, 0x7fff0000
sar edx, 0x1f
shr dx, 0xc
mov bx, di
shr bx, 0xc
or dl, bl
movzx dx, dl
and ecx, 0xfff0
or dx, cx
mov word [esi], dx
add esi, eax
sub dword [esp + 0x30], 1
jne 0x4fde40
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0x10]
add ebp, dword [esp + 0x20]
add esi, dword [esp + 0x24]
sub dword [esp + 0x14], 1
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x10], esi
jne 0x4fde33
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4fe000
Capabilities:
Decompress data using quicklz

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, esi
call fcn.004d5360
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.004d5280
mov edi, dword [esp + 0x30]
mov ebp, eax
mov eax, dword [edi + 4]
push eax
mov ecx, esi
call fcn.004d5640
mov esi, dword [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.004d5360
mov ecx, esi
mov dword [esp + 0x24], eax
call fcn.004d5280
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x30], eax
mov eax, dword [ebx + 4]
push eax
mov ecx, esi
call fcn.004d5640
push ebp
mov esi, eax
call fcn.0049a970
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
push eax
call fcn.0049a970
mov ebp, dword [ebx + 8]
cdq
and edx, 7
add eax, edx
lea ecx, [ebx + 8]
lea edx, [edi + 8]
add esp, 8
sar eax, 3
cmp ebp, dword [edx]
jl 0x4fe095
mov ecx, edx
mov edx, dword [ecx]
lea ecx, [ebx + 0xc]
mov ebx, dword [ecx]
add edi, 0xc
cmp ebx, dword [edi]
mov dword [esp + 0x1c], edx
jl 0x4fe0a9
mov ecx, edi
mov ecx, dword [ecx]
test ecx, ecx
jle 0x4fe27b
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x14], ecx
test edx, edx
jle 0x4fe258
mov dword [esp + 0x30], edx
nop
mov cx, word [ebp]
shr cx, 0xf
and cl, 1
not cl
inc cl
movzx dx, cl
shl dx, 8
movzx ecx, cl
movzx edx, dx
or edx, ecx
add edx, 0x7ff
mov ecx, edx
and ecx, 0xffff0000
add ecx, 0x7fff0000
sar ecx, 0x1f
shr dx, 0xc
shr cx, 0xc
or cl, dl
movzx edx, word [esi]
movzx cx, cl
shl cx, 0xc
mov edi, 0xfff
and dx, di
or cx, dx
mov word [esi], cx
mov dl, byte [ebp]
add dl, dl
add dl, dl
add dl, dl
mov bl, dl
add dl, dl
add dl, dl
add dl, dl
shr bl, 2
or bl, dl
movzx dx, bl
shl dx, 8
movzx edi, dx
movzx edx, bl
or edi, edx
add edi, 0x7ff
mov edx, edi
and edx, 0xffff0000
add edx, 0x7fff0000
and ecx, 0xf0ff
sar edx, 0x1f
shr dx, 0xc
mov bx, di
shr bx, 0xc
or dl, bl
movzx dx, dl
shl dx, 8
or dx, cx
mov word [esi], dx
mov cx, word [ebp]
shr cx, 5
and cl, 0x1f
mov bl, cl
add cl, cl
add cl, cl
add cl, cl
shr bl, 2
or bl, cl
movzx cx, bl
shl cx, 8
movzx edi, cx
movzx ecx, bl
or edi, ecx
add edi, 0x7ff
mov ecx, edi
and ecx, 0xffff0000
add ecx, 0x7fff0000
sar ecx, 0x1f
shr cx, 0xc
mov bx, di
shr bx, 0xc
or cl, bl
movzx cx, cl
shl cx, 4
and edx, 0xff0f
or cx, dx
mov word [esi], cx
mov dx, word [ebp]
shr dx, 0xa
and dl, 0x1f
mov bl, dl
add dl, dl
add dl, dl
add dl, dl
shr bl, 2
or bl, dl
movzx dx, bl
shl dx, 8
movzx edi, dx
add ebp, dword [esp + 0x18]
movzx edx, bl
or edi, edx
add edi, 0x7ff
mov edx, edi
and edx, 0xffff0000
add edx, 0x7fff0000
sar edx, 0x1f
shr dx, 0xc
mov bx, di
shr bx, 0xc
or dl, bl
movzx dx, dl
and ecx, 0xfff0
or dx, cx
mov word [esi], dx
add esi, eax
sub dword [esp + 0x30], 1
jne 0x4fe0d0
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0x10]
add ebp, dword [esp + 0x20]
add esi, dword [esp + 0x24]
sub dword [esp + 0x14], 1
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x10], esi
jne 0x4fe0c3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x519010
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5bdbeb
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x69e298]
xor eax, esp
mov dword [esp + 0xb8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov edi, dword [esp + 0xe0]
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
call edx
test al, al
jne 0x5190ce
push 1
push 0x5f
push str.._storage_fileio_filereadfiles.cpp
lea ecx, [esp + 0x28]
call fcn.00496f50
lea eax, [esp + 0x1c]
push 0x5d84a0
push eax
mov dword [esp + 0xe0], 0
call fcn.00402cc0
add esp, 8
lea ecx, [esp + 0x1c]
call fcn.00496c20
test al, al
je 0x51909c
int3
lea ecx, [esp + 0x98]
mov dword [esp + 0xd8], 0xffffffff
call fcn.00401f70
lea ecx, [esp + 0x98]
push ecx
mov dword [esp + 0x9c], vtable.std::ios_base.0
call fcn.00588e93
add esp, 4
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0x10]
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, dword [esi + 0x28]
jg 0x5190f1
xor eax, eax
jmp 0x519208
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
mov edx, dword [esi]
mov ebx, eax
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
sub eax, ebx
cmp dword [esp + 0xe4], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0xe4]
jb 0x51911f
lea eax, [esp + 0x14]
mov ebp, dword [eax]
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0x10]
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [esp + 0x14], ebp
cmp dword [esi + 0x28], ecx
jb 0x519146
call fcn.00589a8c
test ebp, ebp
je 0x5191ff
lea ebx, [esi + 0x24]
mov edx, dword [esi + 0x1c]
push edx
call fcn.0058bfa1
add esp, 4
mov eax, ebx
cmp dword [ebx], ebp
jb 0x519167
lea eax, [esp + 0x14]
mov ecx, dword [esi + 0x1c]
mov eax, dword [eax]
push ecx
push eax
push 1
push edi
call fcn.0058c7ea
add dword [esi + 0x20], eax
add edi, eax
sub ebp, eax
add esp, 0x10
sub dword [ebx], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jne 0x5191ee
mov edx, dword [esi + 0x1c]
push edx
call fcn.0058abac
inc dword [esi + 0x28]
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0x10]
mov edi, dword [esi + 0x28]
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 4
cmp edi, eax
jge 0x5191f8
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0x10]
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp edi, ecx
jb 0x5191d9
call fcn.00589a8c
mov eax, dword [esi + 0x10]
lea edx, [edi + edi*8]
lea ecx, [eax + edx*4]
push ecx
mov ecx, esi
call fcn.00518ea0
mov edi, dword [esp + 0x18]
test ebp, ebp
jne 0x519151
jmp 0x5191ff
mov dword [esi + 0x1c], 0
mov eax, dword [esp + 0xe4]
sub eax, ebp
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.00589f78
add esp, 0xc8
ret 8
Function at 0x521f50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5becbb
mov eax, dword fs:[0]
push eax
sub esp, 0x2f0
mov eax, dword [0x69e298]
xor eax, esp
mov dword [esp + 0x2ec], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0x304]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x318]
mov eax, dword [esp + 0x314]
push ecx
push eax
lea ecx, [esp + 0x1c]
mov esi, 0x521e80
mov edi, 0x521eb0
mov ebx, 0x521f10
mov ebp, 0x521f30
call fcn.00518910
xor eax, eax
push 0x2cc
push eax
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x318], eax
mov dword [esp + 0x3c], eax
call fcn.0058a010
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.005187e0
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
push 0
mov dword [eax + 0xc], ebp
push 0
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.00562ab0
lea edx, [esp + 0x50]
push edx
mov esi, eax
call fcn.005614b0
add esp, 0x24
test esi, esi
lea ecx, [esp + 0x14]
sete bl
mov dword [esp + 0x30c], 0xffffffff
call fcn.00518810
mov al, bl
mov ecx, dword [esp + 0x304]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2ec]
xor ecx, esp
call fcn.00589f78
add esp, 0x2fc
ret

Function at 0x522620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5beda8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 0x20], edi
mov dword [esi], vtable.Maid::WaveFile.0
call fcn.00518910
xor eax, eax
xor edx, edx
mov word [esi + 0x22], ax
xor ecx, ecx
mov word [esi + 0x30], ax
mov word [esi + 0x20], dx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov word [esi + 0x2c], cx
mov word [esi + 0x2e], dx
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8

Function at 0x523620
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5bf054
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esp + 0x18], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x10]
mov byte [esp + 0x18], 1
call fcn.00534530
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x18], 3
call fcn.004b9160
lea ecx, [esi + 0x3c]
mov byte [esp + 0x18], 4
call fcn.004b9160
mov dword [esi + 0x5c], 3
mov dword [esi + 0x58], edi
mov dword [esi + 0x48], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x5287b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bf9c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esi + 0x30], edi
mov eax, dword [esi + 0x40]
mov dword [esp + 0x18], edi
cmp eax, edi
je 0x5287f2
push eax
call fcn.0058984a
add esp, 4
mov eax, dword [esi + 0x34]
push eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
call fcn.0058984a
mov ecx, dword [esi + 0x28]
push ecx
call fcn.0058984a
mov eax, dword [esi + 0x1c]
add esp, 8
cmp eax, edi
je 0x528820
push eax
call fcn.0058984a
add esp, 4
mov edx, dword [esi + 0x10]
push edx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
call fcn.0058984a
add esp, 4
lea ecx, [esi + 4]
call fcn.0051bc90
mov dword [esi], vtable.Maid::Input::IMouseDevice.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x534610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5abc48
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push ebp
push esi
push edi
mov eax, dword [0x69e298]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x78]
test eax, eax
je 0x53464e
cmp eax, dword [esp + 0x80]
je 0x534653
call fcn.00589a8c
mov eax, dword [esp + 0x84]
cmp dword [esp + 0x7c], eax
je 0x5347ec
mov esi, dword [esp + 0x74]
cmp ebx, esi
jne 0x534693
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x53467d
cmp eax, dword [esp + 0x80]
je 0x534682
call fcn.00589a8c
mov eax, dword [esp + 0x84]
cmp dword [esp + 0x70], eax
je 0x5347ec
mov dword [esp + 0x74], 0
cmp ebx, esi
je 0x5347b4
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x78]
mov edi, dword [eax]
mov eax, dword [esi]
test ecx, ecx
je 0x5346b6
cmp ecx, eax
je 0x5346bb
call fcn.00589a8c
cmp dword [esp + 0x7c], edi
jne 0x5346f1
mov ecx, dword [esp + 0x80]
mov edi, dword [esi + 0x14]
mov eax, dword [esi]
test ecx, ecx
je 0x5346d5
cmp ecx, eax
je 0x5346da
call fcn.00589a8c
mov eax, dword [esp + 0x84]
cmp eax, edi
jne 0x5346f1
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x74], ecx
jmp 0x5347b4
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
lea esp, [esp]
test ebx, ebx
je 0x53470d
cmp ebx, dword [esp + 0x80]
je 0x534712
call fcn.00589a8c
mov eax, dword [esp + 0x84]
cmp ebp, eax
je 0x5347b0
mov edi, dword [esi + 0x14]
mov eax, dword [esi]
test ebx, ebx
je 0x53472e
cmp ebx, eax
je 0x534733
call fcn.00589a8c
cmp ebp, edi
jne 0x534753
mov ecx, dword [esp + 0x78]
mov edi, dword [esi + 0x14]
mov eax, dword [esi]
test ecx, ecx
je 0x534748
cmp ecx, eax
je 0x53474d
call fcn.00589a8c
cmp dword [esp + 0x7c], edi
je 0x534775
test ebx, ebx
jne 0x534771
call fcn.00589a8c
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x534768
call fcn.00589a8c
mov ebp, dword [ebp]
inc dword [esp + 0x74]
jmp 0x534700
mov eax, dword [ebx]
jmp 0x53475e
push str.list_T__bad_splice
lea ecx, [esp + 0x1c]
call fcn.00402290
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x38]
mov dword [esp + 0x68], 0
call fcn.00402060
push 0x6602c8
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x3c], vtable.std::length_error.0
call fcn.00589b1c
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x80]
push 0
push ecx
mov ecx, dword [esp + 0x80]
push eax
mov eax, dword [esp + 0x88]
push edx
mov edx, dword [esp + 0x80]
push eax
mov eax, dword [esp + 0x80]
push ecx
push esi
push edx
push eax
mov ecx, ebx
call fcn.005345a0
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 0x1c
Function at 0x54e5d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x54e666
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov esi, dword [ecx + 4]
xor eax, eax
cmp esi, edx
push edi
jle 0x54e61d
mov edi, dword [ecx]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
shl eax, 8
xor eax, dword [ebx*4 + 0x5e5c68]
inc edx
cmp edx, esi
jl 0x54e601
xor edx, edx
mov esi, dword [ecx + 0xc]
cmp esi, edx
jle 0x54e641
mov edi, dword [ecx + 8]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
shl eax, 8
xor eax, dword [ebx*4 + 0x5e5c68]
inc edx
cmp edx, esi
jl 0x54e627
mov edx, dword [ecx]
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
pop edi
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
pop esi
shr eax, 0x18
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret