joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485f30
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x20]
mov eax, dword [ecx]
xor edi, edi
push edi
push edx
call dword [eax + 8]
mov ecx, dword [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 0x28]
mov ecx, dword [eax + 0x28]
cmp dword [ecx + 4], edi
jle 0x485f5d
mov eax, dword [eax + 4]
jmp 0x485f5f
xor eax, eax
mov dword [esi + 0x34], eax
mov edx, dword [esi + 0x28]
lea ebx, [esi + 0x34]
mov dword [edx + 4], edi
mov eax, dword [esi + 0x28]
mov ecx, dword [eax + 0x28]
cmp dword [ecx + 4], 1
jle 0x485f7c
mov eax, dword [eax + 8]
jmp 0x485f7e
xor eax, eax
mov dword [esi + 0x38], eax
mov edx, dword [esi + 0x28]
mov dword [edx + 8], edi
mov eax, dword [esi + 0x28]
mov ecx, dword [eax + 0x28]
cmp dword [ecx + 4], 2
jle 0x485f98
mov eax, dword [eax + 0xc]
jmp 0x485f9a
xor eax, eax
mov dword [esi + 0x3c], eax
mov edx, dword [esi + 0x28]
mov dword [edx + 0xc], edi
mov eax, dword [esi + 0x28]
mov ecx, dword [eax + 0x28]
cmp dword [ecx + 4], 3
jle 0x485fb4
mov eax, dword [eax + 0x10]
jmp 0x485fb6
xor eax, eax
mov dword [esi + 0x40], eax
mov edx, dword [esi + 0x28]
mov dword [edx + 0x10], edi
mov eax, dword [esi + 0x28]
mov ecx, dword [eax + 0x28]
cmp dword [ecx + 4], 4
jle 0x485fd0
mov eax, dword [eax + 0x14]
jmp 0x485fd2
xor eax, eax
mov dword [esi + 0x44], eax
mov edx, dword [esi + 0x28]
mov dword [edx + 0x14], edi
mov eax, dword [esi + 0x28]
mov ecx, dword [eax + 0x28]
cmp dword [ecx + 4], 5
jle 0x485fec
mov eax, dword [eax + 0x18]
jmp 0x485fee
xor eax, eax
mov dword [esi + 0x48], eax
mov edx, dword [esi + 0x28]
mov dword [edx + 0x18], edi
mov eax, dword [esi + 0x28]
mov ecx, dword [eax + 0x28]
cmp dword [ecx + 4], 6
jle 0x486008
mov eax, dword [eax + 0x1c]
jmp 0x48600a
xor eax, eax
mov dword [esi + 0x4c], eax
mov edx, dword [esi + 0x28]
mov dword [edx + 0x1c], edi
mov eax, dword [esi + 0x28]
mov ecx, dword [eax + 0x28]
cmp dword [ecx + 4], 7
jle 0x486024
mov eax, dword [eax + 0x20]
jmp 0x486026
xor eax, eax
mov dword [esi + 0x50], eax
mov edx, dword [esi + 0x28]
mov dword [edx + 0x20], edi
mov eax, dword [esi + 0x28]
mov ecx, dword [eax + 0x28]
cmp dword [ecx + 4], 8
jle 0x486040
mov eax, dword [eax + 0x24]
jmp 0x486042
xor eax, eax
mov dword [esi + 0x54], eax
mov edx, dword [esi + 0x28]
mov dword [edx + 0x24], edi
mov eax, 0xa8
mov ecx, dword [0x82b884]
mov ecx, dword [eax + ecx]
cmp ecx, edi
je 0x486066
mov edx, dword [ecx + 0x18]
mov dword [esi + eax - 0x74], edx
jmp 0x48606a
mov dword [esi + eax - 0x74], edi
add eax, 4
cmp eax, 0xcc
jl 0x486050
xor ebp, ebp
jmp 0x486080
xor edi, edi
lea ebx, [ebx]
mov eax, dword [ebx]
test eax, eax
jle 0x486098
mov ecx, dword [esi + 0x28]
push edi
push eax
push ebp
call fcn.00483750
mov eax, dword [ebx]
inc edi
cmp edi, eax
jl 0x486086
inc ebp
add ebx, 4
cmp ebp, 9
jl 0x486078
mov esi, dword [esi + 0x28]
mov ecx, esi
call fcn.00483890
mov ecx, esi
call fcn.00485e20
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4a9ac0
Capabilities:
Create directory
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x240
push esi
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x801c
push 0
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea ecx, [esp + 8]
push ecx
call esi
push 0x790964
lea edx, [esp + 8]
push edx
lea eax, [esp + 0xc]
push eax
call fcn.0043de10
mov ecx, dword [str.NFS_Underground_2]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0043de10
add esp, 0x18
push 0
lea ecx, [esp + 8]
push ecx
call esi
mov eax, dword [0x836498]
mov ecx, dword [eax + 0x5c]
lea edx, [esp + 4]
push edx
call fcn.006fbd68
push 0x790960
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.0043de10
add esp, 0xc
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4a9bb4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push edi
lea edx, [esp + 0x10c]
push edx
push esi
mov edi, 1
call ebx
test eax, eax
je 0x4a9ba1
lea eax, [esp + 0x10c]
push eax
push esi
inc edi
call ebx
test eax, eax
jne 0x4a9b81
cmp edi, 2
jbe 0x4a9ba1
mov ecx, dword [esp + 0x254]
mov byte [ecx + 4], 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebx
pop esi
add esp, 0x240
ret 8
mov edx, dword [esp + 0x24c]
mov byte [edx + 4], 0
pop esi
add esp, 0x240
ret 8

Function at 0x4ae670
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x7728eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push fcn.004022d0
push 0x495190
xor ebx, ebx
push 6
push 0x14
lea eax, [esi + 0x30]
push eax
mov dword [esp + 0x1c], esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.0075c18d
push fcn.004022d0
push 0x495190
push 6
push 0x14
lea ecx, [esi + 0xc8]
push ecx
mov dword [esp + 0x28], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
call fcn.0075c18d
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x140], ebx
mov byte [esi], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4f5e70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x776648
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], esi
mov dword [esi + 4], esi
mov dword [esi + 8], eax
mov dword [esi + 0x10], 0x80
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
push str.SplitTimeText
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x34], ebx
call fcn.00504ff0
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.005376a0
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x4f5ef4
call fcn.00440f10
cmp eax, ebx
je 0x4f5ee5
mov dword [eax + 8], edi
jmp 0x4f5ee7
xor eax, eax
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov dword [esi + 4], eax
mov dword [eax + 4], ecx
mov dword [eax], esi
push str.SplitTimeLapTime
mov dword [esi + 0x20], edi
call fcn.00504ff0
mov edx, dword [esi + 8]
push eax
push edx
call fcn.005376a0
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x4f5f31
call fcn.00440f10
cmp eax, ebx
je 0x4f5f22
mov dword [eax + 8], edi
jmp 0x4f5f24
xor eax, eax
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov dword [esi + 4], eax
mov dword [eax + 4], ecx
mov dword [eax], esi
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x24], edi
mov byte [esi + 0x28], bl
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
pop edi
mov dword [esi + 0x3c], 0xff962020
mov dword [esi + 0x40], 0xff00ff00
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4f98eb
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x773ecd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.00551a50
lea eax, [esi + 0x4c]
xor ebx, ebx
mov dword [esi], 0x795d00
mov dword [esp + 0x14], ebx
mov dword [eax], eax
mov dword [eax + 4], eax
push ebx
push ebx
mov eax, 1
push ebx
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 4]
push str.Scroll_Bar
push eax
lea ecx, [esi + 0x60]
mov byte [esp + 0x28], 1
call fcn.00542750
mov dword [esi + 0xb8], ebx
lea ecx, [esi + 0xc8]
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
call fcn.004ff080
lea ecx, [esi + 0x10c]
mov byte [esp + 0x14], 2
call fcn.004ff080
lea ecx, [esi + 0x150]
mov byte [esp + 0x14], 3
call fcn.004ff080
mov ecx, 0x8637d0
mov byte [esp + 0x14], 4
mov dword [esi + 0x1a8], 0x9120409e
mov byte [esi + 0x1ac], 1
mov byte [esi + 0x194], 1
mov dword [esi + 0xb8], ebx
call fcn.00557b80
mov ecx, esi
call fcn.004961b0
mov ecx, esi
call fcn.004ee0d0
push str.GarageMain.fng
mov byte [esi + 8], 1
call fcn.0052cc10
add esp, 4
test al, al
jne 0x4f99d4
push ebx
push ebx
push ebx
push str.GarageMain.fng
push ebx
call fcn.00555c10
add esp, 0x14
mov ecx, dword [esi + 0x54]
push ebx
mov dword [esi + 0x30], 0xc
mov byte [esi + 0x2c], bl
call fcn.00511a90
push eax
mov ecx, 0x8637d0
call fcn.0055ae10
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x510130
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x776d3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi], 0x79aa8c
mov byte [esi + 4], 1
mov dword [esp + 8], esi
mov dword [esi + 8], 0x78f544
mov dword [esi + 0x10], 0x783fe5
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], 0x42380000
mov byte [esi + 0xc], bl
push 0xff
push 0x8a
push 0xf4
push 0xca
mov dword [esp + 0x24], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
call fcn.004a9c50
push 0xff
push ebx
push 0xff
push 0x80
mov dword [esi + 0xd0], eax
call fcn.004a9c50
push 0xff
push 0x30
push 0x80
push 0xcf
mov dword [esi + 0xd4], eax
call fcn.004a9c50
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xd8], eax
add esp, 0x30
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x510149
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x776d3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi], 0x79aa8c
mov byte [esi + 4], 1
mov dword [esp + 8], esi
mov dword [esi + 8], 0x78f544
mov dword [esi + 0x10], 0x783fe5
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], 0x42380000
mov byte [esi + 0xc], bl
push 0xff
push 0x8a
push 0xf4
push 0xca
mov dword [esp + 0x24], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
call fcn.004a9c50
push 0xff
push ebx
push 0xff
push 0x80
mov dword [esi + 0xd0], eax
call fcn.004a9c50
push 0xff
push 0x30
push 0x80
push 0xcf
mov dword [esi + 0xd4], eax
call fcn.004a9c50
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xd8], eax
add esp, 0x30
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x515490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [ebp], 0
lea eax, [ebp + 0x12]
mov ecx, 0xd
mov edx, 3
lea ecx, [ecx]
mov byte [eax - 2], 1
mov byte [eax - 1], dl
mov byte [eax], 1
mov byte [eax + 1], 1
mov byte [eax + 2], 1
mov byte [eax + 3], 1
mov byte [eax + 4], 0
add eax, 0x14
dec ecx
jne 0x5154b0
mov eax, 1
mov word [ebp + 0x2e], ax
mov word [ebp + 0x42], ax
mov byte [ebp + 0x75], al
xor eax, eax
mov word [ebp + 0x18], 0xfb5
mov word [ebp + 0x56], dx
mov byte [ebp + 0x50], 2
mov word [ebp + 0xce], 0
mov byte [ebp + 0xc5], 0
mov byte [ebp + 0x76], 0
mov byte [ebp + 0xda], 0
mov word [ebp + 0xe0], 0x11f9
mov byte [ebp + 0xdc], 0
mov word [ebp + 0xe2], 0xa
mov byte [ebp + 0x61], 5
mov dword [ebp + 0x108], 2
mov dword [ebp + 0x10c], 0
mov dword [esp + 0x10], eax
test eax, eax
jl 0x515559
cmp eax, 2
jge 0x515559
mov esi, eax
imul esi, esi, 0xab4c
add esi, 0x83ad90
jmp 0x51555b
xor esi, esi
mov ecx, dword [0x7faa48]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x540]
xor edi, edi
test ecx, ecx
jle 0x515592
mov ebx, esi
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 4]
cmp eax, dword [esp + 0x14]
je 0x5155f4
mov eax, dword [esi + 0x540]
inc edi
add ebx, 0x1c
cmp edi, eax
jl 0x515573
mov eax, dword [esp + 0x10]
xor esi, esi
cmp eax, 1
jne 0x51560e
mov ecx, dword [0x845e1c]
mov ebx, dword [0x7faa4c]
xor esi, esi
test ecx, ecx
jle 0x5155cc
mov edi, 0x8458dc
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
cmp eax, ebx
je 0x515601
mov eax, dword [0x845e1c]
inc esi
add edi, 0x1c
cmp esi, eax
jl 0x5155b0
mov eax, dword [esp + 0x10]
mov dword [ebp + eax*4 + 4], 0
inc eax
cmp eax, 2
mov dword [esp + 0x10], eax
jl 0x515540
pop edi
pop esi
lea ecx, [ebp + 0x100]
pop ebp
pop ebx
add esp, 8
jmp fcn.005153e0
mov eax, dword [esp + 0x10]
imul edi, edi, 0x1c
add edi, esi
mov esi, edi
jmp 0x515594
mov eax, dword [esp + 0x10]
imul esi, esi, 0x1c
add esi, 0x8458dc
test esi, esi
je 0x5155cc
mov ecx, dword [esi + 8]
mov dword [ebp + eax*4 + 4], ecx
jmp 0x5155d4
Function at 0x51ff50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x776ecc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esi], 0x790b98
mov ecx, dword [eax]
mov dword [esi + 0xc], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x24]
mov dword [esi + 0x10], edx
mov ecx, dword [eax]
mov dword [esi + 0x14], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x30]
mov cl, byte [esp + 0x34]
mov dword [esi + 0x18], edx
mov dl, byte [esp + 0x38]
mov dword [esi + 0x1c], 0xc38a0000
mov dword [esi + 0x20], 0xc1200000
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], cl
mov byte [esi + 0x29], dl
mov edi, dword [esp + 0x2c]
lea eax, [edi + edi*2]
shl eax, 4
add eax, 4
xor ebx, ebx
push eax
mov dword [esp + 0x20], ebx
mov dword [esi], 0x79b4f8
mov dword [esi + 0x34], 0x3f800000
mov dword [esi + 0x2c], edi
call fcn.005752a0
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov byte [esp + 0x1c], 1
je 0x52000a
push 0x50d980
push 0x50d960
push edi
lea ebp, [eax + 4]
push 0x30
push ebp
mov dword [eax], edi
call fcn.0075c18d
jmp 0x52000c
xor ebp, ebp
mov eax, dword [esi + 0x2c]
xor edi, edi
cmp eax, ebx
mov byte [esp + 0x1c], bl
mov dword [esi + 0x30], ebp
jle 0x520036
mov ebp, dword [esp + 0x30]
mov ecx, dword [esi + 0x30]
push ebp
add ecx, ebx
call fcn.0050d9a0
mov eax, dword [esi + 0x2c]
inc edi
add ebx, 0x30
cmp edi, eax
jl 0x520020
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c

Function at 0x5223b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x776fe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dl, 1
mov dword [esi + 0x30], eax
mov eax, 0x3f800000
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], ecx
mov byte [esi + 0x20], cl
mov byte [esi + 0x21], dl
mov byte [esi + 0x22], cl
mov byte [esi + 0x23], cl
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov byte [esi + 0x44], dl
mov byte [esi + 0x45], cl
mov dword [esi], 0x79b768
cmp dword [0x839c40], ecx
mov dword [ebp - 4], ecx
je 0x522465
mov edx, dword [0x83a540]
cmp edx, ecx
je 0x522465
mov eax, dword [0x83a63c]
cmp eax, 0xff
je 0x522465
imul eax, eax, 0x29
add eax, 0x83a544
push eax
lea ecx, [edx + 0x14]
call fcn.0059ab50
neg al
sbb al, al
inc al
mov byte [esi + 0x45], al
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
mov byte [esi + 0x45], cl
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x52c280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x98
push esi
push edi
mov edi, dword [esp + 0xa4]
mov edx, dword [edi + 0x2c]
mov eax, dword [edx + 0xc]
test eax, eax
mov esi, ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
je 0x52c3ee
cmp byte [esi], 0
jne 0x52c2df
mov eax, dword [edi + 0x1c]
test eax, eax
js 0x52c3ee
push ebx
push ebp
lea eax, [esp + 0x28]
push eax
lea ecx, [edx + 0x28]
call fcn.00504640
fld dword [edx + 0x10]
fld dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
fxch st(1)
mov dword [esp + 0x18], ecx
fmul dword [0x7842a0]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
fstp dword [esp + 0x14]
push ecx
lea eax, [esp + 0x24]
fmul dword [0x7842a0]
push eax
fstp dword [esp + 0x20]
fld dword [esp + 0x24]
fmul dword [0x7842a0]
fstp dword [esp + 0x24]
call fcn.00504740
fld dword [esp + 0x28]
mov ecx, dword [esp + 0xbc]
fadd dword [edx + 0x1c]
push ecx
lea eax, [esp + 0x78]
fadd dword [edx + 0x10]
fstp dword [esp + 0x68]
fld dword [edx + 0x20]
fadd dword [edx + 0x14]
fadd dword [esp + 0x30]
fstp dword [esp + 0x6c]
fld dword [edx + 0x24]
fadd dword [edx + 0x18]
lea edx, [esp + 0x38]
push edx
push eax
fadd dword [esp + 0x3c]
fstp dword [esp + 0x78]
call fcn.00518430
mov ebp, dword [esp + 0xcc]
push ebp
lea ecx, [esp + 0x84]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.00518430
mov ax, word [esp + 0xdc]
add esp, 0x24
inc word [esi + 0xd8]
xor ebx, ebx
mov bx, word [esi + 0xd8]
mov word [edi + 0x20], ax
mov ecx, dword [esi + 0x10c]
mov edx, dword [ecx]
push edi
push ebx
call dword [edx + 0x28]
mov edi, dword [edi + 0x64]
test edi, edi
je 0x52c3ec
cmp dword [edi + 0x18], 5
push ebx
jne 0x52c3d8
push ebp
lea eax, [esp + 0x70]
push eax
push edi
mov ecx, esi
call fcn.0052c280
jmp 0x52c3e5
lea ecx, [esp + 0x2c]
push ecx
push edi
mov ecx, esi
call fcn.0051a600
mov edi, dword [edi + 4]
test edi, edi
jne 0x52c3c1
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x98
ret 0x10
Function at 0x52cfe0
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [esp + 4]
test cl, 0x20
mov eax, 0x9f1b2c7a
je 0x52cff6
mov eax, 0x5e0ab884
ret 4
test cl, 2
je 0x52d003
mov eax, 0x545c5292
ret 4
test cl, 1
je 0x52d010
mov eax, 0x1c101778
ret 4
test cl, 0x10
je 0x52d01d
mov eax, 0x5f52d4fd
ret 4
test cl, 8
je 0x52d02a
mov eax, 0x7eff16c2
ret 4
test cl, 0x40
je 0x52d037
mov eax, 0x9e067677
ret 4
test cl, cl
jns 0x52d043
mov eax, 0x5ee1c847
ret 4
test ch, 1
je 0x52d050
mov eax, 0xe24b4bd5
ret 4
test ecx, 0x2000000
je 0x52d060
mov eax, 0xdaac95f9
ret 4
test ecx, 0x4000000
je 0x52d070
mov eax, 0x9db54a80
ret 4
test ecx, 0x8000000
je 0x52d080
mov eax, 0xc6b7eb02
ret 4
test ecx, 0x10000000
je 0x52d090
mov eax, 0x43512519
ret 4
test ecx, 0x20000000
je 0x52d0a0
mov eax, 0x11159f62
ret 4
test ecx, 0x40000000
je 0x52d0b0
mov eax, 0x80af4fc7
ret 4
test ch, 2
je 0x52d0bd
mov eax, 0x18127bd
ret 4
test ch, 4
je 0x52d0ca
mov eax, 0x1c0787e6
ret 4
test ecx, 0x40000
je 0x52d0da
mov eax, 0xefddc126
ret 4
test ch, 8
je 0x52d0f5
mov al, byte [0x89e7e6]
neg al
sbb eax, eax
and eax, 0xf5b91808
add eax, 0xb7d0d273
ret 4
test ch, 0x10
je 0x52d102
mov eax, 0x8d5abf58
ret 4
test ch, 0x20
je 0x52d10f
mov eax, 0x4100ada8
ret 4
test ch, 0x40
je 0x52d11c
mov eax, 0xd0efbea3
ret 4
test ecx, 0x80000
je 0x52d12c
mov eax, 0xba0e1020
ret 4
test ecx, 0x100000
je 0x52d13c
mov eax, 0xeaa1d5df
ret 4
test ecx, 0x200000
je 0x52d14c
mov eax, 0x3e9431dc
ret 4
test ecx, 0x1000000
je 0x52d15c
mov eax, 0x80833fc2
ret 4
test ecx, 0x400000
je 0x52d16c
mov eax, 0xcbbcb1c5
ret 4
test ecx, 0x800000
je 0x52d18f
push str.UI_ChooseVinylLayer.fng
call fcn.0052cc10
add esp, 4
neg al
sbb eax, eax
and eax, 0x6dcbb8e6
add eax, 0x889bacb6
ret 4
Function at 0x531340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [esp + 4]
test al, al
push esi
mov esi, ecx
je 0x531375
mov eax, dword [esi + 0x78]
push 1
lea ecx, [esi + 0x4c]
push str.UnGrab
push eax
call fcn.0051f130
mov ecx, dword [esi + eax*4 + 0x110]
push ecx
call fcn.0051cc00
add esp, 0xc
mov byte [esi + 0x108], 0
mov esi, dword [esi + 0x5c]
test esi, esi
je 0x531381
lea ecx, [esi - 4]
jmp 0x531383
xor ecx, ecx
mov eax, 0x83acc0
pop esi
lea esp, [esp]
mov edx, dword [ecx + 0x18]
mov dword [eax - 8], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax - 4], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x5313a8
add ecx, 0xfffffffc
jmp 0x5313aa
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 4], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x5313c1
add ecx, 0xfffffffc
jmp 0x5313c3
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax + 8], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0xc], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x5313db
add ecx, 0xfffffffc
jmp 0x5313dd
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x10], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0x14], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x5313f5
add ecx, 0xfffffffc
jmp 0x5313f7
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x18], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0x1c], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x53140f
add ecx, 0xfffffffc
jmp 0x531411
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x20], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0x24], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x531429
add ecx, 0xfffffffc
jmp 0x53142b
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x28], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0x2c], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x531443
add ecx, 0xfffffffc
jmp 0x531445
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x30], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0x34], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x53145d
add ecx, 0xfffffffc
jmp 0x53145f
xor ecx, ecx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x38], edx
mov dl, byte [ecx + 0x1c]
mov byte [eax + 0x3c], dl
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x531477
add ecx, 0xfffffffc
jmp 0x531479
xor ecx, ecx
add eax, 0x48
cmp eax, 0x83ad98
jl 0x531390
ret 4