joyce8/EMBER2024-capa huggingface dataset:
Function at 0x546610
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x6511d6
mov eax, dword fs:[0]
push eax
sub esp, 0x90
push ebp
push esi
push edi
mov eax, dword [0x6af168]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xb4]
mov edi, ecx
cmp byte [edi + 0x511], 0
je 0x546680
cmp byte [edi + 0x512], 0
jne 0x54687b
call fcn.0054aa80
push 0
push 1
lea esi, [edi + 0x54c]
mov byte [edi + 0x57c], 1
call fcn.00565a00
test eax, eax
setne al
jmp 0x54687d
push 0
lea eax, [esp + 0x18]
push ebx
push eax
call fcn.004e7740
add esp, 0xc
push eax
mov dword [esp + 0xac], 0
call fcn.004e75f0
mov esi, 0x10
add esp, 4
mov dword [esp + 0xa8], 0xffffffff
cmp dword [esp + 0x2c], esi
jb 0x5466c7
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0062493b
add esp, 4
cmp dword [ebx + 0x18], esi
jb 0x5466d1
mov eax, dword [ebx + 4]
jmp 0x5466d4
lea eax, [ebx + 4]
push 0x68103c
push eax
call fcn.006262fc
mov esi, eax
add esp, 8
test esi, esi
jne 0x54671d
cmp byte [edi + 0x510], al
je 0x546716
call fcn.0054a9f0
push 1
lea esi, [edi + 0x54c]
push 0
call fcn.00565600
push 5
push 0x10
call fcn.00565600
push 1
push 0
call fcn.00565600
xor al, al
jmp 0x54687d
mov edx, dword [esp + 0xb0]
push esi
push ebp
push 1
push edx
call fcn.00627cab
push esi
call fcn.006261bc
add esp, 0x14
cmp byte [edi + 0x510], 0
je 0x546766
call fcn.0054a9f0
push 1
lea esi, [edi + 0x54c]
push 0
call fcn.00565600
push 5
push 0x10
call fcn.00565600
push 1
push 1
call fcn.00565600
cmp byte [edi + 0x505], 0
je 0x54687b
cmp byte [edi + 0x504], 0
je 0x54687b
push str.Buffer
lea ecx, [esp + 0x18]
call fcn.00402130
push ebx
lea edi, [esp + 0x50]
mov dword [esp + 0xac], 1
call fcn.004e70c0
add esp, 4
lea ecx, [ebp + 1]
push ecx
lea edx, [esp + 0x18]
push edx
mov edi, eax
mov byte [esp + 0xb0], 2
call fcn.004f1ec0
lea ecx, [esp + 0x4c]
mov esi, eax
call fcn.00401c70
lea ecx, [esp + 0x14]
mov dword [esp + 0xa8], 0xffffffff
call fcn.00401c70
test esi, esi
je 0x54687b
mov eax, dword [esp + 0xb0]
push ebp
push eax
lea ecx, [esi + 1]
push ecx
mov byte [esi], 1
call fcn.0062a790
add esp, 0xc
push esi
call fcn.004f2110
push esi
call fcn.004f2020
push str.Buffer
lea ecx, [esp + 0x34]
call fcn.00402130
push ebx
lea edi, [esp + 0x88]
mov dword [esp + 0xac], 3
call fcn.004e70c0
add esp, 4
mov esi, eax
push ebx
lea edi, [esp + 0x6c]
mov byte [esp + 0xac], 4
call fcn.004e70c0
add esp, 4
mov ecx, eax
lea edx, [esp + 0x30]
push edx
mov eax, esi
mov byte [esp + 0xac], 5
call fcn.004f1e50
mov ecx, edi
call fcn.00401c70
lea ecx, [esp + 0x84]
call fcn.00401c70
lea ecx, [esp + 0x30]
call fcn.00401c70
mov al, 1
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x9c
ret 8

Function at 0x546eb0
Capabilities:
Delete file

Disassembly:
cmp byte [ecx + 0x511], 0
je 0x546ebc
mov al, 1
ret
cmp dword [eax + 0x18], 0x10
jb 0x546ed3
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
ret
Function at 0x546ef2
Capabilities:
Hide graphical window

Disassembly:
fldz
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0xf8]
sub esp, 8
fstp qword [esp]
call edx
mov eax, dword [esi + 0x350]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
mov byte [esi + 0x340], 1
mov ecx, esi
pop esi
jmp eax

Function at 0x547460
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x33c], 0
je 0x547491
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [edi + 0x33c]
je 0x547491
mov byte [edi + 0x4fd], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [edi + 0x341], 0
jne 0x547571
mov al, 1
mov byte [edi + 0x342], al
mov byte [edi + 0x341], al
mov eax, dword [edi]
mov edx, dword [eax + 0x50]
mov ecx, edi
call edx
cmp byte [edi + 0x511], 0
je 0x5474ee
mov eax, dword [edi]
fld qword [edi + 0xe0]
mov edx, dword [eax + 0xf8]
sub esp, 8
mov ecx, edi
fstp qword [esp]
call edx
fld qword [edi + 0xe8]
mov eax, dword [edi]
mov edx, dword [eax + 0xfc]
sub esp, 8
mov ecx, edi
fstp qword [esp]
call edx
cmp byte [edi + 0x4fe], 0
je 0x54750d
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
push 0xa
call esi
cmp byte [edi + 0x4fe], 0
jne 0x547500
mov ecx, dword [edi + 0x374]
test ecx, ecx
je 0x54751e
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
call edx
cmp byte [edi + 0x344], 0
jne 0x547542
mov eax, dword [edi + 0x36c]
test eax, eax
je 0x547542
cmp dword [eax + 0x58], 0
je 0x547542
mov eax, dword [eax + 0x58]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x4c]
push eax
call edx
mov eax, dword [edi + 0x350]
test eax, eax
je 0x547555
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00547580
cmp byte [edi + 0x378], 0
je 0x54756c
mov eax, dword [edi]
mov edx, dword [eax + 0x5c]
mov ecx, edi
call edx
call fcn.005d7480
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x54d130
Capabilities:
Create thread

Disassembly:
cmp byte [esi + 0x4f9], 0
jne 0x54d166
push 1
mov byte [esi + 0x4fc], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
push 0
push 0x54d0c0
mov byte [esi + 0x4f9], 1
call fcn.00627877
add esp, 0xc
ret

Function at 0x54d2b0
Capabilities:
Create thread

Disassembly:
cmp byte [esi + 0x4fe], 0
jne 0x54d2df
push 1
mov byte [esi + 0x4fe], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
push 0
push 0x54d290
call fcn.00627877
add esp, 0xc
ret
Function at 0x54e030
Capabilities:
Hide graphical window
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x134
mov eax, dword [0x6af168]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x341], 0
push edi
jne 0x54e20a
call fcn.0054d2b0
cmp byte [esi + 0x4f8], 0
je 0x54e06f
call fcn.0054d130
mov eax, dword [esi + 0x350]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x350]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
call ebx
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx + 0x180]
mov ecx, esi
mov byte [esi + 0x4cd], 1
mov dword [esi + 0x474], edi
mov dword [esi + 0x478], edi
mov dword [esi + 0x410], edi
call eax
push esi
call fcn.0054d660
mov byte [esi + 0x4cd], 0
call fcn.00542460
call ebx
sub eax, edi
test eax, eax
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
jge 0x54e0ea
fadd qword [0x686800]
fdiv qword [0x687158]
sub esp, 8
lea ecx, [esp + 0x40]
fstp qword [esp]
push str.Seconds_________g_r_n
push ecx
call fcn.0062635f
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x10
lea edx, [esp + 0x38]
push edx
call edi
mov eax, dword [esi + 0x47c]
push eax
lea ecx, [esp + 0x3c]
push str.Sleep_Count_____d_r_n
push ecx
call fcn.0062635f
add esp, 0xc
lea edx, [esp + 0x38]
push edx
call edi
mov eax, dword [esi + 0x484]
push eax
lea ecx, [esp + 0x3c]
push str.Update_Count____d_r_n
push ecx
call fcn.0062635f
add esp, 0xc
lea edx, [esp + 0x38]
push edx
call edi
mov eax, dword [esi + 0x480]
push eax
lea ecx, [esp + 0x3c]
push str.Draw_Count______d_r_n
push ecx
call fcn.0062635f
add esp, 0xc
lea edx, [esp + 0x38]
push edx
call edi
mov eax, dword [esi + 0x4d4]
push eax
lea ecx, [esp + 0x3c]
push str.Draw_Time_______d_r_n
push ecx
call fcn.0062635f
add esp, 0xc
lea edx, [esp + 0x38]
push edx
call edi
mov eax, dword [esi + 0x4f4]
push eax
lea ecx, [esp + 0x3c]
push str.Screen_Blt______d_r_n
push ecx
call fcn.0062635f
add esp, 0xc
lea edx, [esp + 0x38]
push edx
call edi
mov eax, dword [esi + 0x4f4]
mov ecx, dword [esi + 0x4d4]
add ecx, eax
test ecx, ecx
jle 0x54e1f0
mov eax, dword [esi + 0x480]
imul eax, eax, 0x3e8
cdq
idiv ecx
lea edx, [esp + 0x38]
push eax
push str.Avg_FPS_________d_r_n
push edx
call fcn.0062635f
add esp, 0xc
lea eax, [esp + 0x38]
push eax
call edi
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
mov edx, dword [esi]
mov eax, dword [edx + 0x54]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x5c]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00624940
mov esp, ebp
pop ebp
ret
Function at 0x54e510
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x659c98
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
mov eax, dword [0x6af168]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0x18
xor ebx, ebx
push str.properties_resources.xml
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00402300
mov dword [esp + 0x30], ebx
mov ecx, dword [esi + 0x634]
lea edx, [esp + 0xc]
call fcn.004edc50
test al, al
sete byte [esp + 0xb]
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x24], 0x10
jb 0x54e58c
mov eax, dword [esp + 0x10]
push eax
call fcn.0062493b
add esp, 4
cmp byte [esp + 0xb], bl
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
je 0x54e5ab
push 1
mov ecx, esi
call fcn.0054e5c0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x2c
ret

Function at 0x54e5c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x659c98
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x6af168]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x634]
lea esi, [esp + 0xc]
call fcn.004eb0f0
mov dword [esp + 0x30], 0
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x80]
mov ecx, edi
call eax
cmp dword [esp + 0x24], 0x10
jb 0x54e61f
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0062493b
add esp, 4
cmp byte [esp + 0x38], 0
je 0x54e62d
push 0
call fcn.005475c0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4
Function at 0x5504e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
cmp byte [eax + 0x511], 0
jne 0x5505e2
mov eax, dword [eax + 0x350]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5505e2
push ebx
push ebp
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esi + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
add eax, 1
push eax
push 0x2002
call ebp
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi + 0x18], 0x10
lea ecx, [esi + 4]
mov dword [esp + 0xc], ecx
jb 0x550538
mov ecx, dword [ecx]
mov edx, eax
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x550540
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, dword [sym.imp.USER32.dll_SetClipboardData]
push edi
push 1
call ebx
push edi
push 7
call ebx
push edi
push 0x10
call ebx
cmp dword [esi + 0x18], 0x10
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0xc]
jb 0x550579
mov ecx, dword [ecx]
push 0
push 0
push eax
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
lea edx, [edi + edi + 2]
push edx
push 0x2002
call ebp
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi + 0x18], 0x10
mov ecx, dword [esp + 0xc]
mov ebp, eax
mov eax, dword [esi + 0x14]
jb 0x5505b1
mov ecx, dword [ecx]
push edi
push ebp
push eax
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
mov word [ebp + edi*2], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop ebp
pop ebx
add esp, 4
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop ecx
ret

Function at 0x5505f0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x655629
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push edi
mov eax, dword [0x6af168]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 0x14], esi
mov byte [esi + 4], bl
mov dword [esp + 0x20], ebx
cmp byte [ebp + 0x511], bl
mov dword [esp + 0x10], 1
jne 0x550684
mov eax, dword [ebp + 0x350]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x550684
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, ebx
je 0x55067e
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
je 0x55067e
push eax
mov ecx, esi
call fcn.004022b0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
mov ecx, ebp
call fcn.00541b90
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x5662b0
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x104
mov eax, dword [0x6af168]
xor eax, esp
mov dword [esp + 0x100], eax
cmp dword [0x6b9db4], 0
jne 0x56632d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 4]
push str.gPakInterfaceP__d
push eax
call fcn.0062635f
add esp, 0xc
lea ecx, [esp]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x6b9db4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x6b9db8], eax
mov eax, dword [eax]
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00624940
add esp, 0x104
ret
mov ecx, dword [esp + 0x100]
mov edx, dword [0x6b9db8]
mov eax, dword [edx]
xor ecx, esp
call fcn.00624940
add esp, 0x104
ret

Function at 0x566450
Capabilities:
Read file on windows

Disassembly:
call fcn.005662b0
test eax, eax
je 0x56647c
mov eax, dword [0x6b9db8]
mov ecx, dword [eax]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 0x14]
push eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
call edx
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
jmp fcn.00626e1f
Function at 0x568a60
Capabilities:
Access peb ldr_data
Get kernel32 base address
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x648b38
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6af168]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
xor ebx, ebx
cmp ecx, ebx
mov dword [esp + 0x20], ebx
lea edi, [esi + 0xc]
mov dword [esi], vtable.Sexy::DSoundInstance.0
mov dword [esi + 4], eax
mov byte [esi + 0x12], bl
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov dword [esi + 8], ecx
mov dword [edi], ebx
fld qword [0x665830]
lea ebp, [esi + 0x30]
fst qword [esi + 0x18]
fstp qword [esi + 0x28]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x20], ebx
mov dword [ebp], 0xac44
je 0x568b61
mov eax, dword [eax + 0x3094]
mov edx, dword [eax]
push edi
push ecx
push eax
mov eax, dword [edx + 0x14]
call eax
cmp eax, ebx
je 0x568b56
cmp eax, 0x8878000a
jg 0x568b23
je 0x568b16
cmp eax, 0x8007000e
je 0x568b09
cmp eax, 0x80070057
jne 0x568b50
push ebx
push 0x682b08
push str.DSERR_INVALIDPARAM
jmp 0x568b49
push ebx
push 0x682b08
push str.DSERR_OUTOFMEMORY
jmp 0x568b49
push ebx
push 0x682b08
push str.DSERR_ALLOCATED
jmp 0x568b49
cmp eax, 0x88780032
je 0x568b3e
cmp eax, 0x887800aa
jne 0x568b50
push ebx
push 0x682b08
push str.DSERR_UNINITIALIZED
jmp 0x568b49
push ebx
push 0x682b08
push str.DSERR_INVALIDCALL
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.006294cf
mov edi, dword [edi]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x20]
push ebp
push edi
call edx
mov eax, esi
call fcn.00568c00
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8

Function at 0x568e80
Capabilities:
Terminate process

Disassembly:
sub esp, 0x404
mov eax, dword [0x6af168]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [esp + 0x408], 0
mov eax, dword [esp + 0x40c]
jne 0x568ed3
push eax
lea eax, [esp + 4]
push str._s_function_not_found_in_bass.dll
push eax
call fcn.0062635f
add esp, 0xc
push 0x10
push str.Error
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.006294cf
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00624940
add esp, 0x404
ret
Function at 0x56a850
Capabilities:
Terminate process

Disassembly:
sub esp, 0x404
mov eax, dword [0x6af168]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [esp + 0x408], 0
mov eax, dword [esp + 0x40c]
jne 0x56a8a3
push eax
lea eax, [esp + 4]
push str._s_function_not_found_in_fmod.dll
push eax
call fcn.0062635f
add esp, 0xc
push 0x10
push str.Error
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.006294cf
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00624940
add esp, 0x404
ret
Function at 0x56ac70
Capabilities:
Terminate process

Disassembly:
push 0x6b9dc8
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [0x6b9dc4], 0
jne 0x56acc8
push 0x80
call fcn.00624a6a
add esp, 4
test eax, eax
je 0x56aca0
push esi
mov esi, eax
call fcn.0056a8c0
pop esi
jmp 0x56aca2
xor eax, eax
cmp dword [eax + 4], 0
mov dword [0x6b9dc4], eax
jne 0x56acc8
push 0x10
push str.Error
push str.Cant_find_fmod.dll.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.006294cf
ret
Function at 0x571740
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push esi
mov esi, ecx
call fcn.005475d0
mov ecx, dword [esi + 0x640]
pop esi
jmp fcn.004e2e70
Function at 0x5d3550
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x104
mov eax, dword [0x6af168]
xor eax, esp
mov dword [esp + 0x100], eax
cmp dword [0x6b9dd4], 0
jne 0x5d35cd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 4]
push str.gPakInterfaceP__d
push eax
call fcn.0062635f
add esp, 0xc
lea ecx, [esp]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x6b9dd4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x6b9fd8], eax
mov eax, dword [eax]
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00624940
add esp, 0x104
ret
mov ecx, dword [esp + 0x100]
mov edx, dword [0x6b9fd8]
mov eax, dword [edx]
xor ecx, esp
call fcn.00624940
add esp, 0x104
ret

Function at 0x5d36f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
call fcn.005d3550
test eax, eax
je 0x5d3712
mov eax, dword [0x6b9fd8]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push esi
push edi
push ebx
push ebp
call eax
pop ebp
ret
mov ecx, dword [esi + 8]
push ecx
push edi
push ebx
push ebp
call fcn.00626e1f
add esp, 0x10
pop ebp
ret
Function at 0x5dac90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64a228
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x6af168]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.005db1a0
mov edi, eax
mov dword [esp + 0x28], 0
call fcn.005dac30
lea ecx, [esp + 0xc]
call fcn.005da500
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4

Function at 0x5dad00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64a228
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x6af168]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.005daeb0
mov edi, eax
mov dword [esp + 0x28], 0
call fcn.005dac30
lea ecx, [esp + 0xc]
call fcn.005da500
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4

Function at 0x5dad70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64a228
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x6af168]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x10]
push ecx
mov edi, esi
call fcn.005db370
mov edi, eax
mov dword [esp + 0x28], 0
call fcn.005dac30
lea ecx, [esp + 0xc]
call fcn.005da500
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4

Function at 0x5dae40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64a228
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x6af168]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.005db450
mov edi, eax
mov dword [esp + 0x28], 0
call fcn.005dac30
lea ecx, [esp + 0xc]
call fcn.005da500
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4

Function at 0x5dbb00
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
ret
Function at 0x5de200
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x5de229
call fcn.005eeee0
cmp byte [esi + 0x40], 0
je 0x5de222
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x5de2a5
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x5de295
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x5de24f
mov ecx, dword [eax]
push esi
call ecx
add esp, 4
mov edx, dword [esi + 0x190]
mov eax, dword [edx]
push esi
call eax
add esp, 4
test eax, eax
je 0x5de291
cmp eax, 2
je 0x5de295
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5de240
cmp eax, 3
je 0x5de277
cmp eax, 1
jne 0x5de240
add dword [ecx + 4], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
jl 0x5de240
mov edx, dword [esi + 0x11c]
add dword [eax + 8], edx
jmp 0x5de240
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
call fcn.005de2d0
pop esi
ret
cmp eax, 0xcc
je 0x5de2c7
mov ecx, dword [esi]
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
call fcn.005de2d0
pop esi
ret