joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4edca0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d319d
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x6229a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push eax
call fcn.0040c9d0
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x144], eax
nop dword [eax + eax]
cmp dword [ebp - 0x14], 0x10
lea esi, [ebp - 0x28]
mov edi, dword [ebp - 0x18]
cmovae esi, dword [ebp - 0x28]
cmp eax, edi
jae 0x4edd55
push 0x100
lea eax, [ebp - 0x140]
push 0
push eax
call fcn.0059d800
add esp, 0xc
mov ecx, 0x5e4f74
nop dword [eax]
movzx eax, byte [ecx]
inc ecx
mov byte [ebp + eax - 0x140], 1
cmp ecx, 0x5e4f76
jne 0x4edd20
mov eax, dword [ebp - 0x144]
lea edx, [edi + esi]
add eax, esi
cmp eax, edx
jae 0x4edd55
movzx ecx, byte [eax]
cmp byte [ebp + ecx - 0x140], 0
jne 0x4edda0
inc eax
cmp eax, edx
jb 0x4edd43
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.005b4cee
mov ecx, dword [ebp - 0x14]
add esp, 4
cmp ecx, 0x10
jb 0x4ede42
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4ede38
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ede5d
jmp 0x4ede38
sub eax, esi
cmp eax, 0xffffffff
je 0x4edd55
cmp edi, eax
mov dword [ebp - 0x30], 0
lea ecx, [eax + 1]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x144], ecx
cmovb eax, edi
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
push eax
cmovae ecx, dword [ebp - 0x28]
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x40]
movups xmmword [ebp - 0x40], xmm0
call fcn.00402b80
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.005b4cee
mov ecx, dword [ebp - 0x2c]
add esp, 4
mov eax, dword [ebp - 0x144]
cmp ecx, 0x10
jb 0x4edcf0
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4ede23
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ede5d
push ecx
push edx
call fcn.0059b718
mov eax, dword [ebp - 0x144]
add esp, 8
jmp 0x4edcf0
push ecx
push edx
call fcn.0059b718
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059b734
mov esp, ebp
pop ebp
ret
call fcn.005a17d1
int3
Function at 0x4efe00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x9c0]
cmp eax, 0x270
jl 0x4efebe
xor edx, edx
nop word [eax + eax]
mov ecx, dword [esi + edx*4 + 4]
xor ecx, dword [esi + edx*4]
and ecx, 0x7fffffff
xor ecx, dword [esi + edx*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x6209e8]
xor ecx, dword [esi + edx*4 + 0x634]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, 0xe3
jl 0x4efe20
mov ecx, dword [esi + edx*4 + 4]
xor ecx, dword [esi + edx*4]
and ecx, 0x7fffffff
xor ecx, dword [esi + edx*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x6209e8]
xor ecx, dword [esi + edx*4 - 0x38c]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, 0x26f
jl 0x4efe51
mov ecx, dword [esi + 0x9bc]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x9bc]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [eax*4 + 0x6209e8]
xor eax, dword [esi + 0x630]
xor eax, ecx
mov dword [esi + 0x9bc], eax
xor eax, eax
mov dword [esi + 0x9c0], 0
mov ecx, dword [esi + eax*4]
inc eax
mov dword [esi + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
and eax, 0x7fffffff
pop esi
ret

Function at 0x4f01a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d341d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6229a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
call fcn.004fde00
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.004fa970
mov ecx, dword [ebp - 0x2c]
add esp, 0x14
cmp ecx, 8
jb 0x4f0222
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4f0218
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f027d
push ecx
push edx
call fcn.0059b718
add esp, 8
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x4f0264
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4f025a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f0282
push ecx
push edx
call fcn.0059b718
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059b734
mov esp, ebp
pop ebp
ret
call fcn.005a17d1
call fcn.005a17d1
int3
Function at 0x4f70e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, 0x1105
test eax, eax
mov dword [ecx + 0x9c0], 1
push esi
cmovne edx, eax
mov esi, 1
mov dword [ecx], edx
mov edx, dword [ecx + esi*4 - 4]
shr edx, 0x1e
xor edx, dword [ecx + esi*4 - 4]
imul eax, edx, 0x6c078965
add eax, esi
mov dword [ecx + esi*4], eax
mov esi, dword [ecx + 0x9c0]
inc esi
mov dword [ecx + 0x9c0], esi
cmp esi, 0x270
jl 0x4f7102
pop esi
pop ebp
ret 4

Function at 0x4f7600
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.0059bbc0
mov eax, dword [0x6229a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x666227], 0
je 0x4f77a9
push ebx
push edi
push 0x666290
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x5e4eb8
push str.mem_leaks.txt
xor ebx, ebx
call fcn.005a94a9
mov edi, eax
add esp, 8
test edi, edi
je 0x4f779c
push esi
push ebx
call fcn.005b048b
mov dword [ebp - 0x2010], eax
lea eax, [ebp - 0x2010]
push eax
mov dword [ebp - 0x200c], edx
call fcn.005b0407
push eax
call fcn.005b0122
push eax
lea eax, [ebp - 0x2004]
push str.Memory_Leak_Report_for__s_n
push eax
call fcn.00404f70
lea eax, [ebp - 0x2004]
push eax
push edi
call fcn.004fe480
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x20
push 0x5d9a94
call esi
lea eax, [ebp - 0x2004]
push eax
call esi
mov eax, dword [0x666288]
mov esi, dword [eax]
mov dword [ebp - 0x2008], esi
cmp esi, eax
je 0x4f772e
mov edx, 0x5d9560
mov ecx, dword [esi + 0x14]
mov eax, 0x5e4ee8
cmp ecx, 1
cmovle eax, edx
push eax
push ecx
push dword [esi + 0x120]
lea eax, [esi + 0x18]
push eax
lea eax, [ebp - 0x2004]
push str._s__d__:_Leak__d_byte_s_n
push eax
call fcn.00404f70
add esp, 0x18
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x2004]
push eax
push edi
call fcn.004fe480
add ebx, dword [esi + 0x14]
lea ecx, [ebp - 0x2008]
add esp, 8
call fcn.004e11d0
mov esi, dword [ebp - 0x2008]
mov edx, 0x5d9560
cmp esi, dword [0x666288]
jne 0x4f76c2
lea eax, [ebp - 0x2004]
push str.____________________________________________________________n
push eax
call fcn.00404f70
lea eax, [ebp - 0x2004]
push eax
push edi
call fcn.004fe480
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x2004]
add esp, 0x10
push eax
call esi
mov eax, ebx
cdq
and edx, 0x3ff
add eax, edx
sar eax, 0xa
push eax
push ebx
lea eax, [ebp - 0x2004]
push str.Total_Unfreed:__d_bytes___dKB__n_n
push eax
call fcn.00404f70
add esp, 0x10
lea eax, [ebp - 0x2004]
push eax
call esi
lea eax, [ebp - 0x2004]
push eax
push edi
call fcn.004fe480
add esp, 8
pop esi
push 0x666290
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059b734
mov esp, ebp
pop ebp
ret
Function at 0x4f7f60
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x6229a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0xd6], 0
jne 0x4f806a
cmp byte [ebp + 8], 0
mov ecx, 8
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x20c], 0
je 0x4f7fb7
mov eax, dword [edi + 8]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x108], 1
cmp byte [ebp + 0xc], 0
mov eax, edi
lea esi, [ecx + eax]
je 0x4f7fda
mov eax, dword [edi + 8]
lea esi, [edi + 8]
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x20c], 1
jmp 0x4f7fdc
mov eax, dword [esi]
mov dword [ebp - 0x30c], eax
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x310]
mov dword [ebp - 0x310], 1
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x318], 0
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x314], 0x186a0
push eax
push 0x40
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
je 0x4f807f
lea eax, [ebp - 0x310]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x4f807f
lea eax, [ebp - 0x108]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x4f806a
lea eax, [ebp - 0x20c]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x4f806a
cmp byte [edi + 0xd6], al
je 0x4f7f85
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059b734
mov esp, ebp
pop ebp
ret 8
push 6
mov ecx, edi
call fcn.004e4e20
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059b734
mov esp, ebp
pop ebp
ret 8

Function at 0x4f8110
Capabilities:
Create thread

Disassembly:
mov byte [ecx + 0xd4], 1
mov eax, dword [0x668248]
test eax, eax
je 0x4f8129
cmp byte [eax + 0x4ed], 0
jne 0x4f8140
push ecx
push 0
push 0x4ec6e0
mov byte [ecx + 0xd5], 1
call fcn.005b4397
add esp, 0xc
ret
Function at 0x4f82d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x18], 0
xorps xmm2, xmm2
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x20]
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 8], esi
movsd qword [esi], xmm2
je 0x4f83e8
movsd xmm4, qword [0x5e2780]
lea eax, [ebp + 8]
cmp edi, 8
xorps xmm0, xmm0
cmovae eax, edx
movzx eax, word [eax]
mov ecx, eax
mov dword [ebp - 0xc], ecx
xor ecx, ecx
cmp eax, 0x2d
mov eax, dword [ebp + 0x18]
sete cl
cmp ecx, eax
jae 0x4f8362
xorps xmm1, xmm1
cmp edi, 8
lea eax, [ebp + 8]
cmovae eax, edx
movzx esi, word [eax + ecx*2]
lea eax, [esi - 0x30]
cmp ax, 9
ja 0x4f83d0
lea eax, [esi - 0x30]
mulsd xmm1, xmm4
mov esi, dword [ebp - 8]
inc ecx
movd xmm0, eax
mov eax, dword [ebp + 0x18]
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm1
movsd qword [esi], xmm0
movaps xmm1, xmm0
cmp ecx, eax
jb 0x4f8323
movsd xmm1, qword [0x5e1868]
cmp ecx, eax
jae 0x4f83b8
movaps xmm3, xmm0
cmp edi, 8
lea eax, [ebp + 8]
cmovae eax, edx
movzx eax, word [eax + ecx*2]
mov dword [ebp - 8], eax
add eax, 0xffffffd0
cmp ax, 9
ja 0x4f8414
mov eax, dword [ebp - 8]
inc ecx
movzx eax, ax
sub eax, 0x30
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm1
divsd xmm1, xmm4
addsd xmm0, xmm3
movaps xmm3, xmm0
movsd qword [esi], xmm0
cmp ecx, dword [ebp + 0x18]
jb 0x4f8371
cmp word [ebp - 0xc], 0x2d
jne 0x4f83ca
xorps xmm0, xmmword [0x5d99f0]
movsd qword [esi], xmm0
mov byte [ebp - 1], 1
jmp 0x4f83ec
cmp esi, 0x2e
jne 0x4f83e1
mov esi, dword [ebp - 8]
inc ecx
mov eax, dword [ebp + 0x18]
movaps xmm0, xmm1
jmp 0x4f8362
mov eax, dword [ebp - 8]
movsd qword [eax], xmm2
mov byte [ebp - 1], 0
cmp edi, 8
jb 0x4f8424
lea edi, [edi*2 + 2]
mov eax, edx
cmp edi, 0x1000
jb 0x4f841a
mov edx, dword [eax - 4]
add edi, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f842d
jmp 0x4f841a
movsd qword [esi], xmm2
jmp 0x4f83e8
push edi
push edx
call fcn.0059b718
add esp, 8
mov al, byte [ebp - 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.005a17d1
int3

Function at 0x4fcd30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
call fcn.004e8e70
test eax, eax
je 0x4fcd56
mov eax, dword [0x666d58]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x14]
pop ebp
ret
mov eax, dword [ebp + 0x14]
push dword [eax + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005a96a6
add esp, 0x10
pop ebp
ret
Function at 0x4ff1d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d4210
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push edi
mov eax, dword [0x6229a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x30]
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.004feb90
mov dword [edi], vtable.Sexy::Graphics.0
push 0x54
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
call fcn.0059b742
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0x3f800000
mov dword [edi + 0x14], 0x3f800000
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 4], eax
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0x10000
test eax, eax
jne 0x4ff2a0
mov dword [edi + 4], 0x6671dc
xor al, al
jmp 0x4ff2a9
push eax
call fcn.0050fc00
add esp, 4
mov byte [edi + 0x4c], al
mov ecx, dword [edi + 4]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.0051a4f0
mov ecx, dword [edi + 4]
mov dword [ebp - 0x18], eax
call fcn.00519810
mov dword [ebp - 0x14], eax
mov eax, edi
movups xmm0, xmmword [ebp - 0x20]
movups xmmword [edi + 0x20], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x50ff30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.0059bbc0
mov eax, dword [0x6229a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
mov byte [esi + 0xaa], 1
test eax, eax
je 0x5101be
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x1018]
push ecx
lea ecx, [ebp - 0x1020]
mov dword [ebp - 0x1020], 0
push ecx
lea ecx, [ebp - 0x101c]
mov dword [ebp - 0x1018], 4
push ecx
push 0
push str.Version
push eax
mov dword [ebp - 0x101c], 4
call ebx
test eax, eax
jne 0x5101be
cmp dword [ebp - 0x1020], 2
jne 0x5101be
mov dword [ebp - 0x1024], eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x1024]
mov dword [ebp - 0x1018], 4
push eax
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x101c], 4
push eax
push 0
push str.MinVidMemory
push dword [esi + 0x1c]
call ebx
test eax, eax
jne 0x5101be
mov eax, dword [ebp - 0x1024]
cmp eax, dword [esi + 0xa0]
jne 0x5101be
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x1028], 0
push eax
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x1018], 4
push eax
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x101c], 4
push eax
push 0
push str.RecVidMemory
push dword [esi + 0x1c]
call ebx
test eax, eax
jne 0x5101be
mov eax, dword [ebp - 0x1028]
cmp eax, dword [esi + 0xa4]
jne 0x5101be
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x1018], 0x10
push eax
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x101c], 3
push eax
lea eax, [ebp - 0x101c]
push eax
push 0
push str.DisplayGUID
push dword [esi + 0x1c]
call ebx
test eax, eax
jne 0x5101be
cmp dword [ebp - 0x1018], 0x10
jne 0x5101be
lea edx, [esi + 0x20]
lea ecx, [ebp - 0x1014]
lea edi, [eax + 0xc]
nop word [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x5101be
add ecx, 4
add edx, 4
sub edi, 4
jae 0x5100c0
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x101c], 1
push eax
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1018], 0x1000
push eax
lea eax, [ebp - 0x101c]
push eax
push 0
push str.FailureReason
push dword [esi + 0x1c]
call ebx
test eax, eax
jne 0x5101be
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x510120
sub ecx, edx
lea eax, [ebp - 0x1004]
push ecx
push eax
lea ecx, [esi + 0x70]
call fcn.0040c5a0
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x101c], 1
push eax
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1018], 0x1000
push eax
lea eax, [ebp - 0x101c]
push eax
push 0
push str.Warning
push dword [esi + 0x1c]
call ebx
test eax, eax
jne 0x5101be
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x510180
sub ecx, edx
lea eax, [ebp - 0x1004]
push ecx
push eax
lea ecx, [esi + 0x88]
call fcn.0040c5a0
cmp dword [esi + 0x80], 0
pop edi
mov byte [esi + 0xaa], 0
sete al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059b734
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059b734
mov esp, ebp
pop ebp
ret
Function at 0x5175a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ebx
call fcn.00532d60
mov edx, dword [ebx]
mov edi, eax
mov ecx, ebx
mov dword [ebp - 0x24], edi
call dword [edx + 0x7c]
mov edx, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 8], eax
shr ecx, 0x18
mov dword [ebp - 0x14], ecx
mov ebx, dword [edx + 4]
mov eax, dword [edx + 0xc]
add eax, ebx
mov dword [ebp - 0x18], ebx
cmp ecx, 0xff
jne 0x517630
cmp ebx, eax
jge 0x517742
mov esi, dword [edx + 8]
nop
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov eax, dword [eax + 0x20]
imul eax, ebx
add eax, dword [edx]
lea ecx, [ecx + eax*4]
xor eax, eax
test esi, esi
jle 0x517614
mov dword [ecx], edi
lea ecx, [ecx + 4]
mov esi, dword [edx + 8]
inc eax
cmp eax, esi
jl 0x517607
mov eax, dword [edx + 4]
inc ebx
add eax, dword [edx + 0xc]
cmp ebx, eax
jl 0x5175f0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0x64]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp ebx, eax
jge 0x517742
mov esi, dword [edx + 8]
nop dword [eax + eax]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], 0
mov eax, dword [eax + 0x20]
imul eax, ebx
add eax, dword [edx]
lea ecx, [ecx + eax*4]
mov dword [ebp + 0xc], ecx
test esi, esi
jle 0x517730
mov ebx, dword [ebp - 0x14]
imul eax, ebx, 0xff
mov dword [ebp - 0x1c], eax
mov eax, edi
and eax, 0xff00ff
mov dword [ebp - 0xc], eax
mov eax, edi
and eax, 0xff00
mov dword [ebp - 0x20], eax
mov edi, dword [ecx]
mov eax, 0x80808081
mov esi, edi
mov ecx, 0xff
shr esi, 0x18
and edi, 0xff00
sub ecx, esi
imul ecx, ebx
imul ecx
mov eax, dword [ebp - 0x1c]
add edx, ecx
mov ecx, dword [ebp - 0x20]
sar edx, 7
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
cdq
add ebx, esi
idiv ebx
mov edx, 0x100
shl ebx, 0x18
mov esi, eax
mov eax, dword [ebp - 0xc]
imul ecx, esi
sub edx, esi
imul edi, edx
imul eax, esi
add edi, ecx
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
and ecx, 0xffff00ff
imul ecx, edx
add ecx, eax
mov eax, dword [ebp + 0xc]
xor edi, ecx
and edi, 0xff0000
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc]
and ecx, 0xff00ff
imul ecx, edx
mov edx, dword [ebp + 8]
imul eax, esi
add ecx, eax
mov eax, dword [ebp - 0x10]
xor edi, ecx
inc eax
mov ecx, dword [ebp + 0xc]
shr edi, 8
or edi, ebx
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x14]
mov dword [ecx], edi
add ecx, 4
mov esi, dword [edx + 8]
mov dword [ebp + 0xc], ecx
cmp eax, esi
jl 0x517683
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov eax, dword [edx + 4]
inc ebx
add eax, dword [edx + 0xc]
mov dword [ebp - 0x18], ebx
cmp ebx, eax
jl 0x517640
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0x64]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x519e40
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x6229a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x667234], 0
jne 0x519eba
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x104]
push str.gPakInterfaceP__d
push eax
call fcn.00404f70
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x667234], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x667238], eax
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059b734
mov esp, ebp
pop ebp
ret
mov eax, dword [0x667238]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [eax]
call fcn.0059b734
mov esp, ebp
pop ebp
ret
Function at 0x52a720
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d4b1d
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push esi
push edi
mov eax, dword [0x6229a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x38]
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
movups xmmword [ebp - 0x48], xmm0
call fcn.004feb90
cmp dword [edi + 0x60], 0x30c30c3
lea esi, [edi + 0x5c]
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
je 0x52a860
mov dword [ebp - 0x18], esi
push 0x54
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.0059b742
mov edx, eax
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x48]
add esp, 4
movups xmm0, xmmword [ebp - 0x60]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 0x44]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0x40]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0x3c]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 0x24]
mov dword [edx + 0x48], eax
movzx eax, byte [ebp - 0x20]
mov byte [edx + 0x4c], al
movzx eax, byte [ebp - 0x1f]
movups xmmword [edx + 0xc], xmm0
mov byte [edx + 0x4d], al
movss xmm0, dword [ebp - 0x50]
movzx eax, byte [ebp - 0x1e]
movss dword [edx + 0x1c], xmm0
movss xmm0, dword [ebp - 0x4c]
mov byte [edx + 0x4e], al
movzx eax, byte [ebp - 0x1d]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x10]
movss dword [edx + 0x20], xmm0
movups xmm0, xmmword [ebp - 0x38]
mov byte [edx + 0x4f], al
movzx eax, byte [ebp - 0x1c]
mov byte [edx + 0x50], al
movups xmmword [edx + 0x34], xmm0
inc dword [esi + 4]
mov eax, dword [ecx + 4]
mov dword [edx], ecx
mov dword [edx + 4], eax
mov dword [ecx + 4], edx
mov dword [eax], edx
lea eax, [edi + 4]
neg edi
sbb edi, edi
and edi, eax
mov eax, dword [esi]
push edi
mov ecx, dword [eax + 4]
add ecx, 8
call fcn.00511910
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.list_too_long
call fcn.00599f30
int3