joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53b790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6aae56
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x18
mov dword [edi], 0xbb8
mov dword [edi + 4], 0x3e80
mov dword [edi + 8], 0xafc8
mov dword [edi + 0xc], 0x3e8
mov word [edi + 0x10], 0
call fcn.0064fb19
mov dword [edi + 0x14], eax
add esp, 4
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x14]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov eax, dword [edi + 0x14]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x30]
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
push 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00531200
mov dword [esi], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x53b940
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ecx
push ebx
push edi
mov edi, ecx
mov ecx, dword [edi + 0x14]
mov word [edi + 0x10], 0
mov eax, dword [ecx]
or eax, dword [ecx + 4]
je 0x53b966
lea ecx, [edi + 0x14]
call fcn.0053bea0
add dword [edi + 0x18], eax
mov ecx, dword [edi + 0x14]
adc dword [edi + 0x1c], edx
lea eax, [ecx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov word [edi + 0x10], 1
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [edi + 0x14]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [edi + 0x14]
mov ecx, edi
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call fcn.0053b9c0
pop edi
pop ebx
pop ecx
ret
Function at 0x53e660
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x53e66b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0053e680
Function at 0x543fb0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebx
mov ebx, edx
mov edx, ecx
push esi
mov ecx, ebx
xor esi, esi
push edi
shr ecx, 2
xor edi, edi
test ecx, ecx
je 0x543fe7
imul eax, dword [edx + esi*4], 0xcc9e2d51
inc esi
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edi, eax
rol edi, 0xd
add edi, 0xfaddaf14
lea edi, [edi + edi*4]
cmp esi, ecx
jb 0x543fc4
mov eax, ebx
lea edx, [edx + ecx*4]
and eax, 3
xor ecx, ecx
sub eax, 1
je 0x544010
sub eax, 1
je 0x544007
sub eax, 1
jne 0x544026
movzx ecx, byte [edx + 2]
shl ecx, 0x10
movzx eax, byte [edx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edi, eax
xor edi, ebx
mov eax, edi
shr eax, 0x10
xor eax, edi
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
Function at 0x54dea0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ac0ce
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.SkRefCntBase.0
mov dword [esi + 4], 1
mov dword [ebp - 4], 0
mov dword [esi], vtable.SkRefCnt.0
mov dword [ebp - 4], 1
lea eax, [esi + 8]
mov dword [esi], vtable.SkCanvas.0
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov byte [ebp - 4], 3
sub esp, 8
lea eax, [esi + 0x30]
push eax
push ecx
lea ecx, [esi + 0xc]
call fcn.0057fa80
mov byte [ebp - 4], 4
push ecx
lea ecx, [esi + 0x4b8]
call fcn.00573740
push 0
push 0
mov ecx, esi
call fcn.0054db30
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x54e1f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ac22d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.SkRefCntBase.0
mov dword [edi + 4], 1
mov dword [ebp - 4], 0
mov dword [edi], vtable.SkRefCnt.0
mov dword [ebp - 4], 1
lea eax, [edi + 8]
mov dword [edi], vtable.SkCanvas.0
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov byte [ebp - 4], 3
sub esp, 8
lea eax, [edi + 0x30]
push eax
push ecx
lea ecx, [edi + 0xc]
call fcn.0057fa80
mov byte [ebp - 4], 4
lea esi, [edi + 0x4b8]
push ecx
mov ecx, esi
call fcn.00573740
push 0x50
call fcn.0064fb19
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
mov ecx, eax
push esi
push dword [ebp + 8]
call fcn.0054dfd0
mov byte [ebp - 4], 4
mov ecx, edi
push 1
push eax
call fcn.0054db30
mov esi, eax
or edx, 0xffffffff
lea ecx, [esi + 4]
lock xadd dword [ecx], edx
cmp edx, 1
jne 0x54e2b7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x54e2e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ac27e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.SkRefCntBase.0
mov dword [esi + 4], 1
mov dword [ebp - 4], 0
mov dword [esi], vtable.SkRefCnt.0
mov dword [ebp - 4], 1
lea eax, [esi + 8]
mov dword [esi], vtable.SkCanvas.0
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov byte [ebp - 4], 3
sub esp, 8
lea eax, [esi + 0x30]
push eax
push ecx
lea ecx, [esi + 0xc]
call fcn.0057fa80
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 8]
push 0
push ecx
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x4b8], eax
mov eax, dword [ecx + 0x18]
mov ecx, esi
mov dword [esi + 0x4bc], eax
call fcn.0054db30
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x54e390
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ac2f5
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.SkRefCntBase.0
mov dword [edi + 4], 1
mov dword [ebp - 4], 0
mov dword [edi], vtable.SkRefCnt.0
mov dword [ebp - 4], 1
lea eax, [edi + 8]
mov dword [edi], vtable.SkCanvas.0
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov byte [ebp - 4], 3
sub esp, 8
lea eax, [edi + 0x30]
push eax
push ecx
lea ecx, [edi + 0xc]
call fcn.0057fa80
mov byte [ebp - 4], 4
lea esi, [edi + 0x4b8]
mov ecx, dword [ebp + 0xc]
push 0x50
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
call fcn.0064fb19
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
mov ecx, eax
push esi
push dword [ebp + 8]
call fcn.0057d590
mov esi, eax
mov byte [ebp - 4], 4
mov dword [ebp + 0xc], esi
mov byte [ebp - 4], 7
mov ecx, edi
push 0
push esi
call fcn.0054db30
mov byte [ebp - 4], 4
test esi, esi
je 0x54e46b
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
cmp ecx, 1
jne 0x54e46b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x54e490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ac365
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.SkRefCntBase.0
mov dword [edi + 4], 1
mov dword [ebp - 4], 0
mov dword [edi], vtable.SkRefCnt.0
mov dword [ebp - 4], 1
lea eax, [edi + 8]
mov dword [edi], vtable.SkCanvas.0
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov byte [ebp - 4], 3
sub esp, 8
lea eax, [edi + 0x30]
push eax
push ecx
lea ecx, [edi + 0xc]
call fcn.0057fa80
mov byte [ebp - 4], 4
lea esi, [edi + 0x4b8]
push ecx
mov ecx, esi
call fcn.00573740
push 0x50
call fcn.0064fb19
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
mov ecx, eax
push esi
push dword [ebp + 8]
call fcn.0057d590
mov esi, eax
mov byte [ebp - 4], 4
mov dword [ebp + 8], esi
mov byte [ebp - 4], 7
mov ecx, edi
push 0
push esi
call fcn.0054db30
mov byte [ebp - 4], 4
test esi, esi
je 0x54e566
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
cmp ecx, 1
jne 0x54e566
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x556800
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ad438
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 0xc]
push 0x68
call fcn.004047f0
mov ebx, dword [ebp + 8]
add esp, 8
mov edi, eax
mov ecx, eax
mov dword [ebp - 0x10], edi
push ebx
push esi
call fcn.00556310
mov dword [ebp - 4], 0
mov dword [edi], vtable.SkColorShader::ColorShaderContext.0
mov eax, dword [ebx]
mov ecx, dword [esi + 0x30]
movzx ebx, cl
movzx edx, byte [eax + 0x37]
mov eax, ecx
shr eax, 0x18
inc edx
imul edx, eax
mov eax, ecx
shr eax, 0x10
shr edx, 8
mov dword [ebp + 0xc], edx
movzx edx, al
mov eax, ecx
shr eax, 8
mov ecx, edx
and ecx, 0xfff8
movzx esi, al
shl ecx, 5
mov eax, ebx
or ecx, esi
shr eax, 3
and ecx, 0xfffc
shl ecx, 3
or ecx, eax
mov word [edi + 0x64], cx
mov ecx, dword [ebp + 0xc]
cmp ecx, 0xff
je 0x5568e3
imul edx, ecx
imul esi, ecx
imul ebx, ecx
lea eax, [edx + 0x80]
mov edx, eax
shr edx, 8
add edx, eax
lea eax, [esi + 0x80]
mov esi, eax
shr edx, 8
shr esi, 8
add esi, eax
lea eax, [ebx + 0x80]
mov ebx, eax
shr esi, 8
shr ebx, 8
add ebx, eax
shr ebx, 8
mov eax, ecx
mov dword [edi + 0x60], 8
shl eax, 8
or eax, edx
shl eax, 8
or eax, esi
shl eax, 8
or eax, ebx
mov dword [edi + 0x5c], eax
cmp ecx, 0xff
jne 0x556923
mov eax, dword [ebp + 8]
mov dword [edi + 0x60], 9
mov eax, dword [eax]
mov eax, dword [eax + 0x40]
shr eax, 2
test al, 1
jne 0x556923
mov dword [edi + 0x60], 0xb
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x575a60
Capabilities:
Set thread local storage value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.005e08f0
mov ebp, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, eax
test edi, edi
je 0x575a93
mov ecx, edi
nop dword [eax + eax]
cmp dword [ecx + 8], 0x575970
je 0x575b32
mov ecx, dword [ecx]
test ecx, ecx
jne 0x575a80
push 0x10
call fcn.0064fb19
add esp, 4
mov esi, eax
push esi
push dword [0x7560f8]
mov dword [esi], edi
call ebp
push 4
call fcn.0064fb19
add esp, 4
mov dword [esi + 4], eax
mov dword [esi + 8], 0x575970
mov dword [esi + 0xc], 0x575990
mov ebx, dword [esp + 0x18]
mov dword [eax], ebx
call fcn.005e08f0
mov edi, eax
test edi, edi
je 0x575aef
mov ecx, edi
nop dword [eax + eax]
cmp dword [ecx + 8], 0x5759c0
je 0x575b37
mov ecx, dword [ecx]
test ecx, ecx
jne 0x575ae0
push 0x10
call fcn.0064fb19
add esp, 4
mov esi, eax
push esi
push dword [0x7560f8]
mov dword [esi], edi
call ebp
push 0x800
call fcn.0064ff25
mov edi, eax
mov dword [esi + 8], 0x5759c0
add esp, 4
mov dword [esi + 4], edi
mov dword [esi + 0xc], 0x5759d0
cmp ebx, 6
ja case.default.0x575b2b
jmp dword [ebx*4 + 0x575ca4]
mov eax, dword [ecx + 4]
jmp 0x575ac5
mov edi, dword [ecx + 4]
jmp 0x575b26
mov eax, str.No_Error
jmp 0x575b72
mov eax, str.Invalid_Argument
jmp 0x575b72
mov eax, str.Invalid_Operation
jmp 0x575b72
mov eax, str.Invalid_Handle
jmp 0x575b72
mov eax, str.Invalid_Paint
jmp 0x575b72
mov eax, str.Out_Of_Memory
jmp 0x575b72
mov eax, str.Parse_Error
jmp 0x575b72
mov eax, str.Unknown_error
push eax
push str._s:
push edi
call fcn.00477ba0
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x575b86
sub ecx, edx
mov esi, edi
mov edx, 0x800
sub edx, ecx
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x575ba0
sub esi, ecx
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea ecx, [esi + edi]
call fcn.00575930
add esp, 8
call fcn.005e08f0
mov edi, eax
test edi, edi
je 0x575be3
mov ecx, edi
nop word [eax + eax]
cmp dword [ecx + 8], 0x5759a0
je 0x575c8b
mov ecx, dword [ecx]
test ecx, ecx
jne 0x575bd0
push 0x10
call fcn.0064fb19
add esp, 4
mov esi, eax
push esi
push dword [0x7560f8]
mov dword [esi], edi
call ebp
push 4
call fcn.0064fb19
add esp, 4
mov dword [eax], 0x5759e0
mov dword [esi + 4], eax
mov dword [esi + 8], 0x5759a0
mov dword [esi + 0xc], 0x575990
mov ebp, dword [eax]
test ebp, ebp
je 0x575c85
test ebx, ebx
je 0x575c85
call fcn.005e08f0
mov edi, eax
test edi, edi
je 0x575c41
mov ecx, edi
cmp dword [ecx + 8], 0x575970
je 0x575c90
mov ecx, dword [ecx]
test ecx, ecx
jne 0x575c32
push 0x10
call fcn.0064fb19
add esp, 4
mov esi, eax
push esi
push dword [0x7560f8]
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 4
call fcn.0064fb19
add esp, 4
mov dword [eax], 0
mov dword [esi + 4], eax
mov dword [esi + 8], 0x575970
mov dword [esi + 0xc], 0x575990
push dword [eax]
push ebx
call ebp
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [ecx + 4]
jmp 0x575c1b
mov eax, dword [ecx + 4]
push dword [eax]
push ebx
call ebp
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x57a090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b0581
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov dword [edx + 0xc], 0
mov dword [edx + 0x10], 0xffffffff
mov dword [ebp - 4], 0
lea ecx, [edx + 0x14]
mov dword [ebp - 0x14], ecx
mov dword [ecx], vtable.SkBlitter.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 2
lea eax, [ecx + 0x34]
mov dword [ecx], vtable.SkAAClipBlitter.0
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], 0x400
mov byte [ebp - 4], 3
mov dword [ecx + 0x434], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x57a140
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b05d1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0xffffffff
mov dword [ebp - 4], 0
lea ecx, [esi + 0x14]
mov dword [ebp - 0x14], ecx
mov dword [ecx], vtable.SkBlitter.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 2
lea eax, [ecx + 0x34]
mov dword [ecx], vtable.SkAAClipBlitter.0
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], 0x400
mov byte [ebp - 4], 3
mov dword [ecx + 0x434], 0
mov byte [ebp - 4], 4
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0057a200
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x591ca0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b2408
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
push ecx
call fcn.00677080
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
jne 0x591cee
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x591cda
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00591d70
add esp, 8
test al, al
je 0x591cda
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x591d4c
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x591d4c
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
jmp 0x591d4e
xor edi, edi
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5935e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b2506
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0x21], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
mov bl, byte [ebp + 0xc]
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], 0xbf800000
mov byte [esi + 0x31], bl
mov dword [esi + 0x2c], 0xffffffff
mov eax, dword [edx]
mov eax, dword [eax + 0x1c]
mov dword [esi], eax
mov eax, dword [edx]
mov eax, dword [eax + 0x20]
mov dword [esi + 4], eax
mov eax, dword [edx]
mov ecx, dword [eax + 0x20]
sub ecx, dword [eax + 0x24]
mov dword [esi + 8], ecx
mov eax, dword [edx]
mov eax, dword [eax + 0x30]
add eax, 0xfffffffc
mov dword [esi + 0x1c], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov byte [esi + 0x20], bl
mov byte [esi + 0x21], 0
mov byte [esi + 0x23], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5b3740
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b407b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx], vtable.SkBlitter.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [edx], vtable.SkRasterBlitter.0
movups xmm0, xmmword [eax]
movups xmmword [edx + 0xc], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [edx + 0x1c], xmm0
mov dword [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov dword [edx], vtable.SkARGB32_Blitter.0
mov ecx, dword [eax + 0x34]
mov edi, ecx
shr edi, 0x18
mov eax, ecx
shr eax, 0x10
mov dword [edx + 0x34], edi
movzx esi, al
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x2c], ecx
lea edx, [edi + 1]
imul esi, edx
mov dword [ebp + 8], ecx
shl edi, 8
shr esi, 8
mov dword [eax + 0x38], esi
or edi, esi
mov eax, ecx
shl edi, 8
shr eax, 8
movzx ecx, al
mov eax, dword [ebp - 0x10]
imul ecx, edx
shr ecx, 8
mov dword [eax + 0x3c], ecx
or edi, ecx
mov eax, dword [ebp + 8]
movzx eax, al
imul eax, edx
mov edx, dword [ebp - 0x10]
shl edi, 8
shr eax, 8
or edi, eax
mov dword [edx + 0x40], eax
mov dword [edx + 0x30], edi
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x5b8446
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0x20
movzx ecx, byte [esp + 0x1c]
inc ecx
push edi
mov edx, dword [esi + 0x14]
imul edx, dword [esp + 0x18]
mov edi, dword [esi + 0x30]
mov ebp, dword [esi + 0x14]
shr ecx, 3
imul edi, ecx
lea eax, [edx + eax*2]
add eax, dword [esi + 0xc]
sub ebx, ecx
mov esi, dword [esp + 0x1c]
movzx ecx, word [eax]
mov edx, ecx
and edx, 0x7e0
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
imul edx, ebx
add edx, edi
shr edx, 5
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax], cx
add eax, ebp
sub esi, 1
jne 0x5b8475
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x5b8e36
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0x20
movzx ecx, byte [esp + 0x1c]
inc ecx
push edi
mov edx, dword [esi + 0x14]
imul edx, dword [esp + 0x18]
imul ecx, dword [esi + 0x34]
mov edi, dword [esi + 0x30]
mov ebp, dword [esi + 0x14]
shr ecx, 0xb
imul edi, ecx
lea eax, [edx + eax*2]
add eax, dword [esi + 0xc]
sub ebx, ecx
mov esi, dword [esp + 0x1c]
nop dword [eax]
movzx ecx, word [eax]
mov edx, ecx
and edx, 0x7e0
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
imul edx, ebx
add edx, edi
shr edx, 5
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax], cx
add eax, ebp
sub esi, 1
jne 0x5b8e70
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x5b9f80
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b4314
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x748068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push dword [ebp + 0x18]
call fcn.00556050
mov dword [ebp - 4], 0
lea esi, [edi + 0x30]
mov dword [edi], vtable.SkLightingShaderImpl.0
push 0x34
push 0
push esi
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
call fcn.00652810
add esp, 0xc
mov ecx, esi
push dword [ebp + 8]
call fcn.005411c0
mov byte [ebp - 4], 1
lea esi, [edi + 0x64]
push 0x34
push 0
push esi
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
call fcn.00652810
add esp, 0xc
mov ecx, esi
push dword [ebp + 0xc]
call fcn.005411c0
mov byte [ebp - 4], 2
mov eax, 1
mov edx, dword [ebp + 0x10]
lea ecx, [edx + 4]
lock xadd dword [ecx], eax
lea eax, [edi + 0x98]
mov dword [ebp + 0x18], eax
mov dword [eax], edx
mov byte [ebp - 4], 4
lea esi, [edi + 0x9c]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov dword [edi + 0xc4], eax
mov eax, dword [ecx + 4]
mov dword [edi + 0xc8], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x5ba09a
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x10], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x20], xmm0
jmp 0x5ba0df
mov dword [esi + 0x20], 0x3f800000
mov dword [esi + 0x10], 0x3f800000
mov dword [esi], 0x3f800000
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 4], 0
mov dword [esi + 0x24], 0x10
test byte [esi + 0x24], 0x80
je 0x5ba0f2
mov ecx, esi
call fcn.00556d30
movzx eax, al
mov dword [esi + 0x24], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18