joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cfdff
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
sub esp, 0x31c
lea ebp, [esp - 4]
mov eax, dword [0x67d978]
xor eax, ebp
mov dword [ebp + 0x31c], eax
push 0x20
mov eax, 0x56edee
call fcn.0053d79c
lea eax, [ebp]
push eax
mov dword [ebp], 0x114
call dword [0x6894a8]
test eax, eax
jne 0x4cfe3f
xor eax, eax
jmp 0x4cff6f
cmp dword [ebp + 0x10], 2
jne 0x4cfe58
cmp dword [ebp + 4], 4
jne 0x4cfe58
cmp dword [ebp + 8], 0
jne 0x4cfe58
push str.security.dll
jmp 0x4cfe5d
push str.secur32.dll
lea eax, [ebp + 0x114]
push eax
call dword [0x6894e8]
sub esp, 0x1c
lea eax, [ebp + 0x114]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.00415a69
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x2c]
call fcn.0045f0bc
add esp, 0x1c
xor esi, esi
inc esi
mov dword [ebp - 4], esi
cmp dword [eax + 0x18], 8
jb 0x4cfea2
mov eax, dword [eax + 4]
jmp 0x4cfea5
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
or dword [ebp - 4], 0xffffffff
push 0
push esi
lea ecx, [ebp - 0x2c]
call fcn.0041382c
test edi, edi
je 0x4cfe38
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AcceptSecurityContext
push edi
call esi
test eax, eax
mov dword [0x68bfc4], eax
je 0x4cff64
push str.AcquireCredentialsHandleW
push edi
call esi
test eax, eax
mov dword [0x68bfc8], eax
je 0x4cff64
push str.CompleteAuthToken
push edi
call esi
push str.DeleteSecurityContext
push edi
mov dword [0x68bfcc], eax
call esi
test eax, eax
mov dword [0x68bfd0], eax
je 0x4cff64
push str.FreeContextBuffer
push edi
call esi
test eax, eax
mov dword [0x68bfd4], eax
je 0x4cff64
push str.FreeCredentialsHandle
push edi
call esi
test eax, eax
mov dword [0x68bfd8], eax
je 0x4cff64
push str.InitializeSecurityContextW
push edi
call esi
test eax, eax
mov dword [0x68bfdc], eax
je 0x4cff64
push str.QuerySecurityPackageInfoW
push edi
call esi
test eax, eax
mov dword [0x68bfe0], eax
je 0x4cff64
push str.QuerySecurityContextToken
push edi
call esi
test eax, eax
mov dword [0x68bfe4], eax
jne 0x4cff6d
push edi
call fcn.004cfdb4
pop ecx
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x31c]
xor ecx, ebp
call fcn.00536476
add ebp, 0x320
leave
ret

Function at 0x4d2ee0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [ecx + 4]
mov edx, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp esi, 4
push edi
jb 0x4d2f4d
mov edi, esi
shr edi, 2
xor eax, dword [edx]
sub esi, 4
mov ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x61acd0]
add edx, 4
mov ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x61acd0]
mov ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x61acd0]
mov ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x61acd0]
sub edi, 1
jne 0x4d2ef8
test esi, esi
je 0x4d2f72
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x61acd0]
sub esi, 1
add edx, 1
test esi, esi
jne 0x4d2f51
pop edi
pop esi
mov dword [ecx + 4], eax
pop ebx
ret 8
Function at 0x4d5ec0
Capabilities:
Hash data using sha256

Disassembly:
push 0xffffffffffffffff
push 0x576065
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x20]
push ebx
call fcn.004a74d0
lea eax, [ebx + 0x60]
mov ecx, eax
neg ecx
and ecx, 0xf
mov dword [esp + 0x18], 2
add ecx, eax
mov dword [eax + 0x50], 0x10
mov byte [eax + 0x49], 1
mov dword [eax + 0x54], ecx
mov byte [esp + 0x18], 3
mov edi, dword [ebx + 0xb4]
mov ecx, 8
mov esi, 0x631acc
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x18], 0xffffffff
mov eax, ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x4d6800
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ecx, edi
xor ebx, ebx
shr ecx, 2
je 0x4d6832
mov eax, edx
sub esi, edx
mov ebx, ecx
push ebp
lea esp, [esp]
mov ebp, dword [esi + eax]
xor dword [eax], ebp
add eax, 4
sub ecx, 1
jne 0x4d6820
mov esi, dword [esp + 0x14]
pop ebp
lea eax, [ebx*4]
sub edi, eax
je 0x4d685d
add edx, eax
add esi, eax
test edi, edi
jbe 0x4d685d
mov ecx, esi
mov eax, edx
sub ecx, edx
mov esi, edi
lea ecx, [ecx]
mov dl, byte [eax + ecx]
xor byte [eax], dl
add eax, 1
sub esi, 1
jne 0x4d6850
pop edi
pop esi
pop ebx
ret

Function at 0x4d6870
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov edx, edi
xor eax, eax
shr edx, 2
je 0x4d68b4
mov edi, ebx
sub esi, ecx
mov eax, ecx
sub edi, ecx
mov dword [esp + 0xc], edx
push ebp
mov ebp, dword [esi + eax]
xor ebp, dword [eax]
add eax, 4
sub edx, 1
mov dword [edi + eax - 4], ebp
jne 0x4d6896
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop ebp
add eax, eax
add eax, eax
sub edi, eax
je 0x4d68e1
add ebx, eax
add esi, eax
add ecx, eax
test edi, edi
jbe 0x4d68e1
mov edx, esi
mov esi, ebx
sub edx, ecx
mov eax, ecx
sub esi, ecx
mov cl, byte [eax + edx]
xor cl, byte [eax]
add eax, 1
sub edi, 1
mov byte [eax + esi - 1], cl
jne 0x4d68d0
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4d6d00
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0xffffffffffffffff
push 0x572ac8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
call fcn.004d6ff0
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
mov eax, dword [eax]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4d6d85
push 0xe
push 0x630780
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], eax
mov byte [esp + 0x10], al
call fcn.00414470
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x5c], 0
call fcn.004d6a40
push 0x64925c
lea edx, [esp + 0x24]
push edx
call fcn.0053cd8e
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
add esp, 0x54
ret 8
Function at 0x4d75d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56a5f0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
push 0x19
xor ebx, ebx
push str.Integer:_division_by_zero
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00414470
lea eax, [esp + 0xc]
push eax
push 6
push esi
mov dword [esp + 0x3c], ebx
call fcn.004687b9
mov byte [esp + 0x30], 2
cmp dword [esp + 0x24], 0x10
jb 0x4d7645
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00535941
add esp, 4
mov dword [esi], vtable.CryptoPP::Integer::DivideByZero.0
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov dword [esp + 0x30], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4

Function at 0x4d7680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56a5f0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
push 0x32
xor ebx, ebx
push str.Integer:_no_integer_satisfies_the_given_parameters
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00414470
lea eax, [esp + 0xc]
push eax
push 6
push esi
mov dword [esp + 0x3c], ebx
call fcn.004687b9
mov byte [esp + 0x30], 2
cmp dword [esp + 0x24], 0x10
jb 0x4d76f5
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00535941
add esp, 4
mov dword [esi], vtable.CryptoPP::Integer::RandomNumberNotFound.0
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov dword [esp + 0x30], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4

Function at 0x4d77d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x585241
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
push eax
lea esi, [esp + 0x14]
mov dword [esp + 0x10], 0
call fcn.004e4bc0
mov ecx, dword [esp + 0x3c]
push ecx
mov dword [esp + 0x30], 1
call fcn.004e6cc0
push eax
mov esi, edi
call fcn.004e4bc0
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x2c], 0
call fcn.0046ae2f
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 0xc
Function at 0x4d8080
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x586aa1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 8], 0
mov eax, dword [esi + 0x14]
shl eax, 5
push eax
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.004d7860
mov ecx, eax
mov dword [esp + 0x28], 1
lea eax, [esi + 0xc]
mov esi, dword [esp + 0x30]
call fcn.004d7b20
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x28], 0
call fcn.0046ae2f
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 8

Function at 0x4d85a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57c75a
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0xc], 0
call fcn.0045dc10
mov dword [esp + 0x20], 0
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x30], edx
call fcn.004c991e
lea ecx, [esp + 8]
push ecx
push esi
call fcn.0045dc10
lea edx, [esp + 8]
push edx
call fcn.0045af14
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
add esp, 0x20
ret

Function at 0x4d8640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58329a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.004d8620
push 2
push eax
mov esi, edi
mov dword [esp + 0x30], 0
call fcn.004d85a0
add esp, 8
lea eax, [esp + 0x10]
push eax
call fcn.0045af14
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x4d86b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58329a
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.004d8640
push 0x348
push eax
mov dword [esp + 0x30], 0
call fcn.004d85a0
add esp, 8
mov eax, edi
push eax
call fcn.0045af14
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x4e74c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x586a31
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x88]
mov esi, 1
mov dword [esp + 0x88], 0
cmp dword [ebp + 0x10], esi
je 0x4e750e
mov eax, ebp
call fcn.004e4e10
test al, al
je 0x4e7525
call fcn.004e9060
mov esi, dword [esp + 0x8c]
push eax
call fcn.004e4bc0
jmp 0x4e7665
lea ecx, [esp + 0x14]
call fcn.004e4b00
mov eax, ebp
mov dword [esp + 0x80], esi
call fcn.004e5080
mov edi, eax
lea eax, [esp + 0x28]
add edi, esi
shr edi, 1
push eax
call fcn.004e4da0
add esp, 4
mov byte [esp + 0x80], 2
mov bl, 4
lea esp, [esp]
lea ecx, [esp + 0x28]
push ecx
lea esi, [esp + 0x18]
call fcn.004e4e60
mov eax, esi
mov ecx, ebp
lea esi, [esp + 0x64]
call fcn.004d7b00
lea edi, [esp + 0x14]
lea esi, [esp + 0x50]
mov byte [esp + 0x80], 3
call fcn.004d7aa0
mov edi, 1
push edi
lea edx, [esp + 0x40]
push edx
push eax
mov byte [esp + 0x8c], bl
call fcn.004d77d0
push eax
lea esi, [esp + 0x2c]
mov byte [esp + 0x84], 5
call fcn.004e4e60
lea ecx, [esp + 0x3c]
mov byte [esp + 0x80], bl
call fcn.0046ae2f
lea ecx, [esp + 0x50]
mov byte [esp + 0x80], 3
call fcn.0046ae2f
lea ecx, [esp + 0x64]
mov byte [esp + 0x80], 2
call fcn.0046ae2f
cmp dword [esp + 0x38], edi
je 0x4e7605
cmp dword [esp + 0x24], edi
je 0x4e762b
lea edx, [esp + 0x14]
mov eax, esi
call fcn.004e7460
jmp 0x4e761e
cmp dword [esp + 0x24], edi
jne 0x4e7560
lea edx, [esp + 0x14]
lea eax, [esp + 0x28]
call fcn.004e7460
neg eax
test eax, eax
jl 0x4e7560
mov edi, 1
mov esi, dword [esp + 0x8c]
lea eax, [esp + 0x14]
push eax
call fcn.004e4bc0
lea ecx, [esp + 0x28]
mov dword [esp + 0x88], edi
mov byte [esp + 0x80], 1
call fcn.0046ae2f
lea ecx, [esp + 0x14]
mov byte [esp + 0x80], 0
call fcn.0046ae2f
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 8

Function at 0x4e9b80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56e950
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
push 0x10
xor ebx, ebx
push str.BER_decode_error
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00414470
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x38], ebx
call fcn.00468952
mov byte [esp + 0x30], 2
cmp dword [esp + 0x24], 0x10
jb 0x4e9bf3
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00535941
add esp, 4
mov dword [esi], vtable.CryptoPP::BERDecodeErr.0
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov dword [esp + 0x30], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x4eb7a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58329a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.004d86b0
push 0x1bb8d
push eax
mov dword [esp + 0x30], 0
call fcn.004d85a0
add esp, 8
lea eax, [esp + 0x10]
push eax
call fcn.0045af14
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x4eb810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58329a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.004eb7a0
push 1
push eax
mov dword [esp + 0x30], 0
call fcn.004d85a0
add esp, 8
lea eax, [esp + 0x10]
push eax
call fcn.0045af14
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x4eb880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58329a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.004eb810
push 1
push eax
mov dword [esp + 0x30], 0
call fcn.004d85a0
add esp, 8
lea eax, [esp + 0x10]
push eax
call fcn.0045af14
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x4eb8f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5851ba
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.004eb880
push 1
push eax
mov dword [esp + 0x30], 0
call fcn.004d85a0
add esp, 8
lea eax, [esp + 0xc]
push eax
call fcn.0045af14
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4fa6b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57e848
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 2
lea eax, [esp + 0xc]
push eax
call fcn.004e4c70
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], 0
call fcn.004f9850
add esp, 4
lea ecx, [esp + 8]
mov bl, al
mov dword [esp + 0x24], 0xffffffff
call fcn.0046ae2f
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x20
ret
Function at 0x4fa720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x580d17
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0xb4]
mov dword fs:[0], eax
mov ebx, dword [esp + 0xc8]
mov ebp, dword [esp + 0xc4]
xor eax, eax
cmp ebx, 0x10
mov dword [esp + 0x14], eax
jae 0x4fa7b5
push 0x12
push str.invalid_bit_length
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], eax
mov byte [esp + 0x28], al
call fcn.00414470
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x8c]
push ecx
mov dword [esp + 0xc4], 1
call fcn.00468952
push 0x648cdc
lea edx, [esp + 0x8c]
push edx
call fcn.0053cd8e
lea ecx, [esp + 0x74]
call fcn.004e4b00
lea ecx, [esp + 0x60]
mov dword [esp + 0xbc], 2
call fcn.004e4b00
test bl, 1
mov byte [esp + 0xbc], 3
jne 0x4fa8b6
push 0xb6
lea eax, [esp + 0x50]
push eax
call fcn.004e4c70
mov edi, ebx
shr edi, 1
lea ecx, [edi - 8]
push ecx
lea edx, [esp + 0x3c]
push edx
push eax
mov byte [esp + 0xc8], 4
call fcn.004d7860
push eax
lea esi, [esp + 0x78]
mov byte [esp + 0xc0], 5
call fcn.004e4e60
lea ecx, [esp + 0x38]
mov byte [esp + 0xbc], 4
call fcn.0046ae2f
lea ecx, [esp + 0x4c]
mov byte [esp + 0xbc], 3
call fcn.0046ae2f
push 1
lea eax, [esp + 0x3c]
push eax
call fcn.004e4c70
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0xc0], 6
call fcn.004e4da0
add esp, 4
mov edi, eax
mov bl, 7
lea eax, [esp + 0x38]
lea esi, [esp + 0x4c]
mov byte [esp + 0xbc], bl
call fcn.004d7ac0
push eax
lea esi, [esp + 0x64]
mov byte [esp + 0xc0], 8
call fcn.004e4e60
lea ecx, [esp + 0x4c]
mov byte [esp + 0xbc], bl
call fcn.0046ae2f
lea ecx, [esp + 0x1c]
mov byte [esp + 0xbc], 6
call fcn.0046ae2f
lea ecx, [esp + 0x38]
jmp 0x4fa93d
lea edx, [esp + 0x1c]
lea edi, [ebx - 1]
shr edi, 1
push edx
call fcn.004e4da0
add esp, 4
push eax
lea esi, [esp + 0x78]
mov byte [esp + 0xc0], 9
call fcn.004e4e60
lea ecx, [esp + 0x1c]
mov byte [esp + 0xbc], 3
call fcn.0046ae2f
push 0xb5
lea eax, [esp + 0x50]
push eax
call fcn.004e4c70
add ebx, 1
shr ebx, 1
sub ebx, 8
push ebx
lea ecx, [esp + 0x20]
push ecx
push eax
mov byte [esp + 0xc8], 0xa
call fcn.004d7860
push eax
lea esi, [esp + 0x64]
mov byte [esp + 0xc0], 0xb
call fcn.004e4e60
lea ecx, [esp + 0x1c]
mov byte [esp + 0xbc], 0xa
call fcn.0046ae2f
lea ecx, [esp + 0x4c]
mov byte [esp + 0xbc], 3
call fcn.0046ae2f
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x3c]
mov esi, 1
push eax
mov dword [esp + 0x20], esi
call fcn.004fc630
add esp, 8
mov byte [esp + 0xbc], 0xc
movzx ecx, byte [eax + 8]
push ecx
lea edx, [esp + 0x78]
push edx
push 0x630980
mov edi, eax
call fcn.004e9640
movzx ecx, byte [eax + 8]
push ecx
lea edx, [esp + 0x64]
push edx
push 0x630984
mov edi, eax
call fcn.004e9640
push eax
push ebp
call fcn.004d5ac0
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x18], esi
mov byte [esp + 0xc0], 3
call fcn.0046a6f6
lea ecx, [esp + 0x60]
mov byte [esp + 0xbc], 2
call fcn.0046ae2f
lea ecx, [esp + 0x74]
mov byte [esp + 0xbc], 0
call fcn.0046ae2f
mov eax, ebp
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
Function at 0x4facd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x580c64
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov si, cx
mov ebx, dword [esp + 0x90]
test si, si
mov dword [esp + 0x1c], 0
je 0x4faf38
movzx ebp, word [esp + 0x8c]
mov edi, dword [esp + 0x88]
mov eax, dword [edi]
push ebp
push ebx
mov dword [esp + 0x2c], eax
call fcn.004e7380
mov ecx, eax
movzx edx, si
mov eax, ebp
sub eax, ecx
imul eax, edx
xor edx, edx
div ebp
mov eax, dword [ebx + 8]
test eax, eax
mov ecx, dword [ebx + 0xc]
mov esi, edx
mov dword [esp + 0x20], esi
je 0x4fad61
lea ecx, [ecx + eax*4 - 4]
cmp dword [ecx], 0
jne 0x4fad61
sub eax, 1
sub ecx, 4
test eax, eax
jne 0x4fad52
cmp eax, 1
ja 0x4fae04
push ebp
lea eax, [esp + 0x40]
push eax
call fcn.004e4c70
push esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x84], 0
mov edi, 1
push ecx
mov dword [esp + 0x24], edi
call fcn.004e4c70
mov eax, dword [esp + 0x94]
mov dword [esp + 0x80], edi
lea edi, [esp + 0x28]
lea esi, [esp + 0x64]
mov dword [esp + 0x1c], 3
call fcn.004d7ae0
mov dword [esp + 0x80], 2
mov edi, ebx
lea esi, [esp + 0x50]
mov dword [esp + 0x1c], 7
call fcn.004d7aa0
mov dword [esp + 0x80], 3
mov ebx, 0xf
lea edx, [esp + 0x3c]
mov dword [esp + 0x1c], ebx
call fcn.004d7960
test al, al
mov edi, dword [esp + 0x88]
je 0x4fae08
mov byte [esp + 0x1b], 1
jmp 0x4fae0d
mov ebx, dword [esp + 0x1c]
mov byte [esp + 0x1b], 0
test bl, 8
mov dword [esp + 0x80], 2
je 0x4fae2d
and ebx, 0xfffffff7
lea ecx, [esp + 0x50]
mov dword [esp + 0x1c], ebx
call fcn.0046ae2f
test bl, 4
mov dword [esp + 0x80], 1
je 0x4fae4d
and ebx, 0xfffffffb
lea ecx, [esp + 0x64]
mov dword [esp + 0x1c], ebx
call fcn.0046ae2f
test bl, 2
mov dword [esp + 0x80], 0
je 0x4fae6d
and ebx, 0xfffffffd
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], ebx
call fcn.0046ae2f
test bl, 1
mov dword [esp + 0x80], 0xffffffff
je 0x4fae86
lea ecx, [esp + 0x3c]
call fcn.0046ae2f
cmp byte [esp + 0x1b], 0
je 0x4fae91
add dword [esp + 0x20], ebp
mov edx, dword [esp + 0x20]
cmp edx, dword [esp + 0x24]
jae 0x4faf38
jmp 0x4faea8
mov edi, dword [esp + 0x88]
mov esi, dword [edi + 8]
cmp esi, dword [edi + 0xc]
jbe 0x4faeb5
call fcn.00536646
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], edi
mov edi, dword [esp + 0x20]
lea esi, [esp + 0x28]
mov dword [esp + 0x30], 0
call fcn.0040c9b0
mov edi, dword [esp + 0x28]
test edi, edi
mov esi, dword [esp + 0x2c]
jne 0x4faeea
call fcn.00536646
call fcn.00536646
jmp 0x4faeee
test esi, esi
jne 0x4faef3
call fcn.00536646
mov ebx, dword [edi + 8]
cmp ebx, dword [edi + 0xc]
jbe 0x4faf00
call fcn.00536646
mov eax, esi
sub eax, ebx
mov ebx, dword [esp + 0x30]
sar eax, 2
shl eax, 5
add eax, ebx
cmp eax, dword [edi]
jb 0x4faf19
call fcn.00536646
mov eax, dword [esp + 0x20]
mov edx, 1
mov ecx, ebx
shl edx, cl
add eax, ebp
mov dword [esp + 0x20], eax
or dword [esi], edx
cmp eax, dword [esp + 0x24]
jb 0x4faea1
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret