joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459b30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x38], eax
lea eax, [esp + 0x34]
push eax
push ecx
call dword [0x4780e4]
lea edx, [esp + 0x138]
lea ecx, [esp + 0xbc]
push edx
call 0x4992a3
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x230]
push eax
push 0
push ecx
lea ecx, [esp + 0xc8]
call 0x499794
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
push edx
push eax
lea ecx, [esp + 0xc4]
call 0x4997e0
lea ecx, [esp + 0x110]
push ecx
lea ecx, [esp + 0xc0]
call 0x4992a3
mov edx, dword [esp + 0x3c]
push ebp
push edx
lea ecx, [esp + 0xc4]
call 0x4997e0
push ebp
push 0
lea ecx, [esp + 0xc4]
and al, 0xc4
add byte [eax], al
add al, ch
cmpsb byte [esi], byte es:[edi]
cld
add eax, dword [eax]
push edi
push 0
lea ecx, [esp + 0xc4]
call 0x4997e0
inc ebx
lea eax, [esp + 0x248]
push ebx
push 0x5b0d24
push eax
call dword [0x478434]
lea ecx, [esp + 0x9c]
add esp, 0xc
test ecx, ecx
je 0x459b86
mov eax, dword [esp + 0x94]
test eax, eax
je 0x459b86
mov edx, dword [esp + 0xc0]
push eax
push edx
call dword [0x478098]
push 0
lea ecx, [esp + 0xc0]
call 0x499437
lea eax, [esp + 0x248]
lea ecx, [esp + 0x158]
add byte [eax], al
push eax
call 0x492f50
mov eax, dword [esp + 0x158]
lea edx, [esp + 0x14]
push 0x825
push edx
mov ecx, dword [eax - 8]
mov byte [esp + 0x28c], 0x12
push ecx
push eax
mov eax, dword [esp + 0xcc]
lea ecx, [esp + 0xcc]
call dword [eax + 0x68]
lea ecx, [esp + 0x158]
mov byte [esp + 0x284], 0x10
call 0x492ee2

Function at 0x459ba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x38], eax
lea eax, [esp + 0x34]
push eax
push ecx
call dword [0x4780e4]
lea edx, [esp + 0x138]
lea ecx, [esp + 0xbc]
push edx
call 0x4992a3
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x230]
push eax
push 0
push ecx
lea ecx, [esp + 0xc8]
call 0x499794
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
push edx
push eax
lea ecx, [esp + 0xc4]
call 0x4997e0
lea ecx, [esp + 0x110]
push ecx
lea ecx, [esp + 0xc0]
call 0x4992a3
mov edx, dword [esp + 0x3c]
push ebp
push edx
lea ecx, [esp + 0xc4]
call 0x4997e0
push ebp
push 0
lea ecx, [esp + 0xc4]
and al, 0xc4
add byte [eax], al
add al, ch
cmpsb byte [esi], byte es:[edi]
cld
add eax, dword [eax]
push edi
push 0
lea ecx, [esp + 0xc4]
call 0x4997e0
inc ebx
lea eax, [esp + 0x248]
push ebx
push 0x5b0d24
push eax
call dword [0x478434]
lea ecx, [esp + 0x9c]
add esp, 0xc
test ecx, ecx
je 0x459b86
mov eax, dword [esp + 0x94]
test eax, eax
je 0x459b86
mov edx, dword [esp + 0xc0]
push eax
push edx
call dword [0x478098]
push 0
lea ecx, [esp + 0xc0]
call 0x499437
lea eax, [esp + 0x248]
lea ecx, [esp + 0x158]
add byte [eax], al
push eax
call 0x492f50
mov eax, dword [esp + 0x158]
lea edx, [esp + 0x14]
push 0x825
push edx
mov ecx, dword [eax - 8]
mov byte [esp + 0x28c], 0x12
push ecx
push eax
mov eax, dword [esp + 0xcc]
lea ecx, [esp + 0xcc]
call dword [eax + 0x68]
lea ecx, [esp + 0x158]
mov byte [esp + 0x284], 0x10
call 0x492ee2
Function at 0x459c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x10]
mov edi, ebx
cmp ebx, eax
jge 0x459c66
mov ecx, eax
mov eax, dword [esp + 0x38]
and al, 0x38
and al, 0x38
sub edi, ecx
add edi, eax
push edi
mov ecx, esi
call fcn.00458568
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xa8], eax
push edi
lea eax, [ecx - 1]
mov ecx, dword [esp + 0x54]
push eax
call fcn.00455e98
push eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0xac]
push 0x10
push edx
dec eax
push edi
mov edi, dword [esp + 0x3c]
push eax
push ebp
lea ecx, [esp + 0xd4]
push edi
push ecx
mov ecx, esi
call fcn.0045c048
mov edx, dword [esp + 0xa8]
mov ecx, esi
push edx
push edi
call fcn.00458728
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x44]
inc ebx
cmp ebx, eax
jl 0x459c52
cmp dword [esp + 0x74], 4
jg 0x459d80
cmp dword [esp + 0x38], ebp
jne 0x459d80
cmp dword [esp + 0x10], ebp
jle 0x459d80
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x64]
sub ebx, ecx
cmp ebx, eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0xa8], ebp
jge 0x459d80
mov eax, dword [esp + 0x28]
mov edi, ebx
cmp ebx, eax
jge 0x459d1b
mov ecx, eax
mov eax, dword [esp + 0x58]
sub edi, ecx
add edi, eax
push edi
mov ecx, esi
call int.00458488
mov ecx, dword [esp + 0x50]
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x10]
dec eax
push eax
push edi
call fcn.00455e98
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0xac]
mov word [esp + ebp*4], fs
add byte [eax], al
add byte [edx + 8], ch
lea eax, [edx - 1]
push ecx
push eax
push edi
mov edi, dword [esp + 0x40]
lea eax, [esp + 0xd0]
push edi
push ebp
push eax
mov ecx, esi
call fcn.0045c048
mov ecx, dword [esp + 0xac]
push ecx
push edi
mov ecx, esi
call fcn.00458858
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x64]
inc ebx
cmp ebx, eax
jl 0x459d07
xor ebx, ebx
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x16c]
invalid
pushfd
and al, 0x90
Function at 0x459d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x10]
mov edi, ebx
cmp ebx, eax
jge 0x459c66
mov ecx, eax
mov eax, dword [esp + 0x38]
and al, 0x38
and al, 0x38
sub edi, ecx
add edi, eax
push edi
mov ecx, esi
call fcn.00458568
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xa8], eax
push edi
lea eax, [ecx - 1]
mov ecx, dword [esp + 0x54]
push eax
call fcn.00455e98
push eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0xac]
push 0x10
push edx
dec eax
push edi
mov edi, dword [esp + 0x3c]
push eax
push ebp
lea ecx, [esp + 0xd4]
push edi
push ecx
mov ecx, esi
call fcn.0045c048
mov edx, dword [esp + 0xa8]
mov ecx, esi
push edx
push edi
call fcn.00458728
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x44]
inc ebx
cmp ebx, eax
jl 0x459c52
cmp dword [esp + 0x74], 4
jg 0x459d80
cmp dword [esp + 0x38], ebp
jne 0x459d80
cmp dword [esp + 0x10], ebp
jle 0x459d80
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x64]
sub ebx, ecx
cmp ebx, eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0xa8], ebp
jge 0x459d80
mov eax, dword [esp + 0x28]
mov edi, ebx
cmp ebx, eax
jge 0x459d1b
mov ecx, eax
mov eax, dword [esp + 0x58]
sub edi, ecx
add edi, eax
push edi
mov ecx, esi
call int.00458488
mov ecx, dword [esp + 0x50]
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x10]
dec eax
push eax
push edi
call fcn.00455e98
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0xac]
mov word [esp + ebp*4], fs
add byte [eax], al
add byte [edx + 8], ch
lea eax, [edx - 1]
push ecx
push eax
push edi
mov edi, dword [esp + 0x40]
lea eax, [esp + 0xd0]
push edi
push ebp
push eax
mov ecx, esi
call fcn.0045c048
mov ecx, dword [esp + 0xac]
push ecx
push edi
mov ecx, esi
call fcn.00458858
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x64]
inc ebx
cmp ebx, eax
jl 0x459d07
xor ebx, ebx
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x16c]
invalid
pushfd
and al, 0x90

Function at 0x459ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or byte [ebx + 0x88249c], cl
add byte [eax], al
test byte [esp + edx*4], ah
add byte [eax], al
add al, ch
jge 0x459e98
invalid

Function at 0x459ff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x40
add dword [eax], eax
add byte [ecx + ebx*8 - 0x7d], bh
std
push dword [ebx + ecx*2 - 0x77]
push esp
and al, 0x70
Function at 0x45a818
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x475388
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x74]
push edi
push eax
mov eax, dword [esp + 0x74]
push ecx
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.0045b398
lea edx, [esp + 0x18]
push eax
push edx
call dword [0x478648]
mov eax, dword [esp + 0x18]
xor edi, edi
xor ecx, ecx
cmp eax, edi
setl cl
dec ecx
xor edx, edx
and ecx, eax
mov eax, dword [esp + 0x1c]
cmp eax, edi
mov dword [esp + 0x18], ecx
setl dl
dec edx
and edx, eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x20], edx
call dword [0x478454]
test eax, eax
je 0x45a8c1
mov eax, dword [esp + 0x6c]
push ebx
mov ebx, eax
xor ecx, ecx
xor edx, edx
xor esi, esi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0045a4a8
mov edx, eax
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push ecx
push eax
lea eax, [esp + 0x20]
push eax
call dword [0x478488]
push edi
lea ecx, [esp + 0x4c]
call 0x4999a7
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x70], edi
call fcn.00469d68
mov edx, dword [esp + 0x5c]
add esp, 0xc
lea ecx, [esp + 0x18]
push 2
push ecx
push edx
call dword [0x4780e0]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x38]
push eax
push ecx
call dword [0x47841c]
lea edx, [esp + 0x38]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
call dword [0x478494]
mov esi, dword [esp + 0x6c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, esi
mov dword [esp + 0x64], 0xffffffff
mov dword [edx], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x48]
call 0x499a19
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14

Function at 0x45adf8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4753b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
push edi
mov esi, ecx
call fcn.004589f8
mov ebx, eax
test ebx, ebx
mov dword [esp + 0xc], ebx
jne 0x45ae51
mov eax, dword [esp + 0x68]
xor ecx, ecx
mov ebx, eax
xor edx, edx
xor esi, esi
xor edi, edi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
push ebp
mov ecx, ebx
call fcn.00455e48
mov ebp, dword [esp + 0x70]
mov edi, eax
add edi, ebp
mov ecx, ebx
mov dword [esp + 0x28], edi
call fcn.00455e38
mov edx, dword [esp + 0x74]
Function at 0x45b0a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push fcn.004753e0
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004589f8
mov edi, eax
test edi, edi
invalid
Function at 0x43156c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
lea ebx, [ecx + edx]
mov edx, edi
imul edx, esi
add edx, edx
add esi, esi
or eax, 0xffffffff
add edx, edx
lea edi, [ecx + edi*4]
add esi, esi
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], ecx
movzx edi, byte [ecx + 2]
mov esi, eax
and esi, 0xff
xor esi, edi
movzx edi, byte [ecx + 1]
shr eax, 8
xor eax, dword [esi*4 + 0x491be8]
mov esi, eax
and esi, 0xff
xor esi, edi
movzx edi, byte [ecx]
shr eax, 8
xor eax, dword [esi*4 + 0x491be8]
add ecx, edx
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x491be8]
mov esi, dword [ebp + 0x14]
cmp ecx, ebx
jb 0x4315f5
add esi, dword [ebp + 0x10]
mov dword [ebp + 0x14], esi
mov ecx, esi
cmp esi, dword [ebp + 8]
jb 0x43159d
not eax
mov dword [ebp + 0x14], eax
fild dword [ebp + 0x14]
test eax, eax
jns 0x43160c
fadd qword [0x48cd18]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x432017
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x464]
test eax, eax
je 0x43202f
cmp eax, 0x10000
jne 0x432053
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x45c]
push eax
push 0x10000
push 1
push ecx
call fcn.00414d04
add esp, 0x10
mov dword [esi + 0x464], 0
mov ecx, dword [esi + 0x464]
mov edx, dword [esi + 0x45c]
mov al, byte [ecx + edx]
inc ecx
mov dword [esi + 0x464], ecx
pop esi
pop ebp
ret 4

Function at 0x43206e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x460]
test eax, eax
je 0x43209f
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x458]
push ecx
push eax
push 1
push edx
call fcn.004142b6
add esp, 0x10
mov dword [esi + 0x460], 0
pop esi
pop ebp
ret 4

Function at 0x4320a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov dl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x460]
mov eax, dword [esi + 0x458]
mov byte [eax + ecx], dl
inc dword [esi + 0x460]
cmp dword [esi + 0x460], 0x10000
jne 0x4320f3
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x458]
push eax
push 0x10000
push 1
push ecx
call fcn.004142b6
add esp, 0x10
mov dword [esi + 0x460], 0
pop esi
pop ebp
ret 8
Function at 0x4321a4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 1
jne 0x4321cb
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
push 8
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00410e60
add esp, 0xc
jmp 0x4321df
mov edx, dword [esi + 0x1c]
push edx
push 8
lea eax, [ebp - 8]
push 1
push eax
call fcn.00414d04
add esp, 0x10
movzx ecx, byte [ebp - 4]
movzx edx, byte [ebp - 3]
movzx eax, byte [ebp - 2]
add dword [esi + 0xc], 8
shl ecx, 8
or ecx, edx
movzx edx, byte [ebp - 1]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
or ecx, edx
mov dword [eax], ecx
lea ecx, [ebp - 8]
push str.EA06
push ecx
mov byte [ebp - 4], 0
call fcn.00414d30
add esp, 8
neg eax
sbb eax, eax
neg eax
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x432281
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x4a7540], eax
mov edx, 1
mov eax, 0x4a7540
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x4a7efc
jl 0x432297
mov dword [0x49205c], 1
mov dword [0x4a7f10], 1
pop edi
pop ebp
ret
Function at 0x466a4b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0xd0], 0
je 0x466a8d
test al, al
je 0x466a8d
lea eax, [esi + 0xd4]
push eax
call fcn.004319f5
push esi
push 0
push 0x466a39
call fcn.00415214
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], eax
sete al
pop esi
pop ecx
pop ebp
ret 8
push eax
push esi
call fcn.0046690e
pop esi
pop ecx
pop ebp
ret 8

Function at 0x46888b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov al, byte [0x4974e7]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x8000
push edi
mov byte [ebp - 4], al
call fcn.00414139
add esp, 4
push eax
call fcn.0041404e
add esp, 8
mov esi, eax
push ebx
mov dword [ebp - 8], esi
call fcn.00443d61
test al, al
je 0x4688e8
push edi
push ebx
call fcn.00443106
push eax
push 1
push ebx
call fcn.004680ed
push eax
call fcn.004142b6
add esp, 0x10
mov ebx, eax
jmp 0x468933
push esi
jmp 0x468946
lea esi, [ebp - 0x1c]
call fcn.0040d370
push ebx
call fcn.004533eb
push esi
push eax
call fcn.0045f645
mov edx, dword [ebp - 0x1c]
push edx
push 0x487e30
push edi
call fcn.00414330
add esp, 0xc
cmp byte [ebp - 4], 0
mov dword [ebp - 0xc], eax
je 0x468925
push ebx
call fcn.0045340c
push eax
call dword [0x482214]
lea esi, [ebp - 0x1c]
call fcn.00401350
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push edi
call fcn.004145c6
add esp, 4
cmp esi, 0xffffffff
jne 0x4688e5
push 0x4000
push edi
call fcn.00414139
add esp, 4
push eax
call fcn.0041404e
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af522
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4ab650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4af540
push eax
call dword [fcn.004ab020]
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
movzx eax, word [ebx + 0x14]
push dword [ebx + 0x88]
lea eax, [eax + ebx + 0x18]
push ebx
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0
mov dword [ebp - 0x10], eax
call fcn.004acaa7
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
je 0x4af604
movzx eax, word [ebx + 6]
and dword [ebp - 0x14], 0
test eax, eax
push esi
push edi
jle 0x4af5af
mov edi, dword [ebp - 0x10]
push 2
pop ecx
lea esi, [ebp - 0xc]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x4af5af
add dword [ebp - 0x10], 0x28
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0x4af594
cmp dword [ebp - 0x14], eax
je 0x4af602
mov eax, dword [ebp - 0x10]
mov edx, dword [ebx + 0x34]
add edx, dword [eax + 0xc]
push 4
pop ecx
mov edi, 0x4acf88
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x4af602
push 4
pop ecx
mov edi, 0x4acf88
lea esi, [edx + 0x140]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x4af602
cmp dword [edx + 0x124], eax
je 0x4af5f0
push 0x4af324
jmp 0x4af5f5
push 0x4af50a
push ebx
push dword [ebp - 0x18]
push edx
call fcn.004af0fb
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004b05aa
leave
ret
Function at 0x4c4e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
xor ebp, ebp
cmp ebx, ebp
push esi
push edi
mov dword [esp + 0x10], ebp
je 0x4c4eee
mov eax, dword [ebx + 0x3c]
mov esi, dword [eax + ebx + 0x78]
add eax, ebx
add esi, ebx
cmp dword [esi + 0x18], ebp
mov dword [esp + 0x18], eax
jbe 0x4c4eee
jmp 0x4c4e80
mov eax, dword [esi + 0x20]
mov edi, dword [esp + 0x1c]
lea ecx, [eax + ebp*4]
mov eax, dword [ecx + ebx]
add eax, ebx
test eax, 0xffff0000
je 0x4c4eaf
test edi, 0xffff0000
je 0x4c4eaf
push edi
push eax
call dword [0x10082060]
neg eax
sbb eax, eax
add eax, 1
jmp 0x4c4eb8
xor edx, edx
cmp eax, edi
sete dl
mov eax, edx
test eax, eax
je 0x4c4ee6
mov eax, dword [esi + 0x24]
lea ecx, [eax + ebp*2]
movzx edx, word [ecx + ebx]
mov eax, dword [esi + 0x1c]
lea ecx, [eax + edx*4]
mov edi, dword [ecx + ebx]
add edi, ebx
cmp edi, esi
jb 0x4c4ee2
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x7c]
add eax, esi
cmp edi, eax
jbe 0x4c4ef8
mov dword [esp + 0x10], edi
add ebp, 1
cmp ebp, dword [esi + 0x18]
jb 0x4c4e80
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor ecx, ecx
cmp byte [edi], cl
mov eax, edi
je 0x4c4f0b
add eax, 1
add ecx, 1
cmp byte [eax], 0
jne 0x4c4f00
lea ebx, [ecx + 1]
xor esi, esi
test ebx, ebx
jbe 0x4c4f1f
push ebx
call fcn.004c32d0
add esp, 4
mov esi, eax
push ebx
push edi
push esi
call fcn.004c3260
mov al, byte [esi]
add esp, 0xc
test al, al
mov edi, esi
je 0x4c4f40
cmp al, 0x2e
je 0x4c4f51
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4c4f32
push esi
call fcn.004c3420
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push esi
call dword [0x1008220c]
add edi, 1
push edi
push eax
call fcn.004c4e50
push esi
mov edi, eax
call fcn.004c3420
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4d80f0
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi], 0x100851fc
lea esi, [edi + 4]
push 0x100
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xff
call fcn.004c3370
mov dword [esi], eax
mov ecx, 0x20
mov dword [esi + 4], ebx
add esp, 8
mov byte [eax], bl
mov eax, 1
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xac], ecx
push 0x10082314
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0x10000
mov dword [esp + 0x24], 0x100851f4
mov dword [esp + 0x28], 0x20000
mov dword [esp + 0x2c], 0x100851e4
mov dword [esp + 0x30], 0x100000
mov dword [esp + 0x34], 0x100851d8
mov dword [esp + 0x38], 0x40000
mov dword [esp + 0x3c], 0x100851cc
mov dword [esp + 0x40], 0x80000
mov dword [esp + 0x44], 0x100851c0
mov dword [esp + 0x48], 0x80000000
mov dword [esp + 0x4c], 0x100851b0
mov dword [esp + 0x50], 0x40000000
mov dword [esp + 0x54], 0x100851a0
mov dword [esp + 0x58], 0x20000000
mov dword [esp + 0x5c], 0x10085190
mov dword [esp + 0x60], 0x10000000
mov dword [esp + 0x64], 0x10085184
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0x10085174
mov dword [esp + 0x70], 0x80
mov dword [esp + 0x74], 0x1008515c
mov dword [esp + 0x78], 8
mov dword [esp + 0x7c], 0x1008514c
mov dword [esp + 0x80], 2
mov dword [esp + 0x84], 0x1008513c
mov dword [esp + 0x88], 0x100
mov dword [esp + 0x8c], 0x10085124
mov dword [esp + 0x90], 0x10
mov dword [esp + 0x94], 0x10085114
mov dword [esp + 0x98], 4
mov dword [esp + 0x9c], 0x10085100
mov dword [esp + 0xa4], 0x100850f0
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], 0x100850dc
mov dword [esp + 0xb4], 0x100850cc
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.004c4b50
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.004c4b50
cmp ebp, ebx
je 0x4d82af
push ebp
call fcn.004c3420
add esp, 4
xor ebp, ebp
mov eax, dword [esp + ebp*8 + 0x1c]
test dword [esp + 0x120], eax
je 0x4d82e4
not eax
and dword [esp + 0x120], eax
cmp dword [edi + 8], ebx
je 0x4d82d8
push 0x100850c8
mov ecx, esi
call fcn.004c7960
mov eax, dword [esp + ebp*8 + 0x20]
push eax
mov ecx, esi
call fcn.004c7960
add ebp, 1
cmp ebp, 0x13
jb 0x4d82b1
cmp dword [edi + 8], ebx
jne 0x4d8333
push 0x100850c0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.004c4b50
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.004c4b50
cmp ebp, ebx
je 0x4d836f
push ebp
call fcn.004c3420
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
mov eax, dword [esp + 0x120]
cmp eax, ebx
je 0x4d836f
push eax
lea ecx, [esp + 0x20]
push 0x100850b8
push ecx
call dword [0x1008225c]
add esp, 0xc
cmp dword [edi + 8], ebx
je 0x4d8363
push 0x100850c8
mov ecx, esi
call fcn.004c7960
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.004c7960
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4