joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f96f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fdff2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6a4108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [ebp - 4], 1
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov byte [ebp - 4], 2
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov byte [ebp - 4], 3
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov byte [ebp - 4], 4
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov byte [ebp - 4], 5
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov byte [ebp - 4], 6
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov byte [ebp - 4], 7
mov dword [edi + 0x60], vtable.AgReference_class_AgVertexBuffer_.0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov byte [ebp - 4], 8
mov dword [edi + 0x6c], vtable.AgReference_class_AgIndexBuffer_.0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov byte [ebp - 4], 9
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov byte [ebp - 4], 0xa
lea esi, [edi + 0x80]
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00546f60
mov dword [esi], eax
mov byte [ebp - 4], 0xf
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4fc870
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fe48e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6a4108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov dword [esi], vtable.AgStream.0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
add eax, 0xc
mov dword [esi + 8], eax
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0xc]
mov dword [esi], vtable.AgFile.0
call fcn.0054b1c0
mov byte [ebp - 4], 2
push dword [ebp + 0x10]
lea ecx, [esi + 0x14]
mov dword [ebp - 0x14], ecx
call fcn.004f7ed0
mov byte [ebp - 4], 4
mov eax, dword [ebp + 0x14]
sub esp, 8
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov ecx, esp
push str.FileSystem.Stream
mov dword [esi + 0x30], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
call fcn.00503f30
lea ecx, [esi + 0x40]
call fcn.004fc960
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0051e400
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x50fbd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6016b6
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6a4108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.004e4830
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 1
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 1
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [ebp - 4], 0
push 4
call fcn.005c686d
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x50fc85
push dword [ebp + 8]
mov ecx, eax
call fcn.0050d9d0
jmp 0x50fc87
xor eax, eax
mov byte [ebp - 4], 0
mov dword [esi + 4], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x516de0
Capabilities:
Capture screenshot
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6a4108]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push ebx
mov eax, ecx
push esi
mov dword [ebp - 0x24], eax
je 0x516e13
mov ebx, dword [eax + 0x2d4]
lea eax, [ebp - 0x14]
push eax
push ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
jmp 0x516e29
xor ebx, ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
push ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov esi, eax
push ecx
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], esi
push ecx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebx, eax
push ebx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
push 0xcc0020
push 0
push 0
push dword [ebp - 0x1c]
mov esi, eax
push ecx
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
push ecx
push 0
push 0
push dword [ebp - 0x20]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [ebp - 0x20]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0x24]
push dword [eax + 0x2d4]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_ReleaseDC]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005c7124
mov esp, ebp
pop ebp
ret 4
Function at 0x5176a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x602956
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6a4108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebx + 4], 0
push 0x14
mov dword [ebx], vtable.AgThread.0
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
call fcn.005c686d
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x51770a
lea ecx, [edi + 0xc]
call fcn.004f81a0
mov byte [ebp - 4], 0
jmp 0x51770c
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebx + 0xc], edi
mov dword [edi], esi
mov eax, dword [ebx + 0xc]
mov edi, dword [ebp + 0x14]
mov dword [eax + 4], ecx
mov ecx, dword [ebx + 0xc]
push edi
add ecx, 0xc
call fcn.004f8330
lea eax, [ebp + 8]
push eax
push 0
push ebx
push 0x517920
push esi
push 0
call fcn.005caa5d
mov ecx, dword [ebx + 0xc]
push edi
mov dword [ecx + 8], eax
push dword [ebp + 8]
call fcn.00517890
mov esi, dword [ebp + 0x10]
add esp, 0x20
cmp esi, 0xffffffff
je 0x51778f
lea ecx, [esi*4]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, 0xfffffffe
add eax, edx
push eax
mov eax, dword [ebx + 0xc]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebx + 0xc]
mov dword [eax + 4], esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x51c990
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
movzx esi, byte [edx]
movzx eax, byte [edx + 1]
xor esi, 0x811c9dc5
imul esi, esi, 0x1000193
xor esi, eax
movzx eax, byte [edx + 2]
imul esi, esi, 0x1000193
xor esi, eax
movzx eax, byte [edx + 3]
imul esi, esi, 0x1000193
mov edx, dword [ecx + 0x14]
xor esi, eax
imul esi, esi, 0x1000193
mov eax, edx
and eax, esi
pop esi
cmp dword [ecx + 0x18], eax
ja 0x51c9e0
shr edx, 1
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
pop ebp
ret 4
Function at 0x51cc60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul edx, edx, 0x1000193
xor edx, eax
imul edx, edx, 0x1000193
push edi
mov edi, dword [ebx + 0x14]
mov ecx, edi
and ecx, edx
mov dword [ebp - 4], ebx
cmp dword [ebx + 0x18], ecx
ja 0x51ccb7
shr edi, 1
or eax, 0xffffffff
sub eax, edi
add ecx, eax
mov eax, dword [ebx + 8]
mov edx, dword [ebp - 4]
mov edi, dword [eax + ecx*8]
mov edx, dword [edx]
lea ebx, [eax + ecx*8]
mov eax, edi
cmp edi, edx
jne 0x51cccf
mov ecx, edx
jmp 0x51ccd4
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x51cd03
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x51cce3
mov eax, dword [eax]
jmp 0x51ccc7
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], edx
jne 0x51ccf3
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5214f0
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x604455
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x6a4108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0055b5b0
mov dword [ebp - 4], 0
mov dword [esi], vtable.AgPCInputManager.0
mov dword [esi + 0x688], 0
mov dword [esi + 0x68c], 0
mov dword [esi + 0x690], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x694], 0
mov dword [esi + 0x698], 0
mov byte [ebp - 4], 2
push 0x98
call fcn.005c686d
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x52158c
push 0
mov ecx, eax
call fcn.00521820
jmp 0x52158e
xor eax, eax
mov byte [ebp - 4], 2
push eax
lea ecx, [esi + 0x694]
call fcn.00521d00
push 0x58
call fcn.005c686d
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x5215be
push 1
mov ecx, eax
call fcn.005216c0
jmp 0x5215c0
xor eax, eax
mov byte [ebp - 4], 2
push eax
lea ecx, [esi + 0x68c]
call fcn.00521d00
sub esp, 8
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
lea ecx, [esi + 0x68c]
call fcn.00505390
mov byte [ebp - 4], 5
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.004f30d0
sub esp, 8
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
lea ecx, [esi + 0x694]
call fcn.00505390
mov byte [ebp - 4], 6
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.004f30d0
push 8
call fcn.005c686d
mov ecx, eax
add esp, 4
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 7
test ecx, ecx
je 0x52163c
mov dword [ecx], 0
mov dword [ecx + 4], 0
jmp 0x52163e
xor ecx, ecx
mov byte [ebp - 4], 2
mov dword [esi + 0x688], ecx
mov eax, dword [0x75aca4]
mov dword [ecx], eax
mov eax, dword [0x75aca8]
mov dword [ecx + 4], eax
call fcn.005163c0
test eax, eax
je 0x521698
push 0xc
push 2
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x20001
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x60001
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x521ea0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
call fcn.005164c0
neg eax
sbb eax, eax
and eax, 2
inc eax
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, eax
lea eax, [edx - 8]
cmp eax, 0xd6
ja case.0x521ed1.10
movzx ecx, byte [eax + 0x52220c]
jmp dword [ecx*4 + 0x522124]
mov eax, 0x65
pop ebp
ret
mov eax, 0x1b
pop ebp
ret
cmp dword [ebp + 0xc], 0
mov eax, 0xd
mov ecx, 0x7e
cmovne eax, ecx
pop ebp
ret
mov eax, 0x1f
pop ebp
ret
mov eax, 7
pop ebp
ret
cmp dword [ebp + 0xc], 0
mov eax, 0x6c
mov ecx, 0x2e
cmovne eax, ecx
pop ebp
ret
cmp dword [ebp + 0xc], 0
mov eax, 0x60
mov ecx, 0x2d
cmovne eax, ecx
pop ebp
ret
cmp dword [ebp + 0xc], 0
mov eax, 0x69
mov ecx, 0x20
cmovne eax, ecx
pop ebp
ret
cmp dword [ebp + 0xc], 0
mov eax, 0x63
mov ecx, 0x21
cmovne eax, ecx
pop ebp
ret
cmp dword [ebp + 0xc], 0
mov eax, 0x67
mov ecx, 0x23
cmovne eax, ecx
pop ebp
ret
cmp dword [ebp + 0xc], 0
mov eax, 0x61
mov ecx, 0x22
cmovne eax, ecx
pop ebp
ret
xor eax, eax
cmp dword [ebp + 0xc], eax
setne al
add eax, 0xa2
pop ebp
ret
mov eax, 0xa0
pop ebp
ret
mov eax, 0xa1
pop ebp
ret
xor eax, eax
cmp dword [ebp + 0xc], eax
setne al
add eax, 0xa4
pop ebp
ret
mov eax, 0xa6
pop ebp
ret
mov eax, 0xa7
pop ebp
ret
mov eax, 0xa8
pop ebp
ret
cmp dword [ebp + 0xc], 0
mov eax, 0x68
mov ecx, 0x25
cmovne eax, ecx
pop ebp
ret
cmp dword [ebp + 0xc], 0
mov eax, 0x62
mov ecx, 0x27
cmovne eax, ecx
pop ebp
ret
cmp dword [ebp + 0xc], 0
mov eax, 0x64
mov ecx, 0x24
cmovne eax, ecx
pop ebp
ret
cmp dword [ebp + 0xc], 0
mov eax, 0x66
mov ecx, 0x26
cmovne eax, ecx
pop ebp
ret
mov eax, 0x70
pop ebp
ret
mov eax, 0x71
pop ebp
ret
mov eax, 0x72
pop ebp
ret
mov eax, 0x73
pop ebp
ret
mov eax, 0x74
pop ebp
ret
mov eax, 0x75
pop ebp
ret
mov eax, 0x76
pop ebp
ret
mov eax, 0x77
pop ebp
ret
mov eax, 0x78
pop ebp
ret
mov eax, 0x79
pop ebp
ret
mov eax, 0x7a
pop ebp
ret
mov eax, 0x7b
pop ebp
ret
mov eax, 0x14
pop ebp
ret
mov eax, 8
pop ebp
ret
mov eax, 0xc0
pop ebp
ret
mov eax, 0x7d
pop ebp
ret
mov eax, 0x7c
pop ebp
ret
mov eax, 0xdb
pop ebp
ret
mov eax, 0xdd
pop ebp
ret
mov eax, 0xba
pop ebp
ret
mov eax, 0xde
pop ebp
ret
mov eax, 0xbc
pop ebp
ret
mov eax, 0xbe
pop ebp
ret
mov eax, 0xbf
pop ebp
ret
mov eax, 0xdc
pop ebp
ret
mov eax, 0x6b
pop ebp
ret
mov eax, 0x6d
pop ebp
ret
mov eax, 0x6a
pop ebp
ret
mov eax, 0x6f
pop ebp
ret
mov eax, 0xa2
pop ebp
ret
mov eax, 0xa3
pop ebp
ret
mov eax, 0xa4
pop ebp
ret
mov eax, 0xa5
pop ebp
ret
mov eax, 0x90
pop ebp
ret
mov eax, 0x91
pop ebp
ret
lea eax, [edx - 0x61]
cmp eax, 0x19
ja 0x522108
lea eax, [edx - 0x20]
pop ebp
ret
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x522114
mov eax, edx
pop ebp
ret
lea ecx, [edx - 0x30]
xor eax, eax
cmp ecx, 9
cmovbe eax, edx
pop ebp
ret
Function at 0x522ee0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6046c9
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6a4108]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x10
lea eax, [ebp - 0x30]
push eax
movzx eax, word [ebp + 0xc]
push 0x100
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0
call fcn.005222f0
add esp, 8
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [ebp - 0x50]
push 0
push 0
push 0x20
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x30]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xffffffffffffffff
lea eax, [ebp - 0x50]
push eax
mov ecx, esi
call fcn.004f8040
mov dword [ebp - 4], 0
mov dword [ebp - 0x54], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c7124
mov esp, ebp
pop ebp
ret 8

Function at 0x523340
Capabilities:
Capture screenshot
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
movzx edx, word [esi + 0x12]
movzx ebx, word [esi + 0x16]
mov eax, edx
shr eax, 2
and eax, 1
push eax
movzx eax, word [esi + 0x10]
shr edx, 1
and edx, 1
push edx
push eax
push ebx
mov edi, ecx
call fcn.00522880
add esp, 0x10
test eax, eax
je 0x5233ff
movzx ecx, word [esi + 0x12]
test cl, 1
je 0x5233f7
cmp ebx, 0x2c
jne 0x5233e8
mov ecx, dword [edi + 0x690]
push 1
call fcn.004d3ac0
mov edx, dword [eax]
mov eax, dword [edx]
cmp eax, edx
je 0x5233af
jmp 0x5233a0
mov ecx, dword [eax + 8]
cmp dword [ecx + 4], 0
je 0x5233b4
mov eax, dword [eax]
cmp eax, edx
jne 0x5233a0
mov ecx, 0x75ac9c
cmp dword [ecx], 0
je 0x5233d1
cmp dword [ecx + 0x14], 0xa4
jbe 0x5233d1
push 0xa4
add ecx, 8
call fcn.004d3880
jmp 0x5233d3
xor al, al
pop edi
pop esi
movzx eax, al
pop ebx
mov dword [ebp + 8], eax
mov ecx, dword [0x75ac88]
pop ebp
jmp fcn.00516de0
push eax
mov ecx, edi
call fcn.00523240
pop edi
pop esi
pop ebx
pop ebp
ret 4
push eax
mov ecx, edi
call fcn.005231e0
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x5344d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x605dca
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x6a4108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.AgSingleton_class_AgLeaderboardManager_.0
mov dword [ebp - 4], 0
lea esi, [edi + 4]
push 0x102
lea eax, [esi + 0x28]
push eax
mov dword [edi], vtable.AgLeaderboardManager.0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], eax
call fcn.005e26f6
add esp, 8
test eax, eax
je 0x534539
push eax
call fcn.005e277c
add esp, 4
mov byte [ebp - 4], 3
call fcn.0050f000
cmp dword [eax + 4], 0
je 0x53454f
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 4
lea esi, [edi + 0x30]
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00506a20
mov dword [esi], eax
mov byte [ebp - 4], 9
lea esi, [edi + 0x38]
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0054f100
mov dword [esi], eax
mov byte [ebp - 4], 0xe
lea eax, [edi + 0x80]
mov dword [ebp - 0x1c], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x40], 0
mov byte [ebp - 4], 0x10
movsd xmm0, qword [0x62fe38]
sub esp, 8
lea ecx, [edi + 0x110]
mov dword [edi + 0x100], 0
mov dword [edi + 0x104], 0
movsd qword [esp], xmm0
call fcn.004f7d30
mov dword [edi + 0x138], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x534610
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x605e32
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6a4108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
lea ecx, [ebx + 8]
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
lea eax, [edi + 8]
push eax
call fcn.004f7ed0
mov dword [ebp - 4], 0
lea eax, [edi + 0x10]
push eax
lea ecx, [ebx + 0x10]
call fcn.0054b1c0
mov byte [ebp - 4], 1
mov eax, dword [edi + 0x18]
lea esi, [ebx + 0x18]
mov dword [ebp + 8], esi
mov dword [esi], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x30]
push eax
lea ecx, [esi + 0x18]
call fcn.004f7ed0
mov byte [ebp - 4], 2
lea eax, [edi + 0x38]
push eax
lea ecx, [esi + 0x20]
call fcn.0054b1c0
mov byte [ebp - 4], 4
lea eax, [edi + 0x40]
push eax
lea ecx, [ebx + 0x40]
call fcn.0054b1c0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5396a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x606e78
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x6a4108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.AgSingleton_class_AgResourceManager_.0
mov dword [ebp - 4], 0
lea esi, [edi + 4]
push 0x102
lea eax, [esi + 0x28]
push eax
mov dword [edi], vtable.AgResourceManager.0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], eax
call fcn.005e26f6
add esp, 8
test eax, eax
je 0x539709
push eax
call fcn.005e277c
add esp, 4
mov byte [ebp - 4], 3
call fcn.0050f000
cmp dword [eax + 4], 0
je 0x53971f
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 4
sub esp, 8
mov ecx, esp
push str.Resources
call fcn.00503f30
lea ecx, [edi + 0x30]
call fcn.004fc960
lea ecx, [edi + 0x38]
call fcn.005040e0
mov byte [ebp - 4], 5
push fcn.004f8230
push fcn.004f81a0
push 8
push 8
lea eax, [edi + 0x74]
push eax
call fcn.005c9b60
mov byte [ebp - 4], 6
lea eax, [ebp - 0xe]
push eax
lea eax, [ebp - 0xf]
lea ecx, [edi + 0xb4]
push eax
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0xd], 0
call fcn.00539500
mov byte [ebp - 4], 8
lea esi, [edi + 0xd4]
mov ecx, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005154e0
mov dword [esi], eax
mov byte [ebp - 4], 0xe
lea ecx, [edi + 0xdc]
call fcn.00530b60
mov byte [ebp - 4], 0xf
lea esi, [edi + 0x178]
mov dword [ebp - 0x20], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 0x10
push 0
push 0x7fffffff
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0xc]
push 0
mov dword [esi + 0x10], 0
mov ecx, dword [esi + 0x10]
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi + 0x10], eax
mov byte [ebp - 4], 0x12
mov dword [edi + 0x18c], 0
mov dword [edi + 0x190], 0
mov dword [edi + 0x194], 0
mov byte [ebp - 4], 0x13
mov dword [edi + 0x198], 1
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x53bf40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6076b9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6a4108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov esi, dword [ecx + 0x30]
mov edi, dword [ebp + 8]
mov dword [ecx + 0x3c], esi
push esi
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.004f7ed0
mov dword [ebp - 4], 2
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov ecx, dword [esi + 0xc]
mov dword [edi + 0xc], ecx
mov ecx, dword [esi + 0x10]
mov dword [edi + 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4