joyce8/EMBER2024-capa huggingface dataset:
Function at 0x573080
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x791e6a
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [esp + 0x30], 0
mov ebx, dword [esi + 0x10]
mov ebp, dword [esi + 0xc]
mov ecx, ebx
sub ecx, ebp
mov eax, 0x42df9bb1
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jbe 0x573107
cmp ebp, ebx
jbe 0x5730db
call fcn.006441b7
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
push ebx
push eax
lea eax, [esp + 0x40]
push eax
mov eax, 0x42df9bb1
imul ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push edi
mov ecx, esi
call fcn.005759c0
jmp 0x573153
jae 0x573153
cmp ebp, ebx
jbe 0x573112
call fcn.006441b7
mov ebp, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x20], edx
cmp ebp, dword [esi + 0x10]
jbe 0x573125
call fcn.006441b7
mov eax, dword [esi]
push edi
lea edi, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebp
call fcn.0057a6a0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebx
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
call fcn.00575870
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x34], 0xffffffff
call fcn.00572250
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x7a8

Function at 0x5734b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x78e5ea
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [esp + 0x30], 0
mov ebx, dword [esi + 0x10]
mov ebp, dword [esi + 0xc]
mov ecx, ebx
sub ecx, ebp
mov eax, 0x4bda12f7
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jbe 0x573536
cmp ebp, ebx
jbe 0x57350b
call fcn.006441b7
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
push ebx
push eax
lea eax, [esp + 0x40]
push eax
mov eax, 0x4bda12f7
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push edi
push esi
call fcn.00576c40
jmp 0x573582
jae 0x573582
cmp ebp, ebx
jbe 0x573541
call fcn.006441b7
mov ebp, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x20], edx
cmp ebp, dword [esi + 0x10]
jbe 0x573554
call fcn.006441b7
mov eax, dword [esi]
push edi
lea edi, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebp
call fcn.0057a6f0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebx
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
call fcn.00576b60
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x34], 0xffffffff
call fcn.00572370
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xd8
Function at 0x5736f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x793d1a
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [esp + 0x30], 0
mov ebx, dword [esi + 0x10]
mov ebp, dword [esi + 0xc]
mov ecx, ebx
sub ecx, ebp
mov eax, 0x30c30c31
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jbe 0x573777
cmp ebp, ebx
jbe 0x57374b
call fcn.006441b7
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
push ebx
push eax
lea eax, [esp + 0x40]
push eax
mov eax, 0x30c30c31
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push edi
mov ecx, esi
call fcn.00577230
jmp 0x5737c3
jae 0x5737c3
cmp ebp, ebx
jbe 0x573782
call fcn.006441b7
mov ebp, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x20], edx
cmp ebp, dword [esi + 0x10]
jbe 0x573795
call fcn.006441b7
mov eax, dword [esi]
push edi
lea edi, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebp
call fcn.0057a600
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebx
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
call fcn.005737f0
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x34], 0xffffffff
call fcn.00572500
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x150

Function at 0x573d50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x791e38
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, edx
mov dword [esp + 0x38], 0
mov edi, dword [esi + 0x10]
mov ebp, dword [esi + 0xc]
mov ecx, edi
sub ecx, ebp
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jbe 0x573dd6
cmp ebp, edi
jbe 0x573dab
call fcn.006441b7
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
push edi
push eax
lea eax, [esp + 0x48]
push eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
push ebx
push esi
call fcn.00577a90
jmp 0x573e23
jae 0x573e23
cmp ebp, edi
jbe 0x573de1
call fcn.006441b7
mov ebp, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x20], edx
cmp ebp, dword [esi + 0x10]
jbe 0x573df4
call fcn.006441b7
mov eax, dword [esi]
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], eax
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], ebp
call fcn.005786e0
mov edx, dword [esp + 0x20]
mov ecx, dword [eax + 4]
push edi
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x30]
push eax
call fcn.005779f0
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x3c], 0xffffffff
call fcn.00571590
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x60
Function at 0x578730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x78e57e
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push edi
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00401530
mov dword [esp + 0x14], ebx
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x24]
mov dword [esi + 0x24], edx
movzx eax, byte [edi + 0x28]
mov byte [esi + 0x28], al
movzx ecx, byte [edi + 0x29]
mov byte [esi + 0x29], cl
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
movzx ecx, byte [edi + 0x34]
lea edx, [esi + 0x38]
mov byte [esi + 0x34], cl
lea ecx, [edi + 0x38]
push edx
call fcn.004064a0
mov byte [esp + 0x14], 1
movzx eax, byte [edi + 0x50]
lea ecx, [esi + 0x58]
lea ebx, [edi + 0x58]
push ecx
mov byte [esi + 0x50], al
call fcn.0042eec0
push fcn.00560920
push fcn.00574b40
push 0x13
push 0x5c
lea edx, [edi + 0xb8]
push edx
lea eax, [esi + 0xb8]
push eax
mov byte [esp + 0x2c], 2
call fcn.00645661
lea edx, [esi + 0x78c]
lea ecx, [edi + 0x78c]
push edx
call fcn.00578eb0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x578820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x78e8ad
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push edi
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00401530
mov dword [esp + 0x14], ebx
fld dword [edi + 0x1c]
fstp dword [esi + 0x1c]
lea ecx, [esi + 0x30]
fld dword [edi + 0x20]
lea ebx, [edi + 0x30]
fstp dword [esi + 0x20]
push ecx
fld dword [edi + 0x24]
fstp dword [esi + 0x24]
mov al, byte [edi + 0x28]
mov byte [esi + 0x28], al
call fcn.0042eec0
lea edx, [edi + 0x90]
push edx
lea ecx, [esi + 0x90]
mov byte [esp + 0x18], 1
call fcn.00574b40
lea eax, [edi + 0xec]
push eax
lea ecx, [esi + 0xec]
mov byte [esp + 0x18], 2
call fcn.00574b40
lea edx, [esi + 0x148]
lea ecx, [edi + 0x148]
push edx
mov byte [esp + 0x18], 3
call fcn.00578eb0
lea eax, [esi + 0x160]
lea ecx, [edi + 0x160]
push eax
mov byte [esp + 0x18], 4
call fcn.00578fd0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x581300
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, 0x1105
jmp fcn.00581380

Function at 0x581330
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [edx + 0x14], 0x9c4
jne 0x58136c
push esi
push edi
mov edi, 0x10
lea ecx, [edx + 4]
cmp dword [edx + 0x18], edi
jb 0x58134c
mov esi, dword [ecx]
jmp 0x58134e
mov esi, ecx
mov esi, dword [esi]
mov dword [eax + 0x9c0], esi
cmp dword [edx + 0x18], edi
jb 0x58135d
mov ecx, dword [ecx]
lea esi, [ecx + 4]
mov ecx, 0x270
mov edi, eax
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret
mov ecx, 0x1105
jmp fcn.00581380

Function at 0x581380
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
test ecx, ecx
jne 0x581389
mov ecx, 0x1105
mov dword [eax], ecx
mov dword [eax + 0x9c0], 1
push ebx
jmp 0x5813a0
mov ecx, dword [eax + 0x9c0]
mov edx, dword [eax + ecx*4 - 4]
mov ebx, edx
shr ebx, 0x1e
xor ebx, edx
imul ebx, ebx, 0x6c078965
add ebx, ecx
mov dword [eax + ecx*4], ebx
inc dword [eax + 0x9c0]
cmp dword [eax + 0x9c0], 0x270
jl 0x5813a0
pop ebx
ret

Function at 0x5813e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [edx + 0x9c0], 0x270
jl 0x58149c
xor eax, eax
push esi
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4]
inc eax
and ecx, 0x7fffffff
xor ecx, dword [edx + eax*4 - 4]
mov esi, ecx
shr ecx, 1
and esi, 1
xor ecx, dword [esi*4 + 0x87e890]
xor ecx, dword [edx + eax*4 + 0x630]
cmp eax, 0xe3
mov dword [edx + eax*4 - 4], ecx
jl 0x5813f3
cmp eax, 0x26f
jge 0x581462
lea esp, [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4]
inc eax
and ecx, 0x7fffffff
xor ecx, dword [edx + eax*4 - 4]
mov esi, ecx
shr ecx, 1
and esi, 1
xor ecx, dword [esi*4 + 0x87e890]
xor ecx, dword [edx + eax*4 - 0x390]
cmp eax, 0x26f
mov dword [edx + eax*4 - 4], ecx
jl 0x581430
mov eax, dword [edx + 0x9bc]
xor eax, dword [edx]
pop esi
and eax, 0x7fffffff
xor eax, dword [edx + 0x9bc]
mov ecx, eax
and ecx, 1
mov ecx, dword [ecx*4 + 0x87e890]
xor ecx, dword [edx + 0x630]
shr eax, 1
xor ecx, eax
mov dword [edx + 0x9bc], ecx
mov dword [edx + 0x9c0], 0
mov eax, dword [edx + 0x9c0]
mov ecx, dword [edx + eax*4]
inc eax
mov dword [edx + 0x9c0], eax
mov edx, ecx
shr edx, 0xb
xor ecx, edx
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov edx, ecx
and edx, 0xffffdf8c
shl edx, 0xf
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
and eax, 0x7fffffff
ret
Function at 0x581980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x788b87
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
lea eax, [esi + 4]
push eax
call fcn.0040b990
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [esi + 0x3c], 0xf
mov dword [esi + 0x38], ebx
mov byte [esi + 0x28], bl
lea eax, [esi + 0x40]
push eax
mov byte [esp + 0x34], 1
call fcn.00428920
lea ecx, [esi + 0x58]
push ecx
mov byte [esp + 0x34], 2
call fcn.00428920
lea ecx, [esi + 0x70]
mov byte [esp + 0x30], 3
call fcn.00401ff0
lea ebp, [esi + 0x88]
push ebp
mov byte [esp + 0x34], 4
call fcn.00581610
lea edx, [esi + 0xbc]
mov ecx, edx
call fcn.00434800
lea edi, [esi + 0xcc]
mov ecx, edi
call fcn.00434800
lea ecx, [esi + 0xdc]
call fcn.00466370
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x104], 0xf
mov dword [esi + 0x100], ebx
mov byte [esi + 0xf0], bl
mov dword [esi + 0x10c], ebx
mov dword [esi + 0x110], ebx
mov dword [esi], eax
or eax, 0xffffffff
mov dword [esi + 0x108], eax
mov dword [esi + 0x118], eax
mov dword [esi + 0x11c], eax
mov dword [esi + 0x114], ebx
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x130], ebx
mov ecx, dword [0x88ba50]
mov dword [edx], ecx
mov eax, dword [0x88ba54]
mov dword [edx + 4], eax
mov ecx, dword [0x88ba58]
mov dword [edx + 8], ecx
mov eax, dword [0x88ba5c]
mov dword [edx + 0xc], eax
push ebx
push ebx
xor edx, edx
xor ecx, ecx
lea eax, [esp + 0x20]
call fcn.004348b0
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov al, byte [0x88b5ba]
mov dword [edi + 0xc], edx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov byte [esi + 0xe8], bl
mov byte [esi + 0x13c], 1
mov byte [ebp], al
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x588b40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x788998
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, ecx
lea edi, [esp + 0x24]
mov dword [esp + 0x1c], esi
call fcn.00471da0
add esi, 0x1c
mov dword [esp + 0x50], 0
mov ebx, dword [esi + 0x10]
cmp dword [esi + 0xc], ebx
jbe 0x588ba1
call fcn.006441b7
mov edi, dword [esi + 0xc]
mov dword [esp + 0x20], edi
cmp edi, dword [esi + 0x10]
jbe 0x588bb2
call fcn.006441b7
mov eax, dword [esi]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], edi
lea edi, [esp + 0x24]
call fcn.0058da30
mov edi, dword [esi + 0x10]
mov ebx, eax
cmp dword [esi + 0xc], edi
jbe 0x588bd8
call fcn.006441b7
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
test eax, eax
je 0x588be6
cmp eax, ecx
je 0x588bef
call fcn.006441b7
mov eax, dword [esp + 0x14]
cmp ebx, edi
jne 0x588c0b
cmp dword [esp + 0x3c], 0x10
jb 0x588c07
mov ecx, dword [esp + 0x28]
push ecx
call fcn.006441c7
add esp, 4
xor al, al
jmp 0x588c34
push ebx
push eax
lea ebx, [esp + 0x1c]
call fcn.0058aa30
cmp dword [esp + 0x3c], 0x10
mov edx, dword [esp + 0x1c]
mov byte [edx + 0x35], 0
jb 0x588c32
mov eax, dword [esp + 0x28]
push eax
call fcn.006441c7
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00643db8
mov esp, ebp
pop ebp
ret 4
Function at 0x592260
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x7844c8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x20], ebx
lea edi, [esi + 0xc]
mov dword [esi], vtable.Sexy::DSoundInstance.0
mov dword [esi + 4], eax
mov byte [esi + 0x12], bl
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov dword [esi + 8], ecx
mov dword [edi], ebx
mov dword [esi + 0x28], ebx
fld qword [0x7a8008]
fst qword [esi + 0x18]
lea ebp, [esi + 0x40]
fst qword [esi + 0x20]
mov dword [esi + 0x14], ebx
fst qword [esi + 0x30]
mov dword [esi + 0x2c], ebx
fstp qword [esi + 0x38]
mov dword [ebp], 0xac44
cmp ecx, ebx
je 0x59236a
mov eax, dword [eax + 0x3010c]
mov edx, dword [eax]
push edi
push ecx
push eax
mov eax, dword [edx + 0x14]
call eax
cmp eax, ebx
je 0x59235f
cmp eax, 0x8878000a
jg 0x59232c
je 0x59231f
cmp eax, 0x8007000e
je 0x592312
cmp eax, 0x80070057
jne 0x592359
push ebx
push 0x8234fc
push str.DSERR_INVALIDPARAM
jmp 0x592352
push ebx
push 0x8234fc
push str.DSERR_OUTOFMEMORY
jmp 0x592352
push ebx
push 0x8234fc
push str.DSERR_ALLOCATED
jmp 0x592352
cmp eax, 0x88780032
je 0x592347
cmp eax, 0x887800aa
jne 0x592359
push ebx
push 0x8234fc
push str.DSERR_UNINITIALIZED
jmp 0x592352
push ebx
push 0x8234fc
push str.DSERR_INVALIDCALL
push ebx
call dword [sym.imp.user32.dll_MessageBoxA]
push ebx
call fcn.00647d99
mov edi, dword [edi]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x20]
push ebp
push edi
call edx
mov eax, esi
call fcn.00592410
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x595030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x78b9e9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.00428920
lea eax, [esi + 0x18]
push eax
mov dword [esp + 0x18], 0
call fcn.00428920
lea ecx, [esi + 0x30]
push ecx
mov byte [esp + 0x18], 1
call fcn.00428920
lea edx, [esi + 0x48]
push edx
mov byte [esp + 0x18], 2
call fcn.00428920
lea eax, [esi + 0x60]
push eax
mov byte [esp + 0x18], 3
call fcn.00428920
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x595250
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x78b9a3
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.00428920
lea ebx, [esi + 0x18]
push ebx
mov dword [esp + 0x18], 0
call fcn.00428920
mov byte [esp + 0x14], 1
fldz
lea eax, [edi + 1]
mov dword [esi + 0x30], eax
imul eax, edi
push ecx
mov ecx, esi
mov dword [esi + 0x34], 0
fstp dword [esp]
call fcn.0042ccd0
push ecx
fldz
mov eax, edi
mov ecx, ebx
fstp dword [esp]
call fcn.0042ccd0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x595c30
Capabilities:
Create thread

Disassembly:
push eax
push 0
push 0x762410
call fcn.006480e2
add esp, 0xc
ret
Function at 0x595db0
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x104
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0x100], eax
cmp dword [0x8c05e8], 0
jne 0x595de6
xor al, al
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00643db8
add esp, 0x104
ret 4
push ebx
push ebp
push edi
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
lea eax, [esp + 0x10]
push str.SexyCacheReq_d
push eax
call fcn.006456f4
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x304
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
push 0x304
push 0
push 0
mov ebp, eax
push 0xf001f
push ebp
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov ebx, 0x10
mov edi, eax
cmp dword [esi + 0x18], ebx
jb 0x595e42
mov ecx, dword [esi + 4]
jmp 0x595e45
lea ecx, [esi + 4]
mov edx, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x595e47
mov ecx, dword [esp + 0x114]
cmp dword [ecx + 0x18], ebx
jb 0x595e62
mov ecx, dword [ecx + 4]
jmp 0x595e65
add ecx, 4
lea edx, [edi + 0x100]
jmp 0x595e70
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x595e70
mov dword [edi + 0x300], 0
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov edx, dword [0x8c05e8]
push eax
mov eax, dword [0x8c05dc]
push 0
push edx
push eax
call dword [sym.imp.user32.dll_SendMessageA]
test eax, eax
push edi
setne bl
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [esp + 0x10c]
pop edi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.00643db8
add esp, 0x104
ret 4

Function at 0x595ed0
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x104
mov eax, dword [0x867e6c]
xor eax, esp
mov dword [esp + 0x100], eax
cmp dword [0x8c05e8], 0
jne 0x595f06
xor al, al
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00643db8
add esp, 0x104
ret 4
push ebx
mov ebx, dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push ebp
push edi
call ebx
push eax
lea eax, [esp + 0x10]
push str.SexyCacheReq_d
push eax
call fcn.006456f4
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x304
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
push 0x304
push 0
push 0
mov ebp, eax
push 0xf001f
push ebp
call dword [sym.imp.kernel32.dll_MapViewOfFile]
cmp dword [esi + 0x18], 0x10
mov edi, eax
jb 0x595f60
mov ecx, dword [esi + 4]
jmp 0x595f63
lea ecx, [esi + 4]
mov edx, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x595f65
mov ecx, dword [esp + 0x114]
cmp dword [ecx + 0x18], 0x10
jb 0x595f81
mov ecx, dword [ecx + 4]
jmp 0x595f84
add ecx, 4
lea edx, [edi + 0x100]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x595f90
mov dword [edi + 0x300], 0
call ebx
mov edx, dword [0x8c05e8]
push eax
mov eax, dword [0x8c05dc]
push 4
push edx
push eax
call dword [sym.imp.user32.dll_SendMessageA]
test eax, eax
push edi
setne bl
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [esp + 0x10c]
pop edi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.00643db8
add esp, 0x104
ret 4