joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bad0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f2c3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 8], esi
mov dword [esi + 0xc], eax
mov dword [esi], vtable.ds::sys3d::ParticleElement.0
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x18], vtable.ds::BasicTextureObject.0
mov dword [esi + 0x1c], 0
lea eax, [esi + 0x44]
push eax
mov byte [ebp - 4], 1
mov byte [esi + 0x74], 1
call fcn.0042f260
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x2c], 0x1000
mov dword [esi + 0x30], 0x1000
mov dword [esi + 0x34], 0x1000
add esp, 4
mov dword [esi + 0x38], 0x1000
mov dword [esi + 0x3c], 0x1000
mov dword [esi + 0x40], 0x1000
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x45eb90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
cmp dword [ebx + 8], 0
jne 0x45ecff
push esi
push edi
call fcn.00425870
mov edi, eax
test edi, edi
jne 0x45ebb7
xor esi, esi
jmp 0x45ebd7
push 0x200
lea esi, [ebx + 0x40]
push 0
push esi
call sub.MSVCR110.dll_memset
push edi
push str._s_report_achi.bin
push esi
call dword [sym.imp.MSVCR110.dll_sprintf]
add esp, 0x18
push 0x5bb068
push esi
call dword [sym.imp.MSVCR110.dll_fopen]
push 0xc
mov esi, eax
mov byte [ebp - 1], 0
call fcn.00419c10
add esp, 0xc
test eax, eax
je 0x45ec0d
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
jmp 0x45ec0f
xor eax, eax
mov dword [ebx + 8], eax
test eax, eax
jne 0x45ec27
push esi
call dword [sym.imp.MSVCR110.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x45ecfd
push 0
push 0
push esi
call dword [sym.imp.MSVCR110.dll_fseek]
push esi
push 1
lea eax, [ebp - 1]
push 1
push eax
call dword [sym.imp.MSVCR110.dll_fread]
mov al, byte [ebp - 1]
mov edi, dword [sym.imp.MSVCR110.dll_fclose]
add esp, 0x1c
test al, al
jne 0x45ec62
push esi
call edi
mov al, byte [ebp - 1]
add esp, 4
movzx ebx, al
imul ebx, ebx, 0x108
push ebx
call fcn.00419c10
add esp, 4
mov dword [ebp - 8], eax
push esi
test eax, eax
jne 0x45ec88
call edi
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 1
push eax
call dword [sym.imp.MSVCR110.dll_fread]
push esi
call edi
xor ebx, ebx
add esp, 0x14
cmp byte [ebp - 1], bl
jbe 0x45ecf2
mov edi, dword [ebp - 8]
push 0x108
call fcn.00419c10
mov esi, eax
add esp, 4
test esi, esi
je 0x45ecf2
push 0x108
push 0
push esi
call sub.MSVCR110.dll_memset
push 0x108
push edi
push esi
mov dword [ebp - 0xc], esi
call sub.MSVCR110.dll_memcpy
add esp, 0x18
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
call fcn.0045ed10
movzx eax, byte [ebp - 1]
inc ebx
add edi, 0x108
cmp ebx, eax
jl 0x45eca2
push dword [ebp - 8]
call fcn.0043ad40
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45fa90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
cdq
push esi
push edi
mov edi, eax
xor edi, edx
sub edi, edx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 1], 0
jns 0x45fab2
xor edi, edi
jmp 0x45fabc
mov eax, 0x270f
cmp edi, eax
cmovg edi, eax
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 8], ecx
mov dword [ebp - 0x10], eax
jne 0x45fb97
xor esi, esi
mov ecx, 0xa
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], esi
add ebx, 0x90
mov eax, edi
cdq
idiv ecx
cmp byte [ebp - 1], 0
movzx eax, ax
mov dword [ebp + 0xc], eax
jne 0x45fb02
test ax, ax
jne 0x45fb02
cmp esi, 1
jne 0x45fb65
lea esi, [ebx - 0x8c]
push 0x61e5b4
mov ecx, esi
call fcn.004539c0
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, esi
mov dword [ebx + 0x14], eax
call fcn.00453620
or dword [ebx], 2
mov byte [ebx + 9], 2
or dword [ebx], 0x28
xor eax, eax
push 0x30000
mov ecx, esi
mov word [ebx + 0xe], ax
call fcn.00453670
push esi
mov ecx, 0x61aa98
call fcn.00451f50
add dword [ebp + 8], 0xa000
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0xc]
mov byte [ebp - 1], 1
movzx eax, ax
imul eax, ecx
sub edi, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
inc esi
add ecx, edx
add ebx, 0x114
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], esi
cmp esi, 2
jl 0x45fae7
mov ebx, dword [ebp - 0x14]
lea esi, [ebx + 0x22c]
push 0x61e5b4
mov ecx, esi
call fcn.004539c0
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebx + 0x2c8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x2cc], eax
movzx eax, word [edi*4 + 0x5968e4]
push eax
mov ecx, esi
call fcn.00453620
or dword [esi + 0x8c], 2
mov byte [esi + 0x95], 2
movzx eax, word [edi*4 + 0x5969c4]
or dword [esi + 0x8c], 0x20
mov word [esi + 0x9a], ax
or dword [ebx + 0x2b8], 8
push 0x30000
mov ecx, esi
call fcn.00453670
mov ecx, 0x61aa98
push esi
call fcn.00451f50
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4612a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58495b
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x5eae84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], ecx
mov eax, dword [0x596ea8]
movq xmm0, qword [0x596e98]
mov dword [ebp - 0x40], eax
mov ax, word [0x596eac]
mov word [ebp - 0x3c], ax
movq qword [ebp - 0x50], xmm0
movq xmm0, qword [0x596ea0]
lea eax, [ebp - 0x50]
push 0x5bb068
push eax
movq qword [ebp - 0x48], xmm0
call dword [sym.imp.MSVCR110.dll_fopen]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x461329
push str.not_load_file
push 0x117
push str.user_achievement_achievement_resource.cpp
call fcn.004301a0
add esp, 0xc
mov esi, dword [sym.imp.MSVCR110.dll_fseek]
push 2
push 0
push ebx
call esi
push ebx
call dword [sym.imp.MSVCR110.dll_ftell]
push 0
push 0
push ebx
mov edi, eax
call esi
push edi
call fcn.0045c4e0
mov ecx, dword [ebp - 0x54]
add esp, 0x20
xor esi, esi
mov dword [ecx], eax
test edi, edi
je 0x461378
lea ebx, [ebx]
push ebx
push edi
push 1
push dword [ecx]
call dword [sym.imp.MSVCR110.dll_fread]
mov ecx, dword [ebp - 0x54]
add esi, eax
add esp, 0x10
cmp esi, edi
jb 0x461360
push ebx
call dword [sym.imp.MSVCR110.dll_fclose]
xor edx, edx
mov eax, edi
mov ecx, 0x140
div ecx
mov esi, dword [ebp - 0x54]
add esp, 4
mov dword [esi + 4], eax
test edx, edx
je 0x46139b
inc eax
mov dword [esi + 4], eax
mov eax, dword [0x61e6d4]
test eax, eax
jne 0x4613d4
push 0x60
call fcn.00425cc0
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4613c6
push esi
mov ecx, eax
call fcn.00461400
jmp 0x4613c8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x61e6d4], eax
push eax
call fcn.0043f310
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057d22e
mov esp, ebp
pop ebp
ret 4
Function at 0x468d90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f85b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x4c]
mov byte [esi + 0x18], 1
mov dword [esi + 0x2c], 0
mov byte [esi + 0x30], 0
mov dword [esi + 0x34], 0
call fcn.00441210
lea ecx, [esi + 0x78]
mov dword [ebp - 4], 0
call fcn.0049e750
lea ecx, [esi + 0x338]
call fcn.004912f0
mov dword [esi + 0x928], 0x5975d8
mov dword [esi + 0x934], 0x5975e4
mov dword [esi + 0x940], 0x5975f0
mov dword [esi + 0x94c], 0x5975fc
mov dword [esi + 0x958], 0x597608
mov dword [esi + 0x960], 0x597614
mov dword [esi + 0x9a0], 0x597620
mov dword [esi + 0x9a8], 0x59762c
mov dword [esi + 0x9b4], 0x597638
mov dword [esi + 0x9c0], 0x597644
lea ebx, [esi + 0x9d8]
mov dword [esi + 0x9cc], 0x597650
lea ecx, [esi + 0xa20]
mov dword [ebx], vtable.btl::BABDefencePosture.0
call fcn.004b1570
add esi, 0xa74
lea ecx, [esi + 0xc]
mov dword [esi], vtable.btl::BABThumbing.0
call fcn.004b9760
mov edx, dword [ebp - 0x10]
xor eax, eax
lea edi, [edx + 0x720]
mov ecx, 0x82
rep stosd dword es:[edi], eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], eax
lea eax, [edx + 0x928]
mov dword [edx + 0x79c], eax
lea eax, [edx + 0x934]
mov dword [edx + 0x7a0], eax
lea eax, [edx + 0x940]
mov dword [edx + 0x7a4], eax
lea eax, [edx + 0x94c]
mov dword [edx + 0x7a8], eax
lea eax, [edx + 0x958]
mov dword [edx + 0x7b4], eax
lea eax, [edx + 0x960]
mov dword [edx + 0x7c8], eax
lea eax, [edx + 0x9a0]
mov dword [edx + 0x7cc], eax
lea eax, [edx + 0x9a8]
mov dword [edx + 0x7d0], eax
lea eax, [edx + 0x9b4]
mov dword [edx + 0x7d8], eax
lea eax, [edx + 0x9c0]
mov dword [edx + 0x7e0], eax
lea eax, [edx + 0x9cc]
mov dword [edx + 0x7f0], eax
mov dword [edx + 0x7fc], ebx
mov dword [edx + 0x8bc], esi
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4da210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
call fcn.004da140
mov ecx, 0x5eb498
call fcn.00421520
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x44], 0xffffffff
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x4c], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], 0xffffffff
mov dword [esi + 0x64], 0xffffffff
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x6c], 0xffffffff
mov dword [esi + 0x70], 0xffffffff
mov dword [esi + 0x74], 0xffffffff
lea eax, [esi + 0x80]
push 0xc0
mov dword [esi + 0x78], 0xffffffff
push eax
mov dword [esi + 0x7c], 0xffffffff
call fcn.0042e2b0
add esp, 8
mov ecx, 0x5eb498
pop esi
jmp fcn.00421310
Function at 0x50a2a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x581f48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov eax, dword [0x5e6ef8]
mov dword [esi + 0x14], eax
xor eax, eax
push esi
push 0x5e6efc
mov dword [ebp - 4], 0
mov dword [esi], vtable.layout::Frame.0
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov byte [esi + 0x39], 0xff
mov byte [esi + 0xc], 1
call fcn.00435590
add esp, 8
or byte [esi + 0x38], 2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x50cba0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5820da
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], vtable.menu::CMSBridge.0
lea ecx, [edi + 0x30]
mov dword [ebp - 4], 0
call fcn.004528b0
mov dword [edi + 0x30], vtable.sys2d::Nscr.0
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 1
call fcn.0052d7d0
lea ecx, [edi + 0x4c]
mov byte [ebp - 4], 2
call fcn.004538d0
lea ecx, [edi + 0x160]
mov byte [ebp - 4], 3
call fcn.004516e0
lea ecx, [edi + 0x26c]
mov byte [ebp - 4], 4
call fcn.004538d0
lea ecx, [edi + 0x380]
mov byte [ebp - 4], 5
call fcn.004516e0
lea ecx, [edi + 0x48c]
mov byte [ebp - 4], 6
call fcn.004538d0
lea ecx, [edi + 0x5a0]
mov byte [ebp - 4], 7
call fcn.004516e0
lea ecx, [edi + 0x6ac]
mov byte [ebp - 4], 8
call fcn.004516e0
lea ecx, [edi + 0x7b8]
mov byte [ebp - 4], 9
call fcn.004538d0
lea ecx, [edi + 0x8cc]
mov byte [ebp - 4], 0xa
call fcn.0045b480
lea ecx, [edi + 0xb10]
mov byte [ebp - 4], 0xb
call fcn.0045b480
lea ecx, [edi + 0xd54]
mov byte [ebp - 4], 0xc
call fcn.00454ba0
mov dword [edi + 0xd54], 0x5ad634
mov dword [edi], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov byte [edi + 0x44], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x50cce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58219c
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0xb10]
mov dword [ebp - 4], 0xb
call fcn.0045b4f0
lea ecx, [esi + 0x8cc]
mov byte [ebp - 4], 0xa
call fcn.0045b4f0
lea ecx, [esi + 0x7b8]
mov byte [ebp - 4], 9
call fcn.00453950
lea ecx, [esi + 0x6ac]
mov byte [ebp - 4], 8
call fcn.00451750
lea ecx, [esi + 0x5a0]
mov byte [ebp - 4], 7
call fcn.00451750
lea ecx, [esi + 0x48c]
mov byte [ebp - 4], 6
call fcn.00453950
lea ecx, [esi + 0x380]
mov byte [ebp - 4], 5
call fcn.00451750
lea ecx, [esi + 0x26c]
mov byte [ebp - 4], 4
call fcn.00453950
lea ecx, [esi + 0x160]
mov byte [ebp - 4], 3
call fcn.00451750
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
call fcn.00453950
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 1
call fcn.004159f0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 0
call fcn.00452910
mov dword [esi + 0xc], vtable.menu::ChokoboMenuSubState.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x511bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5eae84]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x44], 0x294a294a
mov dword [ebp - 0x40], 0x294a294a
mov dword [ebp - 0x3c], 0x294a294a
mov dword [ebp - 0x38], 0x294a294a
mov dword [ebp - 0x34], 0x294a294a
mov dword [ebp - 0x30], 0x294a294a
mov dword [ebp - 0x2c], 0x294a294a
mov dword [ebp - 0x28], 0x294a294a
mov dword [ebp - 0x24], 0x294a294a
mov dword [ebp - 0x20], 0x294a294a
mov dword [ebp - 0x1c], 0x294a294a
mov dword [ebp - 0x18], 0x294a294a
mov dword [ebp - 0x14], 0x294a294a
mov dword [ebp - 0x10], 0x294a294a
mov dword [ebp - 0xc], 0x294a294a
mov dword [ebp - 8], 0x294a294a
call fcn.0042cd20
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
call fcn.0057d22e
mov esp, ebp
pop ebp
ret
Function at 0x539af0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584d08
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov byte [esi + 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.object::MapObject.0
xorps xmm0, xmm0
movq qword [esi + 0x14], xmm0
lea edx, [esi + 0x14]
mov dword [ebp - 4], 0
movq qword [edx + 8], xmm0
movq qword [esi + 0x24], xmm0
mov dword [esi + 0x2c], 0
movq qword [esi + 0x30], xmm0
mov dword [esi + 0x38], 0
mov byte [esi + 0x3c], 0
test eax, eax
jne 0x539b82
mov eax, dword [str.no_name]
mov dword [edx], eax
mov eax, dword [0x5b4bf8]
mov dword [edx + 4], eax
jmp 0x539b90
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
lea eax, [eax + 1]
test cl, cl
jne 0x539b84
cmp byte [esi + 0xc], 0
jne 0x539ba8
push esi
push 0x5e9170
mov byte [esi + 0xc], 1
call fcn.00435590
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x53a280
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584d68
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov word [edx + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [edx], vtable.object::OSLinearMoveFixedAndRelative.0
movq xmm0, qword [eax]
movq qword [edx + 0xc], xmm0
mov eax, dword [eax + 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 0x10]
lea ecx, [edx + 0x18]
movq xmm0, qword [eax]
lea esi, [edx + 0x24]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
movq xmm0, qword [ebp - 0x1c]
push esi
movq qword [esi], xmm0
push ecx
mov dword [ebp - 4], 0
mov dword [ecx + 8], eax
mov dword [edx + 0x30], 0
mov dword [edx + 0x34], 0
mov dword [esi + 8], 0
call fcn.00430b40
mov eax, dword [ebp + 0x14]
cdq
add esp, 8
mov ebx, eax
mov eax, dword [esi]
mov edi, edx
push edi
cdq
push ebx
push edx
push eax
call fcn.0057d2a0
add eax, 0x800
adc edx, 0
shrd eax, edx, 0xc
mov dword [esi], eax
mov esi, dword [ebp - 0x10]
push edi
mov eax, dword [esi + 0x28]
sar edx, 0xc
cdq
push ebx
push edx
push eax
call fcn.0057d2a0
add eax, 0x800
adc edx, 0
shrd eax, edx, 0xc
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x2c]
push edi
sar edx, 0xc
cdq
push ebx
push edx
push eax
call fcn.0057d2a0
add eax, 0x800
push dword [ebp + 0x14]
adc edx, 0
shrd eax, edx, 0xc
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x18]
push eax
sar edx, 0xc
call fcn.004309f0
add esp, 4
push eax
call fcn.0042c6b0
add esp, 8
sar eax, 0xc
mov dword [esi + 0x30], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x53a4d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584d98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov word [esi + 8], 0
mov ecx, dword [ebp + 0xc]
mov dword [esi], vtable.object::OSRandomWalk.0
movq xmm0, qword [ecx]
movq qword [esi + 0xc], xmm0
mov eax, dword [ecx + 8]
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x1c], eax
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x20], eax
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x24], eax
push 0xb4
mov dword [ebp - 4], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
call fcn.0045d010
movzx eax, ax
mov dword [esi + 0x28], eax
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x53a580
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584d68
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
mov dword [esi + 4], ebx
mov word [esi + 8], 0
mov edi, dword [ebp + 0xc]
mov dword [esi], vtable.object::OSRotationByFrame.0
mov eax, dword [edi]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 4]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x24], eax
cmp dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
jg 0x53a64c
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x18], eax
movq xmm0, qword [ebp - 0x1c]
mov eax, ebx
movq qword [eax + 0x64], xmm0
mov dword [eax + 0x6c], ecx
movzx eax, word [esi + 0xc]
push eax
movzx eax, word [esi + 0x14]
push eax
movzx eax, word [esi + 0x10]
push eax
mov eax, dword [esi + 4]
mov ecx, 0x6208c8
push dword [eax + 0x50]
call fcn.004d8fc0
jmp 0x53a653
mov ecx, esi
call fcn.0053abc0
push dword [ebx + 0x50]
mov ecx, 0x6208c8
call fcn.004d6d90
cmp eax, 1
jge 0x53a67f
mov byte [esi + 8], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x18]
cmp eax, 0xffffffff
je 0x53a669
push eax
push dword [ebx + 0x50]
mov ecx, 0x6208c8
call fcn.004d7720
test al, al
mov eax, esi
jne 0x53a66b
mov byte [esi + 8], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8