joyce8/EMBER2024-capa huggingface dataset:
Function at 0x580900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x1c]
sub esp, 0x54
push ebx
push ebp
push esi
xor ebx, ebx
mov esi, ecx
cmp eax, ebx
mov eax, dword [esi + 0x338]
push edi
jne 0x580ace
cmp eax, ebx
mov dword [esp + 0x80], ebx
jle 0x580b15
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x78]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov eax, dword [esi + 0x334]
lea ecx, [ebx + eax]
mov eax, dword [ecx + 0x124]
test eax, eax
jne 0x580992
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
push edx
mov edx, dword [esp + 0x6c]
push eax
push edx
add ecx, 0x104
call fcn.005e29a0
jmp 0x580a8b
cmp eax, 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
jne 0x5809b7
mov edx, dword [ecx + 0x114]
jmp 0x5809c4
mov edi, dword [ecx + 0x114]
lea edx, [eax + eax*2 - 6]
lea edx, [edi + edx*4]
mov edi, dword [edx]
mov dword [esp + 0x10], edi
mov edi, dword [edx + 4]
mov dword [esp + 0x14], edi
mov edx, dword [edx + 8]
mov dword [esp + 0x18], edx
mov ecx, dword [ecx + 0x114]
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4 - 0xc]
mov eax, dword [edx]
mov dword [esp + 0x58], eax
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x5c], ecx
mov edx, dword [edx + 8]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x44], eax
mov dword [esp + 0x50], ebp
mov dword [esp + 0x40], edx
mov dword [esp + 0x48], ecx
xor eax, eax
jmp 0x580a30
lea edi, [eax + 1]
mov dword [esp + 0x74], edi
fild dword [esp + 0x74]
push ecx
lea edx, [esp + 0x44]
lea eax, [esp + 0x50]
fmul dword [0x6654b4]
lea ecx, [esp + 0x5c]
fstp dword [esp]
push edx
push eax
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.004f7b28
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x334]
push edx
push eax
lea ecx, [ebx + ecx + 0x104]
call fcn.005e29a0
mov eax, edi
cmp eax, 0x14
jl 0x580a30
mov edx, dword [esi + 0x334]
push 1
push 0
lea ecx, [ebx + edx + 0x104]
call fcn.005e2ed0
mov eax, dword [esp + 0x80]
mov ecx, dword [esi + 0x338]
inc eax
add ebx, 0x1d0
cmp eax, ecx
mov dword [esp + 0x80], eax
jl 0x580960
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 0x1c
xor ebp, ebp
cmp eax, ebx
jle 0x580b15
jmp 0x580ae0
mov eax, dword [esi + 0x334]
add eax, ebx
lea edi, [eax + 0x104]
test edi, edi
je 0x580b04
fld dword [eax + 0x1c4]
call fcn.0061672c
mov byte [edi + 0x6c], 1
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x338]
inc ebp
add ebx, 0x1d0
cmp ebp, eax
jl 0x580ae0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 0x1c
Function at 0x592eb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x64983b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], 0x6658fc
push edi
mov dword [esp + 0x14], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x40], ebx
mov byte [esi + 4], bl
mov edi, dword [0xdb7570]
mov ecx, dword [edi + 4]
lea eax, [esp + 0x10]
push eax
push ecx
push edi
mov ecx, 0xdb756c
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], esi
call fcn.004c3800
push 1
mov ecx, 0xdb756c
mov ebp, eax
call fcn.00591100
mov dword [edi + 4], ebp
mov edx, dword [ebp + 4]
mov dword [edx], ebp
mov eax, dword [0xdb7570]
mov ecx, dword [eax + 4]
mov dword [esi + 0x40], ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
pop edi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], 0x3f800000
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x5a57a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x64a0bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
mov ecx, edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x665d54
call fcn.00468ea0
xor ebx, ebx
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x8c]
mov ecx, edi
mov dword [esp + 0x18], ebx
call fcn.005f3300
mov dword [edi + 4], eax
mov cl, 1
mov byte [eax + 0x15], cl
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
or eax, 0xffffffff
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov eax, 0x3f800000
mov dword [esi + 0x84], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x60], ebx
mov byte [esi + 0xa9], bl
mov byte [esi + 0x88], bl
mov byte [esi + 0x30], bl
mov byte [esi + 0x89], cl
mov ecx, dword [esp + 0x10]
mov byte [esi + 0xa8], bl
pop edi
mov dword [esi + 0x18], 0x21
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5b1c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x78
push ebx
mov ebx, ecx
lea eax, [ebx + 0x40]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x24], edx
fld dword [esp + 0x24]
fsub dword [0x665de4]
push ebp
mov dword [esp + 0x2c], eax
mov al, byte [esp + 0x84]
test al, al
fstp dword [esp + 0x28]
push esi
push edi
mov dword [esp + 0x2c], ecx
je 0x5b1e18
mov ecx, dword [0xb223f8]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0x10], eax
jle 0x5b1e18
mov edi, dword [0xb223f4]
mov ebp, 0xf0
nop
mov al, byte [edi + ebp + 0xc9]
test al, al
jne 0x5b1dfb
mov al, byte [edi + ebp + 0xc1]
test al, al
je 0x5b1dfb
mov eax, dword [edi + ebp + 4]
fld dword [esp + 0x2c]
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
mov dword [esp + 0x20], ecx
fsub dword [esp + 0x20]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
fstp dword [esp + 0x38]
mov ecx, dword [esp + 0x38]
fld dword [esp + 0x30]
mov dword [esp + 0x14], ecx
fsub dword [esp + 0x24]
fstp dword [esp + 0x3c]
mov edx, dword [esp + 0x3c]
fld dword [esp + 0x34]
mov dword [esp + 0x18], edx
fsub dword [esp + 0x28]
fstp dword [esp + 0x40]
mov esi, dword [esp + 0x40]
mov dword [esp + 0x1c], esi
fld dword [esp + 0x1c]
fmul dword [esp + 0x1c]
fld dword [esp + 0x18]
fmul dword [esp + 0x18]
faddp st(1)
fld dword [esp + 0x14]
fmul dword [esp + 0x14]
faddp st(1)
fsqrt
fld dword [ebx + 0x4c]
fadd st(0), st(0)
fld st(1)
fcompp
fnstsw ax
test ah, 5
jp 0x5b1df9
fsub dword [ebx + 0x4c]
mov dword [esp + 0x6c], ecx
lea ecx, [esp + 0x6c]
mov dword [esp + 0x70], edx
fadd dword [0x6582cc]
mov dword [esp + 0x74], esi
fstp dword [esp + 0x5c]
call fcn.004181c0
fld dword [esp + 0x6c]
sub esp, 0x2c
fmul dword [ebx + 0x4c]
mov edi, esp
fld dword [esp + 0x9c]
lea esi, [esp + 0x88]
fmul dword [ebx + 0x4c]
mov dword [esp + 0xb0], 1
fld dword [esp + 0xa0]
fmul dword [ebx + 0x4c]
fstp dword [esp + 0x84]
fxch st(1)
fadd dword [esp + 0x4c]
fstp dword [esp + 0x70]
mov ecx, dword [esp + 0x70]
mov dword [esp + 0xa4], ecx
fadd dword [esp + 0x50]
mov ecx, 0xb
fstp dword [esp + 0x74]
mov edx, dword [esp + 0x74]
fld dword [esp + 0x84]
mov dword [esp + 0xa8], edx
fadd dword [esp + 0x54]
fstp dword [esp + 0x78]
mov eax, dword [esp + 0x78]
mov dword [esp + 0xac], eax
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x28]
call fcn.005a9f30
mov edi, dword [0xb223f4]
jmp 0x5b1dfb
fstp st(0)
mov eax, dword [esp + 0x10]
mov ecx, dword [0xb223f8]
inc eax
add ebp, 0xf0
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x5b1ca0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x78
ret 4
Function at 0x5ce2f3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
push esi
mov esi, ecx
mov ecx, dword [0xb1a124]
lea eax, [esp + 0x20]
push eax
add ecx, 0x220
call fcn.0057772c
mov eax, dword [esi + 0x1f5f4]
test eax, eax
je 0x5ce518
mov ecx, dword [eax + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x78]
push edi
xor edi, edi
test ecx, ecx
jle 0x5ce476
xor ebx, ebx
mov ecx, dword [eax + 0xc]
mov ecx, dword [ebx + ecx + 0x34]
sub ecx, 3
je 0x5ce36c
dec ecx
je 0x5ce359
dec ecx
jne 0x5ce45e
mov edx, dword [esi + 0x1e068]
mov ecx, dword [edx + edi*4]
call fcn.0060e020
jmp 0x5ce45e
mov eax, dword [esi + 0x1e068]
mov ecx, dword [eax + edi*4]
call fcn.0060a6a0
jmp 0x5ce45e
mov ecx, dword [eax + 0xc]
mov eax, dword [ebx + ecx + 0x124]
test eax, eax
je 0x5ce3ec
mov ecx, dword [0xb1a124]
lea edx, [esp + 0x20]
push edx
add ecx, 0x220
call fcn.0057772c
fild dword [0x68d1ec]
mov eax, dword [esi + 0x1f5f4]
mov ecx, dword [eax + 0xc]
fdivr dword [0x64fe64]
lea eax, [ecx + ebx]
mov dword [esp + 0x10], eax
fld st(0)
fmul dword [eax + 0x38]
call fcn.0061672c
fld dword [esp + 0x20]
fmul st(1)
mov ebp, eax
call fcn.0061672c
cmp eax, ebp
jne 0x5ce458
mov edx, dword [esp + 0x10]
fld st(0)
fmul dword [edx + 0x40]
call fcn.0061672c
fmul dword [esp + 0x28]
mov ebp, eax
call fcn.0061672c
cmp eax, ebp
mov ebp, dword [esp + 0x7c]
jne 0x5ce45e
mov eax, dword [esi + 0x1f5f4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + ebx + 0x38]
lea eax, [ecx + ebx]
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 0x40]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x1c], edx
call fcn.005770ff
mov eax, dword [ebp]
lea ecx, [esp + 0x38]
push ecx
push pe_nt_image_headers32
push ebp
call dword [eax + 0x94]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esi + 0x1e068]
push eax
push ecx
mov ecx, dword [edx + edi*4]
call fcn.0060ea10
mov eax, dword [esi + 0x1e068]
mov ecx, dword [eax + edi*4]
call fcn.005bb160
jmp 0x5ce45e
mov ebp, dword [esp + 0x7c]
fstp st(0)
mov eax, dword [esi + 0x1f5f4]
mov ecx, dword [eax + 0x10]
inc edi
add ebx, 0x198
cmp edi, ecx
jl 0x5ce330
mov eax, dword [esi + 0x1f5f4]
mov ecx, dword [eax + 0x10]
xor edi, edi
test ecx, ecx
jle 0x5ce515
xor ebx, ebx
jmp 0x5ce490
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + ebx + 0x34]
dec eax
je 0x5ce4ce
dec eax
jne 0x5ce4fd
fld dword [0xb1a1f4]
fcom dword [0x65f1b0]
fnstsw ax
test ah, 0x41
jp 0x5ce4fb
fcomp dword [0x64fe7c]
fnstsw ax
test ah, 1
jne 0x5ce4fd
mov edx, dword [esi + 0x1e068]
mov ecx, dword [edx + edi*4]
push ebp
call fcn.0060a360
jmp 0x5ce4fd
lea ecx, [esp + 0x38]
call fcn.005770ff
mov eax, dword [ebp]
lea ecx, [esp + 0x38]
push ecx
push pe_nt_image_headers32
push ebp
call dword [eax + 0x94]
mov edx, dword [esi + 0x1e068]
mov ecx, dword [edx + edi*4]
call fcn.0060fda0
jmp 0x5ce4fd
fstp st(0)
mov eax, dword [esi + 0x1f5f4]
mov ecx, dword [eax + 0x10]
inc edi
add ebx, 0x198
cmp edi, ecx
jl 0x5ce490
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x68
ret 4
Function at 0x5dccc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x10]
call fcn.005dad40
lea ecx, [esi + 0x2160]
call fcn.00610c90
lea ecx, [esi + 0x2efc]
call fcn.0060e660
lea ecx, [esi + 0x32f4]
pop esi
jmp 0x612920
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov eax, dword [0x688d20]
push eax
push eax
lea ecx, [esi + 0x66c]
call fcn.005bc7ed
mov ecx, ebx
lea eax, [esi + 0x51c]
mov dword [eax], ecx
mov dword [esp + 0x2c], 0x47c35000
mov edx, dword [esp + 0x2c]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
or edx, 0xffffffff
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
mov dword [esi + 0x52c], ebx
mov dword [esi + 0x528], edx
mov dword [esi + 0x530], ebx
mov dword [esi + 0x534], ebx
mov dword [esp + 0x10], ebx
lea eax, [esi + 0x540]
mov ecx, 0xb
mov edi, 0x461c4000
jmp 0x6129b0
fild dword [esp + 0x10]
mov ebp, dword [esp + 0x10]
mov dword [eax - 4], edi
mov dword [eax + 4], edx
fmul dword [0x6662f4]
mov dword [eax + 8], ebx
inc ebp
add eax, 0x1c
dec ecx
fld st(0)
fsin
mov dword [esp + 0x10], ebp
fld dword [0x666d70]
fmul st(1)
fstp dword [eax - 0x24]
fxch st(1)
fcos
fst dword [esp + 0x14]
fmul dword [0x666d70]
fstp dword [eax - 0x1c]
fmul dword [str.333__n]
fstp dword [eax - 0x10]
fld dword [esp + 0x14]
fmul dword [str.333__n]
fstp dword [eax - 0xc]
jne 0x6129b0
add esi, 0xbc
mov edi, 0x20
mov dword [esp + 0x20], esi
mov ebp, 4
lea esp, [esp]
push ebx
push 1
push 0x1a
push edi
push edi
mov ecx, esi
call fcn.00573f6a
add edi, edi
add esi, 0x118
dec ebp
jne 0x612a20
mov esi, dword [esp + 0x20]
mov ebp, 0x20
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 4
mov edi, edi
mov ecx, esi
call fcn.00574105
cmp ebp, ebx
jle 0x612b19
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebp
jmp 0x612a70
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov ebx, ebp
lea ebx, [ebx]
mov eax, esi
shl eax, 0xd
xor eax, esi
mov edx, eax
imul edx, eax
imul edx, edx, 0x3d73
add edx, 0xc0ae5
imul edx, eax
sub edx, 0x2df722f3
and edx, 0x7fffffff
mov dword [esp + 0x24], edx
fild dword [esp + 0x24]
fmul dword [0x666d78]
fsubr dword [0x64fe64]
fadd dword [0x64fe64]
fmul dword [0x658038]
call fcn.0061672c
movzx cx, al
or al, 0xf0
movzx ax, al
add edi, 2
shl eax, 4
or eax, ecx
shl eax, 4
or eax, ecx
mov word [edi - 2], ax
inc esi
dec ebx
jne 0x612a80
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [ebp + ebp]
add ecx, eax
mov eax, dword [esp + 0x18]
add edx, 0x39
dec eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
jne 0x612a70
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov ecx, esi
call fcn.00574123
mov eax, dword [esp + 0x20]
add esi, 0x118
add ebp, ebp
dec eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], eax
jne 0x612a50
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x5e1b50
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x74]
test eax, eax
push edi
mov edi, dword [sym.imp.kernel32.dll_CreateThread]
jne 0x5e1b76
lea eax, [esi + 0x6c]
push eax
push 0
push esi
push 0x5e1b30
push 0
push 0
call edi
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0x78]
test eax, eax
jne 0x5e1b92
lea ecx, [esi + 0x70]
push ecx
push 0
push esi
push 0x5e1b40
push 0
push 0
call edi
mov dword [esi + 0x78], eax
pop edi
pop esi
ret
Function at 0x5f68a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x48
cmp eax, 1
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x10], 0
jne 0x5f69fa
mov edi, dword [esp + 0x5c]
test edi, edi
jne 0x5f68da
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
add esp, 0x48
ret 0xc
mov eax, dword [ebx]
test eax, eax
je 0x5f68ef
push eax
call fcn.00616a81
add esp, 4
mov dword [ebx], 0
push 0x10000
push 0
push edi
call dword [sym.imp.winmm.dll_mmioOpenA]
test eax, eax
mov dword [ebx + 4], eax
jne 0x5f69b9
mov ebp, dword [sym.imp.kernel32.dll_FindResourceA]
push str.WAVE
push edi
push eax
call ebp
mov esi, eax
test esi, esi
jne 0x5f6930
push 0x666800
push edi
push eax
call ebp
mov esi, eax
test esi, esi
je 0x5f6a49
push esi
push 0
call dword [sym.imp.kernel32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x5f6a49
push esi
push 0
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebp, eax
test ebp, ebp
je 0x5f6a49
push edi
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x5f6a49
push ebp
call fcn.00614c96
mov dword [ebx + 8], eax
mov edi, eax
mov ecx, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add esp, 4
xor eax, eax
push 0x10000
lea edx, [esp + 0x14]
mov ecx, 0x12
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 8]
push edx
push eax
mov dword [esp + 0x20], 0x204d454d
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ecx
call dword [sym.imp.winmm.dll_mmioOpenA]
mov dword [ebx + 4], eax
mov ecx, ebx
call fcn.005f6270
test eax, eax
jge 0x5f69df
mov eax, dword [ebx + 4]
push 0
push eax
call dword [sym.imp.winmm.dll_mmioClose]
pop edi
pop esi
pop ebp
mov eax, 0x80004005
pop ebx
add esp, 0x48
ret 0xc
mov ecx, ebx
call fcn.005f6400
test eax, eax
jl 0x5f6a49
mov ecx, dword [ebx + 0x19]
pop edi
pop esi
pop ebp
mov dword [ebx + 0xc], ecx
pop ebx
add esp, 0x48
ret 0xc
mov edx, dword [esp + 0x5c]
push 0x11002
push 0
push edx
call dword [sym.imp.winmm.dll_mmioOpenA]
test eax, eax
mov dword [ebx + 4], eax
je 0x5f6a49
mov eax, dword [esp + 0x60]
push eax
mov ecx, ebx
call fcn.005f6740
test eax, eax
jge 0x5f6a3e
mov ecx, dword [ebx + 4]
push 0
push ecx
call dword [sym.imp.winmm.dll_mmioClose]
pop edi
pop esi
pop ebp
mov eax, 0x80004005
pop ebx
add esp, 0x48
ret 0xc
mov ecx, ebx
call fcn.005f6400
test eax, eax
jge 0x5f6a4e
mov eax, 0x80004005
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 0xc
Function at 0x5fad30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64b878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, dword [esi + 4]
cmp eax, edi
je 0x5fad6e
push eax
call fcn.00615a1d
add esp, 4
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov eax, dword [esi + 0x2c]
cmp eax, edi
je 0x5fad93
push eax
call fcn.00615a1d
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x5fb1a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x64b917
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, ecx
xor ecx, ecx
mov dword [eax], 0x666998
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], ecx
mov dword [eax + 0x48], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x5fb5e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x64b9cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, ecx
xor ecx, ecx
mov dword [eax], 0x6669ac
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x3c], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5fbb90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x64bbac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, ecx
xor ecx, ecx
mov dword [eax], 0x6669b8
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x3c], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x60e590
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x64c5a4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
lea ecx, [esi + 0x54]
mov dword [esp + 0x14], edi
call fcn.00573f12
lea ecx, [esi + 0x16c]
mov byte [esp + 0x14], 1
call fcn.00573f12
fld qword [esp + 0x24]
mov eax, dword [esp + 0x1c]
fstp qword [esi + 0x28]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x30], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x284], eax
mov eax, dword [esp + 0x38]
mov dword [esi], ecx
mov ecx, esi
mov byte [esp + 0x14], 2
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
call fcn.0060dba0
mov ecx, esi
call fcn.0060da70
mov ecx, esi
call fcn.0060d830
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x24