joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a4c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x789e88
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [esp + 0x30], 0
mov ebp, dword [esi + 0x10]
mov ebx, dword [esi + 0xc]
mov ecx, ebp
sub ecx, ebx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jbe 0x44a54b
cmp ebx, ebp
jbe 0x44a51d
call fcn.006441b7
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
push ebp
push eax
lea eax, [esp + 0x40]
push eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push edi
mov ecx, esi
call fcn.0044bc90
jmp 0x44a59a
jae 0x44a59a
cmp ebx, ebp
jbe 0x44a556
call fcn.006441b7
mov ebx, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x20], edx
cmp ebx, dword [esi + 0x10]
jbe 0x44a569
call fcn.006441b7
mov eax, dword [esi]
mov dword [esp + 0x1c], ebx
mov ebx, edi
lea edi, [esp + 0x18]
mov dword [esp + 0x18], eax
call fcn.005ff510
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebp
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
mov ebx, esi
call fcn.0044bbd0
mov esi, 0x10
cmp dword [esp + 0x6c], esi
jb 0x44a5b2
mov ecx, dword [esp + 0x58]
push ecx
call fcn.006441c7
add esp, 4
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], 0
mov byte [esp + 0x58], 0
cmp dword [esp + 0x50], esi
jb 0x44a5da
mov edx, dword [esp + 0x3c]
push edx
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x38
Function at 0x44ac80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x79243a
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, edx
mov dword [esp + 0x38], 0
mov edi, dword [esi + 0x10]
mov ebp, dword [esi + 0xc]
mov ecx, edi
sub ecx, ebp
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jbe 0x44ad06
cmp ebp, edi
jbe 0x44acdb
call fcn.006441b7
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
push edi
push eax
lea eax, [esp + 0x48]
push eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
push ebx
push esi
call fcn.0044cb00
jmp 0x44ad53
jae 0x44ad53
cmp ebp, edi
jbe 0x44ad11
call fcn.006441b7
mov ebp, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x20], edx
cmp ebp, dword [esi + 0x10]
jbe 0x44ad24
call fcn.006441b7
mov eax, dword [esi]
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], eax
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], ebp
call fcn.005786e0
mov edx, dword [esp + 0x20]
mov ecx, dword [eax + 4]
push edi
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x30]
push eax
call fcn.0044ad80
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x3c], 0xffffffff
call fcn.0043c860
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x60
Function at 0x453ea0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x789b98
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
call fcn.00463cf0
mov dword [esp + 0x38], 0
mov edx, dword [esi]
mov edx, dword [edx + 0x184]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call edx
mov bl, al
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x3c], 0xffffffff
call fcn.00456c10
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455ac0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push esi
mov esi, ecx
call fcn.00469430
mov ecx, dword [esi + 0x860]
pop esi
jmp fcn.005c0fa0
Function at 0x459f00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x78ceb6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x24]
mov dword [esi], vtable.Sexy::Image.0
mov eax, dword [edi + 4]
xor ebx, ebx
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], ebx
mov byte [esi + 0x14], bl
mov dword [esp + 0x1c], ebx
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov edx, dword [edi + 0x30]
mov dword [esi + 0x30], edx
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov byte [esi + 0xc], bl
cmp dword [edi + 0x3c], ebx
je 0x459f98
push pe_nt_image_headers32
call fcn.006442a0
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], 1
cmp eax, ebx
je 0x459f91
mov edi, dword [edi + 0x3c]
push eax
call fcn.00459fc0
mov dword [esi + 0x3c], eax
jmp 0x459f9b
xor eax, eax
mov dword [esi + 0x3c], eax
jmp 0x459f9b
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x469ed0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x797848
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
push 0x18
xor ebx, ebx
push str.properties_resources.xml
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.004016e0
mov dword [esp + 0x38], ebx
mov eax, dword [edi + 0x7e8]
push eax
lea ecx, [esp + 0x18]
call fcn.0045f5f0
test al, al
sete byte [esp + 0x13]
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x2c], 0x10
jb 0x469f50
mov ecx, dword [esp + 0x18]
push ecx
call fcn.006441c7
add esp, 4
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
cmp byte [esp + 0x13], bl
je 0x469f6d
push 1
call fcn.00469f80
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x30
ret

Function at 0x46a440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x786b68
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x50]
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
call fcn.00401530
mov cl, byte [esp + 0x54]
mov byte [esp + 0x34], cl
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0xc]
add eax, 0x768
push edx
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x4c], 0
call fcn.0046ccd0
cmp dword [esp + 0x30], 0x10
jb 0x46a4c7
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.006441c7
add esp, 4
cmp byte [esp + 0x14], 0
jne 0x46a4f2
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x46a505
call fcn.006441b7
xor eax, eax
mov esi, dword [esp + 0x10]
cmp esi, dword [eax + 0x18]
jne 0x46a4eb
call fcn.006441b7
mov dl, byte [esp + 0x54]
mov byte [esi + 0x28], dl
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x40
ret 0xc
mov eax, dword [eax]
jmp 0x46a4dd

Function at 0x46a510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x789638
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4c]
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
call fcn.00401530
mov dword [esp + 0x34], edi
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0xc]
push ecx
add edx, 0x788
push edx
lea eax, [esp + 0x20]
mov dword [esp + 0x48], 0
call fcn.0041daf0
cmp dword [esp + 0x30], 0x10
jb 0x46a594
mov eax, dword [esp + 0x1c]
push eax
call fcn.006441c7
add esp, 4
cmp byte [esp + 0x14], 0
jne 0x46a5bb
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x46a5ce
call fcn.006441b7
xor eax, eax
mov esi, dword [esp + 0x10]
cmp esi, dword [eax + 0x18]
jne 0x46a5b8
call fcn.006441b7
mov dword [esi + 0x28], edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x3c
ret 8
mov eax, dword [eax]
jmp 0x46a5aa
Function at 0x4786c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0x20c], eax
cmp dword [0x88b150], 0
jne 0x47876e
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.0064edd0
add esp, 0xc
lea edx, [esp]
push edx
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
lea eax, [esp]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x478710
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 - 2], 0x5c
lea edx, [esp + eax*2]
je 0x478742
mov eax, 0x81f57c
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x478731
jmp 0x47875f
mov eax, str.j2k_codec.dll
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x478750
lea eax, [esp]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov dword [0x88b150], eax
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00643db8
add esp, 0x210
ret
Function at 0x545410
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esi + 0x1c]
sub esp, 0xc
test eax, eax
je 0x5454ee
push edi
mov edi, dword [sym.imp.advapi32.dll_RegSetValueExA]
push 4
lea ecx, [esp + 8]
push ecx
push 4
push 0
push str.Version
push eax
mov dword [esp + 0x1c], 3
call edi
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0xb0]
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push str.MinVidMemory
push ecx
mov dword [esp + 0x20], edx
call edi
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0xb4]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push str.RecVidMemory
push ecx
mov dword [esp + 0x24], edx
call edi
mov eax, dword [esi + 0x1c]
push 0x10
lea edx, [esi + 0x20]
push edx
push 3
push 0
push str.DisplayGUID
push eax
call edi
mov eax, dword [esi + 0x8c]
inc eax
cmp dword [esi + 0x90], 0x10
jb 0x5454aa
mov ecx, dword [esi + 0x7c]
jmp 0x5454ad
lea ecx, [esi + 0x7c]
push eax
push ecx
mov ecx, dword [esi + 0x1c]
push 1
push 0
push str.FailureReason
push ecx
call edi
mov eax, dword [esi + 0xa8]
inc eax
cmp dword [esi + 0xac], 0x10
jb 0x5454d6
mov ecx, dword [esi + 0x98]
jmp 0x5454dc
lea ecx, [esi + 0x98]
mov edx, dword [esi + 0x1c]
push eax
push ecx
push 1
push 0
push str.Warning
push edx
call edi
pop edi
add esp, 0xc
ret
Function at 0x547380
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, ecx
push eax
mov byte [esi + 0xb9], 0
call fcn.00545730
test al, al
je 0x5473a1
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00547320
jmp 0x5473dc
cmp byte [esi + 0xb8], 0
je 0x5473dc
cmp byte [esi + 0xb9], 0
jne 0x5473e5
mov edx, dword [esi + 0x1c]
push 0
push 0
push 0
push 0
push str.FailureReason
push edx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
setne al
mov byte [esi + 0xba], al
mov byte [esi + 0xb9], 1
cmp byte [esi + 0xb9], 0
je 0x5473ea
call fcn.00545410
call fcn.00546180
pop esi
pop ecx
ret 4

Function at 0x547ea0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x7892ae
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
call fcn.00479640
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi], vtable.Sexy::DescParser.0
mov ecx, 7
xor edx, edx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x40], eax
mov word [esi + 0x30], dx
mov dword [esi + 0x64], ecx
mov dword [esi + 0x60], eax
mov word [esi + 0x50], ax
lea ecx, [esi + 0x68]
push ecx
mov byte [esp + 0x18], 2
call fcn.00471890
mov dword [esi + 0x28], 1
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x54a260
Capabilities:
Hash data using crc32b

Disassembly:
mov byte [0x88b559], 1
xor ecx, ecx
lea esp, [esp]
mov eax, ecx
shl eax, 0x18
test eax, eax
jns 0x54a282
add eax, eax
xor eax, 0x4c11db7
jmp 0x54a284
add eax, eax
test eax, eax
jns 0x54a291
add eax, eax
xor eax, 0x4c11db7
jmp 0x54a293
add eax, eax
test eax, eax
jns 0x54a2a0
add eax, eax
xor eax, 0x4c11db7
jmp 0x54a2a2
add eax, eax
test eax, eax
jns 0x54a2af
add eax, eax
xor eax, 0x4c11db7
jmp 0x54a2b1
add eax, eax
test eax, eax
jns 0x54a2be
add eax, eax
xor eax, 0x4c11db7
jmp 0x54a2c0
add eax, eax
test eax, eax
jns 0x54a2cd
add eax, eax
xor eax, 0x4c11db7
jmp 0x54a2cf
add eax, eax
test eax, eax
jns 0x54a2dc
add eax, eax
xor eax, 0x4c11db7
jmp 0x54a2de
add eax, eax
test eax, eax
jns 0x54a2eb
add eax, eax
xor eax, 0x4c11db7
jmp 0x54a2ed
add eax, eax
mov dword [ecx*4 + 0x885ed0], eax
inc ecx
cmp ecx, 0x100
jl 0x54a270
ret

Function at 0x54adf0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor edx, edx
push edi
mov edi, eax
mov esi, ecx
cmp byte [0x88b559], dl
jne 0x54a325
call fcn.0054a260
test edi, edi
jle 0x54a34f
mov ecx, edi
jmp 0x54a330
movsx edi, byte [esi]
mov eax, edx
shr eax, 0x18
xor eax, edi
and eax, 0xff
shl edx, 8
xor edx, dword [eax*4 + 0x885ed0]
inc esi
sub ecx, 1
jne 0x54a330
pop edi
mov eax, edx
pop esi
ret
mov ecx, dword [esi + 0x14]
xor eax, eax
sub ecx, dword [esi + 0x10]
je 0x54ae19
mov edx, dword [esi + 0x14]
push edi
mov edi, dword [esi + 0x14]
sub edi, dword [esi + 0x10]
sub edx, dword [esi + 0x10]
jne 0x54ae0e
call fcn.006441b7
mov ecx, dword [esi + 0x10]
mov eax, edi
pop edi
jmp 0x54a310
ret
Function at 0x54cd50
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push edi
mov ebx, eax
mov eax, dword [esp + 0x34]
push 0x1c
mov edi, ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x10]
mov dword [eax], 0
push edx
mov dword [ecx], 0
push edi
mov byte [ebx], 0
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
jne 0x54cd9f
push ebp
push str.VirtualQuery_failed
push ebx
call fcn.00647060
add esp, 0xc
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x1c
ret
cmp dword [esp + 0x1c], 0x10000
jne 0x54cdc1
push ebp
push str.Failed_due_to_address_in_MEM_FREE_pages
push ebx
call fcn.00647060
add esp, 0xc
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x1c
ret
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x54cdce
mov esi, dword [esp + 0x10]
push ebp
push ebx
push esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x54cdf4
push ebp
push str.GetModuleFileName_failed
push ebx
call fcn.00647060
add esp, 0xc
pop esi
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x1c
ret
mov eax, dword [esi + 0x3c]
movzx ebp, word [eax + esi + 6]
movzx ecx, word [eax + esi + 0x14]
add eax, esi
sub edi, esi
xor ebx, ebx
lea ecx, [ecx + eax + 0x18]
test ebp, ebp
jbe 0x54cdea
lea eax, [ecx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ecx, dword [eax - 4]
cmp edx, esi
ja 0x54ce20
mov edx, esi
cmp edi, ecx
jb 0x54ce2a
add edx, ecx
cmp edi, edx
jbe 0x54ce3c
inc ebx
add eax, 0x28
cmp ebx, ebp
jb 0x54ce12
pop esi
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
inc ebx
sub edi, ecx
pop esi
mov dword [edx], ebx
mov dword [eax], edi
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x1c
ret
Function at 0x55db50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x78ed78
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [esp + 0x30], 0
mov ebx, dword [esi + 0x10]
mov ebp, dword [esi + 0xc]
mov ecx, ebx
sub ecx, ebp
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jbe 0x55dbd6
cmp ebp, ebx
jbe 0x55dbab
call fcn.006441b7
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
push ebx
push eax
lea eax, [esp + 0x40]
push eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push edi
push esi
call fcn.0055e240
jmp 0x55dc23
jae 0x55dc23
cmp ebp, ebx
jbe 0x55dbe1
call fcn.006441b7
mov ebp, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x20], edx
cmp ebp, dword [esi + 0x10]
jbe 0x55dbf4
call fcn.006441b7
mov eax, dword [esi]
mov dword [esp + 0x18], eax
mov eax, edi
lea edi, [esp + 0x18]
mov dword [esp + 0x1c], ebp
call fcn.0055f240
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebx
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
call fcn.0055e190
mov eax, dword [esp + 0x44]
xor esi, esi
cmp eax, esi
je 0x55dc36
push eax
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x38]
push ecx
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x18

Function at 0x55dd90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x78ed18
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [esp + 0x30], 0
mov ebx, dword [esi + 0x10]
mov ebp, dword [esi + 0xc]
mov ecx, ebx
sub ecx, ebp
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jbe 0x55de16
cmp ebp, ebx
jbe 0x55ddeb
call fcn.006441b7
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
push ebx
push eax
lea eax, [esp + 0x40]
push eax
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push edi
push esi
call fcn.0055eb30
jmp 0x55de64
jae 0x55de64
cmp ebp, ebx
jbe 0x55de21
call fcn.006441b7
mov ebp, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x20], edx
cmp ebp, dword [esi + 0x10]
jbe 0x55de34
call fcn.006441b7
mov eax, dword [esi]
mov dword [esp + 0x18], eax
mov eax, edi
lea edi, [esp + 0x18]
mov dword [esp + 0x1c], ebp
call fcn.0055f2e0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebx
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
push esi
call fcn.0055ea60
lea esi, [esp + 0x38]
call fcn.0055b530
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x48
Function at 0x560340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x78c218
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push esi
call fcn.00428920
lea eax, [esi + 0x18]
push eax
mov dword [esp + 0x1c], 0
call fcn.00448d70
lea eax, [esi + 0x30]
call fcn.0059c810
fld dword [0x82dc70]
fstp dword [esi + 0x4c]
mov eax, esi
fldz
fstp dword [esi + 0x54]
fld dword [0x82dfcc]
fstp dword [esi + 0x58]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret

Function at 0x5604b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x788eb3
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.00448d70
xor ebx, ebx
mov byte [esi + 0x24], bl
mov byte [esi + 0x25], bl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
lea eax, [esi + 0x30]
push eax
mov dword [esp + 0x18], ebx
call fcn.00448d70
mov byte [esp + 0x14], 1
lea ecx, [esi + 0x58]
push ecx
mov byte [esi + 0x54], bl
mov byte [esi + 0x55], bl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
call fcn.00448d70
lea ecx, [esi + 0x80]
mov byte [esi + 0x7c], bl
mov byte [esi + 0x7d], bl
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
call fcn.00434800
lea ecx, [esi + 0x90]
call fcn.00466370
lea eax, [esi + 0x9c]
call fcn.0057e350
fldz
fst qword [esi + 0xc0]
fstp qword [esi + 0xc8]
mov byte [esi + 0x2c], bl
mov byte [esi + 0x2d], 1
mov byte [esi + 0x54], 1
call fcn.0057e0f0
fld1
fstp dword [esi + 0xd0]
mov byte [esi + 0xd4], 1
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x5609e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor ebp, ebp
cmp dword [esp + 0xc], ebp
jle 0x560a57
push ebx
push esi
jmp 0x5609f0
cmp dword [edi + 0xe40], 0x400
jne 0x560a30
mov esi, dword [edi + 4]
lea ebx, [edi + 0xa3c]
mov edx, ebx
mov dword [edi + 0xe40], 0
call fcn.00560980
shr eax, 2
xor ecx, ecx
test eax, eax
jle 0x560a30
mov edx, ebx
mov esi, dword [edx]
xor esi, ecx
add dword [edi + 0xc], esi
inc ecx
add edx, 4
cmp ecx, eax
jl 0x560a21
mov eax, dword [edi + 0xe40]
mov cl, byte [eax + edi + 0xa3c]
mov edx, dword [esp + 0x10]
mov byte [edx + ebp], cl
inc dword [edi + 0xe40]
inc ebp
cmp ebp, dword [esp + 0x14]
jl 0x5609f0
pop esi
pop ebx
mov eax, edx
pop ebp
ret
mov eax, dword [esp + 8]
pop ebp
ret
Function at 0x569150
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x78e8ad
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], eax
mov byte [esi + 4], al
lea edi, [esi + 0x30]
push edi
mov dword [esp + 0x18], eax
call fcn.0042bf10
lea eax, [edi + 0x18]
call fcn.0059c810
fldz
fst qword [edi + 0x38]
fst qword [edi + 0x40]
fst qword [edi + 0x50]
fstp qword [edi + 0x58]
fld dword [0x82dc70]
fstp dword [edi + 0x34]
lea ecx, [esi + 0x90]
mov byte [esp + 0x14], 1
call fcn.00560340
lea ecx, [esi + 0xec]
mov byte [esp + 0x14], 2
call fcn.00560340
lea eax, [esi + 0x148]
push eax
mov byte [esp + 0x18], 3
call fcn.005fb4c0
lea ecx, [esi + 0x160]
push ecx
mov byte [esp + 0x18], 4
call fcn.00448d70
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4