joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56fb10
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
mov esi, ecx
push 1
lea eax, [esi + 4]
push 0x20
push eax
call fcn.00a2db91
push edi
push 1
lea ebx, [esi + 0x38]
push 4
push ebx
call fcn.00a2db91
mov ecx, dword [ebx]
add ecx, ecx
push 1
add ecx, ecx
push ecx
push edi
call fcn.00a2e61e
mov edx, dword [ebx]
add esp, 0x2c
add esi, 0x24
push edx
mov ecx, esi
call fcn.0056f9c0
xor ebp, ebp
cmp dword [ebx], ebp
jbe 0x56fc75
nop
push 0
push 0
push 0
push ebp
mov ecx, esi
call fcn.0056f900
cmp eax, 0xffffffff
je 0x56fc7e
mov ecx, dword [esp + 0x18]
sub ecx, 0x12d
je 0x56fc39
sub ecx, 1
je 0x56fc02
sub ecx, 1
mov ecx, dword [esi + 4]
je 0x56fbce
test ecx, ecx
je 0x56fbc1
test eax, eax
jl 0x56fbc1
cmp eax, dword [esi + 0x10]
jge 0x56fbc1
imul eax, eax, 0x11c
add eax, ecx
movzx ecx, byte [eax + 0x118]
neg ecx
sbb ecx, ecx
and ecx, eax
push edi
call fcn.0056ff70
jmp 0x56fc68
xor ecx, ecx
push edi
call fcn.0056ff70
jmp 0x56fc68
test ecx, ecx
je 0x56fbf8
test eax, eax
jl 0x56fbf8
cmp eax, dword [esi + 0x10]
jge 0x56fbf8
imul eax, eax, 0x11c
add eax, ecx
movzx ecx, byte [eax + 0x118]
neg ecx
sbb ecx, ecx
and ecx, eax
push edi
call fcn.00570a10
jmp 0x56fc68
xor ecx, ecx
push edi
call fcn.00570a10
jmp 0x56fc68
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x56fc2f
test eax, eax
jl 0x56fc2f
cmp eax, dword [esi + 0x10]
jge 0x56fc2f
imul eax, eax, 0x11c
add eax, ecx
movzx ecx, byte [eax + 0x118]
neg ecx
sbb ecx, ecx
and ecx, eax
push edi
call fcn.00570610
jmp 0x56fc68
xor ecx, ecx
push edi
call fcn.00570610
jmp 0x56fc68
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x56fc60
test eax, eax
jl 0x56fc60
cmp eax, dword [esi + 0x10]
jge 0x56fc60
imul eax, eax, 0x11c
add eax, ecx
movzx ecx, byte [eax + 0x118]
neg ecx
sbb ecx, ecx
and ecx, eax
jmp 0x56fc62
xor ecx, ecx
push edi
call fcn.00570270
test al, al
je 0x56fc7e
inc ebp
cmp ebp, dword [ebx]
jb 0x56fb60
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
Function at 0x56ff70
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0xa4f87b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x28]
push ebx
push 1
lea eax, [esi + 4]
push 4
push eax
call fcn.00a2db91
push ebx
push 1
lea edi, [esi + 8]
push 4
push edi
call fcn.00a2db91
mov eax, dword [esi + 0x14]
add esp, 0x20
test eax, eax
je 0x56ffd1
push eax
call fcn.00a2a2f2
add esp, 4
mov dword [esi + 0x14], 0
mov ebp, dword [edi]
test ebp, ebp
je 0x57006e
xor ecx, ecx
mov eax, ebp
mov edx, 0x1c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00a293e7
mov ebx, eax
add esp, 4
mov dword [esp + 0x14], ebx
xor ecx, ecx
mov dword [esp + 0x20], ecx
cmp ebx, ecx
je 0x570016
push fcn.0046ab80
push ebp
push 0x1c
push ebx
call fcn.00405f60
mov ecx, ebx
mov dword [esi + 0x14], ecx
test ecx, ecx
jne 0x570024
xor al, al
jmp 0x5700d2
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [edi]
lea edx, [eax*8]
sub edx, eax
add edx, edx
push 1
add edx, edx
push edx
push ecx
call fcn.00a2db91
xor eax, eax
add esp, 0x10
cmp dword [edi], eax
jbe 0x57006a
xor edx, edx
lea esp, [esp]
mov ecx, dword [esi + 0x14]
add ecx, edx
cmp dword [ecx + 0x14], 0
jne 0x570062
mov dword [ecx + 0x18], 0x20
inc eax
add edx, 0x1c
cmp eax, dword [edi]
jb 0x570050
mov ebx, dword [esp + 0x28]
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], 0
test eax, eax
je 0x57008c
push eax
call fcn.00a2a2f2
add esp, 4
mov dword [esi + 0x10], 0
push ebx
push 1
lea edx, [esi + 0x30]
push 0x60
push edx
call fcn.00a2db91
push ebx
push 1
lea eax, [esi + 0x90]
push 0x30
push eax
call fcn.00a2db91
push ebx
push 1
lea ecx, [esi + 0xc0]
push 0x30
push ecx
call fcn.00a2db91
push ebx
push 1
push 0x20
add esi, 0xf0
push esi
call fcn.00a2db91
add esp, 0x40
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x570270
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0xa4f87b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x28]
push edi
push 1
lea eax, [esi + 4]
push 4
push eax
call fcn.00a2db91
push edi
push 1
lea ebp, [esi + 8]
push 4
push ebp
call fcn.00a2db91
mov eax, dword [esi + 0x14]
add esp, 0x20
test eax, eax
je 0x5702d1
push eax
call fcn.00a2a2f2
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [ebp]
mov dword [esp + 0x28], eax
test eax, eax
je 0x57037b
xor ecx, ecx
mov edx, 0x1c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00a293e7
mov ebx, eax
add esp, 4
mov dword [esp + 0x14], ebx
xor ecx, ecx
mov dword [esp + 0x20], ecx
cmp ebx, ecx
je 0x57031d
mov eax, dword [esp + 0x28]
push fcn.0046ab80
push eax
push 0x1c
push ebx
call fcn.00405f60
mov ecx, ebx
mov dword [esp + 0x20], 0xffffffff
mov dword [esi + 0x14], ecx
test ecx, ecx
jne 0x570333
xor al, al
jmp 0x57041f
mov eax, dword [ebp]
lea edx, [eax*8]
sub edx, eax
push edi
add edx, edx
push 1
add edx, edx
push edx
push ecx
call fcn.00a2db91
xor eax, eax
add esp, 0x10
cmp dword [ebp], eax
jbe 0x57037b
xor edx, edx
lea esp, [esp]
mov ecx, dword [esi + 0x14]
add ecx, edx
cmp dword [ecx + 0x14], 0
jne 0x570372
mov dword [ecx + 0x18], 0x20
inc eax
add edx, 0x1c
cmp eax, dword [ebp]
jb 0x570360
push edi
push 1
lea ebp, [esi + 0xc]
push 4
push ebp
call fcn.00a2db91
mov eax, dword [esi + 0x10]
add esp, 0x10
test eax, eax
je 0x5703a3
push eax
call fcn.00a2a2f2
add esp, 4
mov dword [esi + 0x10], 0
mov eax, dword [ebp]
test eax, eax
je 0x5703d9
xor ecx, ecx
mov edx, 8
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00a293e7
mov ecx, dword [ebp]
add ecx, ecx
push edi
add ecx, ecx
push 1
add ecx, ecx
push ecx
push eax
mov dword [esi + 0x10], eax
call fcn.00a2db91
add esp, 0x14
push edi
push 1
lea edx, [esi + 0x30]
push 0x60
push edx
call fcn.00a2db91
push edi
push 1
lea eax, [esi + 0x90]
push 0x30
push eax
call fcn.00a2db91
push edi
push 1
lea ecx, [esi + 0xc0]
push 0x30
push ecx
call fcn.00a2db91
push edi
push 1
push 0x20
add esi, 0xf0
push esi
call fcn.00a2db91
add esp, 0x40
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x570610
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0xa4f87b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x28]
push edi
push 1
lea eax, [esi + 4]
push 4
push eax
call fcn.00a2db91
push edi
push 1
lea ebp, [esi + 8]
push 4
push ebp
call fcn.00a2db91
mov eax, dword [esi + 0x14]
add esp, 0x20
test eax, eax
je 0x570671
push eax
call fcn.00a2a2f2
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [ebp]
mov dword [esp + 0x28], eax
test eax, eax
je 0x57071b
xor ecx, ecx
mov edx, 0x1c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00a293e7
mov ebx, eax
add esp, 4
mov dword [esp + 0x14], ebx
xor ecx, ecx
mov dword [esp + 0x20], ecx
cmp ebx, ecx
je 0x5706bd
mov eax, dword [esp + 0x28]
push fcn.0046ab80
push eax
push 0x1c
push ebx
call fcn.00405f60
mov ecx, ebx
mov dword [esp + 0x20], 0xffffffff
mov dword [esi + 0x14], ecx
test ecx, ecx
jne 0x5706d3
xor al, al
jmp 0x5707f2
mov eax, dword [ebp]
lea edx, [eax*8]
sub edx, eax
push edi
add edx, edx
push 1
add edx, edx
push edx
push ecx
call fcn.00a2db91
xor eax, eax
add esp, 0x10
cmp dword [ebp], eax
jbe 0x57071b
xor edx, edx
lea esp, [esp]
mov ecx, dword [esi + 0x14]
add ecx, edx
cmp dword [ecx + 0x14], 0
jne 0x570712
mov dword [ecx + 0x18], 0x20
inc eax
add edx, 0x1c
cmp eax, dword [ebp]
jb 0x570700
push edi
push 1
lea ebp, [esi + 0xc]
push 4
push ebp
call fcn.00a2db91
mov eax, dword [esi + 0x10]
add esp, 0x10
test eax, eax
je 0x570743
push eax
call fcn.00a2a2f2
add esp, 4
mov dword [esi + 0x10], 0
mov eax, dword [ebp]
test eax, eax
je 0x570779
xor ecx, ecx
mov edx, 8
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00a293e7
mov ecx, dword [ebp]
add ecx, ecx
push edi
add ecx, ecx
push 1
add ecx, ecx
push ecx
push eax
mov dword [esi + 0x10], eax
call fcn.00a2db91
add esp, 0x14
push edi
push 1
lea edx, [esi + 0x30]
push 0x60
push edx
call fcn.00a2db91
push 0x30
lea ebp, [esi + 0x90]
push 0
push ebp
call fcn.00a2a210
mov ebx, ebp
add esp, 0x1c
mov ebp, 6
push 1
push 8
push edi
call fcn.00a2e61e
push edi
push 1
push 8
push ebx
call fcn.00a2db91
push 1
push 0xc
push edi
call fcn.00a2e61e
add esp, 0x28
add ebx, 8
sub ebp, 1
jne 0x5707a1
push edi
push 1
lea eax, [esi + 0xc0]
push 0x30
push eax
call fcn.00a2db91
push edi
push 1
push 0x20
add esi, 0xf0
push esi
call fcn.00a2db91
add esp, 0x20
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x5715e0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0xa533ce
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push ebp
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov ebp, ecx
lea ecx, [esp + 0x50]
call fcn.005744b0
lea ecx, [ebp + 0xc0c]
xor esi, esi
mov dword [esp + 0x98], esi
mov dword [esp + 0x1c], ecx
call fcn.005737a0
mov edi, dword [esp + 0xa0]
push edi
push 1
lea eax, [esp + 0x2c]
push 0x2c
push eax
call fcn.00a2db91
add esp, 0x10
cmp dword [esp + 0x24], 0x49574147
jne 0x57185e
cmp dword [esp + 0x28], 0x12c
jne 0x57185e
test byte [esp + 0x34], 1
mov ecx, dword [esp + 0x2c]
mov dword [ebp + 0xc30], ecx
je 0x57168b
push 0xff
push esi
push edi
mov ecx, ebp
call fcn.0056bc20
mov dword [ebp + 0xc34], 1
mov edx, dword [esp + 0x48]
push 1
lea eax, [edx*4]
push eax
push edi
call fcn.00a2e61e
mov eax, dword [esp + 0x3c]
add esp, 0xc
sub eax, esi
je 0x5717b0
sub eax, 1
jne 0x57177e
mov dword [esp + 0x18], esi
cmp dword [esp + 0x48], esi
jbe 0x57177e
mov ebx, dword [esp + 0xa4]
push edi
push 1
lea ecx, [esp + 0x1c]
push 4
push ecx
call fcn.00a2db91
add esp, 0x10
cmp dword [esp + 0x14], 0
jbe 0x57173e
push 0x40
call fcn.00a2ab9d
add esp, 4
mov dword [esp + 0x20], eax
mov byte [esp + 0x98], 2
test eax, eax
je 0x57170a
mov ecx, eax
call fcn.005744b0
mov esi, eax
jmp 0x57170c
xor esi, esi
mov byte [esp + 0x98], 0
test esi, esi
je 0x57185e
mov edx, dword [ebp + 0xc30]
push ebx
push edx
push edi
mov ecx, esi
call fcn.005746d0
test al, al
je 0x571854
mov ecx, dword [esp + 0x1c]
push esi
call fcn.00571530
mov esi, 1
cmp dword [esp + 0x14], esi
jbe 0x57176b
mov eax, dword [ebp + 0xc30]
push 1
push eax
push edi
lea ecx, [esp + 0x5c]
call fcn.005746d0
test al, al
je 0x57185e
inc esi
cmp esi, dword [esp + 0x14]
jb 0x571749
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x48]
jb 0x5716cc
lea ecx, [esp + 0x50]
mov dword [esp + 0x98], 0xffffffff
call fcn.005744e0
mov al, 1
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret 8
xor ebp, ebp
cmp dword [esp + 0x48], esi
jbe 0x57177e
mov ebx, dword [esp + 0xa4]
push edi
push 1
lea ecx, [esp + 0x20]
push 4
push ecx
call fcn.00a2db91
add esp, 0x10
cmp dword [esp + 0x18], 0
jbe 0x571822
push 0x40
call fcn.00a2ab9d
add esp, 4
mov dword [esp + 0x20], eax
mov byte [esp + 0x98], 1
test eax, eax
je 0x5717fd
mov ecx, eax
call fcn.005744b0
mov esi, eax
jmp 0x5717ff
xor esi, esi
mov byte [esp + 0x98], 0
test esi, esi
je 0x57185e
push ebx
push edi
mov ecx, esi
call fcn.00574500
test al, al
je 0x571854
mov ecx, dword [esp + 0x1c]
push esi
call fcn.00571530
mov esi, 1
cmp dword [esp + 0x18], esi
jbe 0x571844
push 1
push edi
lea ecx, [esp + 0x58]
call fcn.00574500
test al, al
je 0x57185e
inc esi
cmp esi, dword [esp + 0x18]
jb 0x57182d
inc ebp
cmp ebp, dword [esp + 0x48]
jb 0x5717bf
jmp 0x57177e
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x98], 0xffffffff
call fcn.005744e0
xor al, al
jmp 0x571794
Function at 0x571e20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x38
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 0xc0c]
push edi
mov dword [esp + 0x14], ecx
call fcn.005737a0
lea edi, [esi + 0xc1c]
mov ecx, edi
mov dword [esp + 0x18], edi
call fcn.005711c0
mov ebx, dword [esp + 0x48]
push ebx
push 1
lea eax, [esp + 0x24]
push 0x28
push eax
call fcn.00a2db91
add esp, 0x10
cmp dword [esp + 0x1c], 0x49524f4e
je 0x571e73
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x38
ret 8
mov eax, dword [esp + 0x20]
cmp eax, 0x12c
je 0x571e93
cmp eax, 0x12d
je 0x571e93
cmp eax, 0x12e
je 0x571e93
cmp eax, 0x12f
jne 0x571e68
mov ecx, dword [esp + 0x4c]
push ecx
push ebx
mov ecx, esi
call fcn.005715e0
test al, al
je 0x571e68
mov edx, dword [esp + 0x38]
push ebp
push 1
lea eax, [edx*4]
push eax
push ebx
call fcn.00a2e61e
mov ecx, dword [esp + 0x48]
add esp, 0xc
push ecx
mov ecx, edi
call fcn.00571bf0
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x3c], ebx
jbe 0x571fde
push 0
push 0
push 0
push ebx
mov ecx, edi
call fcn.00571b20
cmp eax, 0xffffffff
je 0x571fea
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x571f12
test eax, eax
jl 0x571f12
cmp eax, dword [edi + 0x10]
jge 0x571f12
lea edx, [eax + eax*8]
movzx ebp, byte [ecx + edx*8 + 0x44]
lea eax, [ecx + edx*8]
neg ebp
sbb ebp, ebp
and ebp, eax
jmp 0x571f14
xor ebp, ebp
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x4c]
push eax
push ecx
mov ecx, ebp
call fcn.0056fb10
xor esi, esi
mov dword [esp + 0x50], esi
cmp dword [ebp + 0x38], esi
jbe 0x571fcf
xor edx, edx
mov dword [esp + 0x10], edx
lea ebx, [ebx]
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x571faf
test esi, esi
jl 0x571faf
cmp esi, dword [ebp + 0x34]
jge 0x571faf
add edx, eax
cmp byte [edx + 0x118], 0
je 0x571faf
test edx, edx
je 0x571faf
xor ebx, ebx
cmp dword [edx + 8], ebx
jbe 0x571faa
xor edi, edi
jmp 0x571f70
mov eax, dword [edx + 0x14]
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
add eax, edi
xor esi, esi
cmp dword [eax], esi
jle 0x571f8c
test ecx, ecx
je 0x571f95
mov ecx, dword [ecx]
inc esi
cmp esi, dword [eax]
jl 0x571f81
test ecx, ecx
je 0x571f95
mov ecx, dword [ecx + 4]
jmp 0x571f97
xor ecx, ecx
inc ebx
mov dword [eax], ecx
add edi, 0x1c
cmp ebx, dword [edx + 8]
jb 0x571f70
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x50]
call fcn.00571090
mov edx, dword [esp + 0x10]
inc esi
add edx, 0x11c
mov dword [esp + 0x50], esi
mov dword [esp + 0x10], edx
cmp esi, dword [ebp + 0x38]
jb 0x571f40
mov ebx, dword [esp + 0x14]
inc ebx
mov dword [esp + 0x14], ebx
cmp ebx, dword [esp + 0x3c]
jb 0x571ed8
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x38
ret 8
pop ebp
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x38
ret 8
Function at 0x5741f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
push 1
mov esi, ecx
push 4
push esi
call fcn.00a2db91
push edi
push 1
lea eax, [esp + 0x20]
push 4
push eax
call fcn.00a2db91
push edi
push 1
lea ecx, [esp + 0x34]
push 4
push ecx
call fcn.00a2db91
push edi
push 1
lea edx, [esi + 4]
push 4
push edx
call fcn.00a2db91
add esp, 0x40
push edi
push 1
lea eax, [esi + 8]
push 4
push eax
call fcn.00a2db91
push edi
push 1
lea ecx, [esi + 0x14]
push 4
push ecx
call fcn.00a2db91
push edi
push 1
lea edx, [esi + 0x18]
push 4
push edx
call fcn.00a2db91
push edi
push 1
lea eax, [esi + 0x1c]
push 4
push eax
call fcn.00a2db91
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
add esp, 0x40
cmp dword [esi + 0xc], eax
jne 0x574282
cmp dword [esi + 0x10], ecx
je 0x57429f
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x10], ecx
test eax, eax
je 0x57429f
push eax
call fcn.00a2a2f2
add esp, 4
mov dword [esi + 0x24], 0
cmp dword [esi + 0x24], 0
jne 0x5742b8
mov ecx, dword [esi + 0x10]
imul ecx, dword [esi + 0xc]
push ecx
call fcn.00a293e7
add esp, 4
mov dword [esi + 0x24], eax
mov edx, dword [esi + 0x10]
imul edx, dword [esi + 0xc]
mov eax, dword [esi + 0x24]
push edi
push 1
push edx
push eax
call fcn.00a2db91
push edi
push 1
lea ecx, [esi + 0x20]
push 4
push ecx
call fcn.00a2db91
push edi
push 1
push 0xc
add esi, 0x28
push esi
call fcn.00a2db91
add esp, 0x30
pop edi
pop esi
add esp, 8
ret 4

Function at 0x574500
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x2c]
call fcn.0057ad60
mov edi, dword [esp + 0x10]
push edi
push 1
lea ebx, [esi + 4]
push 4
push ebx
call fcn.00a2db91
push edi
push 1
lea eax, [esi + 8]
push 4
push eax
call fcn.00a2db91
push edi
push 1
lea ecx, [esi + 0xc]
push 4
push ecx
call fcn.00a2db91
push edi
push 1
lea edx, [esi + 0x10]
push 4
push edx
call fcn.00a2db91
add esp, 0x40
push edi
push 1
lea eax, [esi + 0x14]
push 4
push eax
call fcn.00a2db91
push edi
push 1
lea ecx, [esi + 0x18]
push 4
push ecx
call fcn.00a2db91
add esp, 0x20
mov ecx, esi
call fcn.00574410
cmp byte [esp + 0x14], 0
jne 0x5745bf
mov edx, dword [ebx]
push edx
mov dword [esi + 0x1c], 0
call fcn.00a293e7
add esp, 4
mov dword [esi + 0x20], eax
test eax, eax
jne 0x5745a8
mov eax, dword [ebx]
push 1
push eax
push edi
call fcn.00a2e61e
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
ret 8
mov ecx, dword [ebx]
push edi
push 1
push ecx
push eax
call fcn.00a2db91
add esp, 0x10
pop edi
pop esi
mov al, 1
pop ebx
ret 8
or dword [esi + 0x1c], 1
push edi
call fcn.00a2ea24
mov edx, dword [ebx]
push 1
push edx
push edi
mov dword [esi + 0x20], eax
call fcn.00a2e61e
add esp, 0x10
pop edi
pop esi
mov al, 1
pop ebx
ret 8
Function at 0x5746d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x2c]
call fcn.0057ad60
mov edi, dword [esp + 0x18]
push edi
push 1
lea eax, [esp + 0x18]
push 4
push eax
call fcn.00a2db91
push edi
push 1
lea ebp, [esi + 8]
push 4
push ebp
call fcn.00a2db91
push edi
push 1
lea ebx, [esi + 0xc]
push 4
push ebx
call fcn.00a2db91
push edi
push 1
lea ecx, [esi + 0x10]
push 4
push ecx
call fcn.00a2db91
add esp, 0x40
push edi
push 1
lea edx, [esi + 0x14]
push 4
push edx
call fcn.00a2db91
push edi
push 1
lea eax, [esi + 0x18]
push 4
push eax
call fcn.00a2db91
mov ecx, dword [esp + 0x3c]
shr ecx, 3
imul ecx, dword [ebx]
imul ecx, dword [ebp]
mov dword [esi + 4], ecx
add esp, 0x20
mov ecx, esi
call fcn.00574410
cmp byte [esp + 0x20], 0
je 0x574784
or dword [esi + 0x1c], 3
push edi
call fcn.00a2ea24
mov edx, dword [esp + 0x14]
push 1
push edx
push edi
mov dword [esi + 0x20], eax
call fcn.00a2e61e
add esp, 0x10
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esi + 4]
push eax
mov dword [esi + 0x1c], 0
call fcn.00a293e7
add esp, 4
mov dword [esi + 0x20], eax
test eax, eax
jne 0x5747b8
mov ecx, dword [esp + 0x10]
push 1
push ecx
push edi
call fcn.00a2e61e
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x10]
push edx
call fcn.00a293e7
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x5747ee
mov eax, dword [esi + 0x20]
push eax
call fcn.00a2a2f2
mov ecx, dword [esp + 0x14]
push 1
push ecx
push edi
call fcn.00a2e61e
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x10]
push edi
push 1
push edx
push ebp
call fcn.00a2db91
mov eax, dword [esp + 0x2c]
add esp, 0x10
cmp eax, 8
je 0x574852
cmp eax, 0x10
je 0x574837
cmp eax, 0x18
jne 0x574872
mov ax, word [0xd39e85]
mov cl, byte [0xd39e87]
push 3
lea edx, [esp + 0x24]
mov word [esp + 0x24], ax
mov eax, dword [ebx]
push edx
mov byte [esp + 0x2a], cl
mov ecx, dword [esi + 0x20]
push eax
push ecx
jmp 0x574869
movzx edx, word [0xd39e88]
mov ecx, dword [ebx]
push 2
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], edx
mov edx, dword [esi + 0x20]
push ecx
push edx
jmp 0x574869
mov al, byte [0xd39e84]
mov edx, dword [ebx]
push 1
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x28], al
mov eax, dword [esi + 0x20]
push edx
push eax
push ebp
call fcn.0056c5d0
add esp, 0x14
push ebp
call fcn.00a2a2f2
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 0xc
Function at 0x574c90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
push ebx
push ebp
xor ecx, ecx
push esi
mov esi, dword [esp + 0x30]
push edi
xor ebx, ebx
xor edi, edi
xor ebp, ebp
xor edx, edx
cmp esi, 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
jl 0x574d19
lea ecx, [esi - 2]
shr ecx, 1
add eax, 2
inc ecx
lea edx, [ecx + ecx]
mov dword [esp + 0x34], edx
mov edx, dword [eax - 2]
and edx, 0xff
add edi, edx
movzx edx, byte [eax - 1]
add ebx, edx
movzx edx, byte [eax]
add dword [esp + 0x14], edx
mov edx, dword [eax + 2]
and edx, 0xff
add dword [esp + 0x1c], edx
movzx edx, byte [eax + 3]
add dword [esp + 0x18], edx
movzx edx, byte [eax + 4]
add dword [esp + 0x10], edx
add eax, 8
sub ecx, 1
jne 0x574cd2
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov ecx, ebp
cmp edx, esi
jge 0x574d34
mov ecx, dword [eax + edx*4]
movzx ebp, byte [eax + edx*4 + 1]
movzx eax, byte [eax + edx*4 + 2]
and ecx, 0xff
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add eax, edx
add eax, dword [esp + 0x20]
cdq
idiv esi
mov edx, dword [esp + 0x18]
or eax, 0xff00
shl eax, 8
mov dword [esp + 0x34], eax
lea eax, [edx + ebx]
add eax, ebp
cdq
idiv esi
mov edx, dword [esp + 0x34]
and eax, 0xff
or edx, eax
mov eax, dword [esp + 0x1c]
add eax, edi
shl edx, 8
add eax, ecx
mov ecx, edx
cdq
idiv esi
pop edi
pop esi
pop ebp
pop ebx
and eax, 0xff
or eax, ecx
add esp, 0x1c
ret
Function at 0x57a780
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
je 0x57a843
cmp dword [esi + 0x18], 0
je 0x57a843
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
push edi
push 1
lea ebx, [esi + 4]
push 4
push ebx
call fcn.00a2db91
push edi
push 1
lea ebp, [esi + 8]
push 4
push ebp
call fcn.00a2db91
push edi
push 1
lea eax, [esi + 0xc]
push 4
push eax
mov dword [esp + 0x44], eax
call fcn.00a2db91
mov eax, dword [esi + 0x10]
add esp, 0x30
test eax, eax
je 0x57a7e6
push eax
call fcn.00a2a2f2
add esp, 4
mov dword [esi + 0x10], 0
cmp byte [esp + 0x18], 0
mov eax, dword [ebx]
jne 0x57a826
push eax
call fcn.00a293e7
add esp, 4
mov dword [esi + 0x10], eax
test eax, eax
jne 0x57a806
mov ecx, dword [ebx]
push 1
push ecx
jmp 0x57a829
mov edx, dword [ebx]
push edi
push 1
push edx
push eax
call fcn.00a2db91
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx]
add esp, 0x10
imul eax, dword [ebp]
pop edi
pop ebp
pop ebx
pop esi
ret 8
push 1
push eax
push edi
call fcn.00a2e61e
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
add esp, 0xc
imul eax, dword [ebp]
pop edi
pop ebp
pop ebx
pop esi
ret 8
or eax, 0xffffffff
pop esi
ret 8

Function at 0x57dbe0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0xa5375b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0xcdc190]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.cLayerTex.0
mov dword [esp + 0x18], 0
call fcn.0057d340
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.0057d950
mov eax, dword [esi + 0x30]
test eax, eax
je 0x57dc3d
push eax
call fcn.00a2a2f2
add esp, 4
mov dword [esi + 0x30], 0
mov ecx, edi
call fcn.0057d920
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret