joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429e48
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x429d94
call sub.user32.dll_EnumWindows
ret

Function at 0x429f68
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x429fe5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004299c8
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x429f8d
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004295c8
cmp dword [ebp - 4], 0
je 0x429fcf
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004042d0
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429fec
lea eax, [ebp - 4]
call fcn.00403e10
ret

Function at 0x42cfb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x453b54], 0
je 0x42d0ff
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x45200c]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x42d0ff
mov eax, dword [0x453b58]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x453b54]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x42d0ce
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x453b54]
call fcn.004135bc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x42d0c6
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x42d0c6
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x42d0c6
mov eax, dword [ebp - 0x14]
call fcn.00435c3c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42d0c6
push ebp
call fcn.0042cf6c
pop ecx
test al, al
jne 0x42d0c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x42d082
mov eax, dword [ebp - 0x14]
call fcn.0043476c
dec eax
jle 0x42d0c6
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004032d4
cmp byte [ebp - 1], 0
je 0x42d0c6
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x42d0c6
mov edx, dword [ebp - 0x14]
mov eax, dword [0x453b58]
call fcn.0042c738
inc edi
dec ebx
jne 0x42d015
mov eax, dword [0x453b58]
cmp dword [eax + 8], 0
jle 0x42d0e6
mov eax, dword [0x453b58]
call fcn.0042c7c8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42d0ff
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0042cdd4
pop ecx
test al, al
jne 0x42d0ff
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4306d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x430720
mov eax, esi
call fcn.00445e84
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x430720
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x430720
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x43085f
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x430760
cmp eax, 0x108
ja 0x430760
mov eax, esi
call fcn.00445e84
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x430856
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x43085f
jmp 0x430856
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x43083f
cmp eax, 0x20a
ja 0x43083f
test byte [esi + 0x50], 0x80
jne 0x430792
sub eax, 0x203
je 0x43078f
sub eax, 3
je 0x43078f
sub eax, 3
jne 0x430792
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x4307a6
dec eax
je 0x4307bb
dec eax
je 0x4307d8
dec eax
je 0x4307bb
jmp 0x4307df
mov ecx, ebx
mov eax, dword [0x45200c]
mov eax, dword [eax]
mov edx, esi
call fcn.0044f630
jmp 0x430856
cmp byte [esi + 0x5d], 1
jne 0x4307d1
mov eax, esi
mov si, 0xffed
call fcn.004032d4
jmp 0x43085f
or word [esi + 0x54], 1
jmp 0x430856
and word [esi + 0x54], 0xfffe
jmp 0x430856
mov eax, dword [0x453b10]
cmp byte [eax + 0x20], 0
je 0x430856
mov eax, dword [0x453b10]
cmp dword [eax + 0x1c], 0
je 0x430856
mov eax, dword [ebx]
mov edx, dword [0x453b10]
cmp eax, dword [edx + 0x1c]
jne 0x430856
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00445dc8
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.004032d4
jmp 0x43085f
cmp eax, 0xb00b
jne 0x430856
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0042f000
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d550
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44d567
add esp, 0xfffffff0
call fcn.004033e4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00418f5c
mov eax, dword [0x451f7c]
cmp word [eax + 2], 0
jne 0x44d58f
mov eax, dword [0x451f7c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044ec28
mov eax, dword [0x452028]
cmp word [eax + 2], 0
jne 0x44d5a9
mov eax, dword [0x452028]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044ee20
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411254]
call fcn.004030a8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411254]
call fcn.004030a8
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41b130]
call fcn.00420d78
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44d730
mov eax, dword [0x451ea4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00421148
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44f3c0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x451ea4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040bdf8
test eax, eax
je 0x44d69e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408174
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040be20
test eax, eax
je 0x44d6b2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404080
mov eax, dword [0x451da4]
cmp byte [eax], 0
jne 0x44d6e6
mov eax, ebx
call fcn.0044d858
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044f59c
mov eax, ebx
call fcn.0044ff60
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44d726
call fcn.0040343c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a0af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40a0be
pop dword [ebp - 0x34]
mov eax, 0x40a0be
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x6ded104
add dword [ebp - 0x44], 0x47737447
mov dword [ebp - 0x40], 0xddaa42fa
add dword [ebp - 0x40], 0x5489094b
mov dword [ebp - 0x3c], 0x51c4635e
sub dword [ebp - 0x3c], 0x5781f30
mov dword [ebp - 0x38], 0x67959629
add dword [ebp - 0x38], 0x986a69d7
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x1e716f7e
sub dword [ebp - 0x44], 0xa9ff0628
mov dword [ebp - 0x40], 0x8fd801e9
sub dword [ebp - 0x40], 0x4e6ba074
mov dword [ebp - 0x3c], 0xcdcd7f46
add dword [ebp - 0x3c], 0x95a1ed26
mov dword [ebp - 0x38], 0x45d020ab
sub dword [ebp - 0x38], 0x45d020ab
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xe93b3b63
sub eax, 0xe8fa6b2f
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x37d03
push 0
call eax
mov ecx, 0xf73da760
sub ecx, 0xf73d5f4c
xor ebx, ebx
add ebx, eax
mov edx, 0xa0c19cdf
sub edx, 0xa08048df
add edx, dword [ebp - 0x34]
mov edi, 0x1e7d16f3
sub edi, 0xb7bfbfea
sub dword [ebp - 0x30], esi
mov esi, dword [edx]
xor esi, edi
sub dword [ebp - 0x30], eax
mov dword [ebx], esi
sub dword [ebp - 0x28], 0x2049fb89
add ebx, 0x204cc75d
add ebx, 0xdfb338a7
add edx, 0xaf0e7b4b
sub edx, 0xaf0e7b47
loop 0x40a1d8
add eax, 0x11323
xor ebx, ebx
add ebx, eax
add eax, 0xa873af7b
add eax, 0x578c508a
mov ecx, 0xd0e271a8
add ecx, 0x2f5d8e58
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x40a6c1
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
cmp dword [0x412664], 0
je 0x40a6cd
mov al, 1
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
push 0
push 1
push 0
push 0x40f27c
mov edi, 0x412664
push edi
call esi
test eax, eax
jne 0x40a70f
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x40a70b
push 8
push 1
push 0
push str.__SunJavaKernel
push edi
call esi
test eax, eax
jne 0x40a70f
xor al, al
jmp 0x40a711
mov al, 1
pop edi
pop esi
ret
Function at 0x40b376
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41228c]
jne 0x40b380
repz ret
jmp fcn.0040b979

Function at 0x40b90e
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x410768
call fcn.0040b920
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
cmp dword [0x412a14], ebx
jne 0x40b6a9
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov edi, 0x412a10
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x40b6e3
cmp eax, esi
jne 0x40b6d6
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x40b6e6
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x40b6bd
xor esi, esi
inc esi
mov eax, dword [0x412a0c]
cmp eax, esi
jne 0x40b6f9
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x40b734
mov eax, dword [0x412a0c]
test eax, eax
jne 0x40b72e
mov dword [0x412a0c], esi
push 0x40d330
push 0x40d324
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40b734
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40b84e
mov dword [0x4126c8], esi
mov eax, dword [0x412a0c]
cmp eax, esi
jne 0x40b758
push 0x40d320
push 0x40d300
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x412a0c], 2
cmp dword [ebp - 0x24], ebx
jne 0x40b765
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x412a18], ebx
je 0x40b786
push 0x412a18
call fcn.0040a0af
pop ecx
test eax, eax
je 0x40b786
push ebx
push 2
push ebx
call dword [0x412a18]
mov eax, dword [sym.imp.MSVCR100.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x40b7df
cmp al, bl
je 0x40b79f
cmp dword [ebp - 0x1c], ebx
jne 0x40b7df
mov al, byte [esi]
cmp al, bl
je 0x40b7af
cmp al, 0x20
ja 0x40b7af
inc esi
mov dword [ebp - 0x20], esi
jmp 0x40b79f
test byte [ebp - 0x40], 1
je 0x40b7bb
movzx eax, word [ebp - 0x3c]
jmp 0x40b7be
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x4126c4], eax
cmp dword [0x4126b8], ebx
jne 0x40b834
push eax
call dword [sym.imp.MSVCR100.dll_exit]
cmp al, 0x22
jne 0x40b7ee
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR100.dll__ismbblead]
pop ecx
test eax, eax
je 0x40b801
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x40b78d
cmp dword [0x4126c8], ebx
jne 0x40b842
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x4126c4]
call fcn.0040b965
ret
call fcn.0040a0af
jmp 0x40b67b

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4c2a10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69eb08
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7a1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00573530
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 0x753740
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x1e], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x14], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x28], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x23], 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
add edx, 0x2c
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
cvtsi2ss xmm0, dword [0x7a1b44]
mulss xmm0, dword [ecx + 0x3076c]
cvttss2si edx, xmm0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2c], edx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
cvtsi2ss xmm0, dword [0x7a1b40]
mulss xmm0, dword [edx + 0x30770]
cvttss2si eax, xmm0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x30], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
cvtsi2ss xmm0, dword [0x7a1b44]
mulss xmm0, dword [eax + 0x30774]
cvttss2si ecx, xmm0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x34], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
cvtsi2ss xmm0, dword [0x7a1b40]
mulss xmm0, dword [ecx + 0x30778]
cvttss2si edx, xmm0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x38], edx
mov ecx, dword [ebp - 0x10]
push ecx
push str.DynDataName_NaviShow
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 4]
call fcn.00573670
mov eax, dword [ebp - 0x10]
push eax
push str.DynCmdName_DbMode
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 4]
call fcn.00573670
mov edx, dword [ebp - 0x10]
push edx
push str.DynCmdName_CameraChoose
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
call fcn.00573670
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e1c60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a131b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x7a1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.QX::CBaseCache_class_QX::CCacheNode_unsigned_int__.0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004b1020
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004e2b20
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [edx], 0
mov eax, dword [ebp - 0x10]
add eax, 0x34
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], 0
mov edx, dword [ebp - 0x10]
add edx, 0x38
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov dword [edx], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5033a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a8778
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x7a1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00573530
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 0x754b18
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, 0x24
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
movss xmm0, dword [0x7655b4]
movss dword [ecx], xmm0
mov edx, dword [ebp - 0x14]
movss xmm0, dword [0x7655b4]
movss dword [edx + 4], xmm0
mov eax, dword [ebp - 0x14]
movss xmm0, dword [0x7655b4]
movss dword [eax + 8], xmm0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x14], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x15], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x20], 0
xor eax, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
push str.DynCmdName_Upgrade
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
call fcn.00573670
mov ecx, dword [ebp - 0x10]
push ecx
push str.DynCmdName_CarColor
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 4]
call fcn.00573670
mov eax, dword [ebp - 0x10]
push eax
push str.DynDataName_IsDayLight
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 4]
call fcn.00573670
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1a8], 0
mov eax, dword [ebp - 0x10]
movss xmm0, dword [0x765924]
movss dword [eax + 0x198], xmm0
mov ecx, dword [ebp - 0x10]
movss xmm0, dword [0x76569c]
movss dword [ecx + 0x19c], xmm0
mov edx, dword [ebp - 0x10]
movss xmm0, dword [0x765924]
movss dword [edx + 0x1a0], xmm0
mov eax, dword [ebp - 0x10]
movss xmm0, dword [0x765674]
movss dword [eax + 0x1a4], xmm0
movss xmm0, dword [0x765650]
movss dword [ebp - 0x24], xmm0
movss xmm0, dword [0x765650]
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [0x765650]
movss dword [ebp - 0x1c], xmm0
movss xmm0, dword [ebp - 0x1c]
movss dword [ebp - 0x30], xmm0
movss xmm0, dword [ebp - 0x20]
movss dword [ebp - 0x2c], xmm0
movss xmm0, dword [ebp - 0x24]
movss dword [ebp - 0x28], xmm0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
movss xmm0, dword [ebp - 0x30]
movss dword [edx], xmm0
mov eax, dword [ebp - 0x18]
movss xmm0, dword [ebp - 0x2c]
movss dword [eax + 4], xmm0
mov ecx, dword [ebp - 0x18]
movss xmm0, dword [ebp - 0x28]
movss dword [ecx + 8], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x592c70
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b3d6c
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x7a1070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0x70
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], vtable.pvr::RefCountedResource_class_pvr::api::impl::DescriptorSet__.0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
mov dword [edx], vtable.pvr::EmbeddedRefCountedResource_class_pvr::api::impl::DescriptorSet__.0
mov ecx, dword [ebp - 0x14]
call fcn.0056e650
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x60
call fcn.004b5930
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.004b5930
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.004b5930
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.005a31c0
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.005a31c0
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.005a31c0
mov dword [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.005a31c0
mov dword [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.005a4e50
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
call fcn.005a4e50
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x59f760
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x10
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x14], 0x10
jb 0x59f7b7
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
jmp 0x59f7bd
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], 0x811c9dc5
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x38]
jae 0x59f804
imul ecx, dword [ebp - 0x10], 0x1000193
mov edx, dword [ebp - 4]
movzx eax, byte [edx]
xor ecx, eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x59f7df
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4