joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402bf3
Capabilities:
Set registry value

Disassembly:
jmp 0x41d710
mov edx, dword [esp + 0xc]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call dword [0xdd36d4]
neg eax
sbb eax, eax
pop edi
and eax, 0x80004005
ret

Function at 0x402dd8
Capabilities:
Get disk information

Disassembly:
jmp 0x43cce0
sub esp, 0x20c
mov ecx, 0x3f
xor eax, eax
lea edx, [esp + 8]
push ebx
push esi
push edi
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x118]
push 0xff
lea ecx, [esp + 0x14]
push eax
push ecx
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x230]
push eax
lea ecx, [esp + 0x2c]
push 0xff
push ecx
push edx
call dword [0xdd384c]
mov esi, dword [esp + 0x21c]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x43cd83
push ebp
lea ebp, [esp + 0x1c]
mov edx, 1
dec ebp
movsx eax, byte [esi + edx - 1]
movsx ecx, byte [edx + ebp]
xor eax, edx
mov edi, esi
sub eax, ecx
or ecx, 0xffffffff
add ebx, eax
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx - 1]
cmp eax, ecx
jb 0x43cd4f
test ebx, ebx
pop ebp
je 0x43cd83
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x20c
ret
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x20c
ret
Function at 0x4030cb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x48d380
sub esp, 0x140
push esi
push edi
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0xb0], 0x43000000
mov dword [esp + 0xb4], 0x41d00000
mov dword [esp + 0xb8], 0
mov dword [esp + 0xbc], 0x41d00000
mov dword [esp + 0xc0], 0x42600000
mov dword [esp + 0xc4], 0x41d00000
mov dword [esp + 0xc8], 0x42600000
mov dword [esp + 0xcc], 0x41d00000
mov dword [esp + 0xd0], 0x42820000
mov dword [esp + 0xd4], 0x41d00000
mov dword [esp + 0xd8], 0
mov dword [esp + 0xdc], 0x42500000
mov dword [esp + 0xe0], 0x429a0000
mov dword [esp + 0xe4], 0x41d00000
mov dword [esp + 0xe8], 0x429a0000
mov dword [esp + 0xec], 0x42500000
mov dword [esp + 0xf0], 0x42240000
mov dword [esp + 0xf4], 0x41d00000
mov dword [esp + 0xf8], 0
mov dword [esp + 0xfc], 0x429c0000
mov dword [esp + 0x100], 0x41f00000
mov dword [esp + 0x104], 0x41d00000
mov dword [esp + 0x108], 0x41f00000
mov dword [esp + 0x10c], 0x429c0000
mov dword [esp + 0x110], 0x42800000
mov dword [esp + 0x114], 0x41d00000
mov dword [esp + 0x118], 0
mov dword [esp + 0x11c], 0x42cc0000
mov dword [esp + 0x120], 0x43000000
mov dword [esp + 0x124], 0x41d00000
mov dword [esp + 0x128], 0x42c80000
mov dword [esp + 0x12c], 0
mov dword [esp + 0x130], 0x41e00000
mov dword [esp + 0x134], 0x41d00000
mov dword [esp + 0x138], 0x42ae0000
mov dword [esp + 0x13c], 0x41d00000
mov dword [esp + 0x140], 0x42200000
mov dword [esp + 0x144], 0x41d00000
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x42c80000
mov dword [esp + 0x14], 0x41d00000
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x41d00000
mov dword [esp + 0x20], 0x42ae0000
mov dword [esp + 0x24], 0x41d00000
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x42500000
mov dword [esp + 0x30], 0x42800000
mov dword [esp + 0x34], 0x41d00000
mov dword [esp + 0x38], 0x42800000
mov dword [esp + 0x3c], 0x42500000
mov dword [esp + 0x40], 0x42800000
mov dword [esp + 0x44], 0x41d00000
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0x429c0000
mov dword [esp + 0x50], 0x42a00000
mov dword [esp + 0x54], 0x41d00000
mov dword [esp + 0x58], 0x42a00000
mov dword [esp + 0x5c], 0x429c0000
mov dword [esp + 0x60], 0x42400000
mov dword [esp + 0x64], 0x41d00000
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0x42cc0000
mov dword [esp + 0x70], 0x429c0000
mov dword [esp + 0x74], 0x41d00000
mov dword [esp + 0x78], 0x42a00000
mov dword [esp + 0x7c], 0x42cc0000
mov dword [esp + 0x80], 0x42200000
mov dword [esp + 0x84], 0x41d00000
mov dword [esp + 0x88], 0x42c80000
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0x41e00000
mov dword [esp + 0x94], 0x41d00000
mov dword [esp + 0x98], 0x42ae0000
mov dword [esp + 0x9c], 0x41d00000
mov dword [esp + 0xa0], 0x42200000
mov dword [esp + 0xa4], 0x41d00000
xor edi, edi
mov esi, 0xbf2f68
mov eax, dword [0x6b8278]
push edi
test eax, eax
push 0x80
push 0x80
jne 0x48d6c0
lea eax, [esp + 0x14]
push eax
jmp 0x48d6c8
lea ecx, [esp + 0xb4]
push ecx
push 0x67
push esi
call fcn.00402b7b
mov dword [esi + 0x34], 0xd
add esp, 0x18
add esi, 0x50
inc edi
cmp esi, 0xbf3288
jl 0x48d6a5
pop edi
pop esi
add esp, 0x140
ret
Function at 0x403ad5
Capabilities:
Print debug messages

Disassembly:
jmp 0x40d050
sub esp, 0x100
lea ecx, [esp]
push esi
mov esi, dword [esp + 0x10c]
push edi
mov edi, dword [esp + 0x10c]
push esi
movsx eax, byte [edi + 3]
push eax
push str.ADXT_Pause__i___li__n
push ecx
call fcn.005f58fe
add esp, 0x10
lea edx, [esp + 8]
push edx
call dword [0xdd38e8]
cmp byte [edi + 3], 2
jne 0x40d0c9
cmp esi, 1
jne 0x40d0ac
mov eax, dword [0x77cd88]
test eax, eax
je 0x40d0c9
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
pop edi
pop esi
add esp, 0x100
ret
test esi, esi
jne 0x40d0c9
mov eax, dword [0x77cd88]
test eax, eax
je 0x40d0c9
mov cl, byte [0x77cd80]
test cl, cl
je 0x40d0c9
mov edx, dword [eax]
push eax
call dword [edx + 0x1c]
pop edi
pop esi
add esp, 0x100
ret
Function at 0x520e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
push 0x521050
push 0x118
call fcn.00402d8d
mov ecx, dword [0xd52bb8]
mov ebx, eax
add esp, 8
mov eax, dword [ecx + 4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
mov esi, dword [eax + 0x655be4]
imul esi, dword [eax + 0x655be0]
mov eax, dword [ecx + 0x28]
inc eax
cdq
idiv esi
lea esi, [ebx + 0x104]
mov dword [esp + 0x24], esi
mov dword [ecx + 0x28], edx
mov ecx, dword [0xd52bb8]
mov eax, dword [ecx + 4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [ecx + 0x28]
mov edx, dword [edx*4 + 0x655be8]
lea ecx, [eax*8]
sub ecx, eax
lea eax, [edx + ecx*4]
mov ecx, esi
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
call fcn.004030bc
and eax, 0x7fff
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul dword [0x644824]
fmul dword [0x64fa30]
call fcn.005f5950
mov word [ebx + 0x110], ax
mov eax, dword [esp + 0x11c]
mov edi, esi
xor ecx, ecx
lea edx, [eax + eax*2]
mov dword [ebx + 0x114], ecx
mov ebp, dword [edi]
mov dword [esp + 0x10], ecx
lea edx, [edx*4 + 0xd52ca0]
mov dword [edx], ebp
mov ebp, dword [edi + 4]
mov dword [edx + 4], ebp
mov edi, dword [edi + 8]
mov word [eax*2 + 0xd52be8], cx
mov dword [eax*4 + 0xd52db8], ecx
mov dword [edx + 8], edi
mov edx, dword [0x65681c]
cmp edx, ecx
mov dword [eax*4 + 0xd52d28], ecx
jle 0x520fbb
add eax, 2
add ebx, 0x44
mov dword [esp + 0x20], eax
mov eax, dword [0x656818]
lea ebp, [eax + 0x10]
jmp 0x520f1d
mov esi, dword [esp + 0x24]
mov ecx, dword [esi]
mov dword [esp + 0x14], ecx
lea ecx, [ebp - 0x10]
mov edx, dword [esi + 4]
push ecx
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x18]
mov eax, dword [esi + 8]
push edx
mov dword [esp + 0x24], eax
call fcn.00401203
mov eax, dword [ebp - 4]
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0xac]
push ecx
push edx
call fcn.00401c03
mov ecx, 0x1e
mov esi, eax
mov eax, dword [esp + 0x34]
lea edi, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx - 0x30]
mov ecx, 0x1e
lea esi, [esp + 0x3c]
add esp, 0x14
rep movsd dword es:[edi], dword [esi]
mov dword [ebx], eax
mov edx, dword [esp + 0x14]
lea ecx, [ebx - 0xc]
add ebp, 0x14
add ebx, 0x78
mov dword [ecx], edx
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov edx, dword [esp + 0x1c]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x14]
mov dword [ebx - 0x4c], eax
mov eax, dword [ebx - 0x70]
or al, 4
mov dword [ebx - 0x70], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [0x65681c]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x520f19
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x5b11a8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
push edi
push 0x2c
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call fcn.005f54fb
cmp eax, esi
pop ecx
mov dword [ebp - 0x10], eax
jne 0x5b11e0
push str.Out_of_memory_
call dword [0xdd38e8]
mov edi, 0x8007000e
jmp 0x5b132d
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov esi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [ebx + 0x40]
push 4
lea eax, [ecx + 0x10]
mov dword [eax], edx
mov esi, dword [ebx + 0x20]
pop edx
add eax, edx
mov dword [eax], esi
mov esi, dword [ebx + 0x24]
add eax, edx
mov dword [eax], esi
mov esi, dword [ebx + 0x28]
add eax, edx
mov dword [eax], esi
mov esi, dword [ebx + 0x10]
add eax, edx
mov dword [eax], esi
mov esi, dword [ebp + 8]
add eax, edx
mov edx, dword [ebx + 0x14]
mov dword [eax], edx
mov edx, dword [ebx + 0x18]
mov dword [eax + 4], edx
mov eax, dword [esi]
lea edx, [ebp - 4]
push edx
push ecx
push 0x2c
push 0
push 0
push 0x65b53c
push esi
call dword [eax + 0x10]
mov edi, eax
test edi, edi
jl 0x5b1309
mov eax, dword [ebp + 0x14]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov edi, eax
test edi, edi
jl 0x5b1322
mov edx, dword [ebx + 0x44]
test edx, edx
je 0x5b132d
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
inc edi
cmp dword [ebp + 0x10], 1
jne 0x5b12c0
mov ecx, edx
xor edx, edx
jmp 0x5b1288
cmp al, 0x5c
jne 0x5b1287
inc edx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x5b1282
add edx, edi
push edx
call fcn.005f54fb
test eax, eax
pop ecx
mov dword [ebp - 0xc], eax
je 0x5b11d6
mov ebx, dword [ebx + 0x44]
mov ecx, eax
jmp 0x5b12b6
mov byte [ecx], al
cmp byte [ebx], 0x5c
jne 0x5b12b4
inc ecx
mov byte [ecx], 0x5c
inc ebx
inc ecx
mov al, byte [ebx]
test al, al
jne 0x5b12a9
and byte [ecx], al
jmp 0x5b12ea
push edi
call fcn.005f54fb
test eax, eax
pop ecx
mov dword [ebp - 0xc], eax
je 0x5b11d6
mov esi, dword [ebx + 0x44]
mov ecx, edi
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
push 0
push 0x65b59c
push esi
call dword [eax + 0x10]
mov edi, eax
test edi, edi
jge 0x5b1310
push str.Failed_to_create_x_file_data_object_
jmp 0x5b1327
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov edi, eax
test edi, edi
jge 0x5b132d
push str.Failed_to_add_x_file_data_object_
call dword [0xdd38e8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x5b133e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 8], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x5b134f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 4], 0
push dword [ebp - 0x10]
call fcn.005f54f0
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5b1428
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 0x10]
lea eax, [esi*4 + 8]
push edi
push eax
mov dword [ebp + 0x10], eax
call fcn.005f54fb
mov edi, eax
test edi, edi
pop ecx
jne 0x5b1456
mov eax, 0x8007000e
jmp 0x5b1512
mov eax, dword [ebp + 0x18]
mov dword [edi], eax
lea eax, [edi + 4]
mov dword [eax], esi
add eax, 4
xor ecx, ecx
test esi, esi
jbe 0x5b1479
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + ecx*4]
mov dword [eax], edx
add eax, 4
inc ecx
cmp ecx, esi
jb 0x5b1469
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
lea ecx, [ebp - 4]
push ecx
push edi
push dword [ebp + 0x10]
push 0
push 0
push 0x65b56c
push ebx
call dword [eax + 0x10]
mov esi, eax
test esi, esi
jge 0x5b14a7
push str.Failed_to_create_x_file_data_object_
call dword [0xdd38e8]
jmp 0x5b14f7
mov eax, dword [ebp + 0x20]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov esi, eax
test esi, esi
jge 0x5b14c0
push str.Failed_to_add_x_file_data_object_
jmp 0x5b149f
and dword [ebp + 0xc], 0
cmp dword [ebp + 0x18], 0
jbe 0x5b14f7
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x10], eax
push dword [ebp - 4]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push ebx
call fcn.005b11a8
mov esi, eax
add esp, 0x10
test esi, esi
jl 0x5b14f7
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
add dword [ebp + 0x10], 0x48
cmp eax, dword [ebp + 0x18]
jb 0x5b14d0
mov eax, dword [ebp - 4]
test eax, eax
pop ebx
je 0x5b1509
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 4], 0
push edi
call fcn.005f54f0
pop ecx
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x5b189c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x1c]
mov ecx, esi
shl ecx, 4
lea eax, [ebx + ebx*2]
lea eax, [ecx + eax*4 + 8]
push edi
push eax
mov dword [ebp - 8], eax
call fcn.005f54fb
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp + 0x10], edi
jne 0x5b18d7
mov esi, 0x8007000e
jmp 0x5b19b0
xor edx, edx
test ebx, ebx
mov dword [edi], ebx
lea eax, [edi + 4]
jbe 0x5b1904
mov ecx, dword [ebp + 0x20]
mov esi, dword [ecx + 4]
imul esi, edx
add esi, dword [ebp + 0xc]
mov edi, eax
add esi, dword [ecx + 8]
add eax, 0xc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
inc edx
cmp edx, ebx
movsd dword es:[edi], dword [esi]
jb 0x5b18e5
mov esi, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
push 4
pop edx
mov dword [eax], esi
add eax, edx
test ecx, ecx
je 0x5b193d
test esi, esi
jbe 0x5b196c
add ecx, 8
mov dword [eax], 3
mov ebx, dword [ecx - 8]
add eax, edx
mov dword [eax], ebx
mov ebx, dword [ecx - 4]
add eax, edx
mov dword [eax], ebx
mov ebx, dword [ecx]
add eax, edx
mov dword [eax], ebx
add eax, edx
add ecx, 0xc
dec esi
jne 0x5b1919
jmp 0x5b196c
test esi, esi
jbe 0x5b196c
mov ecx, dword [ebp + 0x14]
add ecx, 4
mov dword [eax], 3
movzx ebx, word [ecx - 4]
add eax, edx
mov dword [eax], ebx
movzx ebx, word [ecx - 2]
add eax, edx
mov dword [eax], ebx
movzx ebx, word [ecx]
add eax, edx
mov dword [eax], ebx
add eax, edx
add ecx, 6
dec esi
jne 0x5b1947
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push edi
push dword [ebp - 8]
push 0
push 0
push 0x65b58c
push eax
call dword [ecx + 0x10]
mov esi, eax
test esi, esi
jge 0x5b1993
push str.Failed_to_create_x_file_data_object_
jmp 0x5b19aa
mov eax, dword [ebp + 0x24]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov esi, eax
test esi, esi
jge 0x5b19b0
push str.Failed_to_add_x_file_data_object_
call dword [0xdd38e8]
mov eax, dword [ebp - 4]
test eax, eax
je 0x5b19c1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 4], 0
push edi
call fcn.005f54f0
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x5b19cf
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [esi*8 + 4]
push edi
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], eax
call fcn.005f54fb
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x5b19fd
mov esi, 0x8007000e
jmp 0x5b1a74
cmp esi, ebx
mov dword [edi], esi
lea ecx, [edi + 4]
mov dword [ebp + 0x10], ebx
jbe 0x5b1a32
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 4]
imul eax, dword [ebp + 0x10]
add eax, dword [edx + 0x18]
add eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov dword [ecx], ebx
mov eax, dword [eax + 4]
add ecx, 4
mov dword [ecx], eax
add ecx, 4
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], esi
jb 0x5b1a0c
xor ebx, ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push edi
push dword [ebp - 8]
push ebx
push ebx
push 0x65b57c
push eax
call dword [ecx + 0x10]
mov esi, eax
cmp esi, ebx
jge 0x5b1a57
push str.Failed_to_create_x_file_data_object_
jmp 0x5b1a6e
mov eax, dword [ebp + 0x18]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov esi, eax
cmp esi, ebx
jge 0x5b1a74
push str.Failed_to_add_x_file_data_object_
call dword [0xdd38e8]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x5b1a84
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], ebx
push edi
call fcn.005f54f0
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x5b1a92
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi*4]
lea eax, [eax*4 + 4]
push edi
push eax
mov dword [ebp - 0x10], eax
call fcn.005f54fb
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp - 0xc], edi
jne 0x5b1ac8
mov esi, 0x8007000e
jmp 0x5b1b71
and dword [ebp - 8], 0
test esi, esi
push ebx
mov dword [edi], esi
lea ebx, [edi + 4]
jbe 0x5b1b2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
imul ecx, dword [ebp - 8]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp + 0xc]
push dword [ecx + eax]
lea ecx, [ebp - 0x30]
call fcn.005b1516
mov esi, eax
mov eax, dword [ebp - 8]
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x20]
mov dword [ebx], eax
push 4
pop ecx
add ebx, ecx
mov dword [ebx], edx
mov edx, dword [ebp - 0x1c]
add ebx, ecx
mov dword [ebx], edx
mov edx, dword [ebp - 0x18]
add ebx, ecx
mov dword [ebx], edx
mov edx, dword [ebp - 0x14]
add ebx, ecx
mov dword [ebx], edx
add ebx, ecx
inc eax
cmp eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
jb 0x5b1ad6
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push edi
push dword [ebp - 0x10]
push 0
push 0
push 0x65b5ac
push eax
call dword [ecx + 0x10]
mov esi, eax
test esi, esi
pop ebx
jge 0x5b1b54
push str.Failed_to_create_x_file_data_object_
jmp 0x5b1b6b
mov eax, dword [ebp + 0x18]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov esi, eax
test esi, esi
jge 0x5b1b71
push str.Failed_to_add_x_file_data_object_
call dword [0xdd38e8]
mov eax, dword [ebp - 4]
test eax, eax
je 0x5b1b82
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 4], 0
push edi
call fcn.005f54f0
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x5d2581
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x5d26d6
push ebx
mov ebx, 0xffc03fc0
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*4]
add edi, eax
cmp eax, edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x5d26b1
mov esi, dword [eax + 4]
mov eax, dword [eax]
mov edx, dword [edi + 4]
mov edi, dword [edi]
mov ecx, eax
shr ecx, 2
and ecx, ebx
mov ebp, edi
shr ebp, 2
and ebp, ebx
add ecx, ebp
mov ebp, esi
shr ebp, 2
and ebp, ebx
add ecx, ebp
mov ebp, edx
shr ebp, 2
and ebp, ebx
lea ebx, [ecx + ebp - 0x7fff80]
mov ecx, eax
mov ebp, edi
and ecx, 0xff00ff
and ebp, 0xff00ff
add ecx, ebp
mov ebp, esi
and ebp, 0xff00ff
add ecx, ebp
mov ebp, edx
and ebp, 0xff00ff
shr eax, 2
lea ecx, [ecx + ebp + 0x20002]
shr ecx, 2
xor ebx, ecx
mov ecx, 0x3fc03fc0
and eax, ecx
shr edi, 2
and edi, ecx
add eax, edi
mov edi, dword [esp + 0x18]
shr esi, 2
and esi, ecx
add eax, esi
shr edx, 2
and edx, ecx
lea eax, [eax + edx + 0x800080]
and ebx, 0xff00ff
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 4
mov dword [eax], ebx
mov eax, dword [esp + 0x14]
add eax, 8
add edi, 8
cmp eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov ebx, 0xffc03fc0
jb 0x5d25e4
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x5d25c1
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x5d27fb
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x5d2942
push ebx
mov edx, 0xf81f
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x5d291d
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x5d2864
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x5d283b
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret