joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c61a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
add esp, 4
pop edx
mov eax, dword [ebp - 0xb3c]
mov dword [ebp - 0x608], eax
mov dword [ebp - 0x69c], 0
mov ecx, dword [ebp - 0x264]
cmp ecx, dword [ebp - 0xb3c]
jne 0x6c61d9
mov edx, dword [ebp - 0x69c]
mov dword [ebp - 0xb44], edx
jmp 0x6c630a
cmp dword [ebp - 0x698], 0
jle 0x6c62fe
push edx
push eax
add esp, 4
or edx, 0x15f6f
pop edx
push ecx
jmp 0x6c61f9
xor ecx, 0xb347
sub ecx, 0x3271
add ecx, 0x5f4
pop ecx
push edx
push esi
add esp, 4
xor edx, 0x1331d
pop edx
mov eax, dword [ebp - 0x648]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x608]
movzx eax, byte [edx]
cmp ecx, eax
je 0x6c629a
push ecx
sub ecx, 0xdb75
jmp 0x6c623a
add ecx, 0xf283
and ecx, 0xd3c6
pop ecx
push ecx
push esi
add esp, 4
call 0x6c625c
add byte [ebp + 0x3a], cl
cmp eax, 0x47414f3e
dec esi
inc ebx
dec ecx
add esp, 4
pop ecx
mov ecx, dword [ebp - 0x648]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x608]
movzx ecx, byte [eax]
cmp edx, ecx
jle 0x6c6282
mov dword [ebp - 0xb40], 1
jmp 0x6c628c
mov dword [ebp - 0xb40], 0xffffffff
mov edx, dword [ebp - 0xb40]
mov dword [ebp - 0x69c], edx
jmp 0x6c62fe
push edi
push edi
add esp, 4
xor edi, 0x16442
add edi, 0x117ba
xor edi, 0xf5e4
pop edi
push eax
sub eax, 0x542f
and eax, 0x49bc
and eax, 0x4158
or eax, 0x13e8a
pop eax
mov eax, dword [ebp - 0x698]
sub eax, 1
mov dword [ebp - 0x698], eax
mov ecx, dword [ebp - 0x648]
add ecx, 1
mov dword [ebp - 0x648], ecx
mov edx, dword [ebp - 0x608]
add edx, 1
mov dword [ebp - 0x608], edx
jmp 0x6c61d9
invalid
invalid
Function at 0x6c625c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
add esp, 4
pop edx
mov eax, dword [ebp - 0xb3c]
mov dword [ebp - 0x608], eax
mov dword [ebp - 0x69c], 0
mov ecx, dword [ebp - 0x264]
cmp ecx, dword [ebp - 0xb3c]
jne 0x6c61d9
mov edx, dword [ebp - 0x69c]
mov dword [ebp - 0xb44], edx
jmp 0x6c630a
cmp dword [ebp - 0x698], 0
jle 0x6c62fe
push edx
push eax
add esp, 4
or edx, 0x15f6f
pop edx
push ecx
jmp 0x6c61f9
xor ecx, 0xb347
sub ecx, 0x3271
add ecx, 0x5f4
pop ecx
push edx
push esi
add esp, 4
xor edx, 0x1331d
pop edx
mov eax, dword [ebp - 0x648]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x608]
movzx eax, byte [edx]
cmp ecx, eax
je 0x6c629a
push ecx
sub ecx, 0xdb75
jmp 0x6c623a
add ecx, 0xf283
and ecx, 0xd3c6
pop ecx
push ecx
push esi
add esp, 4
call 0x6c625c
add byte [ebp + 0x3a], cl
cmp eax, 0x47414f3e
dec esi
inc ebx
dec ecx
add esp, 4
pop ecx
mov ecx, dword [ebp - 0x648]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x608]
movzx ecx, byte [eax]
cmp edx, ecx
jle 0x6c6282
mov dword [ebp - 0xb40], 1
jmp 0x6c628c
mov dword [ebp - 0xb40], 0xffffffff
mov edx, dword [ebp - 0xb40]
mov dword [ebp - 0x69c], edx
jmp 0x6c62fe
push edi
push edi
add esp, 4
xor edi, 0x16442
add edi, 0x117ba
xor edi, 0xf5e4
pop edi
push eax
sub eax, 0x542f
and eax, 0x49bc
and eax, 0x4158
or eax, 0x13e8a
pop eax
mov eax, dword [ebp - 0x698]
sub eax, 1
mov dword [ebp - 0x698], eax
mov ecx, dword [ebp - 0x648]
add ecx, 1
mov dword [ebp - 0x648], ecx
mov edx, dword [ebp - 0x608]
add edx, 1
mov dword [ebp - 0x608], edx
jmp 0x6c61d9
invalid
invalid
Function at 0x6c6778
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
mov byte [ebp - 0x494], 0x45
mov byte [ebp - 0x493], 0x78
mov byte [ebp - 0x492], 0x69
mov byte [ebp - 0x491], 0x74
mov byte [ebp - 0x490], 0x50
mov byte [ebp - 0x48f], 0x72
mov byte [ebp - 0x48e], 0x6f
mov byte [ebp - 0x48d], 0x63
mov byte [ebp - 0x48c], 0x65
invalid
test dword [ebp - 5], esi
invalid

Function at 0x6c6810
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [esi - 0x77], ah
test dword [edx - 0x4600000d], esi
jb 0x6c681d
add byte [eax], al
Function at 0x6c6a18
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push ecx
add esp, 4
sub eax, 0x35e7
add eax, 0x5557
or eax, 0x1550e
sub eax, 0x160bd
pop eax
push edi
and edi, 0x17c24
xor edi, 0x5c8
sub edi, 0x122ea
pop edi
lea edx, [ebp - 0xc50]
mov dword [ebp - 0x6ac], edx
mov eax, dword [ebp - 0x25c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x6a8], ecx
xor edx, edx
mov word [ebp - 0x114], dx
xor eax, eax
mov word [ebp - 0x28], ax
push eax
and eax, 0xf20
call fcn.006c6a18
add byte [ebx], bh
inc eax
inc eax
cmp eax, dword [ecx + 0x37]
cmp al, 0x32
add esp, 4
pop eax
push edi
push eax
add esp, 4
or edi, 0xfd98
and edi, 0x14e07
sub edi, 0x13bb7
pop edi
mov ecx, dword [ebp - 0x6a8]
mov dx, word [ecx]
mov word [ebp - 0x87a], dx
mov eax, dword [ebp - 0x6a8]
add eax, 2
mov dword [ebp - 0x6a8], eax
mov cx, word [ebp - 0x87a]
mov word [ebp - 0x114], cx
mov edx, dword [ebp - 0x6ac]
mov ax, word [edx]
mov word [ebp - 0x92c], ax
mov ecx, dword [ebp - 0x6ac]
add ecx, 2
mov dword [ebp - 0x6ac], ecx
mov dx, word [ebp - 0x92c]
mov word [ebp - 0x28], dx
push ecx
push ecx
add esp, 4
xor ecx, 0x6dbe
add ecx, 0x4d7c
and ecx, 0x777
pop ecx
push eax
push edi
add esp, 4
add eax, 0x29aa
pop eax
push esi
or esi, 0x3b5
xor esi, 0x2add
pop esi
movzx eax, word [ebp - 0x28]
test eax, eax
jne 0x6c6ada
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0xb5c], ecx
jmp 0x6c6b34
movzx eax, word [ebp - 0x114]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x6c6a02
movzx edx, word [ebp - 0x114]
xor edx, 0x20
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x6c6a02
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
jge 0x6c6b1e
mov dword [ebp - 0xb58], 0xffffffff
jmp 0x6c6b28
mov dword [ebp - 0xb58], 1
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0xb5c], 0
jne 0x6c6b7d
push esi
push edx
add esp, 4
or esi, 0x3b17
pop esi
push edi
jmp 0x6c6b51
jmp 0x6c6b5a
sub edi, 0x6ae4
pop edi
push edx
or edx, 0x404b
xor edx, 0x116d4
pop edx
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x188], ecx
jmp 0x6c6be5
push ebx
xor ebx, 0x1431c
sub ebx, 0x8dca
and ebx, 0x338a
pop ebx
push ecx
push edi
add esp, 4
and ecx, 0x10e8b
pop ecx
push ebx
push ebx
add esp, 4
and ebx, 0xfce8
xor ebx, 0x542f
pop ebx
mov edx, dword [ebp - 0x25c]
mov eax, dword [edx]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x25c]
cmp ecx, dword [ebp - 0x6b0]
je 0x6c6bdb
mov edx, dword [ebp - 0x25c]
cmp dword [edx + 0x30], 0
jne 0x6c69a6
mov dword [ebp - 0x188], 0
Function at 0x6c77b3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push ecx
add ecx, 0xa315
pop ecx
mov edx, dword [ebp - 0x254]
mov dword [ebp - 0x188], edx
jmp 0x6c7835

Function at 0x6c77f6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x6c77fe
pop ebx
mov eax, dword [ebp - 0x254]
mov ecx, dword [eax]
mov dword [ebp - 0x254], ecx
mov edx, dword [ebp - 0x254]
cmp edx, dword [ebp - 0x6cc]
je 0x6c782b
mov eax, dword [ebp - 0x254]
cmp dword [eax + 0x30], 0
jne 0x6c75f6
mov dword [ebp - 0x188], 0
Function at 0x6c806c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0x70a5
call 0x6c8081
add byte [esi], dh
xor eax, 0x3b464d33
add esp, 4
pop edx
mov eax, dword [ebp - 0x24c]
mov ecx, dword [eax]
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x24c]
cmp edx, dword [ebp - 0x6dc]
je 0x6c80b1
mov eax, dword [ebp - 0x24c]
cmp dword [eax + 0x30], 0
jne 0x6c7e7c
mov dword [ebp - 0x18c], 0

Function at 0x6c8081
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0x70a5
call 0x6c8081
add byte [esi], dh
xor eax, 0x3b464d33
add esp, 4
pop edx
mov eax, dword [ebp - 0x24c]
mov ecx, dword [eax]
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x24c]
cmp edx, dword [ebp - 0x6dc]
je 0x6c80b1
mov eax, dword [ebp - 0x24c]
cmp dword [eax + 0x30], 0
jne 0x6c7e7c
mov dword [ebp - 0x18c], 0
Function at 0x6c83a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add cl, byte [ecx - 0x6df6b]
jmp dword [esi - 0x75]
Function at 0x707900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87fa88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esi], 0x8b1d98
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], edx
mov edx, dword [0x8a2fb4]
lea ecx, [esi + 0x1c]
mov dword [ecx], edx
mov edx, dword [0x8a2fb8]
xor ebx, ebx
mov dword [ecx + 4], edx
mov edx, dword [0x8a2fbc]
mov dword [esp + 8], esi
mov dword [ecx + 8], edx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], 0x3f800000
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov byte [esi + 0x36], bl
cmp eax, ebx
mov dword [esi], 0x8b1fa0
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], bl
mov byte [esi + 0x3d], bl
mov byte [esi + 0x3e], bl
mov dword [esi + 0x40], ebx
mov ecx, dword [0x925ae8]
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ebx
mov edx, dword [0x925ae8]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], 0x6b
mov dword [esi + 0x64], 0x6b
mov edx, dword [0x8a2fb4]
lea ecx, [esi + 0x68]
mov dword [ecx], edx
mov edx, dword [0x8a2fb8]
mov dword [ecx + 4], edx
mov edx, dword [0x8a2fbc]
mov dword [esp + 0x14], ebx
mov dword [ecx + 8], edx
je 0x707a4d
mov ecx, dword [0x92febc]
push eax
mov eax, dword [0x92feb4]
lea edx, [eax + ecx*8]
push edx
push eax
call fcn.005d51f0
add esp, 0xc
cmp eax, ebx
je 0x707a4d
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x707a4d
mov ecx, dword [eax + 4]
push 0x403700
call fcn.005d59f0
cmp eax, ebx
je 0x707a4d
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx + 0x48]
mov edi, eax
cmp edi, ebx
je 0x707a37
mov ecx, edi
call fcn.00766130
cmp eax, 0x6b
je 0x707a37
mov ecx, edi
call fcn.00766130
mov dword [esi + 0x60], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x707eb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87faa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], edi
push edi
push ecx
mov dword [esi], 0x8b1ee0
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esp + 0x18], esp
mov ebx, esp
push str.Request
mov dword [esp + 0x28], edi
mov dword [esi + 0x38], edi
call fcn.005cc240
add esp, 4
push 0x7048c0
push esi
mov dword [ebx], eax
call fcn.00706140
add esp, 0x10
push edi
push ecx
mov dword [esp + 0x18], esp
mov ebx, esp
push 0x892edc
mov dword [esi + 0x3c], eax
call fcn.005cc240
add esp, 4
push 0x704900
push esi
mov dword [ebx], eax
call fcn.00706140
add esp, 0x10
push edi
push ecx
mov dword [esi + 0x40], eax
mov eax, esp
mov dword [esp + 0x18], esp
push 0x700940
push esi
mov dword [eax], 0x20d60dbf
call fcn.007061d0
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov dword [esi + 0x44], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret

Function at 0x707ec9
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87faa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], edi
push edi
push ecx
mov dword [esi], 0x8b1ee0
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esp + 0x18], esp
mov ebx, esp
push str.Request
mov dword [esp + 0x28], edi
mov dword [esi + 0x38], edi
call fcn.005cc240
add esp, 4
push 0x7048c0
push esi
mov dword [ebx], eax
call fcn.00706140
add esp, 0x10
push edi
push ecx
mov dword [esp + 0x18], esp
mov ebx, esp
push 0x892edc
mov dword [esi + 0x3c], eax
call fcn.005cc240
add esp, 4
push 0x704900
push esi
mov dword [ebx], eax
call fcn.00706140
add esp, 0x10
push edi
push ecx
mov dword [esi + 0x40], eax
mov eax, esp
mov dword [esp + 0x18], esp
push 0x700940
push esi
mov dword [eax], 0x20d60dbf
call fcn.007061d0
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov dword [esi + 0x44], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x708180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87fac8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], edi
mov dword [esi], 0x8b1f28
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
push edi
push ecx
mov dword [esi + 0x1c], edi
mov dword [esp + 0x18], esp
mov ebx, esp
push str.ReqHeliJoin
mov dword [esp + 0x28], edi
mov dword [esi + 0x20], 0x46fffe00
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call fcn.005cc240
add esp, 4
push 0x7049d0
push esi
mov dword [ebx], eax
call fcn.00706450
add esp, 0x10
push edi
push ecx
mov dword [esp + 0x18], esp
mov ebx, esp
push str.Dodged
mov dword [esi + 0x34], eax
call fcn.005cc240
add esp, 4
push 0x700b90
push esi
mov dword [ebx], eax
call fcn.00706450
add esp, 0x10
push edi
push ecx
mov dword [esp + 0x18], esp
mov ebx, esp
push str.Position
mov dword [esi + 0x38], eax
call fcn.005cc240
add esp, 4
push 0x700bc0
push esi
mov dword [ebx], eax
call fcn.00706450
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov dword [esi + 4], edi
mov dword [esi + 0x3c], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret

Function at 0x708199
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87fac8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], edi
mov dword [esi], 0x8b1f28
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
push edi
push ecx
mov dword [esi + 0x1c], edi
mov dword [esp + 0x18], esp
mov ebx, esp
push str.ReqHeliJoin
mov dword [esp + 0x28], edi
mov dword [esi + 0x20], 0x46fffe00
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call fcn.005cc240
add esp, 4
push 0x7049d0
push esi
mov dword [ebx], eax
call fcn.00706450
add esp, 0x10
push edi
push ecx
mov dword [esp + 0x18], esp
mov ebx, esp
push str.Dodged
mov dword [esi + 0x34], eax
call fcn.005cc240
add esp, 4
push 0x700b90
push esi
mov dword [ebx], eax
call fcn.00706450
add esp, 0x10
push edi
push ecx
mov dword [esp + 0x18], esp
mov ebx, esp
push str.Position
mov dword [esi + 0x38], eax
call fcn.005cc240
add esp, 4
push 0x700bc0
push esi
mov dword [ebx], eax
call fcn.00706450
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov dword [esi + 4], edi
mov dword [esi + 0x3c], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x70ced0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87fb8e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], 0x890978
mov dword [esi + 0x40], ebx
mov dword [esp + 8], esi
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
lea ecx, [esi + 0x58]
mov dword [esi], 0x8b2228
mov dword [esp + 0x14], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x10], ebx
mov byte [esi + 0x70], bl
mov dword [esi + 0x74], ebx
mov byte [esi + 0x78], bl
or eax, 0xffffffff
mov dword [esi + 0x80], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov word [esi + 0x8c], bx
mov byte [esp + 0x14], 2
call fcn.00708a50
mov ecx, dword [esi + 0x4c]
cmp ecx, ebx
je 0x70cf72
call fcn.004e0800
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x70d880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87fbf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], ebx
mov dword [esi], 0x8b1f4c
mov byte [esi + 0x10], bl
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
push ebx
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push str.PartUpdate
mov dword [esp + 0x28], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], 0xffffffff
mov byte [esi + 0x40], 1
mov dword [esi + 0x44], ebx
mov byte [esi + 0x4d], bl
call fcn.005cc240
add esp, 4
push 0x704a20
push esi
mov dword [edi], eax
call fcn.007064e0
add esp, 0x10
push ebx
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push 0x89885c
mov dword [esi + 0x50], eax
call fcn.005cc240
add esp, 4
push 0x70aca0
push esi
mov dword [edi], eax
call fcn.007064e0
add esp, 0x10
push ebx
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push str.Terminate
mov dword [esi + 0x54], eax
call fcn.005cc240
add esp, 4
push 0x700d70
push esi
mov dword [edi], eax
call fcn.007064e0
add esp, 0x10
push ebx
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push str.InteractiveDone
mov dword [esi + 0x58], eax
call fcn.005cc240
add esp, 4
push 0x700d80
push esi
mov dword [edi], eax
call fcn.007064e0
add esp, 0x10
push ebx
mov dword [esi + 0x5c], eax
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push str.X360UserTunes
call fcn.005cc240
add esp, 4
push 0x700d90
push esi
mov dword [edi], eax
call fcn.007064e0
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov dword [esi + 0x60], eax
mov dword [esi + 0xc], ebx
pop edi
mov dword [esi + 4], 0xffffffff
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x70d899
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87fbf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], ebx
mov dword [esi], 0x8b1f4c
mov byte [esi + 0x10], bl
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
push ebx
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push str.PartUpdate
mov dword [esp + 0x28], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], 0xffffffff
mov byte [esi + 0x40], 1
mov dword [esi + 0x44], ebx
mov byte [esi + 0x4d], bl
call fcn.005cc240
add esp, 4
push 0x704a20
push esi
mov dword [edi], eax
call fcn.007064e0
add esp, 0x10
push ebx
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push 0x89885c
mov dword [esi + 0x50], eax
call fcn.005cc240
add esp, 4
push 0x70aca0
push esi
mov dword [edi], eax
call fcn.007064e0
add esp, 0x10
push ebx
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push str.Terminate
mov dword [esi + 0x54], eax
call fcn.005cc240
add esp, 4
push 0x700d70
push esi
mov dword [edi], eax
call fcn.007064e0
add esp, 0x10
push ebx
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push str.InteractiveDone
mov dword [esi + 0x58], eax
call fcn.005cc240
add esp, 4
push 0x700d80
push esi
mov dword [edi], eax
call fcn.007064e0
add esp, 0x10
push ebx
mov dword [esi + 0x5c], eax
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push str.X360UserTunes
call fcn.005cc240
add esp, 4
push 0x700d90
push esi
mov dword [edi], eax
call fcn.007064e0
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov dword [esi + 0x60], eax
mov dword [esi + 0xc], ebx
pop edi
mov dword [esi + 4], 0xffffffff
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x716c68
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x88020a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea edi, [esi + 0x10]
mov dword [esp + 0x1c], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
lea ebx, [esi + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
lea ebp, [esi + 0x30]
mov dword [ebp + 4], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
push 8
mov byte [esp + 0x20], 6
call fcn.00711e30
push 6
mov ecx, edi
call fcn.00711e30
push 6
mov ecx, ebx
call fcn.00711e30
push 0x14
mov ecx, ebp
call fcn.00711e30
push 0xa
lea ecx, [esi + 0x40]
call fcn.00711e30
push 0xa
lea ecx, [esi + 0x50]
call fcn.00711e30
push 0xa
lea ecx, [esi + 0x60]
call fcn.00711e30
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x716d20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x88023e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], 0x890978
mov dword [esi + 0x40], edi
mov dword [esp + 8], esi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
lea ecx, [esi + 0x58]
mov dword [esi], 0x8b24f0
mov dword [esp + 0x14], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x74], 0x8b2648
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov word [esi + 0x94], di
mov dword [esi + 0x98], edi
mov byte [esp + 0x14], 2
mov dword [esi + 0xa0], 0x7fff
mov dword [esi + 0xa4], 0x1000
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edi
call fcn.00708a50
cmp dword [esi + 0x2c], edi
jne 0x716e03
cmp dword [0x8f8700], edi
je 0x716e03
push 7
lea ecx, [esi + 0x78]
call fcn.00711d30
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xa4], 0x1000
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret