joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58d750
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x666dd3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 0x40]
mov ecx, edi
call fcn.0058b0c0
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0041fe50
lea ecx, [edi + 4]
mov dword [esi], 0x68ce64
mov dword [esi + 4], 0x68ce24
mov dword [esi + 0x18], 0x68cdf0
mov dword [esi + 0x28], 0x68cdc0
mov dword [esi + 8], edi
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push 0
mov byte [esp + 0x40], 1
call edx
push eax
mov eax, dword [esp + 0x54]
push eax
lea ecx, [esp + 0x28]
call fcn.00401ef0
push 1
push eax
lea ecx, [esp + 0x18]
push 0x6b099c
push ecx
mov byte [esp + 0x4c], 2
call fcn.004145e0
add esp, 0x10
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x48]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x48], 3
call fcn.004176e0
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 2
call fcn.00589f70
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, edi
xor al, al
push edx
mov byte [esp + 0x40], 1
rep stosb byte es:[edi], al
call fcn.00419910
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 0xc

Function at 0x58dc60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x666dd3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 0x40]
mov ecx, edi
call fcn.0058bb00
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0041fe50
lea ecx, [edi + 4]
mov dword [esi], 0x68d054
mov dword [esi + 4], 0x68d014
mov dword [esi + 0x18], 0x68cfe0
mov dword [esi + 0x28], 0x68cfb0
mov dword [esi + 8], edi
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push 0
mov byte [esp + 0x40], 1
call edx
push eax
mov eax, dword [esp + 0x54]
push eax
lea ecx, [esp + 0x28]
call fcn.00401ef0
push 1
push eax
lea ecx, [esp + 0x18]
push 0x6b099c
push ecx
mov byte [esp + 0x4c], 2
call fcn.004145e0
add esp, 0x10
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x48]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x48], 3
call fcn.004176e0
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 2
call fcn.00589f70
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, edi
xor al, al
push edx
mov byte [esp + 0x40], 1
rep stosb byte es:[edi], al
call fcn.00419910
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 0xc
Function at 0x593550
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x667258
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [0x70d120], esi
lea eax, [esp + 0xf]
push eax
lea ecx, [esp + 0x13]
xor edi, edi
push ecx
lea ecx, [esi + 0x6c]
mov dword [esp + 0x24], edi
mov dword [esi], vtable.CSoundManager.0
call fcn.005191f0
fldz
fst dword [esi + 0xc]
mov dword [esi + 4], edi
fst dword [esi + 0x10]
mov dword [esi + 8], edi
fst dword [esi + 0x14]
mov eax, esi
fld dword [0x689b2c]
fstp dword [esi + 0x18]
fld dword [0x673398]
fstp dword [esi + 0x1c]
fld1
fst dword [esi + 0x20]
fstp dword [esi + 0x24]
fst dword [esi + 0x28]
fst dword [esi + 0x2c]
mov dword [esi + 0x30], edi
fst dword [esi + 0x38]
mov dword [esi + 0x44], edi
fst dword [esi + 0x40]
mov dword [esi + 0x34], edi
mov dword [esi + 0x48], edi
fst dword [esi + 0x4c]
fst dword [esi + 0x54]
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
fst dword [esi + 0x60]
fstp dword [esi + 0x68]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret

Function at 0x595de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66747b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0xa0
call fcn.00610463
add esp, 4
mov dword [esp + 8], eax
xor esi, esi
mov dword [esp + 0x24], esi
cmp eax, esi
je 0x595e28
mov ecx, eax
call fcn.00593930
mov esi, eax
mov eax, dword [esp + 0x30]
push eax
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.005936b0
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0xc], ecx
push eax
mov ecx, 0x74f7f4
mov dword [esp + 0x14], esi
call fcn.0050f890
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8
Function at 0x5a4550
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6678c6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.UI::CWindow.0
xor ebx, ebx
mov dword [esi + 0x1c], 0xf
mov dword [esi + 0x18], ebx
mov byte [esi + 8], bl
mov eax, dword [esp + 0x20]
lea ecx, [esi + 0x68]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x59], bl
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], ebx
call fcn.00597350
lea ecx, [esi + 0x88]
mov byte [esp + 0x18], 1
mov dword [esi + 0x84], ebx
call fcn.00597350
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x54], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x5bb750
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x668a08
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
push eax
call fcn.00567460
xor ebx, ebx
lea ecx, [esi + 0x38]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.CEffectMesh.0
call fcn.00577e00
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x50], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x5bf590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x668e98
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00577e00
mov ecx, dword [esp + 0x30]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x34], 0
call fcn.00594ad0
add esp, 0xc
test al, al
je 0x5bf60e
add esi, 0x4c
lea edx, [esp + 8]
push esi
push edx
call fcn.00595090
add esp, 8
lea ecx, [esp + 8]
call fcn.0052eb30
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4
lea ecx, [esp + 8]
call fcn.0052eb30
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4
Function at 0x5c1cf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66905e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.005cbc50
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CParticleSystemInstance.0
call fcn.00577e00
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 1
call fcn.00577e00
mov ecx, esi
mov byte [esp + 0x14], 2
call fcn.005cbc00
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5cf5f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0x10
jb 0x5cf5ff
mov edx, dword [eax + 4]
jmp 0x5cf602
lea edx, [eax + 4]
push esi
mov esi, dword [eax + 0x14]
add esi, edx
xor eax, eax
cmp edx, esi
jae 0x5cf621
push edi
nop
movzx edi, byte [edx]
imul eax, eax, 0x1000193
inc edx
xor eax, edi
cmp edx, esi
jb 0x5cf610
pop edi
xor edx, edx
div dword [ecx + 4]
pop esi
mov eax, edx
ret 4
Function at 0x5cffd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x669900
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov edx, dword [esp + 0x84]
mov eax, dword [edx]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], edx
mov ebp, 4
jle 0x5d01ab
mov dword [esp + 0x18], eax
jmp 0x5d0038
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov eax, dword [edx + ebp]
add ebp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
cmp dword [ecx + 0x3c74], ebx
je 0x5d0072
mov eax, dword [ecx + 0x3c7c]
mov dword [esp + 0x20], eax
cmp eax, ebx
je 0x5d0068
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
lea eax, [esp + 0x20]
jmp 0x5d007e
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x20]
jmp 0x5d007e
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
lea eax, [esp + 0x30]
mov esi, dword [eax + 4]
mov edi, dword [eax]
cmp esi, ebx
je 0x5d01a0
jmp 0x5d0090
push 0xffffffffffffffff
lea eax, [esi + 4]
push ebx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
call fcn.00417450
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x84], ebx
call fcn.004f6c00
add esp, 8
cmp dword [esp + 0x50], 0x10
mov byte [esp + 0x7c], 2
jb 0x5d00e2
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00610458
add esp, 4
cmp dword [esp + 0x6c], 0x10
mov eax, dword [esp + 0x58]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
jae 0x5d0101
lea eax, [esp + 0x58]
mov edx, dword [esp + 0x68]
add edx, eax
xor ecx, ecx
cmp eax, edx
jae 0x5d0124
lea ecx, [ecx]
movzx ebp, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebp
cmp eax, edx
jb 0x5d0110
mov ebp, dword [esp + 0x2c]
cmp dword [esp + 0x1c], ecx
je 0x5d016c
cmp dword [esp + 0x6c], 0x10
mov dword [esp + 0x7c], 0xffffffff
jb 0x5d0146
mov eax, dword [esp + 0x58]
push eax
call fcn.00610458
add esp, 4
mov eax, dword [esi]
cmp eax, ebx
jne 0x5d015a
lea esp, [esp]
mov eax, dword [edi + 4]
add edi, 4
cmp eax, ebx
je 0x5d0150
mov esi, edi
sub esi, eax
neg esi
sbb esi, esi
and esi, eax
jne 0x5d0090
jmp 0x5d01a0
mov ecx, dword [esi + 0x20]
call fcn.005d1060
mov ecx, dword [esp + 0x14]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.005d7490
add ebp, eax
cmp dword [esp + 0x6c], 0x10
mov dword [esp + 0x7c], 0xffffffff
jb 0x5d01a0
mov edx, dword [esp + 0x58]
push edx
call fcn.00610458
add esp, 4
sub dword [esp + 0x18], 1
jne 0x5d0030
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.006108ae
add esp, 0x6c
ret 4
Function at 0x5d0580
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [ebx + 4]
add ecx, 4
cmp dword [ecx + 0x18], 0x10
push edi
jb 0x5d059a
mov eax, dword [ecx + 4]
jmp 0x5d059d
lea eax, [ecx + 4]
mov ecx, dword [ecx + 0x14]
add ecx, eax
xor edi, edi
cmp eax, ecx
jae 0x5d05c0
jmp 0x5d05b0
movzx edx, byte [eax]
imul edi, edi, 0x1000193
inc eax
xor edi, edx
cmp eax, ecx
jb 0x5d05b0
cmp dword [esi], 0
je 0x5d05d3
mov eax, dword [esp + 0x18]
push eax
mov ecx, esi
call fcn.005d0530
jmp 0x5d0603
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.005d6470
cmp dword [esi + 4], eax
lea ecx, [esi + 4]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
jb 0x5d05f1
mov eax, ecx
mov edx, dword [eax]
mov dword [ecx], edx
mov ecx, esi
call fcn.005d20a0
mov ecx, esi
call fcn.005d6360
mov eax, edi
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi]
pop edi
lea ecx, [eax + edx*4]
mov edx, dword [ebx + 4]
mov dword [ebx + 4], 0
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [esp + 0xc]
mov dword [ecx], edx
inc dword [esi + 0x10]
mov dword [esi + 0x18], ecx
pop esi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret 0xc

Function at 0x5d0640
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x669968
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x34]
cmp dword [ebx + 0x18], 0x10
jb 0x5d0678
mov eax, dword [ebx + 4]
jmp 0x5d067b
lea eax, [ebx + 4]
mov ecx, dword [ebx + 0x14]
add ecx, eax
xor ebp, ebp
cmp eax, ecx
jae 0x5d0696
movzx edx, byte [eax]
imul ebp, ebp, 0x1000193
inc eax
xor ebp, edx
cmp eax, ecx
jb 0x5d0686
xor edx, edx
mov eax, ebp
div dword [esi + 4]
mov eax, dword [esi]
push ebx
mov ecx, esi
lea edi, [eax + edx*4]
push edi
call fcn.005cf720
mov ecx, eax
xor eax, eax
cmp ecx, eax
je 0x5d06c0
mov eax, dword [esp + 0x30]
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
jmp 0x5d0733
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], eax
call fcn.005cf850
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x18]
push ecx
lea edx, [ebx + 4]
push edx
push 0
call fcn.005cf8c0
mov eax, dword [esi + 0x10]
add esp, 0xc
inc eax
push eax
mov ecx, esi
mov byte [esp + 0x21], 1
call fcn.005d0530
test al, al
je 0x5d0717
mov eax, ebp
xor edx, edx
div dword [esi + 4]
mov ecx, dword [esi]
lea edi, [ecx + edx*4]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], ebx
inc dword [esi + 0x10]
cmp edi, dword [esi + 0x18]
jae 0x5d0728
mov dword [esi + 0x18], edi
mov eax, dword [esp + 0x30]
mov dword [eax + 4], ebx
mov byte [eax + 8], 1
mov dword [eax], edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x5d0fa0
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x255]
push 0x68a264
push esi
call fcn.006138f9
add esp, 8
test eax, eax
je 0x5d0fca
push eax
call fcn.0061369d
add esp, 4
pop edi
mov al, 1
pop esi
ret
cmp byte [edi + 0x364], 0
je 0x5d0fd8
pop edi
xor al, al
pop esi
ret
push 0x68da3c
push esi
call fcn.006138f9
mov esi, eax
add esp, 8
test esi, esi
je 0x5d0fd3
push esi
push 1
push 4
push str.EPKD
call fcn.0061580c
push esi
push 1
push 4
push 0x6917ec
call fcn.0061580c
push esi
push 1
push 4
add edi, 0x150
push edi
call fcn.0061580c
push esi
call fcn.0061369d
add esp, 0x34
pop edi
mov al, 1
pop esi
ret

Function at 0x5d1b00
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ecx + 0x3c14], 0x20
je 0x5d1b0e
xor al, al
ret 4
cmp byte [ecx + 0x365], 0
jne 0x5d1b56
cmp dword [ecx + 0x3c18], 0x10
push esi
push edi
jb 0x5d1b2a
mov esi, dword [ecx + 0x3c04]
jmp 0x5d1b30
lea esi, [ecx + 0x3c04]
mov edx, dword [esp + 0xc]
xor eax, eax
xor dword [esi + eax*4], edx
mov edi, dword [ecx + 0x3c14]
inc eax
shr edi, 2
add edx, 0x1000193
cmp eax, edi
jne 0x5d1b36
pop edi
mov byte [ecx + 0x365], 1
pop esi
mov al, 1
ret 4
Function at 0x5d6700
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x66a100
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov eax, dword [esp + 0x74]
mov edi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x80]
mov esi, ecx
mov ecx, dword [esp + 0x78]
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
call fcn.00417450
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x70], ebx
call fcn.00586ad0
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.005d66d0
add esp, 0xc
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x6c], 1
jae 0x5d679e
lea eax, [esp + 0x2c]
mov edx, dword [esp + 0x3c]
add edx, eax
xor ecx, ecx
cmp eax, edx
jae 0x5d67c2
lea ebx, [ebx]
movzx ebx, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebx
cmp eax, edx
jb 0x5d67b0
xor ebx, ebx
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.005cf6b0
mov esi, dword [eax + 4]
mov edx, dword [eax]
mov dword [esp + 0x18], edx
cmp esi, ebx
jne 0x5d6826
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x5d67fc
mov eax, dword [esp + 0x2c]
push eax
call fcn.00610458
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp dword [esp + 0x5c], esi
jb 0x5d681f
mov ecx, dword [esp + 0x48]
push ecx
call fcn.00610458
add esp, 4
xor al, al
jmp 0x5d68e7
cmp dword [esp + 0x5c], 0x10
mov eax, dword [esp + 0x48]
jae 0x5d6835
lea eax, [esp + 0x48]
mov edx, dword [esp + 0x58]
push edx
push eax
call fcn.00589490
mov ecx, eax
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [esi + 8]
mov dword [edi], edx
mov eax, dword [esi + 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi + 0x10]
mov dword [edi + 8], edx
mov eax, dword [esi + 0x14]
mov dword [edi + 0xc], eax
mov edx, dword [esi + 0x18]
mov dword [ebp], edx
mov eax, dword [esi + 0x1c]
mov dword [ebp + 4], eax
mov edx, dword [esi + 0x20]
mov dword [ebp + 8], edx
mov eax, dword [esi + 0x24]
add esp, 8
mov dword [ebp + 0xc], eax
xor eax, eax
lea esp, [esp]
xor dword [edi + eax*4], ecx
inc eax
cmp eax, 4
jb 0x5d6890
xor eax, eax
jmp 0x5d68a0
xor dword [ebp + eax*4], ecx
inc eax
cmp eax, 4
jb 0x5d68a0
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x5d68c2
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00610458
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp dword [esp + 0x5c], esi
jb 0x5d68e5
mov edx, dword [esp + 0x48]
push edx
call fcn.00610458
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.006108ae
add esp, 0x5c
ret 0x10
Function at 0x5d6910
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x66a138
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebp
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
mov esi, ecx
mov ecx, dword [esp + 0x5c]
push 0xffffffffffffffff
push 0
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
call fcn.00417450
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x50], 0
call fcn.00586ad0
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x2c]
add esp, 4
cmp edi, 0x10
jae 0x5d69a0
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x38]
lea edx, [ecx + eax]
xor ecx, ecx
cmp eax, edx
jae 0x5d69c4
lea ecx, [ecx]
movzx ebp, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebp
cmp eax, edx
jb 0x5d69b0
mov ebp, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
mov dword [esp + 0x14], ecx
push eax
lea ecx, [esi + 0x20]
call fcn.005cf6b0
mov esi, dword [eax + 4]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
test esi, esi
je 0x5d69fe
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0x30]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
test eax, eax
jg 0x5d6a14
mov dword [ebp], 0
cmp edi, 0x10
jb 0x5d6a10
mov edx, dword [esp + 0x28]
push edx
call fcn.00610458
add esp, 4
xor al, al
jmp 0x5d6a3f
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0x30]
jne 0x5d6a25
call fcn.006111cc
mov edi, dword [esp + 0x3c]
mov ecx, dword [esi + 0x30]
mov dword [ebp], ecx
cmp edi, 0x10
jb 0x5d6a3d
mov edx, dword [esp + 0x28]
push edx
call fcn.00610458
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.006108ae
add esp, 0x40
ret 0xc
Function at 0x5dc8d2
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax], 0x20000000
mov dword [ebp - 4], edi
jne 0x5dca19
push ebx
push esi
push 4
pop esi
add eax, esi
mov ecx, dword [eax]
cmp ecx, 0x40020000
jne 0x5dc978
add eax, esi
mov ecx, dword [eax]
xor edx, edx
cmp ecx, 0x40000001
je 0x5dc922
cmp ecx, 0x40010001
je 0x5dc922
cmp ecx, 0x40020001
je 0x5dc922
cmp ecx, 0x40030001
jne 0x5dc92d
shr ecx, 0x10
and ecx, 0xf
inc ecx
mov edx, ecx
add eax, esi
cmp dword [eax], 0x40050002
jne 0x5dc93f
inc edx
mov dword [ebp - 4], 0x1000
add eax, esi
mov ecx, edx
sub ecx, edi
je 0x5dc972
dec ecx
je 0x5dc96c
dec ecx
je 0x5dc966
dec ecx
je 0x5dc960
dec ecx
je 0x5dc95a
dec ecx
jne 0x5dc985
or dword [ebp - 4], 0xe
jmp 0x5dc985
or dword [ebp - 4], 0xc
jmp 0x5dc985
or dword [ebp - 4], 0xa
jmp 0x5dc985
or dword [ebp - 4], 8
jmp 0x5dc985
or dword [ebp - 4], 6
jmp 0x5dc985
or dword [ebp - 4], 2
jmp 0x5dc985
cmp ecx, 0x40030000
jne 0x5dc985
mov dword [ebp - 4], esi
add eax, esi
cmp dword [eax], 0x40020003
push 0x10
pop ecx
jne 0x5dc995
or dword [ebp - 4], ecx
add eax, esi
cmp dword [eax], 0x40000004
jne 0x5dc9a3
or dword [ebp - 4], 0x20
add eax, esi
cmp dword [eax], 0x40040005
jne 0x5dc9b1
or dword [ebp - 4], 0x40
add eax, esi
cmp dword [eax], 0x40040006
jne 0x5dc9bf
or byte [ebp - 4], 0x80
add eax, esi
push 7
pop esi
mov edx, dword [eax]
mov ebx, esi
or ebx, 0x40000000
cmp ebx, edx
jne 0x5dc9d4
push 3
jmp 0x5dc9ff
mov ebx, esi
or ebx, 0x40010000
cmp ebx, edx
je 0x5dca05
mov ebx, esi
or ebx, 0x40020000
cmp ebx, edx
jne 0x5dc9f1
xor edx, edx
inc edx
jmp 0x5dca00
mov ebx, esi
or ebx, 0x40030000
cmp ebx, edx
jne 0x5dca11
push 2
pop edx
shl edx, cl
or dword [ebp - 4], edx
add eax, 4
inc edi
inc ecx
inc ecx
inc esi
cmp ecx, 0x20
jb 0x5dc9c2
shl edi, 8
or dword [ebp - 4], edi
pop esi
pop ebx
cmp dword [eax], 0xffffffff
pop edi
je 0x5dca26
mov eax, 0x8876086c
jmp 0x5dca30
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
leave
ret 8

Function at 0x5e7124
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x692c68
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x5e717c
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x5e717c
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x5e717c
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret