joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50e6f0
Capabilities:
Hash data using djb2

Disassembly:
movsx ecx, byte [edx]
test ecx, ecx
mov eax, 0x1505
je 0x50e71a
lea esp, [esp]
inc edx
cmp ecx, 0x61
jl 0x50e70e
cmp ecx, 0x7a
jg 0x50e70e
sub ecx, 0x20
imul eax, eax, 0x21
xor eax, ecx
movsx ecx, byte [edx]
test ecx, ecx
jne 0x50e700
ret

Function at 0x50e9f0
Capabilities:
Hash data using djb2

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov esi, ecx
mov edi, eax
xor eax, eax
lea ecx, [esi + 0x28]
mov edx, dword [ecx - 0x28]
test edx, edx
je 0x50ea37
mov edx, dword [ecx - 0x14]
test edx, edx
je 0x50ea2c
cmp dword [ecx], 0
je 0x50ea2f
mov edx, dword [ecx + 0x14]
test edx, edx
je 0x50ea34
add eax, 4
add ecx, 0x50
cmp eax, 0x20
jl 0x50ea05
jmp 0x50ea37
inc eax
jmp 0x50ea37
add eax, 2
jmp 0x50ea37
add eax, 3
cmp eax, 0x20
je 0x50ea84
lea eax, [eax + eax*4]
lea ecx, [esi + eax*4]
movsx eax, byte [edi]
test eax, eax
mov edx, 0x1505
je 0x50ea6a
mov edi, edi
inc edi
cmp eax, 0x61
jl 0x50ea5e
cmp eax, 0x7a
jg 0x50ea5e
sub eax, 0x20
imul edx, edx, 0x21
xor edx, eax
movsx eax, byte [edi]
test eax, eax
jne 0x50ea50
mov dword [ecx + 0xc], ebx
imul ebx, ebp
mov dword [ecx], edx
mov edx, dword [esp + 0x14]
mov dword [ecx + 4], edx
mov dword [ecx + 8], ebp
mov dword [ecx + 0x10], ebx
call fcn.0050e800
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x512960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x6df23b
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ecx, dword [ebp + 4]
mov eax, dword [ebp + 8]
lea edx, [ecx + 1]
cmp eax, edx
push esi
push edi
jge 0x512aba
mov edx, dword [ebp + 0x10]
xor ebx, ebx
cmp edx, ebx
jne 0x5129ad
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x80
jge 0x5129af
mov eax, 0x80
jmp 0x5129af
mov eax, edx
lea edi, [ecx + eax]
mov eax, edi
shl eax, 6
add eax, 0x10
push eax
mov dword [esp + 0x18], edi
call fcn.00685d18
add esp, 4
mov dword [esp + 0x28], eax
cmp eax, ebx
mov dword [esp + 0x20], ebx
je 0x5129f1
push fcn.00668d30
push 0x511360
push edi
lea esi, [eax + 0x10]
push 0x40
push esi
mov dword [eax], edi
call fcn.00686002
mov dword [esp + 0x28], esi
jmp 0x5129f7
mov dword [esp + 0x28], ebx
mov esi, ebx
mov dword [esp + 0x20], 0xffffffff
cmp dword [ebp + 4], ebx
jle 0x512a90
mov edx, 0xfffffff8
sub edx, esi
lea eax, [esi + 8]
mov dword [esp + 0x10], edx
jmp 0x512a20
mov edx, dword [esp + 0x10]
lea esp, [esp]
mov edi, dword [ebp]
add edx, eax
mov ecx, dword [edx + edi]
add edx, edi
mov dword [eax - 8], ecx
mov ecx, dword [edx + 4]
mov dword [eax - 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 4], ecx
lea esi, [edx + 0x10]
lea edi, [eax + 8]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [edx + 0x30]
mov dword [eax + 0x28], ecx
mov cx, word [edx + 0x34]
mov word [eax + 0x2c], cx
xor ecx, ecx
mov cl, byte [edx + 0x36]
xor cl, byte [eax + 0x2e]
add eax, 0x40
and ecx, 1
xor word [eax - 0x12], cx
movzx edx, byte [edx + 0x36]
xor ecx, ecx
mov cx, word [eax - 0x12]
xor dl, cl
and edx, 2
xor edx, ecx
mov word [eax - 0x12], dx
mov ecx, dword [ebp + 4]
inc ebx
cmp ebx, ecx
jl 0x512a18
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x14]
mov eax, dword [ebp]
test eax, eax
je 0x512ab4
mov ecx, dword [eax - 0x10]
lea ebx, [eax - 0x10]
push fcn.00668d30
push ecx
push 0x40
push eax
call fcn.00685fa2
push ebx
call fcn.00685b4c
add esp, 4
mov dword [ebp], esi
mov dword [ebp + 8], edi
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
mov edx, dword [esp + 0x2c]
shl eax, 6
add eax, ecx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
lea esi, [edx + 0x10]
lea edi, [eax + 0x10]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [edx + 0x30]
mov dword [eax + 0x30], ecx
mov cx, word [edx + 0x34]
mov word [eax + 0x34], cx
mov bl, byte [edx + 0x36]
xor ecx, ecx
mov cl, byte [eax + 0x36]
xor cl, bl
pop edi
pop esi
and ecx, 1
xor word [eax + 0x36], cx
movzx edx, byte [edx + 0x36]
xor ecx, ecx
mov cx, word [eax + 0x36]
xor dl, cl
and edx, 2
xor edx, ecx
mov ecx, dword [esp + 0x10]
mov word [eax + 0x36], dx
inc dword [ebp + 4]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x519cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x64
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push edi
push eax
push ecx
mov ecx, 0x8d68e0
call fcn.004013f0
test eax, eax
mov dword [esp + 0xc], eax
je 0x519eeb
xorps xmm0, xmm0
mov ebx, dword [0x80e368]
test ebx, ebx
mov dword [esp + 0x10], 0
movss dword [esp + 0x20], xmm0
movss dword [esp + 0x24], xmm0
movss dword [esp + 0x28], xmm0
je 0x519eeb
jmp 0x519d30
mov eax, dword [esp + 0xc]
mov edi, edi
cmp ebx, eax
je 0x519ecc
mov eax, dword [ebx + 8]
cmp eax, dword [esi + 0xa0]
mov ecx, dword [ebx + 0xc]
jne 0x519d52
cmp ecx, dword [esi + 0xa4]
je 0x519ecc
mov eax, dword [ebx + 0xc4]
test eax, eax
jne 0x519ecc
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x1ec]
fstp dword [esp + 0x14]
movss xmm1, dword [ebx + 0x40]
movss xmm0, dword [esi + 0x70]
movss xmm2, dword [ebx + 0x48]
subss xmm0, xmm1
movss xmm1, dword [esi + 0x78]
subss xmm1, xmm2
xorps xmm2, xmm2
movss dword [esp + 0x44], xmm2
movaps xmm2, xmm1
mulss xmm2, xmm1
movss dword [esp + 0x40], xmm0
movss dword [esp + 0x48], xmm1
movss xmm1, dword [esi + 0x278]
addss xmm1, dword [esp + 0x14]
mulss xmm0, xmm0
addss xmm0, xmm2
movaps xmm2, xmm1
mulss xmm2, xmm1
comiss xmm2, xmm0
movss dword [esp + 0x18], xmm0
movss dword [esp + 0x1c], xmm1
jbe 0x519ecc
mov eax, dword [ebx + 0x70]
test ah, 6
je 0x519de7
mov ecx, ebx
call fcn.005042d0
mov eax, dword [ebp + 0xc]
lea esi, [ebx + 0x50]
mov ecx, 8
lea edi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
movss xmm0, dword [esp + 0x64]
comiss xmm0, dword [eax + 4]
jb 0x519ec9
movss xmm0, dword [eax + 0x14]
comiss xmm0, dword [esp + 0x54]
jb 0x519ec9
fld dword [esp + 0x18]
mov eax, dword [esp + 0x40]
fsqrt
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x4c]
push ecx
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
fsubr dword [esp + 0x20]
fstp dword [esp]
call fcn.0042e260
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x188]
test eax, eax
je 0x519e74
call fcn.0042fab0
mov esi, dword [esp + 0xc]
push eax
mov ecx, esi
call fcn.00401340
test eax, eax
je 0x519eae
jmp 0x519e78
mov esi, dword [esp + 0xc]
movss xmm0, dword [esp + 0x30]
addss xmm0, dword [esp + 0x20]
movss dword [esp + 0x20], xmm0
movss xmm0, dword [esp + 0x34]
addss xmm0, dword [esp + 0x24]
movss dword [esp + 0x24], xmm0
movss xmm0, dword [esp + 0x38]
addss xmm0, dword [esp + 0x28]
movss dword [esp + 0x28], xmm0
mov eax, dword [esp + 0x10]
mov ecx, dword [ebx + 0xc]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x450], eax
mov dword [esi + 0x454], ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebx + 0xa0]
test ebx, ebx
jne 0x519d2a
mov eax, dword [esp + 0x10]
test eax, eax
je 0x519eeb
lea eax, [esp + 0x20]
call fcn.0051d980
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x51fa40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6de4ce
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
push 0x5b8060
push fcn.0042f9a0
push 0xa
push 4
lea eax, [esi + 0x34]
push eax
call fcn.00686002
push 0x51fb70
push 0x51fb60
push 8
push 8
lea ebx, [esi + 0x88]
xor edi, edi
push ebx
mov dword [esp + 0x2c], edi
call fcn.00686002
push 0x51fb70
push 0x51fb60
push 0xb
push 8
lea ebp, [esi + 0xc8]
push ebp
mov byte [esp + 0x2c], 1
call fcn.00686002
or eax, 0xffffffff
mov dword [esi + 0xc], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x80], edi
mov dword [ebx], eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xc0], eax
mov ecx, 0xb
mov dword [ebp], eax
add ebp, 8
dec ecx
jne 0x51fb26
xorps xmm0, xmm0
mov ecx, dword [esp + 0x10]
pop edi
movss dword [esi + 4], xmm0
movss dword [esi + 8], xmm0
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x531880
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6deaa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x7274d8
xor eax, eax
mov dword [esp + 0x10], eax
xorps xmm0, xmm0
movss xmm1, dword [0x7389bc]
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x28]
push eax
mov dword [esi + 8], 0xffffffff
movss dword [esi + 0x10], xmm0
movss dword [esi + 0x18], xmm0
movss dword [esi + 0x1c], xmm0
movss dword [esi + 0x24], xmm1
movss dword [esi + 0x2c], xmm0
movss dword [esi + 0x30], xmm0
call fcn.00685b4c
mov ecx, dword [esp + 0xc]
add esp, 4
mov dword [esi], 0x727500
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x535a30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x34
xorps xmm0, xmm0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
movss dword [esp + 0x28], xmm0
movss dword [esp + 0x24], xmm0
movss dword [esp + 0x20], xmm0
movss dword [esp + 0x38], xmm0
movss dword [esp + 0x34], xmm0
movss dword [esp + 0x30], xmm0
add ebx, 0x148
mov dword [esp + 0xc], 9
mov ecx, dword [ebx]
test ecx, ecx
je 0x535b34
mov esi, dword [ecx + 8]
cmp esi, 0xffffffff
je 0x535b34
mov eax, dword [ecx + 0x30]
test ah, 8
jne 0x535a9e
comiss xmm0, dword [ecx + 0x20]
jae 0x535b34
mov eax, dword [ecx]
mov edi, 1
call dword [eax + 0x10]
mov edx, dword [eax + 0x78]
lea ecx, [esi + esi*4]
shl ecx, 5
movss xmm0, dword [ecx + edx + 0x10]
comiss xmm0, dword [esp + 0x20]
lea eax, [ecx + edx + 0x10]
ja 0x535ac8
movss dword [esp + 0x20], xmm0
movss xmm0, dword [eax + 4]
comiss xmm0, dword [esp + 0x24]
ja 0x535ada
movss dword [esp + 0x24], xmm0
movss xmm0, dword [eax + 8]
comiss xmm0, dword [esp + 0x28]
ja 0x535aec
movss dword [esp + 0x28], xmm0
movss xmm0, dword [esp + 0x30]
comiss xmm0, dword [eax + 0x10]
ja 0x535afd
movss xmm0, dword [eax + 0x10]
movss dword [esp + 0x30], xmm0
movss xmm0, dword [esp + 0x34]
comiss xmm0, dword [eax + 0x14]
ja 0x535b14
movss xmm0, dword [eax + 0x14]
movss dword [esp + 0x34], xmm0
movss xmm0, dword [esp + 0x38]
comiss xmm0, dword [eax + 0x18]
ja 0x535b2b
movss xmm0, dword [eax + 0x18]
movss dword [esp + 0x38], xmm0
xorps xmm0, xmm0
mov eax, dword [esp + 0xc]
add ebx, 4
dec eax
mov dword [esp + 0xc], eax
jne 0x535a76
test edi, edi
jne 0x535c43
mov eax, dword [ebp + 8]
mov ax, word [eax + 0x90]
cmp ax, 0xffff
je 0x535bcf
mov ecx, dword [0x8cf1b4]
movsx edx, ax
imul edx, edx, 0x98
mov edx, dword [edx + ecx + 0x84]
test edx, edx
jne 0x535bc0
movsx esi, ax
cmp esi, 0xffffffff
jne 0x535b84
xor ecx, ecx
jmp 0x535bba
imul esi, esi, 0x98
mov edx, dword [esi + ecx + 0x84]
test edx, edx
lea eax, [esi + ecx]
jne 0x535bb3
mov edx, dword [0x8cf5c0]
test edx, edx
je 0x535bb3
push eax
push 0x8ce750
call fcn.0043adc0
mov ecx, dword [0x8cf1b4]
mov ecx, dword [esi + ecx + 0x84]
mov edx, ecx
test edx, edx
je 0x535bcf
mov ecx, 8
mov esi, edx
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
jmp 0x535c43
movss xmm0, dword [0x738db4]
movss dword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
movss dword [esp + 0x14], xmm0
mov ecx, dword [esp + 0x14]
movss dword [esp + 0x18], xmm0
movss xmm0, dword [0x7389d4]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
movss dword [esp + 0x10], xmm0
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
movss dword [esp + 0x14], xmm0
mov edx, dword [esp + 0x14]
movss dword [esp + 0x18], xmm0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov eax, dword [ebp + 0xc]
mov ecx, 8
lea esi, [esp + 0x20]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53c380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6e0618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x50]
push edi
mov dword [esp + 0x14], eax
mov eax, dword [0x80ed2c]
inc edx
xor ebx, ebx
push eax
mov edi, str.small
mov dword [esi + 0x50], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], 0x190
call fcn.005c2160
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], 0x40
mov dword [esp + 0x24], ebx
mov word [esp + 0x28], bx
mov ecx, dword [esp + 0x70]
lea edx, [esp + 0xc]
push edx
push ecx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x74], ebx
call fcn.006148f0
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
mov edx, dword [esi + 0x50]
inc eax
and edx, 0x8000001f
jns 0x53c416
dec edx
or edx, 0xffffffe0
inc edx
mov di, word [ecx + eax*2]
imul edx, edx, 0x10c
add edx, eax
mov word [esi + edx*2 + 0x58], di
cmp word [ecx + eax*2], bx
jne 0x53c405
mov ecx, dword [esi + 0x50]
and ecx, 0x8000001f
jns 0x53c43d
dec ecx
or ecx, 0xffffffe0
inc ecx
movss xmm1, dword [0x738a00]
imul ecx, ecx, 0x218
cvtsi2ss xmm0, eax
mulss xmm0, dword [0x738d90]
addss xmm0, dword [0x738ebc]
comiss xmm0, xmm1
mov dword [ecx + esi + 0x25c], ebx
jbe 0x53c46e
movaps xmm0, xmm1
mov edx, dword [esi + 0x50]
and edx, 0x8000001f
jns 0x53c47e
dec edx
or edx, 0xffffffe0
inc edx
imul edx, edx, 0x218
mov dword [edx + esi + 0x25c], 1
mov eax, dword [esi + 0x50]
and eax, 0x8000001f
jns 0x53c49e
dec eax
or eax, 0xffffffe0
inc eax
imul eax, eax, 0x218
movss dword [eax + esi + 0x258], xmm0
mov eax, dword [esp + 0x1c]
pop edi
pop esi
cmp eax, ebx
pop ebx
je 0x53c4cf
lea ecx, [eax - 8]
lea edx, [esp + 0x14]
cmp ecx, edx
je 0x53c4cf
add eax, 0xfffffff8
push eax
call fcn.0062a450
add esp, 4
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 4
Function at 0x564a60
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x6e2368
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0xe9c], 0x13
push esi
push edi
mov esi, ecx
jne 0x564c12
xorps xmm0, xmm0
push 0
lea eax, [esp + 0x54]
mov edi, ebx
movss dword [esp + 0x54], xmm0
movss dword [esp + 0x58], xmm0
movss dword [esp + 0x5c], xmm0
call fcn.0056bdb0
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [esi + 8]
mov esi, dword [esi + 0xc]
lea edi, [ebx + 0xeb0]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [esp + 0x44], ecx
mov dword [edi + 8], edx
push 5
mov ecx, 0x784858
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], esi
mov dword [edi + 0xc], esi
call fcn.0065ead0
mov edx, dword [eax]
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call dword [edx + 0xf0]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
mov ecx, 0x8d68e0
call fcn.004013f0
mov dword [esp + 0x14], eax
mov edx, str.CHARACTER_GRENADE
mov ecx, 0x1505
mov eax, 0x43
inc edx
cmp eax, 0x61
jl 0x564b31
cmp eax, 0x7a
jg 0x564b31
sub eax, 0x20
imul ecx, ecx, 0x21
xor ecx, eax
movsx eax, byte [edx]
test eax, eax
jne 0x564b23
and ecx, 0xfffffff
or ecx, 0x40000000
mov dword [esp + 0x10], ecx
mov dword [esp + 0x6c], eax
xorps xmm0, xmm0
movss dword [esp + 0x30], xmm0
movss dword [esp + 0x34], xmm0
movss xmm0, dword [0x738cd0]
lea edi, [ebx + 0xed4]
lea esi, [esp + 0x30]
movss dword [esp + 0x38], xmm0
call fcn.0042e0f0
movzx eax, word [ebx + 0x76]
mov ecx, dword [esp + 0x10]
xorps xmm0, xmm0
mov esi, dword [esp + 0x14]
push ecx
mov edx, eax
shr edx, 8
push edx
and eax, 0xff
push eax
lea eax, [esp + 0x3c]
push eax
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [ebx + 8]
lea edx, [esp + 0x54]
push edx
mov edx, dword [ebx + 0x84]
push eax
push ecx
movss dword [esp + 0x44], xmm0
movss dword [esp + 0x48], xmm0
movss dword [esp + 0x4c], xmm0
call fcn.0051f170
mov edx, dword [ebx]
push 0x3e800000
push 0
push 0
push 0
push 0
push 0
push 0
push 8
mov ecx, ebx
call dword [edx + 0x268]
mov eax, dword [0x916518]
mov dword [ebx + 0xec0], eax
mov eax, dword [ebx + 0x8c]
mov ecx, dword [0x91651c]
or eax, 0x10000
mov dword [ebx + 0xec4], ecx
mov dword [ebx + 0x8c], eax
mov ecx, dword [esp + 0x64]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x56f3b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x6e2b98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x757e18]
push edi
mov edi, ecx
cmp dword [0x80e0e4], eax
jge 0x56f4db
cmp dword [0x8d6698], eax
jg 0x56f4db
mov eax, dword [edi + 0x6c]
mov cl, byte [eax + 0xf14]
test cl, cl
jns 0x56f4db
call fcn.0056ef40
test eax, eax
je 0x56f4db
mov ecx, dword [eax + 0x88]
mov edx, dword [eax]
or ecx, 0x200
mov dword [eax + 0x88], ecx
mov ecx, dword [edi + 0x6c]
add ecx, 0x260
push ecx
mov ecx, eax
call dword [edx + 0x30]
mov ecx, dword [edi + 0x6c]
mov edx, dword [ecx]
call dword [edx + 0x2c8]
push eax
lea eax, [esp + 0x10]
push str._s_VOX_DEATH01
push eax
call fcn.00626a10
add esp, 0xc
mov dword [esp + 0x2c], 0
mov ecx, dword [edi + 0x6c]
movss xmm0, dword [ecx + 0x48]
movss xmm1, dword [ecx + 0x44]
movss xmm2, dword [ecx + 0x40]
movzx ecx, byte [ecx + 0x76]
mov eax, dword [eax]
push 1
push 1
and ecx, 0xff
push ecx
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0x940c00
mov edx, eax
movss dword [esp + 0x28], xmm2
movss dword [esp + 0x2c], xmm1
movss dword [esp + 0x30], xmm0
call fcn.006335d0
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0xc]
call fcn.00626990
mov edx, dword [edi + 0x6c]
mov dword [edx + 0xcc], 2
mov ecx, dword [edi + 0x6c]
mov eax, dword [ecx]
call dword [eax + 0x2b4]
mov eax, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x56f740
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x6e2b98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [0x757e18]
push esi
push edi
mov edi, ecx
cmp dword [0x80e0e4], eax
jge 0x56f790
cmp dword [0x8d6698], eax
jg 0x56f790
mov esi, dword [edi + 0x6c]
mov eax, dword [esi + 0x3c0]
add esi, 0x260
cmp eax, 2
je 0x56f7a3
cmp eax, 3
je 0x56f7a3
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0056ef40
test eax, eax
je 0x56f7b4
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx + 0x30]
mov ecx, dword [edi + 0x6c]
mov eax, dword [ecx]
call dword [eax + 0x2c8]
push eax
lea ecx, [esp + 0x10]
push str._s_VOX_DEATH01
push ecx
call fcn.00626a10
add esp, 0xc
mov dword [esp + 0x2c], 0
mov ecx, dword [edi + 0x6c]
movss xmm0, dword [ecx + 0x48]
movss xmm1, dword [ecx + 0x44]
movss xmm2, dword [ecx + 0x40]
movzx ecx, byte [ecx + 0x76]
mov eax, dword [eax]
push 1
push 1
and ecx, 0xff
push ecx
lea edx, [esp + 0x1c]
push edx
push 1
push 0x940c00
mov edx, eax
movss dword [esp + 0x28], xmm2
movss dword [esp + 0x2c], xmm1
movss dword [esp + 0x30], xmm0
call fcn.006335d0
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0xc]
call fcn.00626990
mov eax, dword [edi + 0x6c]
mov dword [eax + 0xcc], 2
mov ecx, dword [edi + 0x6c]
mov edx, dword [ecx]
call dword [edx + 0x2b4]
mov ecx, dword [esp + 0x24]
pop edi
mov eax, 1
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x56fa80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x6e2b98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, dword [edi + 0x6c]
mov eax, dword [esi + 0x11a4]
shr eax, 4
and eax, 1
push eax
call fcn.004f7d00
test eax, eax
je 0x56faf4
test byte [edi + 0x80], 1
je 0x56fae3
mov ecx, dword [eax + 0x88]
movss xmm0, dword [0x7389e8]
or ecx, 0x200
mov dword [eax + 0x88], ecx
movss dword [eax + 0x168], xmm0
mov ecx, dword [edi + 0x6c]
mov edx, dword [eax]
add ecx, 0x260
push ecx
mov ecx, eax
call dword [edx + 0x30]
mov ecx, dword [edi + 0x6c]
mov edx, dword [ecx]
call dword [edx + 0x2c8]
push eax
lea eax, [esp + 0x10]
push str._s_VOX_DEATH01
push eax
call fcn.00626a10
add esp, 0xc
mov dword [esp + 0x2c], 0
mov ecx, dword [edi + 0x6c]
movss xmm0, dword [ecx + 0x48]
movss xmm1, dword [ecx + 0x44]
movss xmm2, dword [ecx + 0x40]
movzx ecx, byte [ecx + 0x76]
mov eax, dword [eax]
push 1
push 1
and ecx, 0xff
push ecx
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0x940c00
mov edx, eax
movss dword [esp + 0x28], xmm2
movss dword [esp + 0x2c], xmm1
movss dword [esp + 0x30], xmm0
call fcn.006335d0
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0xc]
call fcn.00626990
mov edx, dword [edi + 0x6c]
mov dword [edx + 0xcc], 2
mov ecx, dword [edi + 0x6c]
mov eax, dword [ecx]
call dword [eax + 0x2b4]
mov ecx, dword [esp + 0x24]
mov eax, 1
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x58a110
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, dword fs:[0]
xorps xmm0, xmm0
push 0xffffffffffffffff
push 0x6e033e
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 4]
movss dword [esi + 8], xmm0
movss dword [esi + 0xc], xmm0
movss xmm0, dword [0x738ac8]
and ecx, 0xfffffffc
mov dword [esi + 4], ecx
movss dword [esi + 0x10], xmm0
movss dword [esi + 0x14], xmm0
movss xmm0, dword [0x738a74]
push edi
movss dword [esi + 0x18], xmm0
movss dword [esi + 0x1c], xmm0
push fcn.006176f0
push fcn.006176d0
push 7
xor ebx, ebx
mov dword [esp + 0x20], ebx
push 0x44
lea eax, [esi + 0x64]
mov dword [esi], 0x7184b8
lea edi, [esi + 0x20]
push eax
mov dword [edi], 0xffffffff
call fcn.00686002
mov byte [esp + 0x14], 1
xorps xmm0, xmm0
movss xmm1, dword [0x7389bc]
movss dword [esi + 0x38], xmm0
movss dword [esi + 0x40], xmm0
movss dword [esi + 0x44], xmm0
movss dword [esi + 0x50], xmm0
movss dword [esi + 0x54], xmm1
mov byte [esi + 0x5d], bl
mov al, 0xff
mov byte [esi + 0x5f], al
mov byte [esi + 0x5e], al
mov byte [esi + 0x5c], al
mov byte [esi + 0x63], al
mov byte [esi + 0x62], al
mov byte [esi + 0x61], bl
mov byte [esi + 0x60], al
movss dword [esi + 0x3c], xmm1
movss dword [esi + 0x4c], xmm0
mov cl, byte [0x779977]
mov byte [esi + 0x5f], cl
mov dl, byte [0x779976]
mov byte [esi + 0x5e], dl
mov al, byte [0x779975]
mov byte [esi + 0x5d], al
mov cl, byte [0x779974]
mov byte [esi + 0x5c], cl
push str.HUD_Campaign_scan.xbmp
push edi
mov ecx, 0x8ce750
mov dword [esi + 0x58], ebx
call fcn.0043b1a0
xorps xmm0, xmm0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x24], ebx
movss dword [esi + 0x30], xmm0
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], 1
mov dword [esi + 0x240], ebx
movss dword [esi + 0x244], xmm0
mov dword [esi + 0x248], ebx
mov dword [esi + 0x34], ebx
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0xc
ret 4