joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403eb0
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x404080
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.004736a0
jmp fcn.00403eb0
Function at 0x409b80
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x409ca4
sub esp, 0x2c
movsd xmm0, qword [esp + 0x30]
movsd qword [esp], xmm0
call fcn.00409da0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, ecx
shr ecx, 0x14
and ecx, 0x7ff
mov ebx, edx
shr edx, 0xf
and edx, 0x1f
shl ebx, 5
shr eax, 0x1b
or eax, ebx
lea ebx, [0x560de0]
movsd xmm0, qword [ebx + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x409c97
cmp edx, 0x21
jae 0x409c8b
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and eax, 0xfffff
mov dword [esp + 0x10], eax
movsd xmm0, qword [ebx + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.00467920
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004679a0
movsd xmm0, qword [esp + 0x24]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x4e8168]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd qword [esp + 0x38], xmm0
add esp, 0x2c
ret
mov eax, edx
mov ecx, 0x21
call fcn.00474b30
mov eax, edx
mov ecx, 0x21
call fcn.00474bc0
nop
call fcn.004736a0
jmp fcn.00409b80
Function at 0x40d6f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40d818
sub esp, 0x20
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 0x24]
bsf ebx, edx
jne 0x40d718
mov ebx, 0x20
mov ebp, dword [eax + 0x20]
bsf esi, ebp
jne 0x40d725
mov esi, 0x20
cmp ebp, 1
sbb edi, edi
xor edi, 0xffffffff
xchg edi, ebx
not ebx
xchg edi, ebx
and edi, ebx
lea ebx, [esi + edi]
cmp ebx, 0x40
jge 0x40d80c
mov dword [esp + 0x10], ebp
movzx ecx, word [eax + 0x18]
lea ebp, [ebx + ecx]
movzx eax, word [eax + 0x1a]
cmp ax, bp
jbe 0x40d80c
lea ebx, [ebx + ecx + 1]
test bx, 0x3f
jne 0x40d775
cmp ax, bx
je 0x40d775
mov dword [esp + 0x28], 0
add esp, 0x20
ret
mov word [esp + 0xa], bx
mov dword [esp + 0xc], edx
lea ecx, [esi + edi - 0x1f]
mov dword [esp + 0x1c], ecx
mov eax, edx
shr edx, cl
mov dword [esp + 0x18], edx
neg ecx
shl eax, cl
lea esi, [esi + edi + 1]
mov edi, ecx
mov ecx, esi
mov ebx, dword [esp + 0xc]
shr ebx, cl
mov edx, dword [esp + 0x10]
shr edx, cl
movzx ebp, bp
mov dword [esp + 0x14], ebp
cmp ecx, 0x20
sbb esi, esi
and edx, esi
and ebx, esi
cmp edi, 0x20
sbb esi, esi
and eax, esi
or eax, edx
mov edx, dword [esp + 0x1c]
cmp edx, 0x20
sbb edx, edx
mov esi, dword [esp + 0x18]
and esi, edx
or eax, esi
mov edx, dword [esp + 0x24]
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], ebx
movzx eax, word [esp + 0xa]
mov word [edx + 0x18], ax
movzx eax, word [edx + 0x3c]
inc eax
mov word [edx + 0x3c], ax
mov dword [esp], edx
call fcn.00429860
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
imul eax, dword [edx + 0x44]
add eax, dword [esp + 4]
mov dword [esp + 0x28], eax
add esp, 0x20
ret
mov dword [esp + 0x28], 0
add esp, 0x20
ret
call fcn.004736a0
jmp fcn.0040d6f0
Function at 0x417850
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x417a49
sub esp, 0x18
mov eax, dword [0x587c24]
test eax, eax
jne 0x417a32
lea eax, [0x587c14]
mov dword [esp], eax
call fcn.0040bda0
mov eax, dword [0x587c18]
test eax, eax
je 0x417896
cmp dword [eax + 8], 0xcc
jne 0x41790c
mov edx, dword [0x587c1c]
test edx, edx
jne 0x4178ee
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x58a2f0]
mov dword [esp + 8], eax
call fcn.0040dd60
mov eax, dword [esp + 0xc]
mov dword [0x587c1c], eax
mov ecx, dword [0x587c20]
mov dword [eax], ecx
mov eax, dword [0x587c1c]
mov dword [0x587c20], eax
movzx eax, byte [0x588080]
test al, al
jne 0x4178ee
xor eax, eax
jmp 0x417a03
mov edx, dword [0x587c1c]
mov ebx, dword [edx + 4]
mov dword [0x587c1c], ebx
mov ebx, dword [0x587c18]
mov dword [edx + 4], ebx
mov dword [0x587c18], edx
mov edx, dword [0x587c18]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x4179e2
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00479bb0
mov eax, dword [0x587dc8]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x41795e
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x41799e
call fcn.00474b10
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
lea eax, [0x587c14]
mov dword [esp], eax
call fcn.0040bfc0
lea eax, [0x587c10]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00479680
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00474b30
lea edx, [0x5602c0]
movzx ebx, byte [edx + eax]
lea ebp, [0x588080]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x4178ee
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x4179ec
mov ecx, 5
call fcn.00474b20
lea eax, [0x4db83a]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0046f470
nop
call fcn.004736a0
jmp fcn.00417850
Function at 0x41c330
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41c3a7
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0041c900
movzx eax, byte [esp + 4]
test al, al
je 0x41c38c
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x41c390
mov dword [esp], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], ecx
call fcn.0041c3b0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0041c950
add esp, 0xc
ret
add esp, 0xc
ret
lea eax, [0x4db852]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0046f470
nop
call fcn.004736a0
jmp fcn.0041c330
Function at 0x42cc50
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42cdd8
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42cd2f
cmp cl, 1
je 0x42ccd0
cmp cl, 2
jne 0x42cdc1
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.004797d0
lea eax, [0x5742c8]
mov dword [esp], eax
call fcn.0040bda0
lea eax, [0x5742a0]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.004189a0
lea eax, [0x5742c8]
mov dword [esp], eax
call fcn.0040bfc0
jmp 0x42cdbd
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00417850
lea eax, [0x5742c8]
mov dword [esp], eax
call fcn.0040bda0
lea eax, [0x574200]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.004189a0
lea eax, [0x5742c8]
mov dword [esp], eax
call fcn.0040bfc0
jmp 0x42cdbd
cmp cl, 3
je 0x42cd78
cmp cl, 4
jne 0x42cd3f
mov byte [eax + 8], 1
jmp 0x42cdbd
cmp cl, 5
jne 0x42cdc1
lea eax, [0x5742c8]
mov dword [esp], eax
call fcn.0040bda0
lea eax, [0x574278]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.004189a0
lea eax, [0x5742c8]
mov dword [esp], eax
call fcn.0040bfc0
jmp 0x42cdbd
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.004329a0
lea eax, [0x5742c8]
mov dword [esp], eax
call fcn.0040bda0
lea eax, [0x574228]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.004189a0
lea eax, [0x5742c8]
mov dword [esp], eax
call fcn.0040bfc0
add esp, 0x14
ret
lea eax, [0x4d9224]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0046f470
nop
call fcn.004736a0
jmp fcn.0042cc50
Function at 0x458fd0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x459141
sub esp, 0x14
lea eax, [0x588074]
mov dword [esp], eax
call fcn.00479370
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
test eax, eax
je 0x459007
mov ecx, dword [esp + 0x18]
jmp 0x459022
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 6]
test dl, dl
je 0x459022
lea eax, [ecx + 0x30]
mov dword [esp], eax
call fcn.0040bda0
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
call fcn.00458a50
mov eax, dword [esp + 0x18]
mov dword [esp], eax
lea ecx, [0x4d6f6c]
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
call fcn.00458a10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x459060
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00458ec0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 5]
test dl, 1
je 0x4590a0
mov ebx, edx
or edx, 2
mov byte [ecx + 5], dl
test dl, 4
jne 0x4590a0
or ebx, 6
mov byte [ecx + 5], bl
mov eax, dword [ecx + 0x2c]
test byte [eax], al
add eax, 0x14
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004793e0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0xc]
mov ebx, dword [ecx + 0x10]
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
test ebx, ebx
setg bl
xchg ebp, ebx
sete bl
xchg ebp, ebx
test edx, edx
seta dl
and ebp, edx
or ebp, ebx
xchg ebp, eax
mov byte [esp + 0xf], al
xchg ebp, eax
test eax, eax
jne 0x4590de
movzx edx, byte [ecx + 6]
test dl, dl
je 0x4590de
inc dword [ecx + 0x28]
mov dword [esp], ecx
call fcn.00458aa0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4590f5
movzx ebp, byte [esp + 0xf]
jmp 0x459137
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x459108
movzx ebp, byte [esp + 0xf]
jmp 0x459137
lea ecx, [eax + 0x30]
mov dword [esp], ecx
call fcn.0040bfc0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00458b00
mov eax, dword [esp + 4]
mov dword [esp], eax
call fcn.004067c0
movzx ebp, byte [esp + 4]
movzx eax, byte [esp + 0xf]
or ebp, eax
xchg ebp, eax
mov byte [esp + 0x1c], al
xchg ebp, eax
add esp, 0x14
ret
call fcn.004736a0
jmp fcn.00458fd0
Function at 0x45b050
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45b137
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp], eax
call fcn.00458a50
mov eax, dword [esp + 0x10]
mov dword [esp], eax
lea ecx, [0x4d8b90]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xe
call fcn.00458a10
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x45b0ad
call fcn.0045aeb0
mov eax, dword [esp + 0x10]
inc dword [eax + 8]
movzx ecx, byte [eax + 5]
test cl, 1
je 0x45b101
test cl, 4
je 0x45b101
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
test ebx, ebx
sete bl
xchg ebp, ebx
setg bl
xchg ebp, ebx
test edx, edx
seta dl
and ebx, edx
or ebp, ebx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x45b101
and ecx, 0xfffffffb
mov byte [eax + 5], cl
mov ecx, dword [eax + 0x2c]
test byte [ecx], al
add ecx, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0xffffffff
call fcn.004793e0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00459600
movzx eax, byte [esp + 4]
mov byte [esp + 0xf], al
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call fcn.00458aa0
movzx eax, byte [esp + 0xf]
test al, al
je 0x45b133
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.004596c0
add esp, 0x14
ret
call fcn.004736a0
jmp fcn.0045b050

Function at 0x461730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4617d9
sub esp, 0x20
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x461756
mov ecx, 1
jmp 0x461774
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.00460740
movzx eax, byte [esp + 8]
xor eax, 1
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x1f], cl
test cl, cl
jne 0x46178a
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
jmp 0x4617b7
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
movzx eax, byte [esp + 0x30]
mov byte [esp + 0xc], al
call fcn.004602a0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
movzx eax, byte [esp + 0x30]
mov byte [esp + 0x44], al
movzx eax, byte [esp + 0x1f]
mov byte [esp + 0x48], al
add esp, 0x20
ret
call fcn.004736a0
jmp fcn.00461730
Function at 0x462d70
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x462f64
sub esp, 0x54
mov eax, dword [0x587cec]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x50]
mov dword [esp + 0x4c], eax
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x58]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov word [esp + 8], 0x101
call fcn.00461090
mov eax, dword [esp + 0xc]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x4c]
lea ebp, [ebx + 0xec]
mov dword [esp], ebp
mov ebp, dword [esp + 0x5c]
mov dword [esp + 4], ebp
call fcn.00465450
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov edx, dword [esp + 0x4c]
mov ebx, dword [edx + 0x54]
mov edx, dword [edx + 0x58]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x10
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 2
call fcn.00461340
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x28]
mov dword [esp], ebx
call fcn.0044f250
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x960]
test eax, eax
jne 0x462eb1
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x3c]
jmp 0x462f43
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0044f250
mov eax, dword [esp + 0x5c]
and eax, 1
shl eax, 5
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov ecx, dword [ecx + 0x960]
lea edx, [0x5691d0]
add eax, edx
cmp ecx, 4
jae 0x462f57
lea eax, [eax + ecx*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x27
lea eax, [esp + 0x44]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.00461340
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.004613c0
add esp, 0x54
ret
mov eax, ecx
mov ecx, 4
call fcn.00474b20
nop
call fcn.004736a0
jmp fcn.00462d70
Function at 0x464cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x464eda
sub esp, 0x68
movzx eax, byte [esp + 0x88]
test al, al
je 0x464e8a
mov ecx, dword [esp + 0x8c]
test ecx, ecx
sete dl
mov ebx, dword [esp + 0x90]
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x464d9a
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x34], ebx
movzx eax, al
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x19
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.00461400
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x464e1c
mov edx, dword [esp + 0x78]
mov dword [esp + 0x48], edx
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x4c], ebp
mov esi, dword [esp + 0x80]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x84]
mov dword [esp + 0x54], esi
movzx eax, al
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ebx
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x30
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 4
call fcn.00461400
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x89]
test bl, bl
je 0x464e71
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x44], ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov byte [esp + 0xc], 0x22
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.00461400
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x68
ret
call fcn.0043d390
lea eax, [0x4d8bba]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043dbf0
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
call fcn.0043d8e0
call fcn.0043d590
call fcn.0043d3f0
lea eax, [0x4e0909]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.0046f470
nop
call fcn.004736a0
jmp fcn.00464cd0
Function at 0x472930
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4729cb
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x587cec]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00474cd7
lea ecx, [0x45ef20]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.004735b0
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.004736a0
jmp fcn.00472930