joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c228a
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x104
push esi
mov esi, ecx
push 0
lea ecx, [esp + 8]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edx, dword [esp + 0x110]
mov eax, dword [esp + 0x10c]
push edx
lea ecx, [esp + 8]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x546e1e
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4c22de
pop esi
add esp, 0x104
ret 0xc
lea ecx, [esp + 4]
push ecx
push reloc.WS2_32.dll_connect
mov ecx, esi
call fcn.004c1ff0
mov eax, 1
pop esi
add esp, 0x104
ret 0xc

Function at 0x4c2300
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push eax
push 0x4fb218
push 1
push 0
push 0x4fb208
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x4c232e
xor eax, eax
add esp, 0x210
ret 8
mov eax, dword [esp]
mov edx, dword [esp + 0x214]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp]
lea edx, [esp + 4]
push edx
push 0x4fb228
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jge 0x4c2362
xor eax, eax
add esp, 0x210
ret 8
mov ecx, dword [esp + 0x218]
lea eax, [esp + 8]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push 2
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 1
add esp, 0x210
ret 8
Function at 0x4c4330
Capabilities:
Capture screenshot
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x10
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
push edi
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4c4358
xor eax, eax
pop edi
add esp, 0x10
ret 0xc
push ebx
push ebp
push esi
push 0
push 0
push 0
push 0x5473fa
call dword [sym.imp.GDI32.dll_CreateDCA]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 4]
mov edi, dword [edi + 0xc]
push 8
push esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test ebp, ebp
jge 0x4c43a4
xor ebp, ebp
mov ecx, dword [esp + 0x24]
test ecx, ecx
jge 0x4c43b4
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x10]
cmp ebx, ecx
jle 0x4c43be
mov ebx, ecx
cmp edi, eax
jle 0x4c43c4
mov edi, eax
mov edx, dword [esp + 0x24]
sub ebx, ebp
sub edi, edx
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x24]
push 0xcc0020
push edx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
push ebx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov eax, dword [esp + 0x28]
pop esi
sub eax, 0
pop ebp
pop ebx
je 0x4c444c
dec eax
jne 0x4c4463
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4c4463
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esp + 4]
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esp + 8], 1
jmp 0x4c4463
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 4]
push ecx
mov ecx, dword [esp + 0x14]
push edx
call fcn.004c4560
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 8]
pop edi
add esp, 0x10
ret 0xc
Function at 0x4c4480
Capabilities:
Capture screenshot

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4c449c
xor eax, eax
pop edi
add esp, 8
ret 4
push ebx
push ebp
push esi
push 0
push 0
push 0
push 0x5473fa
call dword [sym.imp.GDI32.dll_CreateDCA]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 4]
mov edi, dword [edi + 0xc]
push 8
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test ebp, ebp
jge 0x4c44e8
xor ebp, ebp
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jge 0x4c44f8
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x14]
cmp ebx, ecx
jle 0x4c4502
mov ebx, ecx
cmp edi, eax
jle 0x4c4508
mov edi, eax
mov edx, dword [esp + 0x1c]
sub ebx, ebp
sub edi, edx
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x1c]
push 0xcc0020
push edx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
push ebx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 4
Function at 0x4d8ec8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4d8f0a
call fcn.004db657
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4d8f0a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4d8f01
xor eax, eax
jmp 0x4d8f12
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004d8f18
pop edi
pop esi
pop ebx
ret 4
Function at 0x4df18c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov edi, dword [ebp + 8]
mov edx, dword [0x56fef0]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [0x56fef4]
dec edi
xor eax, eax
add bl, byte [edx + 0x56fdf1]
mov al, byte [edx + 0x56fdf1]
mov ch, byte [ebx + 0x56fdf0]
mov byte [ebx + 0x56fdf0], al
mov byte [edx + 0x56fdf1], ch
add al, ch
inc edi
mov al, byte [eax + 0x56fdf0]
inc dl
xor byte [edi], al
dec cl
jne 0x4df1a7
mov dword [0x56fef0], edx
mov dword [0x56fef4], ebx
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x4f2b3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4f2b80
call fcn.004f5e95
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4f2b80
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4f2b77
xor eax, eax
jmp 0x4f2b88
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004f2b8e
pop edi
pop esi
pop ebx
ret 4

Function at 0x4f5a07
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4f5a35
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4f5a53
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004f596d
jmp 0x4f5a53
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4f5a53
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004f596d
test edi, edi
mov eax, edi
jne 0x4f5a3d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4070b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push edi
mov edi, dword [esp + 0xc]
shr edi, 2
test edi, edi
mov ecx, 0xeeeeeeee
je 0x40710b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 8]
push ebx
push esi
nop
lea esp, [esp]
mov esi, eax
and esi, 0xff
add ecx, dword [esi*4 + 0x801cc0]
mov ebx, dword [edx]
lea esi, [ecx + eax]
imul ecx, ecx, 0x21
xor ebx, esi
mov esi, ebx
lea ecx, [ecx + esi + 3]
mov esi, eax
not esi
shl esi, 0x15
add esi, 0x11111111
shr eax, 0xb
mov dword [edx], ebx
add edx, 4
or eax, esi
dec edi
jne 0x4070d0
pop esi
pop ebx
pop edi
ret

Function at 0x407110
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push edi
mov edi, dword [esp + 0xc]
shr edi, 2
test edi, edi
mov ecx, 0xeeeeeeee
je 0x407169
mov eax, dword [esp + 0x10]
push ebx
push esi
mov esi, dword [esp + 0x10]
nop
lea esp, [esp]
mov edx, dword [esi]
mov ebx, eax
and ebx, 0xff
add ecx, dword [ebx*4 + 0x801cc0]
lea ebx, [ecx + eax]
imul ecx, ecx, 0x21
xor ebx, edx
lea ecx, [ecx + edx + 3]
mov edx, eax
not edx
shl edx, 0x15
add edx, 0x11111111
shr eax, 0xb
mov dword [esi], ebx
add esi, 4
or eax, edx
dec edi
jne 0x407130
pop esi
pop ebx
pop edi
ret

Function at 0x407680
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x408190
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
je 0x40819d
mov eax, dword [esi]
push ebx
mov bl, byte [esp + 0x18]
test bl, 1
je 0x4081aa
or eax, 0xffffffff
test bl, 2
je 0x4081df
mov edx, dword [esp + 0x10]
test edx, edx
mov ecx, dword [esp + 0xc]
je 0x4081df
push ebp
push edi
lea ecx, [ecx]
movzx ebp, byte [ecx]
mov edi, eax
and edi, 0xff
xor edi, ebp
mov edi, dword [edi*4 + 0x7a89f8]
shr eax, 8
xor eax, edi
inc ecx
dec edx
jne 0x4081c0
pop edi
pop ebp
test bl, 4
pop ebx
je 0x4081e7
not eax
test esi, esi
je 0x4081ed
mov dword [esi], eax
pop esi
ret
Function at 0x412940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
xor ecx, ecx
mov dword [esi], 0x759070
mov eax, dword [esi + 0x80]
test eax, eax
setle cl
push edi
dec ecx
and ecx, eax
mov edi, ecx
test edi, edi
jle 0x41299f
mov edx, dword [edi + 8]
push edi
lea ecx, [esi + 0x78]
mov dword [edx + 0x24], 0
call fcn.00417ac0
mov eax, dword [eax + 4]
xor ebx, ebx
test eax, eax
setle bl
push 0
mov ecx, edi
dec ebx
and ebx, eax
call fcn.00417c90
push 0
push 0
push edi
mov ecx, 0x8573c0
call fcn.0041f760
test ebx, ebx
mov edi, ebx
jg 0x412961
mov ecx, dword [esi + 0x64]
xor edi, edi
cmp ecx, edi
je 0x4129ad
call fcn.0041acf0
mov ecx, dword [esi + 0x68]
cmp ecx, edi
mov dword [esi + 0x64], edi
je 0x4129bc
call fcn.0041af10
mov dword [esi + 0x68], edi
mov ebx, 0x759064
lea ecx, [esi + 0x1b8]
mov dword [esi + 0x1b4], ebx
call fcn.004177a0
lea ecx, [esi + 0x198]
mov dword [esi + 0x194], ebx
call fcn.004177a0
lea ecx, [esi + 0x178]
mov dword [esi + 0x174], ebx
call fcn.004177a0
lea ecx, [esi + 0x150]
mov dword [esi + 0x14c], ebx
call fcn.004177a0
lea ecx, [esi + 0x130]
mov dword [esi + 0x12c], ebx
call fcn.004177a0
lea ecx, [esi + 0xf0]
mov dword [esi + 0xec], ebx
call fcn.004177a0
lea edi, [esi + 0xd0]
mov dword [esi + 0xcc], ebx
cmp dword [edi], 0
je 0x412a5d
push 0xffffffffffffffff
mov ecx, edi
call fcn.00417d00
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov dword [edi], 0
mov dword [edi + 4], 0
lea edi, [esi + 0xa8]
mov dword [esi + 0xa4], ebx
cmp dword [edi], 0
je 0x412a90
push 0xffffffffffffffff
mov ecx, edi
call fcn.00417d00
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov dword [edi], 0
mov dword [edi + 4], 0
lea edi, [esi + 0x88]
mov dword [esi + 0x84], ebx
cmp dword [edi], 0
je 0x412ac3
push 0xffffffffffffffff
mov ecx, edi
call fcn.00417d00
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov dword [edi], 0
mov dword [edi + 4], 0
lea ebx, [esi + 0x78]
lea edi, [ebx + 4]
lea esp, [esp]
mov eax, dword [edi + 4]
test eax, eax
jle 0x412ae8
push eax
mov ecx, ebx
call fcn.00417ac0
mov ecx, eax
call fcn.00417800
jmp 0x412ad0
mov ecx, edi
call fcn.00417800
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.00412670
Function at 0x412941
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
xor ecx, ecx
mov dword [esi], 0x759070
mov eax, dword [esi + 0x80]
test eax, eax
setle cl
push edi
dec ecx
and ecx, eax
mov edi, ecx
test edi, edi
jle 0x41299f
mov edx, dword [edi + 8]
push edi
lea ecx, [esi + 0x78]
mov dword [edx + 0x24], 0
call fcn.00417ac0
mov eax, dword [eax + 4]
xor ebx, ebx
test eax, eax
setle bl
push 0
mov ecx, edi
dec ebx
and ebx, eax
call fcn.00417c90
push 0
push 0
push edi
mov ecx, 0x8573c0
call fcn.0041f760
test ebx, ebx
mov edi, ebx
jg 0x412961
mov ecx, dword [esi + 0x64]
xor edi, edi
cmp ecx, edi
je 0x4129ad
call fcn.0041acf0
mov ecx, dword [esi + 0x68]
cmp ecx, edi
mov dword [esi + 0x64], edi
je 0x4129bc
call fcn.0041af10
mov dword [esi + 0x68], edi
mov ebx, 0x759064
lea ecx, [esi + 0x1b8]
mov dword [esi + 0x1b4], ebx
call fcn.004177a0
lea ecx, [esi + 0x198]
mov dword [esi + 0x194], ebx
call fcn.004177a0
lea ecx, [esi + 0x178]
mov dword [esi + 0x174], ebx
call fcn.004177a0
lea ecx, [esi + 0x150]
mov dword [esi + 0x14c], ebx
call fcn.004177a0
lea ecx, [esi + 0x130]
mov dword [esi + 0x12c], ebx
call fcn.004177a0
lea ecx, [esi + 0xf0]
mov dword [esi + 0xec], ebx
call fcn.004177a0
lea edi, [esi + 0xd0]
mov dword [esi + 0xcc], ebx
cmp dword [edi], 0
je 0x412a5d
push 0xffffffffffffffff
mov ecx, edi
call fcn.00417d00
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov dword [edi], 0
mov dword [edi + 4], 0
lea edi, [esi + 0xa8]
mov dword [esi + 0xa4], ebx
cmp dword [edi], 0
je 0x412a90
push 0xffffffffffffffff
mov ecx, edi
call fcn.00417d00
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov dword [edi], 0
mov dword [edi + 4], 0
lea edi, [esi + 0x88]
mov dword [esi + 0x84], ebx
cmp dword [edi], 0
je 0x412ac3
push 0xffffffffffffffff
mov ecx, edi
call fcn.00417d00
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov dword [edi], 0
mov dword [edi + 4], 0
lea ebx, [esi + 0x78]
lea edi, [ebx + 4]
lea esp, [esp]
mov eax, dword [edi + 4]
test eax, eax
jle 0x412ae8
push eax
mov ecx, ebx
call fcn.00417ac0
mov ecx, eax
call fcn.00417800
jmp 0x412ad0
mov ecx, edi
call fcn.00417800
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.00412670

Function at 0x45b2c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x80915c]
test eax, eax
push ebx
push edi
mov edi, edx
mov ebx, ecx
je 0x45b2fa
push esi
lea esi, [eax - 1]
xor esi, eax
and esi, eax
call fcn.004399f0
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push edi
mov edx, esi
mov ecx, ebx
call fcn.0045b7f0
mov eax, dword [0x80915c]
test eax, eax
jne 0x45b2d3
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4bad80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push esi
call fcn.006c4ac8
mov edx, eax
movzx eax, byte [esi]
mov ecx, 1
cmp edx, ecx
jbe 0x4badae
push edi
mov edi, eax
imul edi, edi, 0x7a2d
xor edi, eax
movzx eax, byte [ecx + esi]
add eax, edi
inc ecx
cmp ecx, edx
jb 0x4bad98
pop edi
pop esi
ret
Function at 0x4cf060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
imul eax, eax, 0x74
push ebx
lea ebx, [eax + ecx + 0x14f8]
push esi
mov esi, dword [ebx]
xor eax, eax
cmp esi, 0xffffffff
mov esi, dword [ebp + 0xc]
sete al
push edi
mov dword [ebp - 4], ecx
test eax, eax
mov dword [ebp - 8], eax
jne 0x4cf0ac
mov edx, esi
mov eax, 0x1a
xor ecx, ecx
mov edi, dword [edx]
dec eax
xor edi, eax
add ecx, edi
add edx, 4
test eax, eax
jne 0x4cf096
cmp dword [ebx + 0x70], ecx
je 0x4cf0ed
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x584]
mov ecx, dword [eax]
push esi
push edx
push eax
call dword [ecx + 0xb0]
lea eax, [ebx + 4]
mov edi, eax
mov ecx, 0x1a
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x1a
xor edx, edx
mov esi, dword [ecx]
dec eax
xor esi, eax
add edx, esi
add ecx, 4
test eax, eax
jne 0x4cf0d5
mov eax, dword [ebp - 8]
test eax, eax
mov dword [ebx + 0x70], edx
jne 0x4cf103
mov esi, dword [ebp + 0x10]
cmp dword [ebx + 0x6c], esi
jne 0x4cf106
mov edx, dword [ebp + 8]
pop edi
pop esi
mov dword [ebx], edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x584]
mov edi, dword [ebp + 8]
mov ecx, dword [eax]
push esi
push edi
push eax
call dword [ecx + 0xb8]
mov dword [ebx], edi
pop edi
mov dword [ebx + 0x6c], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x56de70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, ecx
mov ecx, dword [ebx + 4]
mov eax, dword [ebx + 8]
push edi
mov edi, dword [ebp + 8]
cmp edi, ecx
mov dword [ebp - 4], eax
mov dword [ebp + 8], edi
jae 0x56ded6
mov ecx, edi
imul ecx, ecx, 0x94
lea esi, [ecx + eax + 0x68]
lea ebx, [ebx]
lea ecx, [esi + 0x14]
call fcn.00465080
mov ecx, esi
call fcn.0056e0e0
lea ecx, [esi - 0x14]
call fcn.0056e0a0
lea ecx, [esi - 0x68]
call fcn.0056e030
mov eax, dword [ebp + 8]
mov ecx, dword [ebx + 4]
inc eax
add esi, 0x94
cmp eax, ecx
mov dword [ebp + 8], eax
jb 0x56dea0
mov eax, dword [ebp - 4]
mov esi, edi
imul esi, esi, 0x94
push 0x10
push 0xfffffffffffffffe
push str.._AUTerrainModel__
push esi
push eax
mov dword [ebx], edi
call fcn.006c4b04
test eax, eax
mov dword [ebx + 8], eax
jne 0x56e01c
push eax
push 0xfffffffffffffffe
push str.._AUTerrainModel__
push esi
call fcn.006c4a86
mov ecx, dword [ebp - 4]
test ecx, ecx
mov dword [ebx + 8], eax
je 0x56e01c
mov eax, dword [ebx + 4]
cmp edi, eax
jb 0x56df20
mov edi, eax
test edi, edi
jbe 0x56e00d
mov eax, 0xffffffec
sub eax, ecx
lea esi, [ecx + 0x14]
mov dword [ebp - 8], eax
mov dword [ebp + 8], edi
jmp 0x56df40
mov eax, dword [ebp - 8]
lea ecx, [ecx]
lea edi, [eax + esi]
add edi, dword [ebx + 8]
je 0x56dfd7
mov edx, dword [esi - 0x14]
lea eax, [esi - 0x10]
push eax
lea ecx, [edi + 4]
mov dword [edi], edx
call fcn.0056e3a0
push esi
lea ecx, [edi + 0x14]
call fcn.0056e4c0
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0x30], ecx
mov edx, dword [esi + 0x20]
mov dword [edi + 0x34], edx
mov eax, dword [esi + 0x24]
mov dword [edi + 0x38], eax
mov ecx, dword [esi + 0x28]
mov dword [edi + 0x3c], ecx
mov edx, dword [esi + 0x2c]
mov dword [edi + 0x40], edx
mov eax, dword [esi + 0x30]
mov dword [edi + 0x44], eax
mov ecx, dword [esi + 0x34]
mov dword [edi + 0x48], ecx
mov dx, word [esi + 0x38]
mov word [edi + 0x4c], dx
mov al, byte [esi + 0x3a]
mov byte [edi + 0x4e], al
mov ecx, dword [esi + 0x3c]
lea edx, [esi + 0x40]
mov dword [edi + 0x50], ecx
push edx
lea ecx, [edi + 0x54]
call fcn.0056e180
mov eax, dword [esi + 0x50]
lea ecx, [esi + 0x54]
push ecx
lea ecx, [edi + 0x68]
mov dword [edi + 0x64], eax
call fcn.0056e200
lea edx, [esi + 0x64]
push edx
lea ecx, [edi + 0x78]
call fcn.0056e320
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x90], eax
lea ecx, [esi + 0x68]
call fcn.00465080
lea ecx, [esi + 0x54]
call fcn.0056e0e0
lea ecx, [esi + 0x40]
call fcn.0056e0a0
lea ecx, [esi - 0x14]
call fcn.0056e030
mov eax, dword [ebp + 8]
add esi, 0x94
dec eax
mov dword [ebp + 8], eax
jne 0x56df3a
mov ecx, dword [ebp - 4]
push 0
push 0xfffffffffffffffe
push str.._AUTerrainModel__
push ecx
call fcn.006c4a80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x570550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, ecx
mov ecx, dword [ebx + 4]
mov eax, dword [ebx + 8]
push edi
mov edi, dword [ebp + 8]
cmp edi, ecx
mov dword [ebp - 4], eax
mov dword [ebp + 8], edi
jae 0x570596
mov esi, edi
imul esi, esi, 0x94
add esi, eax
mov ecx, esi
call fcn.005706d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebx + 4]
inc eax
add esi, 0x94
cmp eax, ecx
mov dword [ebp + 8], eax
jb 0x570578
mov eax, dword [ebp - 4]
mov esi, edi
imul esi, esi, 0x94
push 0x10
push 0xfffffffffffffffe
push str.._AUTerrainGridModel__
push esi
push eax
mov dword [ebx], edi
call fcn.006c4b04
test eax, eax
mov dword [ebx + 8], eax
jne 0x5706c7
push eax
push 0xfffffffffffffffe
push str.._AUTerrainGridModel__
push esi
call fcn.006c4a86
mov ecx, dword [ebp - 4]
test ecx, ecx
mov dword [ebx + 8], eax
je 0x5706c7
mov eax, dword [ebx + 4]
cmp edi, eax
jb 0x5705e0
mov edi, eax
test edi, edi
jbe 0x5706b8
mov eax, 0xfffffff4
sub eax, ecx
lea esi, [ecx + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp + 8], edi
jmp 0x570600
mov eax, dword [ebp - 8]
lea ecx, [ecx]
lea edi, [eax + esi]
add edi, dword [ebx + 8]
je 0x57069a
lea eax, [esi - 0xc]
push eax
mov ecx, edi
call fcn.00495c60
mov ecx, dword [esi]
lea edx, [esi + 4]
mov dword [edi + 0xc], ecx
lea ecx, [edi + 0x10]
push edx
call fcn.00495c60
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x14]
push ecx
lea ecx, [edi + 0x20]
mov dword [edi + 0x1c], eax
call fcn.0053e3e0
mov edx, dword [esi + 0x24]
lea eax, [esi + 0x28]
push eax
lea ecx, [edi + 0x34]
mov dword [edi + 0x30], edx
call fcn.00570790
mov ecx, dword [esi + 0x38]
lea edx, [esi + 0x3c]
mov dword [edi + 0x44], ecx
push edx
lea ecx, [edi + 0x48]
call fcn.00570790
mov eax, dword [esi + 0x4c]
lea ecx, [esi + 0x50]
push ecx
lea ecx, [edi + 0x5c]
mov dword [edi + 0x58], eax
call fcn.00570790
mov edx, dword [esi + 0x60]
lea eax, [esi + 0x64]
push eax
lea ecx, [edi + 0x70]
mov dword [edi + 0x6c], edx
call fcn.00570790
mov ecx, dword [esi + 0x74]
lea edx, [esi + 0x78]
mov dword [edi + 0x80], ecx
push edx
lea ecx, [edi + 0x84]
call fcn.00570790
lea ecx, [esi - 0xc]
call fcn.005706d0
mov eax, dword [ebp + 8]
add esi, 0x94
dec eax
mov dword [ebp + 8], eax
jne 0x5705fa
mov ecx, dword [ebp - 4]
push 0
push 0xfffffffffffffffe
push str.._AUTerrainGridModel__
push ecx
call fcn.006c4a80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x58eb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx]
push esi
xor ecx, dword [ebp + 0xc]
mov esi, dword [ebx + 4]
mov eax, ecx
shl ecx, 3
shr eax, 0x1d
or eax, ecx
xor eax, esi
mov esi, dword [ebx + 8]
mov ecx, eax
shr ecx, 0x1d
lea edx, [eax*8]
or ecx, edx
xor ecx, esi
push edi
mov esi, ecx
lea eax, [ecx*8]
lea edi, [ebx + 0x1c]
shr esi, 0x1d
push edi
or esi, eax
call fcn.006c4ac8
mov edx, eax
and eax, 3
shr edx, 2
xor ecx, ecx
test edx, edx
mov dword [ebp + 8], eax
mov eax, edi
je 0x58ebc4
lea ebx, [ebx]
mov edi, dword [eax]
xor edi, ecx
mov ecx, edi
shr ecx, 0x1d
shl edi, 3
add eax, 4
or ecx, edi
dec edx
jne 0x58ebb0
mov edi, dword [ebp + 8]
test edi, edi
mov edx, eax
je 0x58ebe3
lea ecx, [ecx]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, eax
shr ecx, 0x1d
shl eax, 3
inc edx
or ecx, eax
dec edi
jne 0x58ebd0
xor ecx, esi
mov edi, ecx
shl ecx, 3
lea esi, [ebx + 0x80]
shr edi, 0x1d
push esi
or edi, ecx
call fcn.006c4ac8
mov edx, eax
and eax, 3
shr edx, 2
xor ecx, ecx
test edx, edx
mov dword [ebp + 8], eax
mov eax, esi
je 0x58ec24
mov edi, edi
mov esi, dword [eax]
xor esi, ecx
mov ecx, esi
shr ecx, 0x1d
shl esi, 3
add eax, 4
or ecx, esi
dec edx
jne 0x58ec10
mov esi, dword [ebp + 8]
test esi, esi
mov edx, eax
je 0x58ec43
lea ecx, [ecx]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, eax
shr ecx, 0x1d
shl eax, 3
inc edx
or ecx, eax
dec esi
jne 0x58ec30
xor ecx, edi
mov edi, dword [ebx + 0x148]
mov edx, ecx
shr edx, 0x1d
shl ecx, 3
or edx, ecx
xor edx, edi
mov eax, edx
pop edi
shr eax, 0x1d
shl edx, 3
pop esi
or eax, edx
pop ebx
pop ebp
ret 8