joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a4180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x585528
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
xor ebp, ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0x589674
mov eax, dword [esp + 0x48]
mov dword [esp + 0x30], ebp
cmp eax, 0x5b8ab877
ja 0x4a4287
je 0x4a41e6
cmp eax, 0x61a741e
je 0x4a41dc
cmp eax, 0x3b5737a6
jne 0x4a4350
mov eax, 4
jmp 0x4a4297
mov eax, 2
jmp 0x4a4297
mov eax, dword [0xab5b48]
push ebx
lea ecx, [eax + 0x7c]
call fcn.004e0fa0
mov ebx, eax
xor edi, edi
cmp ebx, ebp
mov dword [esp + 0x4c], ebx
jle 0x4a426c
mov ebp, dword [esp + 0x48]
mov ecx, dword [0xab5b48]
push edi
call fcn.004fa2b0
cmp eax, esi
je 0x4a4267
test ebp, ebp
je 0x4a422b
push ebp
push eax
mov ecx, esi
call fcn.004a3e10
test al, al
jne 0x4a4283
mov ebx, dword [esp + 0x4c]
jmp 0x4a4267
lea ecx, [esi + 0x40]
add eax, 0x40
push ecx
lea edx, [esp + 0x20]
push eax
push edx
call fcn.00404c70
fld dword [esp + 0x30]
fmul dword [esp + 0x30]
fld dword [esp + 0x2c]
fmul dword [esp + 0x2c]
add esp, 0xc
faddp st(1)
fld dword [esp + 0x1c]
fmul dword [esp + 0x1c]
faddp st(1)
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 5
jnp 0x4a4283
inc edi
cmp edi, ebx
jl 0x4a4204
xor al, al
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 0x14
mov al, 1
jmp 0x4a426e
cmp eax, 0x88c21962
jne 0x4a4350
mov eax, 3
mov ecx, dword [esi + 0xc]
push eax
mov eax, dword [ecx]
call dword [eax + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.00426790
cmp eax, ebp
je 0x4a4350
mov edi, dword [esp + 0x44]
cmp eax, esi
je 0x4a433f
cmp edi, ebp
je 0x4a42e5
push edi
push eax
mov ecx, esi
call fcn.004a3e10
test al, al
je 0x4a433f
pop edi
pop esi
mov al, 1
pop ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 0x14
fld dword [eax + 0x4c]
fsub dword [esi + 0x4c]
sub esp, 0x10
lea ecx, [esp + 0x28]
fstp dword [esp + 0xc]
fld dword [eax + 0x48]
fsub dword [esi + 0x48]
fstp dword [esp + 8]
fld dword [eax + 0x44]
fsub dword [esi + 0x44]
fstp dword [esp + 4]
fld dword [eax + 0x40]
fsub dword [esi + 0x40]
fstp dword [esp]
call fcn.0045dab0
fld dword [esp + 0x20]
fmul dword [esp + 0x20]
fld dword [esp + 0x1c]
fmul dword [esp + 0x1c]
faddp st(1)
fld dword [esp + 0x18]
fmul dword [esp + 0x18]
faddp st(1)
fcomp dword [esp + 0x40]
fnstsw ax
test ah, 5
jnp 0x4a42cf
lea ecx, [esp + 0xc]
call fcn.00426860
cmp eax, ebp
jne 0x4a42b6
mov ecx, dword [esp + 0x28]
pop edi
pop esi
xor al, al
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 0x14
Function at 0x4a9ec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x585653
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
xor ebx, ebx
push ebp
mov ebp, ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x589674
fld dword [esp + 0x2c]
fmul dword [esp + 0x2c]
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0x28]
push eax
mov dword [esp + 0x20], ebx
mov edx, dword [ecx]
fstp dword [esp + 0x30]
call dword [edx + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00426790
mov ecx, eax
cmp ecx, ebx
je 0x4a9fab
push esi
push edi
fld dword [esp + 0x34]
fcomp dword [0x589284]
fnstsw ax
test ah, 0x44
jnp 0x4a9f65
fld dword [ebp + 0x48]
fsub dword [ecx + 0x48]
fld dword [ebp + 0x44]
fsub dword [ecx + 0x44]
fld dword [ebp + 0x40]
fsub dword [ecx + 0x40]
fld st(0)
fmul st(1)
fld st(2)
fmul st(3)
faddp st(1)
fld st(3)
fmul st(4)
faddp st(1)
fld dword [esp + 0x34]
fcompp
fstp st(0)
fnstsw ax
fstp st(0)
and eax, 0x4100
fstp st(0)
jne 0x4a9f96
mov esi, dword [ecx + 0x348]
xor eax, eax
cmp esi, ebx
jle 0x4a9f89
mov ecx, dword [ecx + 0x34c]
mov edx, ecx
mov edi, dword [edx]
cmp edi, dword [esp + 0x2c]
je 0x4a9fbe
inc eax
add edx, 0x14
cmp eax, esi
jl 0x4a9f79
mov edx, dword [esp + 0x2c]
push edx
call fcn.00408960
add esp, 4
lea ecx, [esp + 0x10]
call fcn.00426860
mov ecx, eax
cmp ecx, ebx
jne 0x4a9f1d
pop edi
pop esi
mov ecx, dword [esp + 0x14]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
lea eax, [eax + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ecx + eax*4 + 0xc]
mov byte [esi + 0x10], 1
cmp ecx, ebx
mov byte [esi + 0x11], bl
je 0x4a9fda
call fcn.004159e0
jmp 0x4a9f96
cmp dword [0xb084cc], ebx
je 0x4aa01d
call fcn.00401180
mov eax, dword [eax + 0x108]
push eax
call fcn.00401180
mov ecx, eax
call fcn.00533cd0
push ebx
push 1
push 8
call fcn.00401180
mov ecx, eax
call fcn.00533b80
mov edi, eax
call fcn.00401180
mov ecx, eax
call fcn.00533d40
mov eax, edi
jmp 0x4aa046
mov ecx, dword [0x5ca258]
mov ecx, dword [ecx*4 + 0x5ca24c]
cmp ecx, ebx
je 0x4aa035
call fcn.005331c0
jmp 0x4aa046
push ebx
push 1
push 8
call fcn.00401180
mov ecx, eax
call fcn.00533b80
mov dword [esp + 0x30], eax
cmp eax, ebx
mov byte [esp + 0x24], 1
je 0x4aa066
mov ecx, eax
call fcn.00415710
mov byte [esp + 0x24], bl
mov dword [esi + 0xc], eax
jmp 0x4a9f96
xor eax, eax
mov byte [esp + 0x24], bl
mov dword [esi + 0xc], eax
jmp 0x4a9f96
Function at 0x4b35b0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov ebx, ecx
mov eax, dword [eax + 0x18]
push edi
xor edi, edi
mov cl, byte [eax + 6]
test cl, cl
je 0x4b35ca
mov edi, 0x40
mov cl, byte [eax + 7]
test cl, cl
je 0x4b35d7
or edi, 0x80
mov cl, byte [eax + 5]
test cl, cl
je 0x4b35e1
or edi, 0x20
mov cl, byte [eax + 4]
test cl, cl
je 0x4b35eb
or edi, 0x10
mov cl, byte [eax + 9]
test cl, cl
je 0x4b35f8
or edi, 0x200
mov cl, byte [eax + 0xb]
test cl, cl
je 0x4b3605
or edi, 0x800
mov cl, byte [eax + 8]
test cl, cl
je 0x4b3612
or edi, 0x100
mov cl, byte [eax + 0xa]
test cl, cl
je 0x4b361f
or edi, 0x400
mov cl, byte [eax + 0xc]
test cl, cl
je 0x4b362c
or edi, 0x1000
mov cl, byte [eax + 0xe]
test cl, cl
je 0x4b3639
or edi, 0x4000
mov cl, byte [eax + 0xd]
test cl, cl
je 0x4b3646
or edi, 0x2000
mov cl, byte [eax + 0xf]
test cl, cl
je 0x4b3653
or edi, 0x8000
xor ecx, ecx
mov ch, byte [eax]
mov cl, byte [eax + 1]
mov eax, dword [eax + 0x14]
test al, 0x40
mov esi, ecx
je 0x4b3669
or esi, 0x10000
test ah, 4
je 0x4b3674
or esi, 0x20000
mov ecx, ebx
call fcn.004b3800
test al, al
jne 0x4b3694
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x14]
test ch, 1
je 0x4b3694
or esi, 0x40000
push esi
mov ecx, ebx
call fcn.004b34f0
mov ax, di
pop edi
pop esi
pop ebx
ret 4
Function at 0x5034d0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x10c
mov al, byte [ecx + 0x30]
push ebx
mov ebx, dword [esp + 0x114]
mov dword [esp + 0xc], ecx
cmp bl, al
je 0x503669
mov eax, dword [0xab5ba8]
push ebp
inc eax
push esi
cmp eax, 0x17
push edi
mov dword [0xab5ba8], eax
jbe 0x50358a
mov eax, dword [0x59a760]
mov byte [esp + 0x13], 0x41
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
test ebx, ebx
je 0x503579
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov al, byte [esp + 0x13]
cmp al, 0x5a
jg 0x503579
test bl, 1
je 0x503569
lea ecx, [esp + 0x14]
mov byte [esp + 0x14], al
push ecx
call edi
cmp eax, 3
jne 0x503569
push 0
push 0
push 0
push 0
push 0x5b6f50
lea edx, [esp + 0x30]
push 0x100
lea eax, [esp + 0x2c]
push edx
push eax
call esi
test eax, eax
jne 0x503579
mov cl, byte [esp + 0x13]
shr ebx, 1
inc cl
test ebx, ebx
mov byte [esp + 0x13], cl
jne 0x50352a
mov ebx, dword [esp + 0x120]
mov dword [0xab5ba8], 0
mov ebp, dword [0xab5b48]
test bl, bl
je 0x5035aa
push 1
mov ecx, ebp
call fcn.004fa650
mov ecx, dword [0xb1f2b4]
call fcn.00543830
jmp 0x5035b5
mov ecx, dword [0xb1f2b4]
call fcn.00543910
push ebx
call fcn.00413520
add esp, 4
lea ecx, [ebp + 0x7c]
xor edi, edi
call fcn.00406800
test eax, eax
je 0x5035d8
mov ecx, eax
inc edi
call fcn.00406800
test eax, eax
jne 0x5035cc
xor esi, esi
test edi, edi
jbe 0x503601
push esi
mov ecx, ebp
call fcn.004fa2b0
mov ecx, eax
test ecx, ecx
je 0x5035fc
test bl, bl
je 0x5035f7
mov edx, dword [ecx]
call dword [edx + 0x28]
jmp 0x5035fc
mov eax, dword [ecx]
call dword [eax + 0x2c]
inc esi
cmp esi, edi
jb 0x5035de
mov ecx, dword [0xab4b80]
push ebx
call fcn.00474a50
mov ecx, dword [esp + 0x18]
pop edi
test bl, bl
mov byte [ecx + 0x30], bl
mov eax, dword [0xab5bbc]
pop esi
pop ebp
je 0x503643
mov edx, dword [0x5cd288]
mov dword [edx + 8], 0xc
mov byte [eax + 0xb0], 1
call fcn.0053b020
pop ebx
add esp, 0x10c
ret 4
mov ecx, dword [0x5cd288]
push 0
mov dword [ecx + 8], 0
mov byte [eax + 0xb0], 0
mov ecx, dword [0xab5b48]
call fcn.004fa650
call fcn.0053b020
pop ebx
add esp, 0x10c
ret 4
Function at 0x5056a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x586fa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0x14], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi], edi
lea ebx, [esi + 0xc]
mov dword [esp + 0x20], edi
mov ebp, ebx
mov dword [esp + 0x10], 4
mov ecx, ebp
call fcn.00402a70
mov eax, dword [esp + 0x10]
add ebp, 0x10
dec eax
mov dword [esp + 0x10], eax
jne 0x5056dd
mov eax, 0x3f800000
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], eax
lea ebp, [esi + 0x6c]
mov dword [esp + 0x10], 4
mov ecx, ebp
call fcn.00402a70
mov eax, dword [esp + 0x10]
add ebp, 0x10
dec eax
mov dword [esp + 0x10], eax
jne 0x50571a
mov ecx, dword [esi]
cmp ecx, edi
je 0x50573d
push esi
call fcn.004287f0
mov dword [esi], edi
mov eax, dword [esp + 0x28]
mov ecx, esi
mov dword [esi], eax
call fcn.0045a970
mov edi, dword [esi]
add edi, 0x554
mov ecx, dword [edi]
mov dword [ebx], ecx
mov edx, dword [edi + 4]
mov dword [ebx + 4], edx
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov ecx, dword [edi + 0xc]
lea edx, [edi + 0x10]
mov dword [ebx + 0xc], ecx
push edx
lea ecx, [ebx + 0x10]
call fcn.00499d60
lea eax, [edi + 0x20]
lea ecx, [ebx + 0x20]
push eax
call fcn.00499d60
add edi, 0x30
lea ecx, [ebx + 0x30]
push edi
call fcn.00499d60
mov eax, dword [esi]
pop edi
add eax, 0x40
mov ecx, dword [eax]
mov dword [esi + 0x4c], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x50], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x54], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x58], edx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
Function at 0x527320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5878d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 0x14]
mov dword [esi], 0x58b64c
mov dword [edi], 0x58b644
mov ecx, dword [esi + 0x30]
mov dword [esp + 0x1c], 2
test ecx, ecx
je 0x527365
mov eax, dword [ecx]
push 1
call dword [eax + 8]
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x527373
mov edx, dword [ecx]
push 1
call dword [edx + 8]
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x527381
mov eax, dword [ecx]
push 1
call dword [eax + 8]
lea eax, [esi + 0x6c]
mov dword [esp + 0x10], eax
mov dword [eax], 0x58b658
mov ecx, dword [eax + 4]
mov byte [esp + 0x1c], 3
test ecx, ecx
jne 0x5273b3
mov ecx, dword [str.Null_Pointer]
push ecx
push 0x237
push str.._sys_mem_memptr.h
call fcn.00401090
add esp, 0xc
call fcn.0051e5b0
mov ecx, edi
mov byte [esp + 0x1c], 0
call fcn.00422460
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
call fcn.00429f40
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x532b80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5880ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x24]
xor ebp, ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
lea ebx, [esi + 0x38]
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x34], edx
push edi
mov dword [esp + 0x10], esi
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 8], ebp
mov dword [ebx + 0xc], ebx
mov dword [ebx + 0x10], ebx
mov dword [ebx], 0x58bb54
lea edi, [esi + 0x4c]
mov dword [esp + 0x1c], ebp
mov dword [edi + 4], edi
mov dword [edi + 8], ebp
mov dword [edi], 0x58bb2c
mov dword [edi + 0xc], edi
mov dword [edi + 0x10], edi
mov dword [edi + 0x14], ebp
mov dword [edi + 0x18], ebp
mov ecx, dword [esi + 0x24]
push esi
mov byte [esp + 0x20], 2
mov dword [esi], 0x58bb30
call fcn.00535550
cmp edi, ebp
jne 0x532c4d
mov eax, dword [str.Null_Pointer]
push eax
push 0x168
push str..core_list_head.h
call fcn.00401090
mov ecx, dword [str.Null_Pointer]
push ecx
push 0x119
push str..core_list_node.h
call fcn.00401090
add esp, 0x18
mov dword [edi + 0x10], ebx
mov edx, dword [ebx + 0xc]
mov dword [edi + 0xc], edx
mov eax, dword [ebx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword [eax + 0x10], edi
mov dword [ebx + 0xc], edi
mov dword [esi + 0x30], edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x535e80
Capabilities:
Get file size

Disassembly:
push ebp
push esi
call fcn.00537a00
mov esi, dword [esp + 0xc]
test al, al
je 0x535ede
push esi
call fcn.00537d50
add esp, 4
mov ebp, eax
call fcn.00537a10
test al, al
je 0x535ede
push ebx
push edi
push 0
push 0
push esi
call fcn.00537cd0
push esi
call fcn.00537d50
push 2
push 0
push esi
mov ebx, eax
call fcn.00537cd0
push esi
call fcn.00537d50
push 0
mov edi, eax
push ebp
push esi
sub edi, ebx
call fcn.00537cd0
add esp, 0x2c
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop esi
pop ebp
ret
Function at 0x5362d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
call fcn.00537a00
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test al, al
je 0x53630f
mov eax, dword [esp + 0x14]
push edi
push ebx
push esi
push eax
call fcn.00537c30
add esp, 0x10
mov dword [esp + 0x20], eax
call fcn.00537a10
test al, al
je 0x53630f
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebx
pop ecx
ret
imul esi, ebx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push 0
push ecx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x538680
Capabilities:
Terminate process

Disassembly:
push ecx
mov al, byte [0xa728c0]
push ebx
push ebp
push esi
test al, al
push edi
je 0x5386a3
call fcn.00531440
mov al, byte [0xaab48c]
test al, al
je 0x5386a3
push 0
call fcn.005755ef
mov ebp, 0xb16ab8
mov edx, dword [ebp]
test edx, edx
je 0x538707
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 3
xor edi, edi
and ecx, 0xfffffffc
add ecx, edx
mov ebx, dword [ecx + 8]
lea esi, [ecx + 0xc]
test ebx, ebx
jle 0x538707
mov eax, dword [esp + 0x18]
lea ecx, [esi + 0xc]
push eax
push ecx
call fcn.00580950
add esp, 8
test eax, eax
je 0x538743
mov ecx, dword [esi + 4]
mov eax, dword [esi]
test ecx, ecx
je 0x5386ee
mov eax, ecx
xor edx, edx
add eax, 3
mov dx, word [esi + 8]
and al, 0xfc
lea esi, [edx + esi + 0x1b]
and esi, 0xfffffff0
add esi, eax
inc edi
cmp edi, ebx
jl 0x5386ce
add ebp, 4
cmp ebp, 0xb16c48
jl 0x5386a8
xor edi, edi
mov esi, 0xb0963c
mov eax, dword [esi - 4]
test eax, eax
je 0x538732
mov ecx, dword [esp + 0x18]
push ecx
push esi
call fcn.00580950
add esp, 8
test eax, eax
je 0x53875d
add esi, 0x110
inc edi
cmp esi, 0xb16abc
jl 0x538719
jmp 0x538780
test esi, esi
je 0x538712
inc word [esi + 0xa]
xor eax, eax
mov ax, word [esi + 8]
pop edi
lea eax, [eax + esi + 0x1b]
pop esi
pop ebp
and al, 0xf0
pop ebx
pop ecx
ret
mov eax, edi
shl eax, 4
add eax, edi
pop edi
shl eax, 4
pop esi
pop ebp
mov ecx, dword [eax + 0xb09744]
pop ebx
inc ecx
mov dword [eax + 0xb09744], ecx
mov eax, dword [eax + 0xb09638]
pop ecx
ret
xor esi, esi
xor ecx, ecx
mov eax, 0xb09638
cmp dword [eax], 0
je 0x53879d
add eax, 0x110
inc ecx
cmp eax, 0xb16ab8
jl 0x538789
jmp 0x5387ad
mov esi, ecx
shl esi, 4
add esi, ecx
shl esi, 4
add esi, 0xb09638
mov edi, dword [esp + 0x18]
push 0
lea edx, [esp + 0x14]
push 0
push edx
push edi
call fcn.00538dc0
mov ecx, dword [esp + 0x20]
mov edx, esi
add esp, 0x10
sub edx, edi
mov dword [esi + 0x108], ecx
mov ecx, edi
mov dword [esi], eax
lea edi, [edx + 4]
mov dl, byte [ecx]
mov byte [edi + ecx], dl
inc ecx
test dl, dl
jne 0x5387d8
mov dword [esi + 0x10c], 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x5409b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ecx + 0x13c]
xor edx, edx
dec eax
mov byte [ecx + 0x148], dl
je 0x5409eb
dec eax
je 0x5409de
sub eax, 3
jne 0x5409f0
mov eax, dword [ecx + 0x140]
mov dword [ecx + 0x140], edx
mov dword [ecx + 0x13c], eax
ret 4
mov edx, dword [esp + 4]
mov dword [esp + 4], edx
jmp fcn.00540bc0
call fcn.00541cd0
ret 4
Function at 0x543070
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x5886c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
mov ebx, ecx
push esi
push edi
xor ebp, ebp
lea edi, [ebx + 4]
mov dword [esp + 0x14], ebx
mov dword [edi + 4], 0xffffffff
mov dword [edi + 8], ebp
mov dword [edi + 0xc], edi
mov dword [edi + 0x10], edi
mov dword [edi], 0x58bc3c
mov dword [esp + 0x24], ebp
mov dword [ebx], 0x58bc38
mov dword [ebx + 0x18], ebp
call fcn.00542a90
call fcn.00540840
push 0x20
call fcn.00401290
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
cmp esi, ebp
mov byte [esp + 0x24], 1
je 0x5430f7
push ebp
mov ecx, esi
call fcn.00405940
mov dword [esi + 0x18], 0x5427d0
mov dword [esi + 0x1c], edi
mov dword [esi], 0x58bc2c
jmp 0x5430f9
xor esi, esi
mov dword [ebx + 0x18], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebp
mov byte [esp + 0x28], 0
call esi
push ebp
push 0xb1f2b0
push 0x58f97c
push 0x800
push ebp
call esi
push eax
call sub.DINPUT8.dll_DirectInput8Create
cmp eax, ebp
jge 0x54312d
push ebp
call fcn.005755ef
mov eax, dword [0xb1f2b0]
push 1
push ebx
mov dword [0xb1f2cc], ebp
mov dword [0xb1f2c4], ebp
mov dword [0xb1f2c0], ebp
mov ecx, dword [eax]
push 0x542970
push ebp
push eax
call dword [ecx + 0x10]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x10], ebp
xor ebx, ebx
jmp 0x543168
xor ebp, ebp
push 0x158
call fcn.00401290
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebp
mov byte [esp + 0x24], 2
je 0x543192
mov edx, dword [esp + 0x10]
push ebp
push ebx
push edx
mov ecx, eax
call fcn.00541df0
mov ebp, eax
test ebp, ebp
mov byte [esp + 0x24], 0
je 0x5431fe
mov esi, dword [ebp + 0x138]
mov eax, dword [ebx*4 + 0xb1f2c0]
test esi, esi
mov dword [ebp + 0xf8], eax
jne 0x5431e1
mov ecx, dword [str.Null_Pointer]
push ecx
push 0x157
push str..core_list_head.h
call fcn.00401090
mov edx, dword [str.Null_Pointer]
push edx
push 0x106
push str..core_list_node.h
call fcn.00401090
add esp, 0x18
mov eax, dword [edi + 0x10]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x10]
mov dword [ecx + 0xc], esi
mov ecx, ebp
mov dword [edi + 0x10], esi
call fcn.00541f70
inc dword [esp + 0x10]
inc ebx
cmp ebx, 2
jl 0x543166
call fcn.0042bda0
test al, al
jne 0x543216
call fcn.0042c4c0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x543430
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5886f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 0x58bc28
lea esi, [ecx + 4]
mov dword [esp + 0x40], ebx
cmp esi, ebx
jne 0x543479
mov eax, dword [str.Null_Pointer]
push eax
push 0x71
push str..core_list_search.h
call fcn.00401090
add esp, 0xc
cmp esi, ebx
mov dword [esp + 0x18], esi
jne 0x54349a
mov ecx, dword [str.Null_Pointer]
push ecx
push 0x93
push str..core_list_search.h
call fcn.00401090
add esp, 0xc
mov esi, dword [esi + 0xc]
push ebp
mov eax, dword [esi + 4]
inc eax
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
cmp eax, ebx
mov dword [esp + 0x1c], esi
jne 0x5434b6
xor ebp, ebp
jmp 0x5434b9
mov ebp, dword [eax + 4]
mov eax, dword [0xb1f2d0]
mov dword [esp + 0x10], ebp
cmp eax, 0x1b1
mov edi, ebp
jbe 0x543545
lea edx, [esp + 0x14]
mov dword [0xb1f2d0], ebx
push edx
call fcn.00535d00
add esp, 4
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x19
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x543503
mov edx, dword [0x5a4c30]
mov byte [edx], bl
jmp 0x543545
xor ecx, ecx
lea esi, [ecx + 1]
xor edx, edx
mov eax, esi
mov ebx, 9
div ebx
mov eax, ecx
mov ebp, 9
movsx ebx, byte [esp + edx + 0x20]
xor edx, edx
div ebp
not ebx
movsx eax, byte [esp + edx + 0x20]
not eax
xor edi, edi
mov dword [ecx*4 + 0xab53bc], ebx
mov ecx, esi
cmp ecx, ebp
jb 0x543505
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
cmp ebp, ebx
mov byte [esp + 0x10], 1
pop ebp
je 0x5435ba
cmp edi, ebx
jne 0x54356c
mov ecx, dword [str.Null_Pointer]
push ecx
push 0x2b3
push str.D:Skate4SysSIOPCp_sioman.cpp
call fcn.00401090
add esp, 0xc
mov edx, dword [esp + 0xc]
mov ecx, edi
push edx
call fcn.005409b0
cmp esi, ebx
jne 0x543594
mov eax, dword [str.Null_Pointer]
push eax
push 0x93
push str..core_list_search.h
call fcn.00401090
add esp, 0xc
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 4]
inc eax
neg eax
sbb eax, eax
and eax, ecx
mov esi, eax
cmp eax, ebx
mov dword [esp + 0x18], esi
jne 0x5435af
xor edi, edi
jmp 0x5435b2
mov edi, dword [eax + 4]
cmp edi, ebx
mov byte [esp + 0xc], bl
jne 0x54356c
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret