joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52de70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, ecx
push ebx
push esi
push edi
mov esi, dword [edx + 0x4c]
mov ebx, 0x100
mov edi, dword [edx + 0x1a8]
cmp esi, 1
mov dword [ebp - 0xc], edx
sete al
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov byte [edi + 0x1c], al
mov eax, dword [edx + 4]
push dword [edx + 0x64]
mov ecx, dword [eax + 8]
mov eax, 0x2fe
cmovne eax, ebx
push eax
push 1
push edx
call ecx
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
mov dword [edi + 0x18], eax
add esp, 0x10
mov eax, dword [edi + 0x14]
mov dword [ebp - 8], ebx
cmp dword [ecx + 0x64], ebx
jle 0x52df9a
nop dword [eax]
mov ecx, dword [edi + ebx*4 + 0x20]
cdq
idiv ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
cmp esi, 1
jne 0x52deec
mov eax, dword [edi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [edi + 0x18]
lea edi, [ecx*2 - 2]
mov eax, dword [eax + ebx*4]
xor ebx, ebx
mov dword [ebp - 4], eax
lea eax, [ecx + 0xfe]
cdq
idiv edi
xor esi, esi
mov edx, eax
nop dword [eax + eax]
cmp esi, edx
jle 0x52df34
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x52df22
mov eax, dword [ebp - 0x10]
movzx eax, al
movzx ecx, bl
imul ecx, eax
mov eax, dword [ebp - 4]
mov byte [esi + eax], cl
inc esi
mov ecx, dword [ebp - 0x14]
cmp esi, 0xff
jle 0x52df10
mov esi, dword [ebp - 0x18]
cmp esi, 1
jne 0x52df81
mov ebx, eax
mov ecx, esi
lea edx, [ebx - 1]
movzx eax, byte [ebx]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebx + 0xff]
mov byte [ebx + ecx + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x52df61
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, dword [eax + 0x64]
mov eax, dword [ebp - 0x10]
jl 0x52ded0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53c891
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0xcc
je 0x53c8ba
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x180]
cmp byte [eax + 8], 0
je 0x53c943
mov ecx, dword [esi + 0x78]
lea ebx, [esi + 0x78]
nop dword [eax]
cmp ecx, dword [esi + 0x60]
jae 0x53c916
mov eax, dword [esi + 8]
mov edi, ecx
test eax, eax
je 0x53c8f7
mov dword [eax + 4], ecx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
mov edi, dword [ebx]
add esp, 4
mov eax, dword [esi + 0x184]
push 0
push ebx
push 0
mov eax, dword [eax + 4]
push esi
call eax
mov ecx, dword [ebx]
add esp, 0x10
cmp ecx, edi
je 0x53c959
cmp ecx, dword [esi + 0x60]
jb 0x53c8d5
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
xor ecx, ecx
mov eax, dword [esi + 0x180]
add esp, 8
cmp byte [eax + 8], cl
jne 0x53c8d0
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x546250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e18ea
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x65a06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movss dword [ebp - 0x10], xmm1
mov ecx, dword [ecx]
test ecx, ecx
jne 0x546289
xor eax, eax
xor edx, edx
jmp 0x54628f
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
push 2
push 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x34]
mov eax, dword [ecx]
push 0
push edx
call dword [eax + 0x10]
mov eax, dword [ebp - 0x2c]
sub eax, 1
je 0x5463af
sub eax, 1
je 0x54631c
sub eax, 1
jne 0x5463af
mov edi, dword [ebp - 0x1c]
xor esi, esi
test edi, edi
jle 0x5463af
mov eax, dword [ebp - 0x20]
movss xmm1, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
xor edx, edx
imul ecx, esi
add ecx, dword [ebp - 0x34]
test eax, eax
jle 0x546312
movzx eax, byte [ecx]
inc edx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
cvttss2si eax, xmm0
mov byte [ecx], al
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp edx, eax
jl 0x5462f0
mov edi, dword [ebp - 0x1c]
inc esi
cmp esi, edi
jl 0x5462e1
jmp 0x5463af
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
test edx, edx
jle 0x5463af
movss xmm2, dword [0x6280c8]
mov eax, dword [ebp - 0x20]
movss xmm1, dword [ebp - 0x10]
nop dword [eax]
mov esi, dword [ebp - 0x28]
xor ebx, ebx
imul esi, ecx
add esi, dword [ebp - 0x34]
test eax, eax
jle 0x5463a7
movaps xmm0, xmm1
mov edi, 1
mulss xmm0, xmm2
cvttss2si eax, xmm0
sub edi, eax
mov edx, dword [esi]
inc ebx
mov ecx, edx
mov eax, edx
and ecx, 0xff00ff
shr eax, 8
imul ecx, edi
and eax, 0xffff00ff
imul eax, edi
shr edx, 8
and edx, 0xff00ff
imul edx, edi
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, edx
mov dword [esi], ecx
add esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp ebx, eax
jl 0x546361
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, edx
jl 0x546340
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x5463bc
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x553e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2047
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x65a06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, 1
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], eax
js 0x553f4a
mov ebx, dword [edx]
test ebx, ebx
jle 0x553f34
push dword [ebp + 8]
lea esi, [edx + 4]
lea esi, [esi + ebx*8]
lea ecx, [edx + 4]
mov dword [ebp - 0x20], esi
mov eax, esi
mov dword [ebp - 0x10], ecx
sub eax, ecx
mov edx, esi
sar eax, 3
push eax
call fcn.0042d3a0
mov edx, dword [ebp - 0x10]
add esp, 8
xor edi, edi
mov ecx, edx
cmp edx, esi
jae 0x553f26
nop word [eax + eax]
add edi, dword [ecx + 4]
mov eax, dword [ecx]
add ecx, 8
mov dword [ebp - 0x1c], eax
cmp ecx, esi
jae 0x553ecf
nop
cmp dword [ecx], eax
jne 0x553ecf
add edi, dword [ecx + 4]
dec ebx
add ecx, 8
cmp ecx, esi
jb 0x553ec0
mov eax, edi
cdq
mov esi, eax
xor esi, edx
sub esi, edx
mov eax, esi
cdq
and edx, 0xff
add eax, edx
sar eax, 8
test eax, eax
je 0x553f0e
cmp byte [ebp + 8], 0
je 0x553ef7
mov esi, 0xff
jmp 0x553f0e
and esi, 0x1ff
mov eax, esi
cmp esi, 0x100
jb 0x553f0e
mov esi, 0x1ff
sub esi, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 4], esi
mov esi, dword [ebp - 0x20]
mov dword [edx], eax
add edx, 8
mov dword [ebp - 0x10], edx
cmp ecx, esi
jb 0x553eb0
mov eax, dword [ebp - 0x14]
mov dword [eax], ebx
mov dword [edx - 4], 0
mov edx, eax
sub dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x18]
lea edx, [edx + eax*4]
mov dword [ebp - 0x14], edx
jns 0x553e71
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x556270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x2c], edi
mov ecx, dword [edi + 0x14]
add ecx, 8
call fcn.005575e0
mov ebx, dword [ebp - 0x10]
xor eax, eax
cmp dword [edi + 0x1c], 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 1
jle 0x5563ef
mov eax, dword [ebp + 0xc]
mov esi, 0x10
movsd xmm2, qword [0x627f88]
dec eax
mov dword [ebp - 0x18], esi
movd xmm1, eax
xor eax, eax
cvtdq2pd xmm1, xmm1
mov ecx, dword [edi + 0x14]
add ecx, esi
movsd xmm0, qword [ecx]
mov ecx, dword [ecx + 8]
mulsd xmm0, xmm1
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
addsd xmm0, xmm2
movsd qword [ebp - 0x28], xmm0
mov esi, dword [ebp - 0x28]
sub esi, eax
mov eax, ecx
shr eax, 0x18
mov dword [ebp - 0x20], esi
cmp al, 0xff
jae 0x55633a
test al, al
jne 0x556303
mov word [ebp - 4], 0
mov byte [ebp - 2], al
jmp 0x556334
mov edx, eax
movzx eax, cl
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [ebp - 4], al
movzx eax, byte [ebp - 3]
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [ebp - 3], al
movzx eax, byte [ebp - 2]
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [ebp - 2], al
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
xor edx, edx
mov dword [ebp - 0x10], edx
test esi, esi
jle 0x5563d1
mov eax, ebx
mov edi, ecx
and eax, 0xff00ff
shr ebx, 8
mov dword [ebp - 4], eax
and ebx, 0xff00ff
mov eax, ecx
and edi, 0xff00ff
shr eax, 8
and eax, 0xff00ff
sub eax, ebx
shl ebx, 8
sub edi, dword [ebp - 4]
mov ecx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], edi
nop dword [eax]
mov eax, edx
shl eax, 8
cdq
idiv esi
mov edx, ecx
mov esi, eax
mov eax, ecx
imul edi, esi
imul edx, esi
imul eax, esi
mov esi, dword [ebp - 0x20]
shr edi, 8
add edi, dword [ebp - 4]
add edx, ebx
xor edi, edx
add eax, ebx
mov edx, dword [ebp + 8]
and edi, 0xff00ff
xor edi, eax
mov eax, dword [ebp - 0xc]
mov dword [edx + eax*4], edi
inc eax
mov edx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x24]
inc edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
cmp edx, esi
jl 0x556380
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 0x2c]
jmp 0x5563d4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov ebx, ecx
mov esi, dword [ebp - 0x18]
inc edx
add esi, 0x10
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], esi
cmp edx, dword [edi + 0x1c]
jl 0x5562c4
mov edx, dword [ebp + 0xc]
cmp eax, edx
jge 0x556404
mov ecx, dword [ebp + 8]
sub edx, eax
lea edi, [ecx + eax*4]
mov ecx, edx
mov eax, ebx
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x55a8f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x65a06c]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, cx
mov edx, eax
push esi
mov esi, edx
push edi
mov edi, eax
test ecx, 0x10000
jne 0x55a964
movaps xmm0, xmmword [str.__._:__]
lea ecx, [esi - 0x20]
add edx, 0xffffff9f
movzx esi, cx
xor eax, eax
mov dword [ebp - 0xc], 0xdb005b
cmp dx, 0x19
mov dword [ebp - 8], 0xdd005d
mov ecx, edi
movups xmmword [ebp - 0x2c], xmm0
cmova esi, ecx
movaps xmm0, xmmword [0x628210]
movups xmmword [ebp - 0x1c], xmm0
movzx edx, si
nop
cmp dx, word [ebp + eax*2 - 0x2c]
jne 0x55a95c
movzx edx, word [ebp + eax*2 - 0x2a]
add eax, 2
cmp eax, 0x14
jl 0x55a950
movsx eax, dx
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [ebp - 4]
shr eax, 0xf
xor ecx, ebp
pop edi
and al, 1
pop esi
call fcn.00494b92
mov esp, ebp
pop ebp
ret
Function at 0x572670
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
cmp dword [eax + 0x1e4], 0
jne 0x572733
mov edx, dword [eax + 0x84]
lea ecx, [eax + 0x84]
add eax, 0x1b0
push eax
lea eax, [ebp - 4]
push eax
call dword [edx + 0x14]
mov eax, dword [ebp - 4]
cmp byte [eax], 0
je 0x572710
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x572710
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x57270a
push edi
push dword [ebp - 4]
call fcn.004112d0
mov edi, eax
add esp, 4
add edi, 4
je 0x572709
push esi
lea ecx, [edi + 2]
push ecx
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x572708
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x572708
push edi
push eax
lea ecx, [ebp - 4]
call fcn.004f02f0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop esi
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff8
mov eax, dword [ecx]
test eax, 0x30000000
jne 0x572733
or eax, 0xffffffff
lock xadd dword [ecx], eax
test eax, eax
jne 0x572733
push ecx
call fcn.00494c04
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x578c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov dword [esi], vtable.juce::Slider.0
mov dword [esi + 0x84], vtable.juce::Slider.1.0
mov ecx, dword [esi + 0x158]
test ecx, ecx
je 0x578cb3
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esi + 0x154]
push edi
lea edi, [esi + 0x130]
test ecx, ecx
je 0x578cd9
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
mov ecx, dword [esi + 0x12c]
lea edi, [esi + 0x108]
test ecx, ecx
je 0x578cfe
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
mov ecx, dword [esi + 0x104]
lea edi, [esi + 0xe0]
test ecx, ecx
je 0x578d23
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
mov ecx, dword [esi + 0xdc]
lea edi, [esi + 0xb8]
test ecx, ecx
je 0x578d48
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
mov ecx, dword [esi + 0xb4]
lea edi, [esi + 0x90]
test ecx, ecx
je 0x578d6d
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
mov ecx, dword [esi + 0x88]
sub ecx, 8
mov eax, dword [ecx]
pop edi
test eax, 0x30000000
jne 0x578d94
or eax, 0xffffffff
lock xadd dword [ecx], eax
test eax, eax
jne 0x578d94
push ecx
call fcn.00494c04
add esp, 4
mov ecx, esi
pop esi
jmp fcn.005c4410

Function at 0x57dc50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4f9a
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x65a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebx + 0x44]
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 0x20]
push ecx
mov eax, dword [eax + 0xc]
call eax
mov esi, dword [ebx + 0x54]
mov edi, eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
push eax
mov ecx, dword [ecx + 0x30]
call ecx
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp esi, edi
je 0x57dd0c
mov ecx, dword [ebx + 0x44]
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x30]
push ecx
mov eax, dword [eax + 0xc]
call eax
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebx - 0x8c]
push 3
push eax
call fcn.0057de20
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 4
push eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x30]
call eax
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494b92
mov esp, ebp
pop ebp
ret 4
Function at 0x57e070
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4ff4
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x65a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0xd0]
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 0x20]
push ecx
mov eax, dword [eax + 0xc]
call eax
add esp, 4
mov ecx, esi
push eax
call fcn.0057e5c0
mov ebx, eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
push eax
mov ecx, dword [ecx + 0x30]
call ecx
add esp, 4
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x57e17e
mov ecx, dword [esi + 0xf8]
lea eax, [ebp - 0x28]
push eax
add ecx, 0x110
call fcn.00505890
mov ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
mov dword [eax], 0x612d9c
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff8
mov eax, dword [ecx]
or edi, 0xffffffff
test eax, 0x30000000
jne 0x57e136
mov eax, edi
lock xadd dword [ecx], eax
test eax, eax
jne 0x57e136
push ecx
call fcn.00494c04
add esp, 4
mov esi, dword [ebp - 0x2c]
cmp esi, dword [ebx]
jne 0x57e146
mov dword [ebp - 0x24], 0
jmp 0x57e154
push dword [ebx]
push esi
call fcn.00411e10
add esp, 8
mov dword [ebp - 0x24], eax
mov ecx, dword [esi - 8]
add esi, 0xfffffff8
test ecx, 0x30000000
jne 0x57e173
lock xadd dword [esi], edi
test edi, edi
jne 0x57e173
push esi
call fcn.00494c04
add esp, 4
cmp dword [ebp - 0x24], 0
jne 0x57e17e
mov eax, dword [ebx + 4]
jmp 0x57e180
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494b92
mov esp, ebp
pop ebp
ret

Function at 0x582750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e55de
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x65a06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [esi + 0x34], 0
mov dword [esi + 0x38], 1
call fcn.005b66e0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, esi
mov dword [esi], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x596b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13f], 0
jne 0x596b96
call fcn.005bbec0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x18]
mov dword [esi + 0x12c], eax
mov ecx, esi
mov eax, dword [esi]
pop esi
mov eax, dword [eax + 0x88]
cmp eax, method.juce::TreeView::TreeViewport.virtual_136
je fcn.00595f90
jmp eax
pop esi
ret
Function at 0x5a2380
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e7604
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x65a06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
lea ecx, [edi + 4]
mov dword [edi], vtable.juce::ChangeBroadcaster.0
call fcn.0050a590
mov dword [edi + 4], vtable.juce::ChangeBroadcaster::ChangeBroadcasterCallback.0
mov eax, edi
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov byte [edi + 0x1c], 0
mov dword [edi + 0xc], edi
mov dword [edi + 0x24], 0xffffffff
mov dword [edi + 0x28], 0
mov dword [edi], vtable.juce::ComponentAnimator.0
mov dword [edi + 0x20], vtable.juce::ComponentAnimator.1.0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5aa6b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e830e
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x65a06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
lea ecx, [edi + 4]
mov dword [edi], vtable.juce::ChangeBroadcaster.0
call fcn.0050a590
mov eax, dword [ebp + 8]
mov dword [edi + 4], vtable.juce::ChangeBroadcaster::ChangeBroadcasterCallback.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov byte [edi + 0x1c], 0
mov dword [edi + 0xc], edi
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi], vtable.juce::DirectoryContentsList.0
mov dword [edi + 0x20], vtable.juce::DirectoryContentsList.1.0
mov dword [edi + 0x30], 0x612d9c
mov dword [edi + 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x38], eax
lea eax, [edi + 0x40]
push eax
mov dword [edi + 0x3c], 6
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [edi + 0x58], 0
mov eax, edi
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov word [edi + 0x68], 0x101
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x5ac470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
or ebx, 0xffffffff
push edi
mov dword [esi], vtable.juce::DrawableShape.0
mov ecx, dword [esi + 0x114]
test ecx, ecx
je 0x5ac49e
lea eax, [ecx + 4]
mov edx, ebx
lock xadd dword [eax], edx
lea eax, [edx - 1]
test eax, eax
jne 0x5ac49e
mov eax, dword [ecx]
push 1
call dword [eax]
mov edi, dword [esi + 0x110]
test edi, edi
je 0x5ac4c2
push dword [edi + 0x14]
mov dword [edi + 0x1c], 0
call fcn.004af8b3
push 0x20
push edi
call fcn.00494ba3
add esp, 0xc
mov ecx, dword [esi + 0xf0]
test ecx, ecx
je 0x5ac4e0
lea eax, [ecx + 4]
lock xadd dword [eax], ebx
lea eax, [ebx - 1]
test eax, eax
jne 0x5ac4e0
mov eax, dword [ecx]
push 1
call dword [eax]
mov edi, dword [esi + 0xec]
test edi, edi
je 0x5ac504
push dword [edi + 0x14]
mov dword [edi + 0x1c], 0
call fcn.004af8b3
push 0x20
push edi
call fcn.00494ba3
add esp, 0xc
push dword [esi + 0xc8]
mov dword [esi + 0xd0], 0
call fcn.004af8b3
push dword [esi + 0xa8]
mov dword [esi + 0xb0], 0
call fcn.004af8b3
push dword [esi + 0x9c]
mov dword [esi + 0xa4], 0
call fcn.004af8b3
mov dword [esi], vtable.juce::Drawable.0
add esp, 0xc
mov ecx, dword [esi + 0x8c]
test ecx, ecx
je 0x5ac55c
mov eax, dword [ecx]
push 1
call dword [eax]
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.005c4410