joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a820
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42a947
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00428180
mov eax, dword [esp + 4]
test eax, eax
je 0x42a930
mov dword [esp + 0xc], eax
call fcn.00449910
mov eax, dword [esp]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0xc]
mov dword [esp], ecx
call fcn.00425ab0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00427da0
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
movzx edx, byte [ecx + 6]
mov byte [esp + 0xb], dl
mov ebx, dword [esp + 0xc]
lea ebp, [ebx + 0x48]
mov dword [esp + 0x18], ebp
mov dword [esp], ebp
call fcn.0040a780
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x42a8b8
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42a8f9
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x42a8cd
cmp byte [ebp + 6], dl
je 0x42a8d8
cmp esi, ebx
ja 0x42a8f9
jne 0x42a8b6
cmp byte [ebp + 6], dl
jbe 0x42a8b6
jmp 0x42a8f9
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040a980
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00449930
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.0042a6a0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040a980
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00449930
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x50b589]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00438c50
nop
call fcn.00463e70
jmp fcn.0042a820

Function at 0x42ae40
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42af39
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x42aec4
cmp cl, 2
je 0x42ae7d
cmp cl, 3
jne 0x42af22
mov byte [eax + 8], 1
jmp 0x42af1e
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.004303b0
lea eax, [0x5ee8f8]
mov dword [esp], eax
call fcn.0040a780
lea eax, [0x5ee8a8]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00417f80
lea eax, [0x5ee8f8]
mov dword [esp], eax
call fcn.0040a980
jmp 0x42af1e
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00416f80
lea eax, [0x5ee8f8]
mov dword [esp], eax
call fcn.0040a780
lea eax, [0x5ee880]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00417f80
lea eax, [0x5ee8f8]
mov dword [esp], eax
call fcn.0040a980
add esp, 0x14
ret
lea eax, [0x5068e0]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00438c50
nop
call fcn.00463e70
jmp fcn.0042ae40
Function at 0x458630
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x458730
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00458f60
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4ea600]
mov dword [esp], ecx
call fcn.0040cb10
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x5ee990]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.00457b70
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00457230
add esp, 0x28
ret
call fcn.00463e70
jmp fcn.00458630
Function at 0x45bc30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45bccf
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00465377
lea ecx, [0x45bce0]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00463d60
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00463e70
jmp fcn.0045bc30
Function at 0x462fa0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
sub esp, 0x20
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.004444f0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
test byte [eax], al
movzx ecx, byte [0x60a2b1]
test cl, cl
je 0x463029
call fcn.00434db0
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x190], eax
mov dword [ecx + 0x194], 3
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x800
lea edx, [esp + 0x14]
mov dword [esp], edx
call fcn.00451ae0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x198], eax
jmp 0x46305f
call fcn.00434da0
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x190], eax
mov dword [ecx + 0x194], 1
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00451ae0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x198], eax
mov eax, dword [0x5e3ef4]
mov dword [esp], eax
lea eax, [ecx + 0x190]
mov dword [esp + 4], eax
call fcn.00404800
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x19c]
mov dword [esp + 0x2c], ecx
test ecx, ecx
jne 0x46309b
mov eax, dword [eax + 0x1a4]
mov dword [esp + 0x30], eax
call fcn.00444580
add esp, 0x20
ret
Function at 0x465130
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x60a660]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x4638fb
je 0x46394e
cmp ebx, 0x20
jbe 0x463954
cmp ebx, 0x40
jbe 0x46399a
jmp 0x463a3b
test ebx, ebx
je 0x463944
add eax, 0x10
test ax, 0xff0
je 0x463930
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x518c20]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x518d20]
jmp 0x463918
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x463918
pxor xmm1, xmmword [0x60a670]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x60a670]
pxor xmm2, xmmword [0x60a680]
pxor xmm3, xmmword [0x60a690]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x60a670]
pxor xmm2, xmmword [0x60a680]
pxor xmm3, xmmword [0x60a690]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x463a9a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x60a2af], 0
je 0x46514a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4638c0
jmp fcn.00409070
Function at 0x465150
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4034ae
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00409070
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.00463e70
jmp 0x403470
cmp byte [0x60a2af], 0
je 0x46516b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x4638c0
jmp 0x403470
Function at 0x47c3a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47c617
sub esp, 0x70
mov eax, dword [esp + 0x8c]
and eax, dword [esp + 0x78]
test eax, 0x80000000
je 0x47c4a3
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x90]
mov ebx, dword [esp + 0x94]
mov ebp, eax
sub eax, edx
mov esi, ecx
sbb ecx, ebx
test ecx, ecx
jge 0x47c43b
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edx
cmp ebx, esi
xchg edi, ebx
setl bl
xchg edi, ebx
sete bl
cmp edx, ebp
setb dl
and edx, ebx
or edx, edi
test dl, dl
jne 0x47c421
test ecx, ecx
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
jmp 0x47c43b
mov dword [esp + 0xa0], 0x7fffffff
mov dword [esp + 0x9c], 0xffffffff
add esp, 0x70
ret
mov dword [esp + 0x44], ecx
mov dword [esp + 0x3c], eax
xchg edi, ebx
setg bl
xchg edi, ebx
sete cl
test eax, eax
seta al
and eax, ecx
or eax, edi
test al, al
je 0x47c489
cmp ebx, esi
setg al
sete cl
cmp edx, ebp
seta dl
and edx, ecx
or edx, eax
test dl, dl
je 0x47c489
mov dword [esp + 0xa0], 0x80000000
mov dword [esp + 0x9c], 0
add esp, 0x70
ret
mov eax, dword [esp + 0x44]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x9c], eax
add esp, 0x70
ret
lea eax, [esp + 0x74]
mov dword [esp], eax
call fcn.0047ae70
mov eax, dword [esp + 4]
mov dword [esp + 0x58], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x54], ecx
lea edx, [esp + 0x88]
mov dword [esp], edx
call fcn.0047ae70
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x58]
mov edx, ecx
sub ecx, eax
mov ebx, eax
mov eax, ecx
mov ebp, 0x3b9aca00
mov ecx, edx
mul ebp
mov dword [esp + 0x58], edx
mov dword [esp + 0x50], eax
mov ebp, dword [esp + 8]
sub ecx, ebx
mov ecx, dword [esp + 0x54]
sbb ecx, ebp
mov dword [esp + 0x4c], ecx
lea ebx, [esp + 0x74]
mov dword [esp], ebx
call fcn.0047ae40
mov eax, dword [esp + 4]
mov dword [esp + 0x48], eax
lea ecx, [esp + 0x88]
mov dword [esp], ecx
call fcn.0047ae40
mov eax, dword [esp + 0x4c]
imul eax, eax, 0x3b9aca00
mov ecx, dword [esp + 0x58]
add eax, ecx
mov ecx, dword [esp + 0x48]
sub ecx, dword [esp + 4]
mov edx, ecx
sar ecx, 0x1f
mov ebx, dword [esp + 0x50]
add ebx, edx
mov dword [esp + 0x38], ebx
adc eax, ecx
mov dword [esp + 0x40], eax
lea edi, [esp]
lea esi, [esp + 0x88]
call fcn.0046585e
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
call fcn.0047c1d0
lea edi, [esp + 0x5c]
lea esi, [esp + 0x1c]
call fcn.0046585e
lea edi, [esp]
lea esi, [esp + 0x5c]
call fcn.0046585e
lea edi, [esp + 0x14]
lea esi, [esp + 0x74]
call fcn.0046585e
call fcn.0047b370
movzx eax, byte [esp + 0x28]
test al, al
jne 0x47c5fd
lea edi, [esp]
lea esi, [esp + 0x74]
call fcn.0046585e
lea edi, [esp + 0x14]
lea esi, [esp + 0x88]
call fcn.0046585e
call fcn.0047b270
movzx eax, byte [esp + 0x28]
test al, al
je 0x47c5e3
mov dword [esp + 0xa0], 0x80000000
mov dword [esp + 0x9c], 0
add esp, 0x70
ret
mov dword [esp + 0xa0], 0x7fffffff
mov dword [esp + 0x9c], 0xffffffff
add esp, 0x70
ret
mov eax, dword [esp + 0x40]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x9c], eax
add esp, 0x70
ret
call fcn.00463e70
jmp fcn.0047c3a0
Function at 0x492970
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4929a8
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
xor ebx, ebx
jmp 0x49299f
movzx ebp, byte [eax + ebx]
inc ebx
imul edx, edx, 0x1000193
xor edx, ebp
cmp ecx, ebx
jg 0x492992
mov dword [esp + 0x14], edx
ret
call fcn.00463e70
jmp fcn.00492970
Function at 0x49ee30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49efd2
sub esp, 0xc
mov eax, dword [esp + 0x14]
cmp eax, 2
jl 0x49ef07
mov ecx, dword [esp + 0x10]
movzx edx, byte [ecx]
cmp byte [ecx + 1], 0x3a
jne 0x49ee8b
lea ebx, [edx - 0x30]
cmp bl, 9
jbe 0x49ee7b
lea ebx, [edx - 0x61]
cmp bl, 0x19
jbe 0x49ee7b
lea ebx, [edx - 0x41]
cmp bl, 0x19
ja 0x49ee8b
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 2
add esp, 0xc
ret
cmp eax, 5
jge 0x49ee94
xor edx, edx
jmp 0x49eeab
mov byte [esp], dl
call fcn.0049ecc0
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0x14]
test dl, dl
jne 0x49eeb3
xor edx, edx
jmp 0x49eef6
movzx eax, byte [ecx + 1]
mov byte [esp], al
call fcn.0049ecc0
movzx eax, byte [esp + 4]
test al, al
jne 0x49eed4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
xor edx, edx
jmp 0x49eef6
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 2]
mov byte [esp], cl
call fcn.0049ecc0
movzx eax, byte [esp + 4]
xor eax, 1
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0x14]
test dl, dl
je 0x49ef1b
cmp byte [ecx + 2], 0x2e
je 0x49ef1b
mov edx, 3
jmp 0x49ef3e
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
add esp, 0xc
ret
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
add esp, 0xc
ret
mov ebx, dword [esp + 8]
lea edx, [ebx + 1]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea ebx, [eax - 1]
cmp edx, ebx
jge 0x49ef1b
mov dword [esp + 8], edx
movzx eax, byte [ecx + edx]
mov byte [esp], al
call fcn.0049ecc0
movzx eax, byte [esp + 4]
test al, al
je 0x49ef2f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
movzx edx, byte [ecx + eax + 1]
mov byte [esp], dl
call fcn.0049ecc0
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
lea ebx, [edx + ecx + 1]
test al, al
jne 0x49ef1b
cmp byte [ebx], 0x2e
je 0x49ef1b
lea eax, [edx + 1]
jmp 0x49ef9d
mov edx, dword [esp + 8]
lea eax, [edx + 1]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
cmp edx, eax
jle 0x49efc6
mov dword [esp + 8], eax
movzx edx, byte [eax + ecx]
mov byte [esp], dl
call fcn.0049ecc0
movzx eax, byte [esp + 4]
test al, al
je 0x49ef92
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
call fcn.00463e70
jmp fcn.0049ee30
Function at 0x4a1250
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a132b
sub esp, 0x10
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 4]
test cl, cl
je 0x4a130d
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4a130d
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
call fcn.00480dc0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
sub ecx, dword [esp + 8]
movzx edx, byte [eax + 6]
test dl, dl
je 0x4a12df
mov dword [esp + 0xc], ecx
mov ecx, dword [eax]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call fcn.004a2aa0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
call fcn.004a1020
jmp 0x4a1309
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004a1020
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004a2aa0
add esp, 0x10
ret
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004a2aa0
add esp, 0x10
ret
call fcn.00463e70
jmp fcn.004a1250
Function at 0x4ad590
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ad6ba
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov edx, dword [esp + 0x24]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov word [esp + 0xc], cx
call fcn.004aff70
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 2]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004aff70
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 4]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004aff70
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 6]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004aff70
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004aff70
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebx, word [ebx + 0xa]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bx
call fcn.004aff70
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
add esp, 0x1c
ret
call fcn.00463e70
jmp fcn.004ad590
Function at 0x4aec40
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4aed9f
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.00465377
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4aec7a
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x4aeca3
lea eax, [0x4eca00]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.0044cc90
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x38]
mov ebx, eax
xor eax, eax
call fcn.00465377
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x54], ecx
lea ecx, [esp + 0x6c]
mov dword [esp], ecx
call fcn.004ad470
movzx ecx, word [esp + 4]
movzx edx, word [esp + 6]
mov word [esp + 0x46], cx
mov word [esp + 0x48], dx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x3c]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x38]
cmp ebx, edx
jae 0x4aed49
mov dword [esp + 0x24], ecx
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0xc
lea eax, [0x4eca00]
mov dword [esp + 0x10], eax
call fcn.0044cd30
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
lea eax, [ebp + ecx]
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.00465a70
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x38]
call fcn.00465836
add esp, 0x5c
ret
call fcn.00463e70
jmp fcn.004aec40
Function at 0x4c3090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c3203
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x4c3129
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x4c30c8
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4c3135
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4c30f3
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4c3135
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4c3135
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004c2f00
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.004c9e10
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.00463e70
jmp fcn.004c3090