joyce8/EMBER2024-capa huggingface dataset:
Function at 0x512fdc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x51300a
mov eax, ebx
call fcn.00513a90
cmp dword [ebx + 0x40], 0
je 0x513003
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x51307b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x51306d
cmp dword [ebx + 8], 0
je 0x51302c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x51303e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x51306d
cmp dword [ebx + 8], 0
je 0x51301f
cmp eax, 3
je 0x513051
dec eax
jne 0x51301f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x51301f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x51301f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x513099
cmp dword [ebx + 0x14], 0xcc
je 0x513099
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005130a4
pop ebx
ret

Function at 0x52711c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x71790c
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x52713e
shr eax, 1
xor eax, 0xedb88320
jmp 0x527140
shr eax, 1
dec edx
jne 0x52712c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x527125
mov byte [0x717d0c], 1
pop esi
pop ebx
ret

Function at 0x52715c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x717d0c], 0
jne 0x527173
call fcn.0052711c
mov eax, edi
dec eax
test eax, eax
jl 0x52719b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x71790c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x52717d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x529f44
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x529fde.0
jmp dword [ecx*4 + 0x529f77]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x529fa9
sub dl, 8
je 0x529fb8
jmp case.0x529fde.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x529bec
jmp case.0x529fde.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x529c44
jmp case.0x529fde.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x529fde.0
movzx ecx, byte [ecx + 0x529fe5]
jmp dword [ecx*4 + 0x529ff6]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x529cf0
jmp case.0x529fde.0
cmp dl, 3
jne 0x52a023
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x529d48
jmp case.0x529fde.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x529d04
jmp case.0x529fde.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x529d8c
jmp case.0x529fde.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x52a04e
sub dl, 8
je 0x52a05a
jmp case.0x529fde.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x529db8
jmp case.0x529fde.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x529e24
jmp case.0x529fde.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x52a079
sub dl, 8
je 0x52a085
jmp case.0x529fde.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x529ee0
jmp case.0x529fde.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x529f08
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x52a127
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005290f0
test eax, eax
je 0x52a127
mov eax, ebx
call fcn.0052a130
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x52a0c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x52a130
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x52a161
dec al
je 0x52a19c
dec al
je 0x52a1e1
dec al
je 0x52a24a
jmp 0x52a2d4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x52a2d4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x52a171
jmp 0x52a2d4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x52a2d4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x52a1ac
jmp 0x52a2d4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x52a2d4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x52a210
xor ebp, ebp
jmp 0x52a220
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x52a229
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x52a1f1
jmp 0x52a2d4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x52a2d4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x52a2a3
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005271a4
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x52a25e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x52eff4
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffec8
mov esi, eax
mov ebx, 1
mov dword [esp + 0x24], 0x114
lea eax, [esp + 0x24]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x28], 5
jb 0x52f047
push esp
call sub.kernel32.dll_GetSystemInfo_1
mov eax, esp
call fcn.0052efd4
cmp eax, 1
jge 0x52f033
mov eax, 1
cmp eax, 0x100
jle 0x52f03f
mov eax, pe_nt_image_headers32
cmp eax, esi
jle 0x52f045
mov eax, esi
mov ebx, eax
mov eax, ebx
add esp, 0x138
pop esi
pop ebx
ret

Function at 0x52f498
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
push esi
push edi
mov dword [ebp - 0x13c], 0x114
lea eax, [ebp - 0x13c]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x138], 5
jb 0x52f579
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov byte [ebp - 1], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 4]
mov eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [0x6f5ec8]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, dword [esp + 4]
jne 0x52f507
cmp eax, dword [esp]
pop edx
pop eax
jb 0x52f50f
jmp 0x52f50b
pop edx
pop eax
jl 0x52f50f
mov byte [ebp - 1], 0
mov ebx, 1
mov eax, dword [ebp + 8]
mov esi, ecx
dec esi
test esi, esi
jl 0x52f579
inc esi
xor edi, edi
jmp 0x52f52c
mov eax, ebx
call fcn.0052f47c
mov ebx, eax
test dword [ebp - 0x18], ebx
je 0x52f523
cmp byte [ebp - 1], 0
je 0x52f54f
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + edi*4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SetThreadAffinityMask
jmp 0x52f56c
mov eax, ebx
call fcn.0052f484
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + edi*4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SetThreadIdealProcessor
mov eax, ebx
call fcn.0052f47c
mov ebx, eax
inc edi
dec esi
jne 0x52f52c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5429b8
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeec
mov ebx, ecx
mov esi, edx
mov edi, eax
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 4], 5
jb 0x542a1a
mov ebp, 0x542a28
push ebp
call sub.kernel32.dll_GlobalFindAtomW
test ax, ax
jne 0x5429f2
push ebp
call sub.kernel32.dll_GlobalAddAtomW
test ax, ax
je 0x542a1a
push ebp
push edi
call sub.user32.dll_GetPropW
test bl, bl
je 0x542a0e
or eax, esi
push eax
push ebp
push edi
call sub.user32.dll_SetPropW
jmp 0x542a1a
not esi
and eax, esi
push eax
push ebp
push edi
call sub.user32.dll_SetPropW
add esp, 0x114
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5449ec
Capabilities:
Hash data using sha256

Disassembly:
push ebx
xor ecx, ecx
mov edx, 0x6f5ee8
mov ebx, dword [edx]
mov dword [eax + ecx*4 + 4], ebx
inc ecx
add edx, 4
cmp ecx, 8
jne 0x5449f4
xor edx, edx
mov dword [eax + 0x24], edx
xor edx, edx
mov dword [eax + 0x28], edx
xor edx, edx
mov dword [eax + 0x6c], edx
pop ebx
ret
Function at 0x55896c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
push eax
push ebx
push ecx
push edx
push esi
push edi
mov ecx, dword [ebp + 8]
shr ecx, 2
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
xor eax, eax
mov edx, dword [edi]
mov ebx, dword [esi]
xor ebx, edx
or eax, ebx
add edi, 4
add esi, 4
dec ecx
jne 0x55898c
mov dword [ebp - 0xc], eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 0xc], 0
sete al
mov esp, ebp
pop ebp
ret 4
Function at 0x5679bc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x567ab9
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov dl, 1
mov eax, esi
call fcn.004e0e04
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00407460
lea ecx, [ebp - 8]
mov dl, 1
mov eax, esi
call fcn.004e0e04
mov edx, dword [ebp - 8]
lea eax, [ebx + 8]
call fcn.00407460
lea edx, [ebx + 0xc]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x10]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x14]
mov ecx, 0x10
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x24]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x28]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x2c]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x30]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x34]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x38]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x10]
lea edx, [ebx + 0x3c]
mov ecx, 4
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x567ac0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407458
ret

Function at 0x567acc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x567bda
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 8]
xor edx, edx
mov eax, esi
call fcn.004e0e04
mov edx, dword [ebp - 8]
lea eax, [ebx + 4]
call fcn.00407460
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, esi
call fcn.004e0e04
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 8]
call fcn.00407460
lea edx, [ebx + 0xc]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x10]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x14]
mov ecx, 0x10
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x24]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x28]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x2c]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x30]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x34]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebx + 0x38]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x10]
lea edx, [ebx + 0x3c]
mov ecx, 4
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x567be1
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00407458
ret
Function at 0x5743e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf0
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp]
cmp byte [eax + 8], 0
je 0x574505
mov eax, dword [esp]
call fcn.00574e68
mov dl, 1
mov eax, dword [esp]
call fcn.00572a90
fstp dword [esp + 0xc]
wait
jmp 0x574493
mov esi, pe_nt_image_headers32
push 0
lea edx, [esp + 0x14]
mov ecx, esi
mov eax, dword [esp + 4]
call fcn.00574d20
mov edi, eax
cmp edi, 1
jl 0x57443a
sub esi, edi
test esi, esi
jg 0x57441c
xor eax, eax
mov dword [esp + 8], eax
mov ebp, pe_nt_image_headers32
lea ebx, [esp + 0x10]
movsx eax, word [ebx]
cdq
xor eax, edx
sub eax, edx
add dword [esp + 8], eax
add ebx, 2
dec ebp
jne 0x574449
mov ecx, pe_nt_image_headers32
mov eax, dword [esp + 8]
cdq
idiv ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp eax, dword [esp + 4]
jg 0x5744aa
fld xword [0x574510]
fadd dword [esp + 0xc]
fstp dword [esp + 0xc]
wait
push dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 4]
call fcn.00572b64
fld dword [esp + 0xc]
mov eax, dword [esp]
fcomp dword [eax + 0x4a8]
wait
fnstsw ax
sahf
jb 0x574417
fld xword [0x574510]
mov eax, dword [esp]
fsubr dword [eax + 0x4a8]
fcomp dword [esp + 0xc]
wait
fnstsw ax
sahf
jae 0x5744c9
xor eax, eax
mov dword [esp + 0xc], eax
fld xword [0x574510]
fsubr dword [esp + 0xc]
fstp dword [esp + 0xc]
wait
fld dword [esp + 0xc]
fcomp dword [0x57451c]
wait
fnstsw ax
sahf
jae 0x5744ee
xor eax, eax
mov dword [esp + 0xc], eax
push dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 4]
call fcn.00572b64
mov eax, dword [esp]
call fcn.00574e74
add esp, 0x210
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x593c08
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x593d49
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov dl, 1
mov eax, dword [0x433fc4]
call fcn.004056c8
mov ebx, eax
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0043f298
push 1
xor ecx, ecx
mov dl, 1
mov eax, ebx
call fcn.004e2550
mov ebx, eax
lea ecx, [ebp - 0x18]
mov dl, 1
mov eax, ebx
call fcn.004e0e04
mov edx, dword [ebp - 0x18]
lea eax, [esi + 0x1c]
call fcn.00407460
lea edx, [esi + 0x28]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x2c]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x30]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0x1c]
mov dl, 1
mov eax, ebx
call fcn.004e0e04
mov edx, dword [ebp - 0x1c]
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
movzx edx, byte [ebp - 0xd]
mov eax, esi
call fcn.005938ac
movzx edi, byte [ebp - 0xd]
dec edi
test edi, edi
jl 0x593d17
inc edi
mov dword [ebp - 0xc], 0
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
mov edx, ebx
call fcn.005927c8
test al, al
jne 0x593d11
mov eax, ebx
call fcn.004056f8
jmp 0x593d2e
inc dword [ebp - 0xc]
dec edi
jne 0x593cf4
mov eax, ebx
call fcn.004056f8
xor eax, eax
mov dword [esi + 0x34], eax
mov dword [esi + 0xc], 0xb
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x593d50
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00407458
ret
Function at 0x594534
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x59467f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov dl, 1
mov eax, dword [0x433fc4]
call fcn.004056c8
mov ebx, eax
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0043f298
push 1
xor ecx, ecx
mov dl, 1
mov eax, ebx
call fcn.004e2550
mov ebx, eax
lea ecx, [ebp - 0x18]
mov dl, 1
mov eax, ebx
call fcn.004e0e04
mov edx, dword [ebp - 0x18]
lea eax, [esi + 0x1c]
call fcn.00407460
lea edx, [esi + 0x28]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x2c]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x30]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x34]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0x1c]
mov dl, 1
mov eax, ebx
call fcn.004e0e04
mov edx, dword [ebp - 0x1c]
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
movzx edx, byte [ebp - 0xd]
mov eax, esi
call fcn.005938ac
movzx edi, byte [ebp - 0xd]
dec edi
test edi, edi
jl 0x594652
inc edi
mov dword [ebp - 0xc], 0
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
mov edx, ebx
call fcn.005927c8
test al, al
jne 0x59464c
mov eax, ebx
call fcn.004056f8
jmp 0x594664
inc dword [ebp - 0xc]
dec edi
jne 0x59462f
mov eax, ebx
call fcn.004056f8
mov dword [esi + 0xc], 0xc
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x594686
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00407458
ret
Function at 0x594694
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x594803
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov dl, 1
mov eax, dword [0x433fc4]
call fcn.004056c8
mov ebx, eax
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0043f298
push 1
xor ecx, ecx
mov dl, 1
mov eax, ebx
call fcn.004e2550
mov ebx, eax
lea ecx, [ebp - 0x1c]
mov dl, 1
mov eax, ebx
call fcn.004e0e04
mov edx, dword [ebp - 0x1c]
lea eax, [esi + 0x1c]
call fcn.00407460
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x28]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x2c]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x30]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x34]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
cmp dword [ebp - 0x18], 1
jl 0x594771
lea edx, [esi + 0x38]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0x20]
mov dl, 1
mov eax, ebx
call fcn.004e0e04
mov edx, dword [ebp - 0x20]
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
movzx edx, byte [ebp - 0xd]
mov eax, esi
call fcn.005938ac
movzx edi, byte [ebp - 0xd]
dec edi
test edi, edi
jl 0x5947d6
inc edi
mov dword [ebp - 0xc], 0
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
mov edx, ebx
call fcn.005927c8
test al, al
jne 0x5947d0
mov eax, ebx
call fcn.004056f8
jmp 0x5947e8
inc dword [ebp - 0xc]
dec edi
jne 0x5947b3
mov eax, ebx
call fcn.004056f8
mov dword [esi + 0xc], 0xd
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59480a
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407458
ret