joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df3d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x24]
test ecx, ecx
jle 0x4df570
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
cmp ecx, 0x100
jl 0x4df498
test eax, eax
jle 0x4df56d
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x14], edx
lea edx, [ecx*4]
mov dword [ebp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x18], edx
mov ecx, 1
test eax, eax
jle 0x4df484
mov dword [ebp + 0xc], eax
jmp 0x4df430
mov ecx, dword [edi]
mov edx, dword [esi]
mov ebx, ecx
xor ebx, edx
and ebx, 0xfefefe
mov eax, ecx
and eax, edx
lea eax, [ebx + eax*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, ecx
sub ebx, eax
add ebx, edx
or ebx, eax
mov eax, dword [ebp + 0x20]
xor ebx, ecx
and ebx, 0xffffff
xor ebx, ecx
add eax, eax
add eax, eax
mov dword [esi], ebx
mov ecx, 1
add esi, 4
add edi, eax
sub dword [ebp + 0xc], ecx
jne 0x4df430
mov eax, dword [ebp + 0x10]
add esi, dword [ebp + 0x14]
add edi, dword [ebp + 0x18]
sub dword [ebp + 0x24], ecx
jne 0x4df424
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
test eax, eax
jle 0x4df56d
mov edx, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
add edx, edx
add edx, edx
mov dword [ebp + 0x14], edx
mov edx, dword [ebp + 0x1c]
add edx, edx
add edx, edx
mov dword [ebp + 0x18], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edx, 1
test eax, eax
jle 0x4df55b
mov dword [ebp + 0x1c], eax
lea ecx, [ecx]
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov esi, dword [edi]
mov eax, edx
and eax, 0xffff00ff
imul eax, ecx
mov ebx, edx
and ebx, 0xff00
imul ebx, ecx
xor eax, ebx
mov ebx, edx
and ebx, 0xff00ff
imul ebx, ecx
and eax, 0xff0000
xor eax, ebx
shr eax, 8
mov ebx, eax
mov ecx, eax
and ecx, esi
xor ebx, esi
and ebx, 0xfefefe
lea ecx, [ebx + ecx*2]
shr ecx, 8
and ecx, 0x10101
add ecx, 0x7f7f7f
xor ecx, 0x7f7f7f
sub eax, ecx
add eax, esi
or eax, ecx
mov ecx, dword [ebp + 0x24]
xor eax, edx
and eax, 0xffffff
xor eax, edx
mov dword [edi], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
add dword [ebp + 0xc], eax
mov edx, 1
add edi, 4
sub dword [ebp + 0x1c], edx
jne 0x4df4d0
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
add edi, dword [ebp + 0x14]
add dword [ebp + 0xc], esi
sub dword [ebp - 4], edx
jne 0x4df4c2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4e6710
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5cba05
push eax
mov dword fs:[0], esp
sub esp, 0xd8
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x114]
push edi
call edx
mov eax, dword [esi + 0x60]
cmp eax, dword [0x694574]
jne 0x4e6754
test eax, eax
je 0x4e6754
call fcn.004e28c0
test byte [esi + 0x38], 1
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
je 0x4e6813
push 0
push 0x67d070
push 0x67d0f0
push 0
push edi
call fcn.005c79f8
add esp, 0x14
test eax, eax
je 0x4e6813
test dword [eax + 0x38], 0x10000
je 0x4e6813
test bl, 2
je 0x4e679e
cmp dword [0x694568], 0
je 0x4e6813
test ebx, 0x1000
je 0x4e67af
cmp dword [0x694564], 0
je 0x4e6813
fld dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x1c]
fst dword [esp + 0x10]
fld dword [ebp + 0x10]
mov edx, dword [esi]
fst dword [esp + 0x14]
mov edx, dword [edx + 0x48]
fld dword [eax + 8]
push ecx
fsub dword [eax]
push ebx
push eax
mov ecx, esi
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
faddp st(2)
fxch st(1)
fstp dword [esp + 0x24]
fld dword [eax + 0xc]
fsub dword [eax + 4]
lea eax, [esp + 0x1c]
push eax
push edi
fstp dword [esp + 0x20]
fadd dword [esp + 0x20]
fstp dword [esp + 0x30]
call edx
mov ecx, dword [esp + 0xe4]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea eax, [esp + 0x20]
push eax
call fcn.004d3580
lea ecx, [esp + 0x80]
push ecx
mov edi, esi
mov dword [esp + 0xf0], 0
call fcn.004d3580
fld dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x14]
push ebx
push ecx
mov byte [esp + 0xf8], 1
mov edx, dword [eax]
mov edx, dword [edx + 0x4c]
sub esp, 8
fstp dword [esp + 4]
lea ecx, [esp + 0x34]
fld dword [ebp + 0xc]
fstp dword [esp]
push ecx
mov ecx, eax
call edx
mov esi, vtable.CMemorySurfaceSupport.0
mov dword [esp + 0x80], esi
mov byte [esp + 0xec], 2
mov ecx, dword [esp + 0xdc]
xor edi, edi
cmp ecx, edi
je 0x4e6891
mov eax, dword [ecx]
mov edx, dword [eax + 0xfc]
call edx
lea ecx, [esp + 0x80]
mov dword [esp + 0x98], edi
mov byte [esp + 0xec], 0
call fcn.004ec5b0
mov dword [esp + 0x20], esi
mov dword [esp + 0xec], 3
mov ecx, dword [esp + 0x7c]
cmp ecx, edi
je 0x4e68cd
mov eax, dword [ecx]
mov edx, dword [eax + 0xfc]
call edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
mov dword [esp + 0xec], 0xffffffff
call fcn.004ec5b0
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4ef510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cbb19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x28]
lea esi, [ebp - 0x20]
call fcn.00418e00
mov edi, dword [ebp - 0x20]
push edi
mov eax, ebx
call fcn.00448ed0
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x30]
xor ebx, ebx
xor ecx, ecx
cmp dword [eax + 0x2c], 0x10
jne 0x4ef594
test esi, esi
jle 0x4ef5ab
lea esp, [esp]
movzx eax, byte [edi + ecx*2]
mov edx, 0x100
imul ax, dx
movzx edx, byte [edi + ecx*2 + 1]
add ax, dx
cwde
cdq
xor eax, edx
sub eax, edx
inc ecx
add ebx, eax
cmp ecx, esi
jl 0x4ef570
jmp 0x4ef5ab
test esi, esi
jle 0x4ef5a8
movsx eax, byte [edi + ecx]
cdq
xor eax, edx
sub eax, edx
inc ecx
add ebx, eax
cmp ecx, esi
jl 0x4ef598
shl ebx, 8
mov eax, ebx
cdq
idiv esi
mov esi, eax
test edi, edi
je 0x4ef5bf
push edi
call fcn.0048f06d
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4fe4e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5cdc47
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push esi
push edi
lea eax, [esp + 0xc]
push eax
lea edi, [esp + 0x3c]
mov dword [esp + 0x10], 3
call fcn.00440540
add esp, 4
mov esi, eax
lea ecx, [esp + 0x10]
xor edi, edi
mov dword [esp + 0x5c], edi
push ecx
mov dword [esp + 0x14], 0x2000
mov dword [esp + 0x18], 4
call fcn.00440760
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 0x4000
mov dword [esp + 0x18], 5
call fcn.00440760
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x8000
mov dword [esp + 0x18], 6
call fcn.00440760
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x10000
mov dword [esp + 0x18], 7
call fcn.00440760
lea eax, [esp + 0x28]
mov ecx, esi
call fcn.00440600
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x64], 1
call fcn.0043c890
mov byte [esp + 0x5c], 4
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push eax
push ecx
lea esi, [esp + 0x14]
lea eax, [esp + 0x30]
call fcn.0044a840
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0048f06d
add esp, 4
lea esi, [esp + 0x38]
mov byte [esp + 0x5c], 5
call fcn.004221a0
mov edx, dword [esp + 0x38]
push edx
call fcn.0048f06d
mov eax, dword [0x6a75f0]
add esp, 4
mov dword [esp + 0x38], edi
cmp eax, edi
jne 0x4fe646
push 0x480
call fcn.0048f2c5
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
mov byte [esp + 0x5c], 6
cmp esi, edi
je 0x4fe633
mov eax, dword [0x692f08]
mov dword [esp + 0xc], eax
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
call fcn.0041fab0
mov ecx, dword [eax]
push esi
call fcn.00593310
mov edi, eax
mov byte [esp + 0x5c], 5
call fcn.0040a8f0
mov edi, eax
call fcn.00421c40
jmp 0x4fe68c
mov ecx, dword [0x692f08]
mov esi, dword [eax + 0x118]
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
mov dword [esp + 0xc], ecx
call fcn.0041fab0
cmp esi, dword [eax]
je 0x4fe68c
mov edx, dword [0x692f08]
mov esi, dword [0x6a75f0]
mov dword [esp + 0xc], edx
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
call fcn.0041fab0
mov eax, dword [eax]
mov dword [esi + 0x118], eax
mov dword [esp + 0x5c], 7
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push eax
push ecx
lea esi, [esp + 0x18]
lea eax, [esp + 0x20]
call fcn.0044a840
mov eax, dword [esp + 0x1c]
push eax
call fcn.0048f06d
mov ecx, dword [esp + 0x58]
add esp, 4
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x521060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d247f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [edi + 0x1a0], 0x5205c0
mov eax, dword [edi + 0x30]
mov edx, dword [eax + 0xc]
lea ecx, [edi + 0x30]
call edx
mov ebx, eax
mov eax, 0x20
sub eax, dword [0x694050]
mov ecx, 1
shl eax, 4
cdq
and edx, 0xf
add eax, edx
sar eax, 4
mov dword [ebp - 0x14], eax
cmp eax, ecx
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x10]
jl 0x5210c3
lea eax, [ebp - 0x14]
mov eax, dword [eax]
xor edx, edx
mov dword [ebp - 0x14], ecx
cmp eax, ecx
mov dword [ebp - 0x10], eax
mov dword [edi + 0x3c], edx
lea ecx, [ebp - 0x14]
jl 0x5210da
lea ecx, [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [edi + 0x38], ecx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], 0x100
cmp eax, edx
jne 0x5210f0
mov dword [edi + 0x3c], ecx
mov dword [edi + 0x34], edx
mov ecx, dword [edi + 0x1ac]
cmp ecx, edx
je 0x521115
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x2a8
call fcn.0048f2c5
mov ecx, eax
add esp, 4
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp ecx, eax
je 0x52117b
cmp byte [edi + 0x399], al
push eax
push eax
push eax
sete al
mov edx, dword [eax*4 + 0x692c84]
mov eax, dword [0x6a49e4]
push edx
push eax
mov eax, dword [edi + 0x138]
sub eax, dword [0x6a5b88]
cdq
sub eax, edx
mov edx, dword [edi + 0x11c]
sar eax, 1
add eax, dword [edi + 0x120]
add edx, 0xa
push eax
push edx
lea eax, [edi + 0x1b4]
push eax
push 0x10
push ecx
call fcn.0051a3a0
push edi
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00441130
push eax
lea edi, [edi + 0x1ac]
call fcn.0041a180
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x563cf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cb00a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
mov edx, dword [eax + 8]
lea ebx, [edi + 0x10]
mov ecx, ebx
mov dword [ebp - 0x10], ebx
call edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x30]
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 4]
push ecx
push eax
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x14], edx
mov dword [ebp + 0xc], eax
call fcn.00452850
mov ecx, dword [edi + 0x34]
mov edx, 0x15555554
sub edx, ecx
cmp edx, 1
jae 0x563d65
push str.list_T__too_long
call fcn.0047cca5
inc ecx
mov dword [edi + 0x34], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], edi
mov edi, dword [edi + 0x30]
mov edi, dword [edi + 4]
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], 1
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebx]
mov eax, dword [edx + 0xc]
mov ecx, ebx
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x564180
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cb05d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
mov edx, dword [eax + 8]
lea ebx, [edi + 0x10]
mov ecx, ebx
mov dword [ebp - 0x10], ebx
call edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 4]
push ecx
push eax
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x14], edx
mov dword [ebp + 0xc], eax
call fcn.00452850
mov ecx, dword [edi + 0x30]
mov edx, 0x15555554
sub edx, ecx
cmp edx, 1
jae 0x5641f5
push str.list_T__too_long
call fcn.0047cca5
inc ecx
mov dword [edi + 0x30], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
mov edi, dword [edi + 0x2c]
mov edi, dword [edi + 4]
mov dword [eax + 8], edi
mov dword [eax + 0x14], 1
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebx]
mov eax, dword [edx + 0xc]
mov ecx, ebx
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5642f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cb07a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0xfffffffffffffff1
mov dword [esi], vtable.CThread.0
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov byte [esi + 0xe], bl
mov byte [esi + 0xc], 1
call fcn.004dae90
mov dword [ebp - 4], ebx
lea eax, [esi + 0x14]
mov dword [esi], vtable.CSurfaceLoader.0
push eax
mov dword [esi + 0x10], vtable.CCriticalSection.0
call dword [0x6100ec]
mov byte [ebp - 4], 1
push 0x14
mov dword [esi + 0x30], ebx
call fcn.0048f2c5
add esp, 4
cmp eax, ebx
je 0x56437d
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
mov dword [eax], eax
mov eax, dword [esi + 0x2c]
mov dword [eax + 4], eax
mov byte [esi + 0x38], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
call fcn.0048f111
push 0x661a10
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call fcn.00490659
int3

Function at 0x5646d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cb09e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
mov edx, dword [eax + 8]
lea ebx, [edi + 0x10]
mov ecx, ebx
mov dword [ebp - 0x10], ebx
call edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 4]
push ecx
push eax
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x14], edx
mov dword [ebp + 0xc], eax
call fcn.00452850
mov ecx, dword [edi + 0x30]
mov edx, 0x15555554
sub edx, ecx
cmp edx, 1
jae 0x564745
push str.list_T__too_long
call fcn.0047cca5
inc ecx
mov dword [edi + 0x30], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], edi
mov edi, dword [edi + 0x2c]
mov edi, dword [edi + 4]
mov dword [eax + 0xc], edi
mov dword [eax + 0x1c], 1
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebx]
mov eax, dword [edx + 0xc]
mov ecx, ebx
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x564840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cb0bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0xfffffffffffffff1
mov dword [esi], vtable.CThread.0
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov byte [esi + 0xe], bl
mov byte [esi + 0xc], 1
call fcn.004dae90
mov dword [ebp - 4], ebx
lea eax, [esi + 0x14]
mov dword [esi], vtable.CWaveLoader.0
push eax
mov dword [esi + 0x10], vtable.CCriticalSection.0
call dword [0x6100ec]
mov byte [ebp - 4], 1
push 0x14
mov dword [esi + 0x30], ebx
call fcn.0048f2c5
add esp, 4
cmp eax, ebx
je 0x5648cd
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
mov dword [eax], eax
mov eax, dword [esi + 0x2c]
mov dword [eax + 4], eax
mov byte [esi + 0x38], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
call fcn.0048f111
push 0x661a10
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call fcn.00490659
int3

Function at 0x56abc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5cbbc2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 4]
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push edi
mov ecx, ebx
mov dword [esp + 0xc], ebx
call edx
mov dword [esp + 0x1c], 0
cmp dword [esi + 0x30], 0
je 0x56ac1c
mov ebx, dword [esi + 0x2c]
mov edi, dword [ebx]
cmp edi, ebx
je 0x56ac18
mov eax, dword [edi + 8]
push eax
mov ecx, esi
call fcn.0056aa00
mov edi, dword [edi]
cmp edi, ebx
jne 0x56ac07
mov ebx, dword [esp + 0xc]
mov ecx, dword [esi + 0x2c]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esi + 0x2c]
mov dword [ecx + 4], ecx
mov dword [esi + 0x30], 0
cmp eax, dword [esi + 0x2c]
je 0x56ac47
mov edi, dword [eax]
push eax
call fcn.0048f06d
add esp, 4
mov eax, edi
cmp edi, dword [esi + 0x2c]
jne 0x56ac35
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x38], 0
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
mov ecx, ebx
call edx
mov ecx, dword [esp + 0x14]
pop edi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58c560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [ebp + 0x20]
push ebx
mov ebx, dword [ebp + 0x1c]
fld dword [ebx + 4]
mov ecx, eax
fldz
sar eax, 8
fcomp st(1)
mov byte [esp + 7], al
sar ecx, 0x10
push esi
push edi
mov byte [esp + 0xe], cl
fnstsw ax
test ah, 0x41
jp 0x58c598
fadd qword [0x650bc0]
jmp 0x58c59e
fsub qword [0x650bc0]
call fcn.005c6e00
fld dword [ebx + 4]
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
imul eax, esi
lea eax, [edx + eax*4]
mov dword [ebp + 8], eax
call fcn.005c6e00
mov ecx, eax
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fld dword [ebx + 0xc]
fcompp
fnstsw ax
test ah, 0x41
jne 0x58c73a
lea eax, [ecx + ecx*2]
mov ecx, dword [ebp + 0x18]
lea edx, [esi*4]
lea edi, [ecx + eax*8]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x1c], edi
lea esp, [esp]
mov edx, dword [edi]
cmp edx, dword [edi + 4]
jg 0x58c714
push ebx
mov ecx, edi
lea esi, [esp + 0x34]
call fcn.004f0610
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
cmp esi, dword [esp + 0x34]
jge 0x58c714
movzx edx, byte [ebp + 0x20]
movzx eax, byte [esp + 0xe]
movzx ecx, byte [esp + 0xf]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
sar edx, 8
imul edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
sar eax, 8
add edx, eax
mov ebx, dword [ecx + edx*4]
mov edx, dword [ebp + 8]
mov edi, dword [edx + esi*4]
movzx ecx, bl
imul ecx, dword [esp + 0x20]
mov eax, 0x80808081
mul ecx
shr edx, 7
mov ecx, edx
mov edx, ebx
and edx, 0xff0000
imul edx, dword [esp + 0x24]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff0000
and ecx, 0xff
or ecx, edx
mov edx, ebx
and edx, 0xff00
imul edx, dword [esp + 0x28]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff00
or ecx, edx
mov eax, edi
not eax
mov edx, eax
xor eax, ecx
and eax, 0xfefefe
and edx, ecx
lea eax, [eax + edx*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov edx, eax
or eax, edi
or edx, ecx
mov ecx, dword [ebp + 8]
sub eax, edx
mov edx, dword [esp + 0x40]
add dword [esp + 0x14], edx
xor eax, ebx
and eax, 0xffffff
xor eax, ebx
mov dword [ecx + esi*4], eax
mov eax, dword [esp + 0x44]
add dword [esp + 0x18], eax
inc esi
cmp esi, dword [esp + 0x34]
jl 0x58c63f
mov ebx, dword [ebp + 0x1c]
mov edi, dword [esp + 0x1c]
inc dword [esp + 0x10]
fild dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
fld dword [ebx + 0xc]
add dword [ebp + 8], ecx
add edi, 0x18
fcompp
mov dword [esp + 0x1c], edi
fnstsw ax
test ah, 0x41
je 0x58c5f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x58c750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x20]
sub esp, 0x3c
push ebx
push esi
push edi
test eax, eax
je 0x58c92d
mov esi, dword [ebp + 0x1c]
fld dword [esi + 4]
mov ecx, eax
fldz
sar eax, 8
fcomp st(1)
mov byte [esp + 0xf], al
sar ecx, 0x10
mov byte [esp + 0xe], cl
fnstsw ax
test ah, 0x41
jp 0x58c790
fadd qword [0x650bc0]
jmp 0x58c796
fsub qword [0x650bc0]
call fcn.005c6e00
fld dword [esi + 4]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
imul eax, edi
lea eax, [edx + eax*4]
mov dword [ebp + 8], eax
call fcn.005c6e00
mov ecx, eax
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fld dword [esi + 0xc]
fcompp
fnstsw ax
test ah, 0x41
jne 0x58c92d
lea eax, [ecx + ecx*2]
mov ecx, dword [ebp + 0x18]
lea edx, [edi*4]
lea ebx, [ecx + eax*8]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x1c], ebx
mov edx, dword [ebx]
cmp edx, dword [ebx + 4]
jg 0x58c907
push esi
mov ecx, ebx
lea esi, [esp + 0x34]
call fcn.004f0610
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov dword [esp + 0x18], eax
cmp esi, dword [esp + 0x34]
jge 0x58c904
movzx ecx, byte [ebp + 0x20]
movzx edx, byte [esp + 0xe]
movzx eax, byte [esp + 0xf]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 0xc]
sar ecx, 8
imul ecx, dword [ebp + 0x14]
mov edx, edi
sar edx, 8
add ecx, edx
mov ebx, dword [eax + ecx*4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + esi*4]
mov dword [esp + 0x14], edx
movzx ecx, bl
imul ecx, dword [esp + 0x20]
mov eax, 0x80808081
mul ecx
shr edx, 7
mov ecx, edx
mov edx, ebx
and edx, 0xff0000
imul edx, dword [esp + 0x24]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff0000
and ecx, 0xff
or ecx, edx
mov edx, ebx
and edx, 0xff00
imul edx, dword [esp + 0x28]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff00
or ecx, edx
mov edx, ecx
xor edx, dword [esp + 0x14]
mov eax, ecx
and eax, dword [esp + 0x14]
add edi, dword [esp + 0x40]
and edx, 0xfefefe
lea eax, [edx + eax*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
sub ecx, eax
add ecx, dword [esp + 0x14]
inc esi
or ecx, eax
mov eax, dword [ebp + 8]
xor ecx, ebx
and ecx, 0xffffff
xor ecx, ebx
mov dword [eax + esi*4 - 4], ecx
mov ecx, dword [esp + 0x44]
add dword [esp + 0x18], ecx
cmp esi, dword [esp + 0x34]
jl 0x58c82f
mov ebx, dword [esp + 0x1c]
mov esi, dword [ebp + 0x1c]
inc dword [esp + 0x10]
fild dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
fld dword [esi + 0xc]
add dword [ebp + 8], edx
add ebx, 0x18
fcompp
mov dword [esp + 0x1c], ebx
fnstsw ax
test ah, 0x41
je 0x58c7e4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c