joyce8/EMBER2024-capa huggingface dataset:
Function at 0x532a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov ecx, eax
sub ecx, 0x80
je 0x532a5e
sub ecx, 0x40
je 0x532a56
sub ecx, 0x40
je 0x532a4e
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0065865c
mov esp, ebp
pop ebp
ret
mov dword [edi], 0xe
jmp 0x532a64
mov dword [edi], 0xc
jmp 0x532a64
mov dword [edi], 0xa
lea esi, [edi + 8]
push edx
lea ecx, [esp + 0xc]
mov dword [edi + 4], esi
call fcn.005324a0
add esp, 4
test eax, eax
jne 0x532c17
mov eax, dword [esp + 8]
shl eax, 4
add eax, dword [esp + 0xc]
add esi, 0x10
mov ecx, dword [eax]
mov dword [esi - 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esi - 0xc], edx
mov ecx, dword [eax + 8]
mov dword [esi - 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi - 4], edx
mov ecx, dword [edi]
dec ecx
sub eax, 0x10
test ecx, ecx
jle 0x532bff
movzx edx, byte [eax + 3]
movzx edx, byte [edx + 0x9f2198]
mov edx, dword [edx*4 + 0x9f2298]
movzx edi, byte [eax + 2]
movzx edi, byte [edi + 0x9f2198]
xor edx, dword [edi*4 + 0x9f2698]
movzx edi, byte [eax + 1]
movzx edi, byte [edi + 0x9f2198]
xor edx, dword [edi*4 + 0x9f2ac0]
mov edi, dword [eax]
and edi, 0xff
movzx edi, byte [edi + 0x9f2198]
xor edx, dword [edi*4 + 0x9f2ec0]
dec ecx
mov dword [esi], edx
mov edx, dword [eax + 4]
movzx edi, byte [eax + 7]
movzx edi, byte [edi + 0x9f2198]
and edx, 0xff
movzx edx, byte [edx + 0x9f2198]
mov edx, dword [edx*4 + 0x9f2ec0]
xor edx, dword [edi*4 + 0x9f2298]
movzx edi, byte [eax + 6]
movzx edi, byte [edi + 0x9f2198]
xor edx, dword [edi*4 + 0x9f2698]
movzx edi, byte [eax + 5]
movzx edi, byte [edi + 0x9f2198]
xor edx, dword [edi*4 + 0x9f2ac0]
add esi, 0x10
mov dword [esi - 0xc], edx
mov edx, dword [eax + 8]
movzx edi, byte [eax + 0xb]
movzx edi, byte [edi + 0x9f2198]
and edx, 0xff
movzx edx, byte [edx + 0x9f2198]
mov edx, dword [edx*4 + 0x9f2ec0]
xor edx, dword [edi*4 + 0x9f2298]
movzx edi, byte [eax + 0xa]
movzx edi, byte [edi + 0x9f2198]
xor edx, dword [edi*4 + 0x9f2698]
movzx edi, byte [eax + 9]
movzx edi, byte [edi + 0x9f2198]
xor edx, dword [edi*4 + 0x9f2ac0]
sub eax, 0x10
mov dword [esi - 8], edx
mov edx, dword [eax + 0x1c]
movzx edi, byte [eax + 0x1f]
movzx edi, byte [edi + 0x9f2198]
and edx, 0xff
movzx edx, byte [edx + 0x9f2198]
mov edx, dword [edx*4 + 0x9f2ec0]
xor edx, dword [edi*4 + 0x9f2298]
movzx edi, byte [eax + 0x1e]
movzx edi, byte [edi + 0x9f2198]
xor edx, dword [edi*4 + 0x9f2698]
movzx edi, byte [eax + 0x1d]
movzx edi, byte [edi + 0x9f2198]
xor edx, dword [edi*4 + 0x9f2ac0]
mov dword [esi - 4], edx
test ecx, ecx
jg 0x532ab2
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
xor eax, eax
mov ecx, dword [esp + 0x124]
pop edi
pop esi
xor ecx, esp
call fcn.0065865c
mov esp, ebp
pop ebp
ret
Function at 0x533690
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
cmp dword [esp + 0x28], 0
push ebx
push ebp
push esi
mov esi, eax
mov eax, dword [esp + 0x38]
jne 0x53375e
test edx, edx
jle 0x533820
mov ebx, eax
mov eax, edi
sub eax, esi
mov dword [esp + 0x34], eax
lea eax, [edx - 1]
shr eax, 4
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0xc]
push esi
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], eax
push 0
push ecx
mov eax, ebx
mov dword [esp + 0x30], edx
call fcn.00532c30
mov eax, esi
add esp, 0xc
lea ebp, [edi + 2]
mov esi, 4
jmp 0x533700
mov edx, dword [esp + 0x34]
movzx ecx, byte [edx + eax]
xor byte [eax], cl
movzx edx, byte [ebp - 1]
xor byte [eax + 1], dl
movzx ecx, byte [ebp]
xor byte [eax + 2], cl
movzx edx, byte [ebp + 1]
xor byte [eax + 3], dl
add eax, 4
add ebp, 4
dec esi
jne 0x533700
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sub dword [esp + 0x34], 0x10
mov dword [edi], ecx
mov ecx, dword [esp + 0x24]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x28]
add ebx, 0x10
dec dword [esp + 0x10]
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov esi, eax
jne 0x5336c4
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
test edx, edx
jle 0x533820
mov ecx, edi
sub ecx, esi
mov dword [esp + 0x10], ecx
mov ecx, edi
sub ecx, eax
mov dword [esp + 0xc], ecx
lea ecx, [edx - 1]
shr ecx, 4
inc ecx
mov dword [esp + 0x18], ecx
mov edx, esi
lea ebp, [edi + 3]
lea ecx, [esi + 1]
sub edx, eax
mov dword [esp + 0x14], 4
mov ebx, dword [esp + 0xc]
movzx ebx, byte [eax + ebx]
xor bl, byte [eax]
add eax, 4
mov byte [edx + eax - 4], bl
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ecx + ebx]
xor bl, byte [eax - 3]
add ecx, 4
mov byte [ecx - 4], bl
movzx ebx, byte [eax - 2]
xor bl, byte [ebp - 1]
add ebp, 4
mov byte [ecx - 3], bl
movzx ebx, byte [eax - 1]
xor bl, byte [ebp - 4]
dec dword [esp + 0x14]
mov byte [ecx - 2], bl
jne 0x533793
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push esi
push eax
push ecx
mov eax, esi
call fcn.00532c30
mov edx, dword [esi]
mov dword [edi], edx
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x44]
mov dword [edi + 8], ecx
mov edx, dword [esi + 0xc]
mov ecx, 0x10
sub dword [esp + 0x18], ecx
sub dword [esp + 0x1c], ecx
add eax, ecx
add esp, 0xc
add esi, ecx
dec dword [esp + 0x18]
mov dword [edi + 0xc], edx
mov dword [esp + 0x38], eax
jne 0x533781
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x534c70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push edi
mov edi, edx
test ecx, ecx
je 0x534ccc
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
sub ebp, edi
mov dword [esp + 0x10], ecx
mov ecx, dword [eax]
mov esi, dword [eax + 4]
inc ecx
and ecx, 0xff
movzx edx, byte [ecx + eax + 8]
add esi, edx
and esi, 0xff
movzx ebx, byte [esi + eax + 8]
mov dword [eax], ecx
mov dword [eax + 4], esi
mov byte [esi + eax + 8], dl
mov byte [ecx + eax + 8], bl
add ebx, edx
and ebx, 0xff
mov cl, byte [ebx + eax + 8]
xor cl, byte [edi + ebp]
inc edi
dec dword [esp + 0x10]
mov byte [edi - 1], cl
jne 0x534c85
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
Function at 0x53bcd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
fld dword [esi + 0x58]
push ebx
fstp dword [esp + 8]
push ebp
fld dword [esp + 0xc]
xor ebx, ebx
push edi
fst dword [esi + 0x70]
mov edi, dword [esi + 0x54]
mov edx, 1
mov dword [esi + 0x64], edx
mov dword [esi + 0x6c], ebx
fld dword [edi]
fcompp
fnstsw ax
test ah, 0x41
jp 0x53bd3d
mov ebp, dword [esi + 0x5c]
xor ecx, ecx
fld dword [esi + 0x70]
xor eax, eax
cmp edx, ebx
sete al
inc ecx
mov edx, eax
mov dword [esi + 0x64], edx
fsub dword [edi + ecx*4 - 4]
mov dword [esi + 0x6c], ecx
fstp dword [esi + 0x70]
cmp ecx, ebp
jne 0x53bd27
xor ecx, ecx
mov dword [esi + 0x6c], ebx
mov eax, dword [esi + 0x6c]
fld dword [esi + 0x70]
mov ebx, edi
fld dword [ebx + eax*4]
xor ebx, ebx
fcompp
fnstsw ax
test ah, 0x41
jnp 0x53bd04
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], edx
cmp dword [esi + 0x64], ebx
je 0x53bd8b
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x68]
push eax
push ecx
mov eax, esi
call fcn.0053b4c0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
add esp, 8
mov dword [esi + 0x68], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x38], 1
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x53ed60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x20]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1b8]
mov dword [esp + 0x18], esi
jne 0x53ed87
mov dword [esp + 8], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x53ed93
mov dword [esp + 8], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [edi + 0x64]
mov edx, dword [esp + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push edi
call eax
xor ecx, ecx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [esp + 0xc], ecx
cmp dword [edi + 0x64], ecx
jle 0x53eea5
push ebx
push ebp
jmp 0x53eddc
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x20]
mov edi, dword [esi + ecx*4 + 0x20]
cdq
idiv edi
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
je 0x53edff
mov edx, dword [esi + 0x18]
add dword [edx + ecx*4], 0xff
lea eax, [edx + ecx*4]
mov eax, dword [esi + 0x18]
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi + edi - 2]
cdq
idiv ecx
xor ebx, ebx
xor ecx, ecx
mov esi, eax
cmp ecx, esi
jle 0x53ee4e
mov edx, ebx
imul edx, edx, 0x1fe
lea edi, [edx + edi + 0xfe]
jmp 0x53ee30
mov esi, dword [esp + 0x18]
add edi, 0x1fe
mov eax, edi
cdq
lea esi, [esi + esi - 2]
idiv esi
inc ebx
mov esi, eax
cmp ecx, esi
jg 0x53ee30
mov edi, dword [esp + 0x18]
mov al, byte [esp + 0x1c]
imul bl
mov byte [ecx + ebp], al
inc ecx
cmp ecx, 0xff
jle 0x53ee18
cmp dword [esp + 0x10], 0
je 0x53ee8d
mov eax, 1
lea ecx, [ebp - 1]
nop
movzx edx, byte [ebp]
mov byte [ecx], dl
movzx edx, byte [ebp + 0xff]
mov byte [eax + ebp + 0xff], dl
inc eax
dec ecx
cmp eax, 0xff
jle 0x53ee70
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [ecx + 0x64]
jl 0x53edd0
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x572720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
mov eax, 1
shl eax, cl
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov ecx, eax
sar ecx, 1
or ecx, eax
mov dword [esp + 8], ecx
cmp dword [edi + 0x14], ebx
jbe 0x5728ca
push ebp
push esi
xor edx, edx
mov dword [esp + 0x14], edx
cmp dword [edi + 0x10], edx
jbe 0x5728b8
lea ecx, [ebx + 4]
mov eax, ebx
cmp ebx, ecx
jae 0x5728aa
mov esi, dword [edi + 0x14]
cmp eax, esi
jae 0x5728aa
dec ecx
cmp eax, ecx
je 0x57277b
dec esi
cmp eax, esi
je 0x57277b
xor ecx, ecx
jmp 0x572780
mov ecx, 1
mov esi, dword [edi + 0x10]
mov ebx, dword [edi + 8]
imul esi, eax
mov ebp, dword [edi]
add esi, edx
lea esi, [ebx + esi*4]
mov ebx, dword [edi + 0xc]
mov dword [esp + 0x18], esi
mov esi, dword [edi + 0x20]
inc eax
imul esi, eax
add esi, edx
lea esi, [ebx + esi*2 + 2]
movsx ebx, word [esi]
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x5727b5
and ebx, 0xfffffbb9
mov ecx, ebx
and ecx, 0xff
je 0x572897
test ebx, 0x5000
jne 0x572897
mov eax, dword [esp + 0x24]
shl eax, 8
or eax, ecx
movzx ecx, byte [eax + 0x9c6c98]
lea edx, [ebp + ecx*4 + 0x18]
mov ecx, ebp
mov dword [ebp + 0x64], edx
call fcn.0057d970
test eax, eax
je 0x572887
shr ebx, 4
and ebx, 0xff
movzx eax, byte [ebx + 0x9c7098]
lea ecx, [ebp + eax*4 + 0x18]
mov dword [ebp + 0x64], ecx
mov bl, byte [ebx + 0x9c7198]
mov ecx, ebp
call fcn.0057d970
mov ecx, dword [esp + 0x10]
movzx edx, bl
xor eax, edx
je 0x572826
neg ecx
mov edx, dword [esp + 0x18]
mov dword [edx], ecx
mov ecx, dword [edi + 0x20]
lea edx, [ecx + ecx]
mov ecx, esi
sub ecx, edx
or word [ecx - 2], 2
mov bx, word [eax*2 + 0x6ba9d0]
or word [ecx], bx
or word [ecx + 2], 4
movzx ecx, word [eax*2 + 0x6ba9d4]
or word [esi - 2], cx
mov ecx, 0x1000
or word [esi], cx
movzx ecx, word [eax*2 + 0x6ba9d8]
or word [esi + 2], cx
or word [edx + esi - 2], 1
mov ax, word [eax*2 + 0x6ba9dc]
or word [edx + esi], ax
or word [edx + esi + 2], 8
lea eax, [edx + esi + 2]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ecx, 0x4000
or word [esi], cx
mov ecx, dword [esp + 0xc]
mov ebx, dword [esp + 0xc]
add ecx, 4
cmp eax, ecx
jb 0x572762
inc edx
mov dword [esp + 0x14], edx
cmp edx, dword [edi + 0x10]
jb 0x572755
add ebx, 4
mov dword [esp + 0xc], ebx
cmp ebx, dword [edi + 0x14]
jb 0x572746
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x575420
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esi + 8]
mov ebx, dword [esi]
push edi
mov edi, eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x575470
mov ecx, dword [esi + 0xc]
cmp ecx, eax
jl 0x575470
mov eax, dword [esi + 0x18]
push ecx
push str.end_of_Jbig2WordStream_reached_at_offset__d
push 0xffffffffffffffff
push 3
push eax
call fcn.005632b0
add esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x575462
mov dword [eax], 0xffffffff
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
mov eax, dword [edi]
test eax, eax
jle 0x575483
mov ecx, 0x20
sub ecx, eax
mov eax, ebx
shr eax, cl
jmp 0x575485
xor eax, eax
mov ecx, dword [edi + 4]
movzx edx, byte [ecx + eax*8 + 4]
lea edi, [ecx + eax*8]
mov al, byte [edi + 6]
mov dword [esp + 0x14], edi
mov byte [esp + 0x13], al
cmp al, 0xff
jne 0x5754ac
cmp edx, 0xff
jne 0x5754ac
cmp dword [edi], 0xffffffff
je 0x575454
mov eax, dword [esi + 4]
add ebp, edx
cmp ebp, 0x20
jl 0x5754fd
add dword [esi + 0xc], 4
mov edi, dword [esi + 0xc]
lea edx, [esp + 0x18]
push edx
mov ebx, eax
mov eax, dword [esi + 0x14]
add edi, 4
push edi
mov dword [esp + 0x20], 0
push eax
mov eax, dword [eax]
call eax
add esp, 0xc
test eax, eax
je 0x5754ed
mov eax, dword [esi + 0x10]
test eax, eax
je 0x5754ea
cmp edi, eax
jge 0x5754ed
mov dword [esi + 0x10], edi
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
sub ebp, 0x20
mov dword [esi + 4], eax
mov edx, ebp
test edx, edx
je 0x575516
mov ecx, 0x20
sub ecx, ebp
mov edi, eax
shr edi, cl
mov ecx, edx
shl ebx, cl
or ebx, edi
mov edi, dword [esp + 0x14]
test byte [esp + 0x13], 4
je 0x575524
mov edi, dword [edi]
jmp 0x575470
mov ecx, dword [edi]
movzx edi, byte [edi + 5]
mov dword [esp + 0x14], ecx
test edi, edi
jle 0x575581
mov ecx, 0x20
sub ecx, edi
mov edx, ebx
shr edx, cl
test byte [esp + 0x13], 2
je 0x57554a
sub dword [esp + 0x14], edx
jmp 0x57554e
add dword [esp + 0x14], edx
add ebp, edi
cmp ebp, 0x20
jl 0x57556e
add dword [esi + 0xc], 4
mov edi, dword [esi + 0xc]
lea edi, [edi + 4]
mov ebx, eax
call fcn.00575110
sub ebp, 0x20
mov dword [esi + 4], eax
mov edi, ebp
test edi, edi
je 0x575581
mov ecx, 0x20
sub ecx, ebp
shr eax, cl
mov ecx, edi
shl ebx, cl
or ebx, eax
mov eax, dword [esp + 0x20]
mov dword [esi], ebx
mov dword [esi + 8], ebp
test eax, eax
je 0x575598
movzx edx, byte [esp + 0x13]
and edx, 1
mov dword [eax], edx
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x57f340
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x28
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x24], eax
cmp dword [0x9f563c], 0
jne 0x57f421
push ebx
mov ecx, str.unrar.dll
call fcn.004557d0
mov ebx, eax
test ebx, ebx
je 0x57f385
lea eax, [esp + 4]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x57f385
test byte [esp + 4], 0x10
je 0x57f3a4
push ebx
call fcn.00658a01
mov eax, dword [esp + 0x34]
add esp, 4
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0065865c
add esp, 0x28
ret 4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
jne 0x57f3bd
push ebx
call fcn.00658a01
add esp, 4
jmp 0x57f41f
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RAROpenArchiveEx
push esi
call edi
mov dword [0x9f562c], eax
test eax, eax
je 0x57f415
push str.RARReadHeaderEx
push esi
call edi
mov dword [0x9f5630], eax
test eax, eax
je 0x57f415
push str.RARProcessFile
push esi
call edi
mov dword [0x9f5634], eax
test eax, eax
je 0x57f415
push str.RARCloseArchive
push esi
call edi
mov dword [0x9f5638], eax
test eax, eax
je 0x57f415
push str.RARGetDllVersion
push esi
call edi
mov dword [0x9f563c], eax
push ebx
call fcn.00658a01
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
xor ecx, esp
call fcn.0065865c
add esp, 0x28
ret 4
Function at 0x585180
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x28
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x14]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 4]
push ebp
push 0x15
lea ecx, [esp + 0x10]
push ecx
push edx
call eax
add esp, 0xc
cmp eax, 0x15
je 0x5851bc
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0065865c
add esp, 0x28
ret
movzx ecx, byte [esp + 0xf]
movzx edx, byte [esp + 0xe]
movzx eax, byte [esp + 0xd]
shl ecx, 8
or ecx, edx
movzx edx, byte [esp + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x10]
shl ecx, 8
or ecx, edx
movzx edx, byte [esp + 0x13]
mov dword [esi], ecx
movzx ecx, byte [esp + 0x14]
mov byte [esi + 8], al
movzx eax, byte [esp + 0x12]
shl ecx, 8
or ecx, edx
movzx edx, byte [esp + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x18]
shl ecx, 8
or ecx, edx
movzx edx, byte [esp + 0x16]
shl eax, 8
mov dword [esi + 0xc], ecx
movzx ecx, byte [esp + 0x17]
or eax, ecx
movzx ecx, byte [esp + 0x15]
shl eax, 8
or eax, edx
mov dl, byte [esp + 0x19]
shl eax, 8
or eax, ecx
movzx ecx, byte [esp + 0x1c]
mov dword [esi + 0x10], eax
movzx eax, byte [esp + 0x1a]
mov byte [esi + 0x14], dl
movzx edx, byte [esp + 0x1b]
mov byte [esi + 0x15], al
movzx eax, byte [esp + 0x20]
shl cx, 8
or cx, dx
movzx edx, byte [esp + 0x1e]
mov word [esi + 0x16], cx
movzx ecx, byte [esp + 0x1f]
shl eax, 8
or eax, ecx
movzx ecx, byte [esp + 0x1d]
shl eax, 8
or eax, edx
shl eax, 8
xor ebp, ebp
or eax, ecx
mov edx, 0x100
mov dword [esi + 4], ebp
mov dword [esi + 0x18], eax
test word [ebx + 4], dx
je 0x5852ff
mov eax, dword [edi + 0x14]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 4]
push 8
lea ecx, [esp + 8]
push ecx
push edx
call eax
add esp, 0xc
cmp eax, 8
jne 0x5851aa
movzx ecx, byte [esp + 7]
movzx edx, byte [esp + 6]
movzx eax, byte [esp + 5]
shl ecx, 8
or ecx, edx
movzx edx, byte [esp + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0xb]
shl ecx, 8
or ecx, edx
add dword [ebx + 8], ecx
movzx ecx, byte [esp + 0xa]
adc dword [ebx + 0xc], ebp
movzx edx, byte [esp + 9]
shl eax, 8
or eax, ecx
movzx ecx, byte [esp + 8]
shl eax, 8
or eax, edx
shl eax, 8
or eax, ecx
add dword [esi], eax
adc dword [esi + 4], ebp
movzx eax, word [esi + 0x16]
mov ecx, dword [edi + 0x14]
cdq
push 1
push edx
mov edx, dword [ecx + 0x10]
push eax
mov eax, dword [ecx + 8]
push edx
call eax
add esp, 0x10
test eax, eax
je 0x5851aa
mov ecx, 0x400
test word [ebx + 4], cx
je 0x58533e
mov eax, dword [edi + 0x14]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 8]
push 1
push ebp
push 8
push edx
call eax
add esp, 0x10
mov cl, byte [esi + 0x14]
mov byte [edi + 0x4c], cl
mov dl, byte [esi + 0x15]
mov byte [edi + 0x4d], dl
mov eax, dword [esi + 0xc]
mov dword [edi + 0x50], eax
mov cx, word [ebx + 6]
mov word [edi + 0x54], cx
cmp byte [esi + 0x14], 0x14
jae 0x585367
movzx eax, word [edi + 0x48]
and eax, 8
jmp 0x58536e
movzx eax, word [ebx + 4]
and eax, 0x10
mov edx, dword [edi + 0x5c]
push edx
mov dword [edi + 0x58], eax
call fcn.00658a01
mov ecx, dword [esp + 0x28]
add esp, 4
mov dword [edi + 0x5c], ebp
pop ebp
xor ecx, esp
mov eax, 1
call fcn.0065865c
add esp, 0x28
ret
Function at 0x58dfe0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6846d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x9c48d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor eax, eax
mov dword [esi + 4], eax
mov edi, dword [esp + 0x20]
mov dword [esi], 0x690ac4
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
or ecx, 0xffffffff
mov dword [esi + 0x10], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov edx, dword [edi + 0x30]
mov dword [esi + 0x30], edx
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.0058dc00
mov eax, dword [edi + 0xc]
mov edx, dword [edi + 0x18]
mov ecx, dword [esi + 0xc]
sub edx, eax
push edx
mov edx, dword [edi + 0x14]
sub edx, eax
mov eax, dword [edi + 8]
push edx
mov edx, dword [esi + 0x18]
push eax
mov eax, dword [esi + 0x14]
sub edx, ecx
push edx
mov edx, dword [edi + 0x2c]
sub eax, ecx
mov ecx, dword [esi + 8]
push eax
push ecx
call edx
add esp, 0x18
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x58e5f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6847ce
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x9c48d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x690b18
mov edi, dword [esi + 0x30]
mov dword [esp + 0x18], 2
mov dword [esi + 0x30], 0
test edi, edi
je 0x58e64c
lea eax, [edi + 4]
push eax
call fcn.0058e4a0
add esp, 4
test eax, eax
jne 0x58e64c
mov ecx, edi
call fcn.005c1030
lea ecx, [esi + 0x28]
mov byte [esp + 0x18], 1
call fcn.005c10a0
mov edi, dword [esi + 0x20]
mov byte [esp + 0x18], 0
mov dword [esi + 0x20], 0
test edi, edi
je 0x58e683
lea ecx, [edi + 4]
push ecx
call fcn.0058e4a0
add esp, 4
test eax, eax
jne 0x58e683
mov ecx, edi
call fcn.005c1030
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.005911a0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x591800
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x684b08
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x9c48d0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c]
mov edx, eax
shr edx, 0x10
mov byte [esp + 0x2c], dl
mov edx, eax
mov byte [esp + 0x2e], al
push 3
lea eax, [esp + 0x30]
shr edx, 8
push eax
mov byte [esp + 0x35], dl
call fcn.00591600
cmp eax, 3
je 0x591898
call fcn.0065a209
mov ecx, dword [eax]
push 0
push 0
push 0x211
push str..extlibdjvuByteStream.cpp
push ecx
call fcn.0065b783
add esp, 4
push eax
lea ecx, [esp + 0x18]
call fcn.005bb2d0
push eax
mov dword [esp + 0x28], 0
call fcn.005bb4a0
add esp, 4
lea ecx, [esp + 4]
mov dword [esp + 0x24], 0xffffffff
call fcn.005bb350
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
add esp, 0x24
ret 4

Function at 0x5918b0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x684b08
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x9c48d0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c]
mov edx, eax
shr edx, 0x18
mov byte [esp + 0x2c], dl
mov edx, eax
shr edx, 0x10
mov byte [esp + 0x2d], dl
mov edx, eax
mov byte [esp + 0x2f], al
push 4
lea eax, [esp + 0x30]
shr edx, 8
push eax
mov byte [esp + 0x36], dl
call fcn.00591600
cmp eax, 4
je 0x591951
call fcn.0065a209
mov ecx, dword [eax]
push 0
push 0
push 0x21d
push str..extlibdjvuByteStream.cpp
push ecx
call fcn.0065b783
add esp, 4
push eax
lea ecx, [esp + 0x18]
call fcn.005bb2d0
push eax
mov dword [esp + 0x28], 0
call fcn.005bb4a0
add esp, 4
lea ecx, [esp + 4]
mov dword [esp + 0x24], 0xffffffff
call fcn.005bb350
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
add esp, 0x24
ret 4

Function at 0x592b70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x684d60
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x9c48d0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x34]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], eax
call fcn.005c5ad0
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0
call fcn.005c5a10
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
call fcn.005935f0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x30]
call fcn.00592480
lea ecx, [esp + 0x14]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.005935f0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret