joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5230f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f3768
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [0x67d59c], esi
lea eax, [esp + 0xf]
push eax
lea ecx, [esp + 0x13]
xor edi, edi
push ecx
lea ecx, [esi + 0x6c]
mov dword [esp + 0x24], edi
mov dword [esi], vtable.CSoundManager.0
call fcn.00526b80
fldz
fst dword [esi + 0xc]
mov dword [esi + 4], edi
fst dword [esi + 0x10]
mov dword [esi + 8], edi
fst dword [esi + 0x14]
mov eax, esi
fld dword [0x611560]
fstp dword [esi + 0x18]
fld dword [0x5fe2a0]
fstp dword [esi + 0x1c]
fld1
fst dword [esi + 0x20]
fstp dword [esi + 0x24]
fst dword [esi + 0x28]
fst dword [esi + 0x2c]
mov dword [esi + 0x30], edi
fst dword [esi + 0x38]
mov dword [esi + 0x44], edi
fst dword [esi + 0x40]
mov dword [esi + 0x34], edi
mov dword [esi + 0x48], edi
fst dword [esi + 0x4c]
fst dword [esi + 0x54]
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
fst dword [esi + 0x60]
fstp dword [esi + 0x68]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret

Function at 0x525680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f394b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0xa0
call fcn.005a01ed
add esp, 4
mov dword [esp + 8], eax
xor esi, esi
mov dword [esp + 0x24], esi
cmp eax, esi
je 0x5256c8
mov ecx, eax
call fcn.005234e0
mov esi, eax
mov eax, dword [esp + 0x30]
push eax
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.00523260
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0xc], ecx
push eax
mov ecx, 0x6bfa4c
mov dword [esp + 0x14], esi
call fcn.004f1e30
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8
Function at 0x533b70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f3d96
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.UI::CWindow.0
xor ebx, ebx
mov dword [esi + 0x1c], 0xf
mov dword [esi + 0x18], ebx
mov byte [esi + 8], bl
mov eax, dword [esp + 0x20]
lea ecx, [esi + 0x68]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x59], bl
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], ebx
call fcn.00538610
lea ecx, [esi + 0x88]
mov byte [esp + 0x18], 1
mov dword [esi + 0x84], ebx
call fcn.00538610
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x54], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x541b30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f4753
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.004efd90
fldz
xor ebx, ebx
fstp dword [esi + 4]
lea ecx, [esi + 0xc]
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.CGrannyLODController.0
mov dword [esi + 8], 0x78
call fcn.0044a600
push 4
mov byte [esp + 0x20], 1
mov dword [esi + 0x24], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 0x2c], ebx
lea edi, [esi + 0x30]
call fcn.005a01ed
add esp, 4
cmp eax, ebx
je 0x541ba2
mov dword [eax], edi
jmp 0x541ba4
xor eax, eax
mov dword [edi], eax
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [esi + 0x50], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x542350
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5f47ce
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CGrannyLODController.0
mov eax, dword [esi + 0x50]
push eax
mov dword [esp + 0x1c], 2
call fcn.00541860
add esp, 4
mov ecx, esi
call fcn.00542170
lea edi, [esi + 0x30]
mov ecx, edi
call fcn.00540d10
mov edi, dword [edi]
push edi
call fcn.0059fc2a
add esp, 4
lea ecx, [esi + 0xc]
call fcn.00541a50
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.004efda0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x54adb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f4eb8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
push eax
call fcn.004fdac0
xor ebx, ebx
lea ecx, [esi + 0x38]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.CEffectMesh.0
call fcn.0044a600
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x50], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x54ebd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f5348
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0044a600
mov ecx, dword [esp + 0x30]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x34], 0
call fcn.00524380
add esp, 0xc
test al, al
je 0x54ec4e
add esi, 0x4c
lea edx, [esp + 8]
push esi
push edx
call fcn.00524940
add esp, 8
lea ecx, [esp + 8]
call fcn.00541a50
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4
lea ecx, [esp + 8]
call fcn.00541a50
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4
Function at 0x551100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f550e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0055ad20
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CParticleSystemInstance.0
call fcn.0044a600
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 1
call fcn.0044a600
mov ecx, esi
mov byte [esp + 0x14], 2
call fcn.0055acd0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x55e6f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0x10
jb 0x55e6ff
mov edx, dword [eax + 4]
jmp 0x55e702
lea edx, [eax + 4]
push esi
mov esi, dword [eax + 0x14]
add esi, edx
xor eax, eax
cmp edx, esi
jae 0x55e721
push edi
nop
movzx edi, byte [edx]
imul eax, eax, 0x1000193
inc edx
xor eax, edi
cmp edx, esi
jb 0x55e710
pop edi
xor edx, edx
div dword [ecx + 4]
pop esi
mov eax, edx
ret 4
Function at 0x55f0e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x5f5e40
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x676890]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov edx, dword [esp + 0x84]
mov eax, dword [edx]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], edx
mov ebp, 4
jle 0x55f2bb
mov dword [esp + 0x18], eax
jmp 0x55f148
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov eax, dword [edx + ebp]
add ebp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
cmp dword [ecx + 0x3c74], ebx
je 0x55f182
mov eax, dword [ecx + 0x3c7c]
mov dword [esp + 0x20], eax
cmp eax, ebx
je 0x55f178
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
lea eax, [esp + 0x20]
jmp 0x55f18e
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x20]
jmp 0x55f18e
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
lea eax, [esp + 0x30]
mov esi, dword [eax + 4]
mov edi, dword [eax]
cmp esi, ebx
je 0x55f2b0
jmp 0x55f1a0
push 0xffffffffffffffff
lea eax, [esi + 4]
push ebx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
call fcn.004046b0
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x84], ebx
call fcn.0048ffd0
add esp, 8
cmp dword [esp + 0x50], 0x10
mov byte [esp + 0x7c], 2
jb 0x55f1f2
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0059fc2a
add esp, 4
cmp dword [esp + 0x6c], 0x10
mov eax, dword [esp + 0x58]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
jae 0x55f211
lea eax, [esp + 0x58]
mov edx, dword [esp + 0x68]
add edx, eax
xor ecx, ecx
cmp eax, edx
jae 0x55f234
lea ecx, [ecx]
movzx ebp, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebp
cmp eax, edx
jb 0x55f220
mov ebp, dword [esp + 0x2c]
cmp dword [esp + 0x1c], ecx
je 0x55f27c
cmp dword [esp + 0x6c], 0x10
mov dword [esp + 0x7c], 0xffffffff
jb 0x55f256
mov eax, dword [esp + 0x58]
push eax
call fcn.0059fc2a
add esp, 4
mov eax, dword [esi]
cmp eax, ebx
jne 0x55f26a
lea esp, [esp]
mov eax, dword [edi + 4]
add edi, 4
cmp eax, ebx
je 0x55f260
mov esi, edi
sub esi, eax
neg esi
sbb esi, esi
and esi, eax
jne 0x55f1a0
jmp 0x55f2b0
mov ecx, dword [esi + 0x20]
call fcn.005601a0
mov ecx, dword [esp + 0x14]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.00566bd0
add ebp, eax
cmp dword [esp + 0x6c], 0x10
mov dword [esp + 0x7c], 0xffffffff
jb 0x55f2b0
mov edx, dword [esp + 0x58]
push edx
call fcn.0059fc2a
add esp, 4
sub dword [esp + 0x18], 1
jne 0x55f140
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.005a09eb
add esp, 0x6c
ret 4
Function at 0x55f6a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [ebx + 4]
add ecx, 4
cmp dword [ecx + 0x18], 0x10
push edi
jb 0x55f6ba
mov eax, dword [ecx + 4]
jmp 0x55f6bd
lea eax, [ecx + 4]
mov ecx, dword [ecx + 0x14]
add ecx, eax
xor edi, edi
cmp eax, ecx
jae 0x55f6e0
jmp 0x55f6d0
movzx edx, byte [eax]
imul edi, edi, 0x1000193
inc eax
xor edi, edx
cmp eax, ecx
jb 0x55f6d0
cmp dword [esi], 0
je 0x55f6f3
mov eax, dword [esp + 0x18]
push eax
mov ecx, esi
call fcn.0055f650
jmp 0x55f723
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.00561350
cmp dword [esi + 4], eax
lea ecx, [esi + 4]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
jb 0x55f711
mov eax, ecx
mov edx, dword [eax]
mov dword [ecx], edx
mov ecx, esi
call fcn.00561130
mov ecx, esi
call fcn.005654b0
mov eax, edi
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi]
pop edi
lea ecx, [eax + edx*4]
mov edx, dword [ebx + 4]
mov dword [ebx + 4], 0
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [esp + 0xc]
mov dword [ecx], edx
inc dword [esi + 0x10]
mov dword [esi + 0x18], ecx
pop esi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret 0xc

Function at 0x55f760
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x5f5ea8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x34]
cmp dword [ebx + 0x18], 0x10
jb 0x55f798
mov eax, dword [ebx + 4]
jmp 0x55f79b
lea eax, [ebx + 4]
mov ecx, dword [ebx + 0x14]
add ecx, eax
xor ebp, ebp
cmp eax, ecx
jae 0x55f7b6
movzx edx, byte [eax]
imul ebp, ebp, 0x1000193
inc eax
xor ebp, edx
cmp eax, ecx
jb 0x55f7a6
xor edx, edx
mov eax, ebp
div dword [esi + 4]
mov eax, dword [esi]
push ebx
mov ecx, esi
lea edi, [eax + edx*4]
push edi
call fcn.0055e830
mov ecx, eax
xor eax, eax
cmp ecx, eax
je 0x55f7e0
mov eax, dword [esp + 0x30]
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
jmp 0x55f853
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], eax
call fcn.0055e960
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x18]
push ecx
lea edx, [ebx + 4]
push edx
push 0
call fcn.0055e9d0
mov eax, dword [esi + 0x10]
add esp, 0xc
inc eax
push eax
mov ecx, esi
mov byte [esp + 0x21], 1
call fcn.0055f650
test al, al
je 0x55f837
mov eax, ebp
xor edx, edx
div dword [esi + 4]
mov ecx, dword [esi]
lea edi, [ecx + edx*4]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], ebx
inc dword [esi + 0x10]
cmp edi, dword [esi + 0x18]
jae 0x55f848
mov dword [esi + 0x18], edi
mov eax, dword [esp + 0x30]
mov dword [eax + 4], ebx
mov byte [eax + 8], 1
mov dword [eax], edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x5600e0
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x255]
push 0x60841c
push esi
call fcn.005a1a50
add esp, 8
test eax, eax
je 0x56010a
push eax
call fcn.005a17f4
add esp, 4
pop edi
mov al, 1
pop esi
ret
cmp byte [edi + 0x364], 0
je 0x560118
pop edi
xor al, al
pop esi
ret
push 0x609874
push esi
call fcn.005a1a50
mov esi, eax
add esp, 8
test esi, esi
je 0x560113
push esi
push 1
push 4
push str.EPKD
call fcn.005a36e0
push esi
push 1
push 4
push 0x61751c
call fcn.005a36e0
push esi
push 1
push 4
add edi, 0x150
push edi
call fcn.005a36e0
push esi
call fcn.005a17f4
add esp, 0x34
pop edi
mov al, 1
pop esi
ret
Function at 0x565800
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5f66c0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x676890]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov eax, dword [esp + 0x74]
mov edi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x80]
mov esi, ecx
mov ecx, dword [esp + 0x78]
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
call fcn.004046b0
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x70], ebx
call fcn.0051db40
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.005657d0
add esp, 0xc
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x6c], 1
jae 0x56589e
lea eax, [esp + 0x2c]
mov edx, dword [esp + 0x3c]
add edx, eax
xor ecx, ecx
cmp eax, edx
jae 0x5658c2
lea ebx, [ebx]
movzx ebx, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebx
cmp eax, edx
jb 0x5658b0
xor ebx, ebx
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.00565590
mov esi, dword [eax + 4]
mov edx, dword [eax]
mov dword [esp + 0x18], edx
cmp esi, ebx
jne 0x565926
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x5658fc
mov eax, dword [esp + 0x2c]
push eax
call fcn.0059fc2a
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp dword [esp + 0x5c], esi
jb 0x56591f
mov ecx, dword [esp + 0x48]
push ecx
call fcn.0059fc2a
add esp, 4
xor al, al
jmp 0x5659e7
cmp dword [esp + 0x5c], 0x10
mov eax, dword [esp + 0x48]
jae 0x565935
lea eax, [esp + 0x48]
mov edx, dword [esp + 0x58]
push edx
push eax
call fcn.0051e1a0
mov ecx, eax
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [esi + 8]
mov dword [edi], edx
mov eax, dword [esi + 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi + 0x10]
mov dword [edi + 8], edx
mov eax, dword [esi + 0x14]
mov dword [edi + 0xc], eax
mov edx, dword [esi + 0x18]
mov dword [ebp], edx
mov eax, dword [esi + 0x1c]
mov dword [ebp + 4], eax
mov edx, dword [esi + 0x20]
mov dword [ebp + 8], edx
mov eax, dword [esi + 0x24]
add esp, 8
mov dword [ebp + 0xc], eax
xor eax, eax
lea esp, [esp]
xor dword [edi + eax*4], ecx
inc eax
cmp eax, 4
jb 0x565990
xor eax, eax
jmp 0x5659a0
xor dword [ebp + eax*4], ecx
inc eax
cmp eax, 4
jb 0x5659a0
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x5659c2
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0059fc2a
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp dword [esp + 0x5c], esi
jb 0x5659e5
mov edx, dword [esp + 0x48]
push edx
call fcn.0059fc2a
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.005a09eb
add esp, 0x5c
ret 0x10
Function at 0x565a10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x5f66f8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x676890]
xor eax, esp
mov dword [esp + 0x30], eax
push ebp
push esi
push edi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
mov esi, ecx
mov ecx, dword [esp + 0x5c]
push 0xffffffffffffffff
push 0
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
call fcn.004046b0
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x50], 0
call fcn.0051db40
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x2c]
add esp, 4
cmp edi, 0x10
jae 0x565aa0
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x38]
lea edx, [ecx + eax]
xor ecx, ecx
cmp eax, edx
jae 0x565ac4
lea ecx, [ecx]
movzx ebp, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebp
cmp eax, edx
jb 0x565ab0
mov ebp, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
mov dword [esp + 0x14], ecx
push eax
lea ecx, [esi + 0x20]
call fcn.00565590
mov esi, dword [eax + 4]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
test esi, esi
je 0x565afe
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0x30]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
test eax, eax
jg 0x565b14
mov dword [ebp], 0
cmp edi, 0x10
jb 0x565b10
mov edx, dword [esp + 0x28]
push edx
call fcn.0059fc2a
add esp, 4
xor al, al
jmp 0x565b3f
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0x30]
jne 0x565b25
call fcn.005a01dd
mov edi, dword [esp + 0x3c]
mov ecx, dword [esi + 0x30]
mov dword [ebp], ecx
cmp edi, 0x10
jb 0x565b3d
mov edx, dword [esp + 0x28]
push edx
call fcn.0059fc2a
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005a09eb
add esp, 0x40
ret 0xc
Function at 0x56c2e5
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax], 0x20000000
mov dword [ebp - 4], edi
jne 0x56c42c
push ebx
push esi
push 4
pop esi
add eax, esi
mov ecx, dword [eax]
cmp ecx, 0x40020000
jne 0x56c38b
add eax, esi
mov ecx, dword [eax]
xor edx, edx
cmp ecx, 0x40000001
je 0x56c335
cmp ecx, 0x40010001
je 0x56c335
cmp ecx, 0x40020001
je 0x56c335
cmp ecx, 0x40030001
jne 0x56c340
shr ecx, 0x10
and ecx, 0xf
inc ecx
mov edx, ecx
add eax, esi
cmp dword [eax], 0x40050002
jne 0x56c352
inc edx
mov dword [ebp - 4], 0x1000
add eax, esi
mov ecx, edx
sub ecx, edi
je 0x56c385
dec ecx
je 0x56c37f
dec ecx
je 0x56c379
dec ecx
je 0x56c373
dec ecx
je 0x56c36d
dec ecx
jne 0x56c398
or dword [ebp - 4], 0xe
jmp 0x56c398
or dword [ebp - 4], 0xc
jmp 0x56c398
or dword [ebp - 4], 0xa
jmp 0x56c398
or dword [ebp - 4], 8
jmp 0x56c398
or dword [ebp - 4], 6
jmp 0x56c398
or dword [ebp - 4], 2
jmp 0x56c398
cmp ecx, 0x40030000
jne 0x56c398
mov dword [ebp - 4], esi
add eax, esi
cmp dword [eax], 0x40020003
push 0x10
pop ecx
jne 0x56c3a8
or dword [ebp - 4], ecx
add eax, esi
cmp dword [eax], 0x40000004
jne 0x56c3b6
or dword [ebp - 4], 0x20
add eax, esi
cmp dword [eax], 0x40040005
jne 0x56c3c4
or dword [ebp - 4], 0x40
add eax, esi
cmp dword [eax], 0x40040006
jne 0x56c3d2
or byte [ebp - 4], 0x80
add eax, esi
push 7
pop esi
mov edx, dword [eax]
mov ebx, esi
or ebx, 0x40000000
cmp ebx, edx
jne 0x56c3e7
push 3
jmp 0x56c412
mov ebx, esi
or ebx, 0x40010000
cmp ebx, edx
je 0x56c418
mov ebx, esi
or ebx, 0x40020000
cmp ebx, edx
jne 0x56c404
xor edx, edx
inc edx
jmp 0x56c413
mov ebx, esi
or ebx, 0x40030000
cmp ebx, edx
jne 0x56c424
push 2
pop edx
shl edx, cl
or dword [ebp - 4], edx
add eax, 4
inc edi
inc ecx
inc ecx
inc esi
cmp ecx, 0x20
jb 0x56c3d5
shl edi, 8
or dword [ebp - 4], edi
pop esi
pop ebx
cmp dword [eax], 0xffffffff
pop edi
je 0x56c439
mov eax, 0x8876086c
jmp 0x56c443
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
leave
ret 8

Function at 0x576b2a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x618cc8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x576b82
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x576b82
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x576b82
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x576bab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x618cc8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x576c19
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x576c10
cmp dword [ebp - 0xc], 4
jne 0x576c10
cmp dword [ebp - 0x10], edi
je 0x576c10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x672774], edi
xor eax, eax
jmp 0x576c41
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x672774], edi
jge 0x576c3c
mov dword [0x672774], edi
call fcn.00576b86
test eax, eax
je 0x576c3c
emms
mov dword [0x672774], 1
mov eax, dword [0x672774]
pop edi
leave
ret

Function at 0x576d21
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x576d58
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x576d7a
cmp dword [ebp - 0x20], 4
ja 0x576d84
jne 0x576d74
cmp dword [ebp - 0x1c], 0xa
jb 0x576d74
cmp word [ebp - 0x18], 0x55d
jae 0x576d84
mov byte [ebp + 0x73], 1
jmp 0x576d84
cmp dword [ebp - 0x14], 2
jne 0x576d9a
test bl, bl
je 0x576db5
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x576da5
dec eax
je 0x576d9e
sub eax, 3
jne 0x576d9a
cmp byte [ebp + 0x73], 0
je 0x576dc6
xor eax, eax
jmp 0x576dce
call fcn.00576c44
jmp 0x576dce
cmp byte [ebp + 0x73], 0
jne 0x576d9a
call fcn.00576c7c
and eax, 4
jmp 0x576dce
cmp dword [ebp + 0x7c], 0xa
je 0x576dc6
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x576dce
call fcn.00576c7c
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret