joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f1b9e63
Capabilities:
Encode data using xor

Disassembly:
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x8000000], ah
add byte [edx], cl
add byte [edi + edi*2], ch
les eax, [esi - 0x7affd700]
adc al, 0x24
pop ss
test dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x9bd7d1], ch
add byte [eax], al
add byte [eax - 0x723fd5f], ch
inc edx
dec ebp
xchg esi, eax
fcom st(1)
xlatb
wait
nop
rcl edi, 1
wait
sldt word [eax]
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax + 0x866673], ch
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, bh
rcl bh, 1
wait
add dword [eax], eax
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add dword [eax], eax
add byte [eax], al
nop
rcl edi, 1
wait
mov esp, 0x851723
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], cl
rcl bh, cl
wait
or dl, dl
xlatb
wait
adc dl, dl
xlatb
wait
adc dl, dl
xlatb
wait
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor dl, dl
xlatb
wait
xor dl, dl
xlatb
wait
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub byte [edi + 0x4f289fcb], cl
lahf
sub byte [edi + 0x24], cl
mov byte [0], al
dec esp
dec edi
and al, 0xa2
adc al, 0
adc al, 0
ror byte [edx], 0xef
xchg ebp, eax
add byte [ecx + ecx*2 + 7], ah
add byte [eax], dh
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [ecx], al
or al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], bh
add eax, dword [eax + 0x8008]
add byte [eax], al
adc al, 0
cmp al, 0
add byte [ebp + 0x10], dl
mov es, word [edx]
add byte [eax], al
add byte [eax], al
Function at 0x5f1e95c0
Capabilities:
Encode data using xor

Disassembly:
adc byte [edx], cl
add byte [eax], al
inc edx
add al, bh
or byte [esi], dl
add byte [eax], bl
add byte [edx], bl
add byte [eax], ah
or dword [esi], edx
add byte [eax + eax*2], al
or byte [eax], al
invalid
add byte [eax], al
mov al, 9
push ss
add byte [eax - 0x47ffe9f7], dh
or dword [esi], edx
add byte [eax - 0xfffe9f7], bh
invalid
fcom dword [0x15d87800]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dh, al
ja 0x5f1e9581
pop eax
cmp edx, dword [esi - 0x1c]
js 0x5f1e95ae
add dword [ebp - 0x33], edx
push edi
add byte [eax], al
add byte [eax + 0x160a60], cl
pushal
or dword [esi], edx
add byte [eax + 0xa], ch
push ss
add byte [eax + 9], ch
push ss
add byte [eax + 0xa], dh
push ss
add byte [eax + 9], dh
push ss
add byte [eax], al
add byte [eax], dl
jne 0x5f1e95de
adc byte [eax], dl
jne 0x5f1e9601
rol byte [eax], 0
inc edx
add byte [eax + eax - 0x70], al
inc eax
push ss
add byte [edx], bl
add byte [eax + eax], bl
mov eax, 0x4001640
inc eax
or byte [eax], al
add al, byte [eax]
add byte [eax], al
or dh, al
sbb dword [edi + 8], esi
invalid

Function at 0x5f1fe31e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov dword [esi], 0x736365a0
mov dword [esi + 0x14], 0xc0000001
mov ecx, dword [0x7368d088]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, esi
pop esi
nop
nop
nop
nop
nop
mov edi, edi
push esi
push edi
mov edi, dword [0x736311d0]
mov esi, ecx
push dword [esi + 0x38]
call edi
push dword [esi + 0x34]
call edi
lea ecx, [esi + 4]
call fcn.5f1fe370
pop edi
lea ecx, [esi + 0x14]
pop esi
jmp 0x5f1f903c

Function at 0x5f1fe40a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov dword [esi], 0x73632398
mov dword [esi + 4], 0xc0000001
mov ecx, dword [0x7368d088]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, esi
pop esi
nop
nop
nop
nop
nop
mov edi, edi
push esi
push edi
mov edi, dword [0x736311d0]
mov esi, ecx
push dword [esi + 0x2c]
call edi
push dword [esi + 0x28]
call edi
pop edi
lea ecx, [esi + 4]
pop esi
jmp 0x5f1f903c

Function at 0x5f1fe47a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov dword [esi], 0x736323d8
mov dword [esi + 4], 0xc0000001
mov ecx, dword [0x7368d088]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, esi
pop esi
nop
nop
nop
nop
nop
mov edi, edi
push esi
push edi
mov edi, dword [0x736311d0]
mov esi, ecx
push dword [esi + 0x28]
call edi
push dword [esi + 0x24]
call edi
pop edi
lea ecx, [esi + 4]
pop esi
jmp 0x5f1f903c
Function at 0x5f1fe4ea
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov dword [esi], 0x73632408
mov dword [esi + 4], 0xc0000001
mov ecx, dword [0x7368d088]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, esi
pop esi
nop
nop
nop
nop
nop
mov edi, edi
push esi
mov esi, dword [0x736311d0]
push edi
mov edi, ecx
push dword [edi + 0x64]
call esi
push dword [edi + 0x60]
call esi
lea eax, [edi + 0x50]
push eax
call dword [0x736311ec]
push dword [edi + 0x48]
call esi
push dword [edi + 0x44]
call esi
push dword [edi + 0x40]
call esi
push dword [edi + 0x3c]
call esi
push dword [edi + 0x38]
call esi
push dword [edi + 0x34]
call esi
push dword [edi + 0x30]
call esi
push dword [edi + 0x2c]
call esi
push dword [edi + 0x28]
call esi
push dword [edi + 0x24]
call esi
lea ecx, [edi + 4]
pop edi
pop esi
jmp 0x5f1f903c

Function at 0x5f1fe596
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov dword [esi], 0x73633590
mov dword [esi + 4], 0x736363d0
mov dword [esi + 8], 0xc0000001
mov ecx, dword [0x7368d088]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, esi
pop esi
nop
nop
nop
nop
nop
mov edi, edi
push esi
push edi
mov edi, dword [0x736311d0]
mov esi, ecx
push dword [esi + 0x54]
call edi
push dword [esi + 0x50]
call edi
push dword [esi + 0x4c]
call edi
push dword [esi + 0x48]
call edi
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x5f1fe5ef
mov ecx, dword [eax]
push eax
Function at 0x5f1fe5ec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
or eax, 0x73758100
mov esi, 0xff
cmp ecx, 0x73758100
je 0x5f1f9086
test byte [ecx + 0x5c], 8
je 0x5f1f9086
movzx eax, word [ebp - 0x14]
cdq
mov ecx, esi
idiv ecx
mov edi, edx
push edi
push 0x737029dc
call fcn.5f1d3ea5
mov eax, dword [0x73758100]
pop ecx
pop ecx
push edi
push ebx
push 0xb
push dword [eax + 0x54]
push dword [eax + 0x50]
call 0x5f1b3705
mov ecx, dword [0x73758100]
movzx eax, word [ebp - 0x14]
cdq
idiv esi
movzx eax, dx
mov edx, dword [ebp - 0x1c]
push ebp
in al, 0x8b
xor al, 0x82
test esi, esi
je 0x5f1f90f4
and dword [ebp - 0x14], 0
cmp dword [esi], 0
lea edi, [esi + 0x10]
jbe 0x5f1f90df
mov ax, word [ebp + 0x10]
cmp ax, word [edi]
jne 0x5f1f90c6
movzx eax, ax
push eax
push dword [ebp - 0x18]
lea eax, [edi + 2]
push eax
call 0x5f1fb4b4
add esp, 0xc
test eax, eax
je 0x5f1f90d9
movzx eax, word [edi]
inc dword [ebp - 0x14]
lea edi, [edi + eax*2 + 2]
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi]
jae 0x5f1f90df
jmp 0x5f1f90a6
mov eax, dword [ebp - 0x20]
mov byte [eax], 1
mov eax, dword [ebp - 0x20]
cmp byte [eax], 0
jne 0x5f1f90ee
mov esi, dword [esi + 0xc]
test esi, esi
jne 0x5f1f909a
mov ecx, dword [0x73758100]
cmp ecx, 0x73758100
je 0x5f1f9125
test byte [ecx + 0x5c], 8
je 0x5f1f9125
push 0
push 0x73753538
call fcn.5f1d3ea5
mov eax, dword [0x73758100]
pop ecx
pop ecx
push 0
push ebx
push 0x13
push dword [eax + 0x54]
push dword [eax + 0x50]
call 0x5f1b3705
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.5f187101
leave
ret 0x10
call dword [ecx + 8]
mov eax, dword [esi + 0x28]
test eax, eax
je 0x5f1fe5fc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
lea ecx, [esi + 8]
pop esi
jmp 0x5f1f903c

Function at 0x5f1fe631
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov dword [esi], 0x73633650
mov dword [esi + 4], 0x736363fc
mov dword [esi + 8], 0xc0000001
mov ecx, dword [0x7368d088]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, esi
pop esi
nop
nop
nop
nop
nop
mov edi, edi
push esi
push edi
mov edi, dword [0x736311d0]
mov esi, ecx
push dword [esi + 0x54]
call edi
lea ecx, [esi + 0x44]
call fcn.5f1fe0d8
push dword [esi + 0x34]
call edi
push dword [esi + 0x30]
call edi
push dword [esi + 0x2c]
call edi
push dword [esi + 0x28]
call edi
pop edi
lea ecx, [esi + 8]
pop esi
jmp 0x5f1f903c

Function at 0x5f1fe6bf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov dword [esi], 0x7363661c
mov dword [esi + 0x14], 0xc0000001
mov ecx, dword [0x7368d088]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, esi
pop esi
nop
nop
nop
nop
nop
mov edi, edi
push esi
mov esi, ecx
lea ecx, [esi + 4]
call fcn.5f1fe370
lea ecx, [esi + 0x14]
pop esi
jmp 0x5f1f903c
Function at 0x5f1fe777
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov dword [esi], 0x736336a0
mov dword [esi + 4], 0x73636464
mov dword [esi + 8], 0xc0000001
mov ecx, dword [0x7368d088]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, esi
pop esi
nop
nop
nop
nop
nop
mov edi, edi
push esi
push edi
mov edi, dword [0x736311d0]
mov esi, ecx
push dword [esi + 0x68]
call edi
push dword [esi + 0x64]
call edi
push dword [esi + 0x60]
call edi
mov eax, dword [esi + 0x38]
test eax, eax
je 0x5f1fe7cb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x34]
test eax, eax
je 0x5f1fe7d8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x5f1fe7e5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x5f1fe7f2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x28]
test eax, eax
je 0x5f1fe7ff
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
lea ecx, [esi + 8]
pop esi
jmp 0x5f1f903c
Function at 0x5f2bcf00
Capabilities:
Encode data using xor

Disassembly:
lahf
out dx, al
lea esp, [edx + 0x3f]
out dx, eax
lea esp, [edx - 0x4b]
lea esp, [edx + 0x76]
lea esp, [edx - 0x6f]
lea esp, [edx - 0x70]
nop
nop
nop
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x49], al
pop ecx
push ebp
push esi
or al, 0
add byte [eax], al
dec ecx
xor al, 0x32
xor byte [eax + eax], cl
add byte [eax], al
pop ecx
push esi
xor dword [edx], esi
or al, 0
add byte [eax], al
pop ecx
push ebp
pop ecx
xor dl, byte [eax]
add byte [eax], al
add byte [ebp + 0x59], dl
adc byte [eax], al
add byte [eax], al
push ebp
pop ecx
push esi
pop ecx
adc byte [eax], al
add byte [eax], al
pop ecx
push esi
pop ecx
push ebp
adc byte [eax], al
add byte [eax], al
pop ecx
push esi
push ebp
cmp dword [ecx], ecx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], bl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [ebx], al
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [edx], ch
test dword [ebp - 0x727d719e], ecx
bound eax, qword [edx + eax*4 - 0x185f9d73]
lea esp, [edx - 0x4c]
out 0x8d, eax
bound ebp, qword [esi + edi*2 - 0x73]
bound esi, qword [esi + edi*2 - 0x73]
bound edx, qword [eax - 0x676f6f70]
or byte [ebp - 0x7281d89e], 0x62
cmp eax, 0x79628d7e
jecxz 0x5f2bcf1c
bound esp, qword [eax - 0x369d721d]
jecxz 0x5f2bcf24
invalid
Function at 0xc14058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xc141a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc1407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc1406a
add dl, dl
jne 0xc14089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc140dc
xor eax, eax
add dl, dl
jne 0xc14096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc1417d
add dl, dl
jne 0xc140a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc140b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc140bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc140c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc140d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc14075
mov eax, 1
add dl, dl
jne 0xc140ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc140f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc140e1
sub eax, ebx
mov ebx, 1
jne 0xc14128
mov ecx, 1
add dl, dl
jne 0xc1410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc14119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc14105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc14075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc1413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc1414a
invalid
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc14136
cmp eax, 0x7d00
jae 0xc1416d
cmp eax, 0x500
jb 0xc14168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc14075
cmp eax, 0x7f
ja 0xc14170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc14075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc1419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc14075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x276d20e5
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6acf2688
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x523c80
Capabilities:
Encode data using xor

Disassembly:
inc esi
adc byte [esi - 0x77], ah
inc esi
pop edx
mov eax, dword [esp + 0x28]
sub esp, 0x10
mov word [esi + 0x12], cx
mov ecx, dword [esp + 0x3c]
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x40]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov ecx, ebp
mov byte [esp + 0x2c], 2
mov dword [esi + 0xc], ebx
mov word [esi + 0x54], 0x5d3f
pop ebp
pop ebp
xor ecx, dword [eax + 0x74]
or edi, dword [edx]
mov edi, 0x587f82c3
leave
mov ebp, 0x818291c9
in eax, 0x50
jl 0x523c47
dec edx
fild qword [edx + 0x5c]
aas
pop ebp
fdivr dword [ecx]
sbb al, al
xor ecx, ebx
pop ds
insb byte es:[edi], dx
or dl, al
push ds
mov eax, dword [0xe95fab1a]
iretd

Function at 0x56d01d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
in eax, dx
je 0x56d111
mov eax, dword [esp + 0x24]
test eax, eax
je 0x56d111
mov edi, dword [esp + 0x28]
test edi, edi
je 0x56d111
mov edx, dword [esi]
mov dword [ebx], edx
mov edx, dword [esi + 4]
mov dword [ebp], edx
movzx edx, byte [esi + 0x18]
mov dword [eax], edx
cmp byte [esi + 0x18], 1
call 0x6a5d3d
add esp, 4
mov dword [esi + 0x54], 0
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.0056f7ad
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
inc esp
and al, 0x1c
add eax, ebp
and esp, dword [edi]
add byte [eax], al
mov ax, word [esp + 0x24]
mov cx, word [esp + 0x38]
mov word [esi + 0x10], ax
mov word [esi + 0x5a], ax
mov eax, dword [esp + 0x28]
sub esp, 0x10
mov word [esi + 0x12], cx
mov ecx, dword [esp + 0x3c]
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x40]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov ecx, ebp
mov byte [esp + 0x2c], 2
mov dword [esi + 0xc], ebx
mov word [esi + 0x54], 0x83f
mov dword [esi + 0x56], ebx
call fcn.0056f89d
mov ecx, dword [esp + 0x14]
mov byte [esi + 0x6a], bl
mov word [esi + 0x64], bx
mov dword [esi + 0x66], ebx
mov word [esi + 0x5d], bx
mov dword [esi + 0x5f], ebx
mov dword [esi + 0x6b], ebx
xor edx, edx
mov al, 0xff
mov byte [esi + 0x63], al
mov byte [esi + 0x5c], al
mov dword [edi], edx
mov dword [edi + 4], edx
mov dword [edi + 8], edx
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], edx
mov dword [edi + 0x14], edx
pop edi
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x18
Function at 0x5b6e2d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop esp
and al, 0x1c
test ebx, ebx
je 0x5b6f31
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x5b6f31
mov eax, dword [esp + 0x24]
test eax, eax
je 0x5b6f31
mov edi, dword [esp + 0x28]
test edi, edi
je 0x5b6f31
mov edx, dword [esi]
mov dword [ebx], edx
mov edx, dword [esi + 4]
mov dword [ebp], edx
movzx edx, byte [esi + 0x18]
mov dword [eax], edx
cmp byte [esi + 0x18], 1
into
mov dword [esp + 0x10], 0xffffffff
call fcn.005b95bd
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
dec esp
and al, 0x38
mov word [esi + 0x10], ax
mov word [esi + 0x5a], ax
mov eax, dword [esp + 0x28]
sub esp, 0x10
mov word [esi + 0x12], cx
mov ecx, dword [esp + 0x3c]
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x40]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov ecx, ebp
mov byte [esp + 0x2c], 2
mov dword [esi + 0xc], ebx
mov word [esi + 0x54], 0x83f
mov dword [esi + 0x56], ebx
call fcn.005b96ad
mov ecx, dword [esp + 0x14]
mov byte [esi + 0x6a], bl
mov word [esi + 0x64], bx
mov dword [esi + 0x66], ebx
mov word [esi + 0x5d], bx
mov dword [esi + 0x5f], ebx
mov dword [esi + 0x6b], ebx
xor edx, edx
mov al, 0xff
mov byte [esi + 0x63], al
mov byte [esi + 0x5c], al
mov dword [edi], edx
mov dword [edi + 4], edx
mov dword [edi + 8], edx
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], edx
mov dword [edi + 0x14], edx
pop edi
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x18
Function at 0x5ff63e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop esp
and al, 0x1c
test ebx, ebx
je 0x5ff742
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x5ff742
mov eax, dword [esp + 0x24]
test eax, eax
je 0x5ff742
mov edi, dword [esp + 0x28]
test edi, edi
je 0x5ff742
mov edx, dword [esi]
mov dword [ebx], edx
mov edx, dword [esi + 4]
mov dword [ebp], edx
movzx edx, byte [esi + 0x18]
mov dword [eax], edx
cmp byte [esi + 0x18], 1
into
mov dword [esp + 0x10], 0xffffffff
call fcn.00601dce
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
dec esp
and al, 0x38
mov word [esi + 0x10], ax
mov word [esi + 0x5a], ax
mov eax, dword [esp + 0x28]
sub esp, 0x10
mov word [esi + 0x12], cx
mov ecx, dword [esp + 0x3c]
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x40]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov ecx, ebp
mov byte [esp + 0x2c], 2
mov dword [esi + 0xc], ebx
mov word [esi + 0x54], 0x83f
mov dword [esi + 0x56], ebx
call fcn.00601ebe
mov ecx, dword [esp + 0x14]
mov byte [esi + 0x6a], bl
mov word [esi + 0x64], bx
mov dword [esi + 0x66], ebx
mov word [esi + 0x5d], bx
mov dword [esi + 0x5f], ebx
mov dword [esi + 0x6b], ebx
xor edx, edx
mov al, 0xff
mov byte [esi + 0x63], al
mov byte [esi + 0x5c], al
mov dword [edi], edx
mov dword [edi + 4], edx
mov dword [edi + 8], edx
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], edx
mov dword [edi + 0x14], edx
pop edi
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x18