joyce8/EMBER2024-capa huggingface dataset:
Function at 0x582270
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x582408
cmp ebp, ebx
jle 0x582408
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x5822ce
dec eax
or eax, 0xfffffff8
inc eax
je 0x5822d5
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, 0x80000001
jns 0x5822e4
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x5822eb
inc edi
mov dword [esp + 0x10], edi
push 0x18
call 0x6957a1
add esp, 4
cmp eax, ebx
je 0x58230c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call 0x6957a1
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
sal dword [ebx], 1
rol cl, 0xe9
add cl, byte [ecx - 0x3b7cef85]
add al, 0xf3
stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x5823fe
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x58bc98
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x15c249c], cl
add byte [eax], al
lea eax, [esp + 0x14]
mov byte [esp + 0x284], 5
push eax
call edi
push eax
lea ecx, [esp + 0x160]
call 0x69faf5
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x68], ebx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], ebx
lea ecx, [esp + 0x1b4]
mov byte [esp + 0x284], 7
push ecx
call edi
push eax
lea ecx, [esp + 0x6c]
call 0x69faf5
mov edx, dword [esp + 0xc4]
mov edi, dword [0x5de0e4]
push 6
push edx
call edi
push eax
call 0x69fae0
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0xc4]
push 1
push eax
call edi
push eax
call 0x69fae0
mov ecx, dword [esp + 0xc4]
push 2
push ecx
mov dword [esp + 0x19c], eax
call edi
push eax
call 0x69fae0
push 1
lea ecx, [esp + 0xc0]
mov dword [esp + 0x1b4], eax
call 0x69f225
mov eax, dword [esi + 0x44]
mov edi, dword [esp + 0x50]
shr eax, 1
and eax, 1
mov ecx, edi
mov dword [esp + 0x144], eax
call fcn.00588658
mov ecx, edi
mov dword [esp + 0x64], eax
call fcn.00588718
mov ebx, eax
mov ecx, edi
mov dword [esp + 0x58], ebx
call fcn.00588698
mov ecx, edi
mov dword [esp + 0x44], eax
call fcn.00588728
mov edi, eax
push 1
mov ecx, esi
mov dword [esp + 0x3c], edi
call 0x69bf37
add eax, ebx
push ebp
mov ecx, esi
mov dword [esp + 0x2c], eax
call 0x69bf37
lea edx, [esp + 0xb4]
add eax, edi
push edx
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.0058b018
mov ecx, dword [eax]
mov dword [esp + 0x3c], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x94], ebp
mov dword [esp + 0x40], edx
mov dword [esp + 0x90], 0xc558ec
lea eax, [esp + 0x90]
nop
add byte [eax], al
add byte [ebx - 0x7b39af32], cl
and al, 0x88
add al, byte [eax]
add byte [eax], cl

Function at 0x58c480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x38], eax
lea eax, [esp + 0x34]
push eax
push ecx
call dword [0x5de0e0]

Function at 0x58c490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea edx, [esp + 0x138]
lea ecx, [esp + 0xbc]
push edx
call 0x69f149
movsd dword es:[edi], dword [esi]
sub al, 0x11
add byte [ebx - 0x72cbdbbc], cl
mov word [eax + esi], fs
add al, byte [eax]
add byte [eax + 0x6a], dl
add byte [ecx - 0x73], dl
mov word [eax + ecx*8], fs
add byte [eax], al
add al, ch
jnp 0x58c4ee
adc dword [eax], eax
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
push edx
push eax
lea ecx, [esp + 0xc4]
Function at 0x58c4d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 0x24]
xor ebp, ebp
cmp edi, dword [esp + 0x80]
jg 0x58c5d4
mov eax, dword [esp + 0x28]
cmp ebx, eax
jge 0x58c347
sub ebx, eax
mov eax, dword [esp + 0x58]
add ebx, eax
push ebx
mov ecx, esi
call fcn.0058ae58
push eax
push edi
mov ecx, esi
call fcn.0058b228
mov ebp, eax
mov eax, dword [esp + 0x78]
cmp ebp, eax
jl 0x58c5bb
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
cmp eax, 1
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], ebp
jne 0x58c451
lea ecx, [esp + 0x74]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call dword [0x5de6d4]
lea ecx, [esp + 0x14]
push ecx
call dword [0x5de714]
test eax, eax
jne 0x58c5bb
lea edx, [esp + 0x174]
lea ecx, [esp + 0xbc]
push edx
call 0x69f149
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
sub eax, edx
sub ecx, edi
push 0xf00021
push eax
mov eax, dword [esp + 0xc8]
push ecx
push edx
push edi
push eax
call dword [0x5de098]
mov edx, dword [esp + 0xc4]
lea ecx, [esp + 0x14]
push 2
push ecx
push edx
call dword [0x5de0dc]
lea eax, [esp + 0x14]
push eax
call dword [0x5de120]
push eax
lea ecx, [esp + 0x4c]
call 0x69faf5
mov edi, dword [esp + 0x4c]
lea eax, [esp + 0x48]
mov edx, dword [esp + 0x6c]
lea ecx, [esp + 0x68]
neg eax
sbb eax, eax
push 4
and eax, edi
neg ecx
sbb ecx, ecx
push eax
and ecx, edx
push ecx
push edx
call dword [0x5de0a4]
lea ecx, [esp + 0x48]
call 0x69fb4c
jmp 0x58c5bb
mov edx, dword [esp + 0xc4]
lea ecx, [esp + 0x30]
push 1
push ecx
push edx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], edi
call dword [0x5de0dc]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0xc4]
inc eax
push 1
call 0x69f686
lea ecx, [esp + 0x110]
push ecx
lea ecx, [esp + 0xc0]
call 0x69f149
mov edx, dword [esp + 0x3c]
push ebp
push edx
lea ecx, [esp + 0xc4]
call 0x69f686
push ebp
push 0
lea ecx, [esp + 0xc4]
call 0x69f686
push edi
push 0
lea ecx, [esp + 0xc4]
call 0x69f686
inc ebx
lea eax, [esp + 0x248]
push ebx
push 0xc6af34
push eax
call dword [0x5de790]
lea ecx, [esp + 0x9c]
add esp, 0xc
test ecx, ecx
je 0x58c556
mov eax, dword [esp + 0x94]
test eax, eax
je 0x58c556
mov edx, dword [esp + 0xc0]
push eax
push edx
push 0
lea ecx, [esp + 0xc0]
call 0x69f2dd
jns 0x58c58f
adc dword [eax], eax
lea eax, [esp + 0x248]
lea ecx, [esp + 0x158]
push eax
call 0x698dc6
mov eax, dword [esp + 0x158]
lea edx, [esp + 0x14]
push 0x825
push edx
mov ecx, dword [eax - 8]
mov byte [esp + 0x28c], 0x12
push ecx
push eax
mov eax, dword [esp + 0xcc]
lea ecx, [esp + 0xcc]
add byte [eax], al
add bh, bh
push eax
push 0x58248c8d
add dword [eax], eax
add dh, al
test byte [esp + eax*4], ah
add al, byte [eax]
add byte [eax], dl
call 0x698d58
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x64]
inc eax
mov edi, ebp
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x58c324
xor ebp, ebp
mov ebx, dword [esp + 0x40]
jmp 0x58c752
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x16c]
invalid
pushfd
and al, 0x90
Function at 0x58c540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [ebp - 0x74f08b40], al
xchg esp, eax
and al, 0xc0
add byte [eax], al
add byte [eax + 0x52], dl

Function at 0x58c8a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test byte [esp + edx*4], ah
add byte [eax], al
add al, ch
lea edi, [esi - 0x73720001]
and al, 0xec
add dword [eax], eax
add al, ch
rcr ebx, 1
invalid
Function at 0x58ea18
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5da0e0
push eax
mov al, byte [esp + 0x28]
mov dword fs:[0], esp
sub esp, 0x2c
test al, 0x1e
push edi
mov edi, ecx
je 0x58ed3f
push ebx
push ebp
push esi
call fcn.0058b3c8
mov ebx, eax
mov ecx, ebx
call fcn.00589688
xor ebp, ebp
mov ecx, 1
cmp eax, ebp
je 0x58ea66
mov edx, dword [eax + 0x28]
mov dword [esp + 0x10], ecx
cmp edx, ecx
je 0x58ea6a
mov dword [esp + 0x10], ebp
mov eax, dword [edi + 0x6c]
cmp eax, ebp
jne 0x58ea7d
mov dl, byte [edi + 0x44]
mov dword [esp + 0x14], ecx
test dl, 4
jne 0x58ea81
mov dword [esp + 0x14], ebp
xor ecx, ecx
mov edx, dword [edi + 0x3c]
cmp eax, 2
push edx
setne cl
dec ecx
and ecx, 3
mov esi, ecx
lea ecx, [esp + 0x30]
push esi
push ebp
call 0x69fb62
mov ecx, ebx
mov dword [esp + 0x44], ebp
call fcn.00588718
cmp dword [esp + 0x58], eax
jl 0x58eac3
mov ecx, ebx
call fcn.00588728
mov ecx, dword [esp + 0x5c]
cmp ecx, eax
mov eax, 0xc0c0c0
jge 0x58eac8
mov eax, 0x808080
push eax
push esi
push ebp
lea ecx, [esp + 0x30]
call 0x69fb62
mov esi, dword [esp + 0x4c]
push 1
mov byte [esp + 0x48], 1
mov eax, dword [esi + 8]
push eax
call dword [0x5de0e4]
push eax
call 0x69fae0
mov ebp, dword [esp + 0x60]
mov edx, dword [esp + 0x50]
mov dword [esp + 0x18], eax
mov ecx, dword [ebp]
push ecx
push edx
mov ecx, edi
call fcn.0058b0f8
mov ebx, eax
mov eax, dword [ebp + 4]
mov ebp, dword [esp + 0x54]
push eax
push ebp
mov ecx, edi
call fcn.0058b228
mov edx, dword [esi + 8]
lea ecx, [esp + 0x1c]
push 1
push ecx
push edx
mov dword [esp + 0x58], eax
add byte [eax], al
jmp 0x58eb30
xchg esp, eax
and al, 0x80
add byte [eax], al
add byte [ebp + 0x68500141], cl
les esp, [ecx]
mov dword [eax], 0x8101e852
or al, 0

Function at 0x58eb8c
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
insb byte es:[edi], dx
xor eax, dword [eax]
add byte [ebx - 0x73], dl
dec eax
or al, ch
aas
push ecx
add dword [eax], eax
Function at 0x58ed58
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add esp, 0xc
test byte [esi + 0x331c], 0x40
je 0x58edbe
mov eax, dword [esi + 0x336c]
mov ecx, dword [esp + 0x34]
push ecx
lea ecx, [eax + 8]
call fcn.005a4578
mov edx, eax
ror byte [ebx + 0x10fac1c8], 1
push edx
mov edx, eax
shr edx, 9
not dl
and edx, 8
and eax, 0x2000
and ecx, 0xfff
or edx, 0x57
neg eax
sbb al, al
push ecx
and al, 0xe9
push edx
add al, 0x5f
lea ecx, [esp + 0x8c]
movsx eax, al
push eax
push 0xc721b4
push ecx
call 0x656e55
mov eax, dword [esp + 0x7c]
inc esp
and al, 0x7c
add esp, 0x18
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov edi, dword [ebp]
mov dword [esp + 0x74], eax
mov dword [esp + 0x68], edx
mov edx, dword [esp + 0x60]
lea eax, [esp + 0x80]
mov dword [esp + 0x6c], ecx
push eax
mov dword [esp + 0x74], edx
call fcn.0058ef98
add esp, 4
lea ecx, [esp + 0x80]
push eax
lea eax, [esi + 0xc94]
or al, 0
add byte [ecx + 0x50], dl
mov ecx, ebp
call dword [edi + 0x58]
mov edi, dword [esp + 0x70]
mov edx, dword [esi + 0xc74]
mov ebp, dword [ebp]
sub edi, eax
mov eax, dword [esi + 0xc6c]
push edx
lea ecx, [esp + 0x84]
push eax
push ecx
sub edi, 3
call fcn.0058ef98
mov ecx, dword [esi + 0x2d7c]
add esp, 4
lea edx, [esp + 0x88]
mov dword [esp + 0x40], ebp
push eax
mov eax, dword [esp + 0x78]
and al, 0x78
add ecx, eax
push edx
push ecx
lea ecx, [esi + 0xc94]
push ecx
mov ecx, dword [esp + 0x8c]
sub esp, 0x10
mov ebp, dword [esp + 0x78]
mov edx, esp
mov dword [edx], edi
mov dword [edx + 4], eax
mov eax, dword [esp + 0x98]
mov dword [edx + 8], eax
Function at 0x58ed78
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add esp, 0xc
test byte [esi + 0x331c], 0x40
je 0x58edbe
mov eax, dword [esi + 0x336c]
mov ecx, dword [esp + 0x34]
push ecx
lea ecx, [eax + 8]
call fcn.005a4578
mov edx, eax
ror byte [ebx + 0x10fac1c8], 1
push edx
mov edx, eax
shr edx, 9
not dl
and edx, 8
and eax, 0x2000
and ecx, 0xfff
or edx, 0x57
neg eax
sbb al, al
push ecx
and al, 0xe9
push edx
add al, 0x5f
lea ecx, [esp + 0x8c]
movsx eax, al
push eax
push 0xc721b4
push ecx
call 0x656e55
mov eax, dword [esp + 0x7c]
inc esp
and al, 0x7c
add esp, 0x18
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov edi, dword [ebp]
mov dword [esp + 0x74], eax
mov dword [esp + 0x68], edx
mov edx, dword [esp + 0x60]
lea eax, [esp + 0x80]
mov dword [esp + 0x6c], ecx
push eax
mov dword [esp + 0x74], edx
call fcn.0058ef98
add esp, 4
lea ecx, [esp + 0x80]
push eax
lea eax, [esi + 0xc94]
or al, 0
add byte [ecx + 0x50], dl
mov ecx, ebp
call dword [edi + 0x58]
mov edi, dword [esp + 0x70]
mov edx, dword [esi + 0xc74]
mov ebp, dword [ebp]
sub edi, eax
mov eax, dword [esi + 0xc6c]
push edx
lea ecx, [esp + 0x84]
push eax
push ecx
sub edi, 3
call fcn.0058ef98
mov ecx, dword [esi + 0x2d7c]
add esp, 4
lea edx, [esp + 0x88]
mov dword [esp + 0x40], ebp
push eax
mov eax, dword [esp + 0x78]
and al, 0x78
add ecx, eax
push edx
push ecx
lea ecx, [esi + 0xc94]
push ecx
mov ecx, dword [esp + 0x8c]
sub esp, 0x10
mov ebp, dword [esp + 0x78]
mov edx, esp
mov dword [edx], edi
mov dword [edx + 4], eax
mov eax, dword [esp + 0x98]
mov dword [edx + 8], eax
Function at 0x58fdd8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe0
mov eax, dword [esp + 0xf8]
mov edx, dword [esp + 0x100]
push ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x108]
mov ebx, ecx
mov ecx, dword [esp + 0x100]
mov dword [esp + 0x1c], eax
mov al, byte [ebx + 0x321c]
push ebp
mov ebp, dword [esp + 0x110]
push esi
push edi
mov edi, dword [esp + 0xf8]
test al, al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov byte [esp + 0x54], 0
mov dword [esp + 0x60], 0
je 0x58fe5e
mov al, byte [edi + 0x2e4c]
test al, al
invalid
je 0x58fe5e
mov al, byte [ebp + 0x30]
test al, al
je 0x58fe5e
mov ecx, dword [edi + 0x2e54]

Function at 0x58fe68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov eax, dword [ebx + 0x336c]
mov edx, dword [esp + 0xfc]
add byte [eax], al
add byte [edx - 0x73], dl
dec eax
or al, ch
add dword ds:[eax], eax
xor esi, esi
lea ecx, [edi + 0x2a14]
test eax, eax
je 0x58fea0
test al, 1
je 0x58fe95
cmp dword [ecx - 0x10], 0x16
jne 0x58fe95
mov edx, dword [ecx]
mov byte [esp + 0x54], 1
mov dword [esp + 0x60], edx
sar eax, 1
inc esi
add ecx, 0x18
cmp esi, 0x20
jl 0x58fe7c
mov al, byte [esp + 0x54]
test al, al
jne 0x58ff00
mov eax, dword [edi + 0x2e00]
test eax, eax
je 0x58ff00
mov ebx, dword [ebx + 0x336c]

Function at 0x58fee8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x58fef5
mov ebx, dword [ecx]
mov byte [esp + 0x54], 1
mov dword [esp + 0x60], ebx
Function at 0x58ff08
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x58ff21
mov al, byte [esp + 0x54]
test al, al
jne 0x58ff21
mov al, byte [edi + 0x2da4]
mov byte [esp + 0x1b], 1
test al, al
jne 0x58ff26
mov byte [esp + 0x1b], 0
mov ebx, dword [esp + 0x11c]
mov ecx, dword [esp + 0x14]
xor esi, esi
mov edx, dword [esp + 0xfc]
mov ecx, dword [ecx + 0x336c]
cmp ebx, esi
sete al
mov byte [esp + 0x5a], al
mov byte [esp + 0x13], al
mov eax, dword [ecx + 0x4b0]
push edx
imul eax, dword [edi + 0x2d74]
mov dword [esp + 0x90], eax
call fcn.0059fa18
cmp ebx, esi
fimul word [ecx + 0x7f682444]
invalid
xor eax, eax
jmp 0x58ff87
cmp ebx, dword [ebp + 0x58]
jge 0x58ff84
mov eax, dword [ebp + 4]
cmp eax, esi
je 0x58ff84
mov eax, dword [eax + ebx*4]
jmp 0x58ff87
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x44]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x5c], esi
mov dword [esp + 0x40], esi
mov edx, dword [ecx + eax*4]
mov ecx, dword [ebp + 0x58]
cmp ebx, ecx
mov dword [esp + 0x50], edx
jge 0x58ffed
cmp ebx, esi
jg 0x58ffae
mov dword [esp + 0x5c], esi
jmp 0x58ffc5
mov eax, dword [ebp + 4]
cmp eax, esi
je 0x58ffbe
mov eax, dword [eax + ebx*4]
mov dword [esp + 0x5c], eax
jmp 0x58ffc5
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x5c], edx
lea eax, [ebx + 1]
mov eax, dword [esp + 0x14]
mov byte [esp + 0x84], 0
test byte [eax + 0x335c], 1
je 0x590030
lea eax, [ebx + 1]
cmp eax, ecx
jge 0x590030
cmp eax, esi
jg 0x590011
xor eax, eax
jmp 0x590024
cmp eax, ecx
jge 0x590021
mov edx, dword [ebp + 4]
cmp edx, esi
je 0x590021
mov eax, dword [edx + eax*4]
jmp 0x590024
mov eax, dword [ebp + 0x18]
cmp eax, esi
setne dl
mov byte [esp + 0x84], dl
mov eax, dword [esp + 0x14]
invalid
mov ah, 0x24
hlt

Function at 0x58ffc8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp eax, esi
jg 0x58ffd2
mov dword [esp + 0x40], esi
jmp 0x58ffed
cmp eax, ecx
jge 0x58ffe6
mov edx, dword [ebp + 4]
cmp edx, esi
je 0x58ffe6
mov eax, dword [edx + eax*4]
mov dword [esp + 0x40], eax
jmp 0x58ffed
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x40], edx

Function at 0x590088
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
and al, 4
add dword [eax], eax
add byte [edi], cl
scasd eax, dword es:[edi]
ret 0x4c89
Function at 0x5900a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ah, 0x24
hlt
je 0x590035
xchg dword [eax], edx
or al, 0
add byte [eax - 0x75], dl
inc esp
and al, 0x20
sub esp, 0x10
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [esp + 0x34]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x38]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [ecx + 0xc], eax
mov ecx, esi
call dword [edx + 0x38]
mov ecx, dword [esp + 0x14]
mov al, 2
test byte [ecx + 0x335c], al
je 0x590145
mov edx, ecx
test byte [edx + 0x3360], al
je 0x5900ff
mov eax, dword [esp + 0x74]
mov ecx, dword [edi + 0x2d70]
sub eax, ecx
mov dword [esp + 0x6c], eax
jmp 0x59010f
mov eax, dword [edi + 0x2d70]
mov ecx, dword [esp + 0x6c]
add eax, ecx
mov dword [esp + 0x74], eax
mov eax, dword [edi + 0x2da0]
mov edx, dword [esp + 0x6c]
push eax
push 0
mov eax, dword [esp + 0x28]
sub esp, 0x10
mov ecx, esp
push esi
mov dword [ecx], edx
Function at 0x5908d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov dword [eax], edx
mov edx, dword [esp + 0xdc]
mov dword [eax + 4], edx
mov edx, dword [esp + 0xe0]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
call fcn.0058efb8
add esp, 0x18
jmp 0x590e15

Function at 0x590940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb byte [ecx - 0x7cb7dbbc], cl
les eax, [edx + ecx*4]
or dl, 0x31
add byte [eax], al
Function at 0x590e38
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x74], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x78], edx
mov edx, dword [edi + 0x2d68]
mov dword [esp + 0x70], ecx
mov eax, dword [esp + 0x1c]
lea ecx, [edx + ecx + 1]
mov edx, dword [esi]
mov dword [esp + 0x70], ecx
inc ecx
mov dword [esp + 0x78], ecx
mov cl, byte [edi + 0x2dd8]
test cl, cl
je 0x590e7b
mov ecx, dword [edi + 0x2de0]
jmp 0x590e7f
mov ecx, dword [esp + 0x34]
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [esp + 0x84]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x88]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x8c]
jmp 0x590f1c

Function at 0x5a1500
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dbe28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.005a18b0
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
xor eax, eax
push ebx
mov dword [esp + 0x20], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x4c], eax
mov eax, dword [esp + 0x30]
push ebp
push eax
lea edi, [esi + 0x10]
push ecx
push edx
push edi
mov dword [esi], 0xb75220
call fcn.005a15a0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push ebx
push ebp
push eax
push ecx
push edx
call fcn.005a1600
add esp, 0x2c
mov dword [esi + 0x4c], eax
push edi
call dword [0x5de0ac]
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], eax
mov dword [esi + 0xc], 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14

Function at 0x5a1518
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dbe28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.005a18b0
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
xor eax, eax
push ebx
mov dword [esp + 0x20], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x4c], eax
mov eax, dword [esp + 0x30]
push ebp
push eax
lea edi, [esi + 0x10]
push ecx
push edx
push edi
mov dword [esi], 0xb75220
call fcn.005a15a0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push ebx
push ebp
push eax
push ecx
push edx
call fcn.005a1600
add esp, 0x2c
mov dword [esi + 0x4c], eax
push edi
call dword [0x5de0ac]
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], eax
mov dword [esi + 0xc], 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x5a2eb0
Capabilities:
Access peb ldr_data

Disassembly:
pop esp
and al, 0x14
je 0x5a2f56
mov ecx, esi
call fcn.005a2db0
lea ecx, [esi + 0x14]
mov byte [esp + 0x14], 1
mov dword [esi + 0xc], 0xa
mov dword [esi + 0x10], ebx
call 0x5ecf10
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], 5
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], 8
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], 1
invalid
pop esi

Function at 0x5a2fb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dbeb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0xb753a4
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x14], 1
je 0x5a2fef
push eax
call dword [0x5de10c]
mov dword [esi + 0x10], ebx
mov eax, dword [esi + 0x28]
push eax
call 0x66cd5a
mov eax, dword [esi + 0x34]
mov dword [esi + 0x28], ebx
push eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call 0x66cd5a
add esp, 8
lea ecx, [esi + 0x14]
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov byte [esp + 0x14], bl
call 0x5ecf30
mov ecx, esi
call fcn.005a2df0
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x5a6530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ecx], 0xb7324c
jmp 0x5ab0e0
or byte [ebx + 0x47503f8], al

Function at 0x5aa8e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ecx, ecx
xor edx, edx
mov eax, dword [esi + 0xb4]
mov ebp, dword [esi + 0x94]
push edi
add ebp, 9
mov cx, word [eax]
add eax, 2
mov dword [esi + 0x60], ecx
mov dword [esi + 0xb4], eax
mov dx, word [eax]
add eax, 2
xor ecx, ecx
mov dword [esi + 0x5c], edx
mov dword [esi + 0xb4], eax
mov cx, word [eax]
mov edx, ecx
add eax, 2
dec edx
mov dword [esi + 0x54], ecx