joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3470
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x537088]
test eax, eax
je 0x4b3555
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4b34a1
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x4b354a
mov eax, dword [0x537088]
test eax, eax
je 0x4b3564
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4b3527
mov esi, eax
test eax, eax
jne 0x4b3507
movzx eax, byte [0x538038]
mov ecx, 0x20
mov edx, 8
call fcn.00439850
test eax, eax
je 0x4b357f
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x537088
mov esi, eax
mov eax, dword [0x537088]
test eax, eax
je 0x4b3573
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x4b352b
movaps xmm0, xmmword [esp]
jmp 0x4b3539
xor esi, esi
jmp 0x4b354d
lea ecx, [esp + 0x10]
call fcn.004ae800
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x537088
call fcn.004ec0d0
jmp 0x4b3488
mov ecx, 0x537088
call fcn.004ec0d0
jmp 0x4b34af
mov ecx, 0x537088
call fcn.004ec0d0
jmp 0x4b34ff
mov ecx, 8
mov edx, 0x20
call fcn.004e8590
int3

Function at 0x4b4e51
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x4b4e53
test al, 1
je 0x4b4e6a
test al, 2
jne 0x4b4e7e
xor eax, 3
ret
mov ecx, str.assertion_failed:_prev.is_running__
mov edx, 0x23
push 0x52aa9c
call fcn.004e8a30
mov ecx, 0x52aaac
mov edx, 0x25
push 0x52aad4
call fcn.004e8a30
Function at 0x4b6bf9
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
cmp edx, 0xffffffff
je 0x4b6c3c
movzx eax, byte [esp + 0xc]
mov esi, ecx
mov ecx, esp
mov dword [ecx], eax
push 4
push ecx
push 1
push 6
push edx
call dword [sym.imp.ws2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x4b6c35
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 4
pop esi
ret
mov ecx, str.called__Option::unwrap____on_a__None__value
mov edx, 0x2b
push 0x52b3b4
call fcn.004e8a30
Function at 0x4b6e8e
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x58]
mov esi, 0x7fffffff
mov edx, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov ebp, dword [ecx + 0xc]
cmp eax, esi
cmovb esi, eax
mov dword [esp + 0x24], esi
lea eax, [edx + 0x40]
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x28]
lea ecx, [esp + 8]
push 1
push dword [esp + 0x54]
call fcn.004b95be
add esp, 8
mov edx, dword [esp + 8]
cmp edx, 2
je 0x4b6fdf
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test edx, edx
jne 0x4b6fe8
cmp edi, 0xffffffff
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], esi
je 0x4b700a
push 0
push dword [esp + 0x28]
push dword [esp + 0x5c]
push edi
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x4b6f23
mov dword [esp + 4], eax
mov byte [esp], 4
jmp 0x4b6f8d
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
xor eax, eax
mov ecx, esp
mov byte [esp], al
mov byte [esp + 3], al
mov word [esp + 1], 0
mov dword [esp + 4], esi
call fcn.0040b924
cmp al, 0xd
jne 0x4b6f8d
test ebp, ebp
mov dword [esp + 0x1c], esi
je 0x4b6f8d
mov eax, dword [ebp + 4]
mov edx, dword [ebp]
mov esi, ebp
lock inc dword [eax]
jle 0x4b701e
add edx, 8
lea ecx, [esp + 8]
push dword [esi + 0xc]
push dword [esi + 8]
push eax
call fcn.00438e0c
add esp, 0xc
cmp byte [esp + 8], 4
je 0x4b6f8d
mov ebx, dword [esp + 8]
mov edx, dword [esp + 0x1c]
cmp bl, 4
jne 0x4b6fca
mov ebx, dword [esp]
mov esi, dword [esp + 4]
cmp bl, 4
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
je 0x4b6ff0
lea ecx, [esp + 0x14]
call fcn.0040b924
cmp al, 0xd
jne 0x4b6ff9
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x2c]
call fcn.004b4877
movzx ecx, bl
mov edx, esi
call fcn.004373a1
jmp 0x4b6ebf
mov esi, dword [esp + 0xc]
xor ecx, ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
call fcn.004373a1
jmp 0x4b6fa1
mov eax, dword [esp + 0x48]
mov byte [eax], 5
jmp 0x4b7002
mov eax, dword [esp + 0x48]
mov dword [eax], ecx
jmp 0x4b6fff
mov eax, dword [esp + 0x48]
mov byte [eax], 4
jmp 0x4b6fff
mov eax, dword [esp + 0x48]
mov dword [eax], ebx
mov dword [eax + 4], esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.called__Option::unwrap____on_a__None__value
mov edx, 0x2b
push 0x52b3e4
call fcn.004e8a30
ud2
Function at 0x4b7020
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x4c]
mov ebx, esp
lea edi, [esp + 0xc]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov ebp, dword [eax + 0xc]
lea eax, [ecx + 0x40]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x28]
mov ecx, ebx
push 1
push dword [esp + 0x54]
call fcn.004b95be
add esp, 8
mov edx, dword [esp]
cmp edx, 2
je 0x4b7176
mov ecx, dword [esp + 4]
mov esi, dword [esp + 8]
test edx, edx
jne 0x4b717f
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], esi
cmp eax, 0xffffffff
je 0x4b71a1
xor ecx, ecx
mov dword [esp], ecx
push ecx
push ecx
push ecx
push ebx
push dword [esp + 0x68]
push dword [esp + 0x68]
push eax
call dword [sym.imp.ws2_32.dll_WSASend]
cmp eax, 0xffffffff
je 0x4b70c9
mov byte [esp + 0x14], 4
mov esi, dword [esp]
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], esi
cmp bl, 4
mov dword [esp + 0xc], ebx
jne 0x4b712f
jmp 0x4b718f
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
lea ecx, [esp + 0x14]
mov esi, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
call fcn.0040b924
cmp al, 0xd
jne 0x4b7121
test ebp, ebp
je 0x4b7121
mov eax, dword [ebp + 4]
mov edx, dword [ebp]
mov ebx, ebp
lock inc dword [eax]
jle 0x4b71b5
add edx, 8
mov ecx, esp
push dword [ebx + 0xc]
push dword [ebx + 8]
push eax
call fcn.00438e0c
add esp, 0xc
cmp byte [esp], 4
je 0x4b7121
mov ebx, dword [esp]
cmp bl, 4
jne 0x4b7157
xor ebx, ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov ecx, edi
call fcn.0040b924
cmp al, 0xd
jne 0x4b7187
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x2c]
call fcn.004b4877
push edi
call fcn.004b8e4f
add esp, 4
mov ebx, esp
jmp 0x4b7049
mov eax, dword [esp + 4]
xor ecx, ecx
mov edx, esi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
call fcn.004373a1
mov esi, dword [esp + 0x1c]
jmp 0x4b712f
mov eax, dword [esp + 0x48]
mov byte [eax], 5
jmp 0x4b7199
mov eax, dword [esp + 0x48]
mov dword [eax], ecx
jmp 0x4b7196
mov eax, dword [esp + 0x48]
mov dword [eax], ebx
jmp 0x4b7196
mov eax, dword [esp + 0x48]
mov byte [eax], 4
mov dword [eax + 4], esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.called__Option::unwrap____on_a__None__value
mov edx, 0x2b
push 0x52c5c4
call fcn.004e8a30
ud2
Function at 0x4b8eb6
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x5370c0]
test eax, eax
je 0x4b8f5d
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4b8edf
cmp dword [eax + 4], 0
mov edi, eax
je 0x4b8edf
add edi, 4
jmp 0x4b8f58
mov eax, dword [0x5370c0]
test eax, eax
je 0x4b8f6c
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4b8f56
mov esi, eax
test eax, eax
jne 0x4b8f38
mov al, byte [0x538038]
mov ecx, 8
mov edx, 4
call fcn.00439850
test eax, eax
je 0x4b8f87
mov dword [eax], 0x5370c0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x5370c0]
test eax, eax
je 0x4b8f7b
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edi, [esi + 4]
call fcn.004b7256
mov ecx, dword [esi + 4]
mov dword [esi + 4], eax
test ecx, ecx
je 0x4b8f58
lock dec dword [ecx]
jne 0x4b8f58
call fcn.00422380
jmp 0x4b8f58
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5370c0
call fcn.004ec0d0
jmp 0x4b8ec6
mov ecx, 0x5370c0
call fcn.004ec0d0
jmp 0x4b8eed
mov ecx, 0x5370c0
call fcn.004ec0d0
jmp 0x4b8f30
mov ecx, 4
mov edx, 8
call fcn.004e8590
Function at 0x4b8f96
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov eax, dword [0x5370b0]
mov esi, ecx
test eax, eax
je 0x4b90b8
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4b8fd2
mov ebx, eax
mov eax, dword [eax]
or eax, dword [ebx + 4]
je 0x4b8fd2
add ebx, 8
jmp 0x4b90ae
mov eax, dword [0x5370b0]
test eax, eax
je 0x4b90c7
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4b9062
mov ebx, eax
test eax, eax
jne 0x4b9034
mov al, byte [0x538038]
mov ecx, 0x48
mov edx, 8
call fcn.00439850
test eax, eax
je 0x4b90e5
mov ebx, eax
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx], eax
mov dword [ebx + 0x40], 0x5370b0
mov eax, dword [0x5370b0]
test eax, eax
je 0x4b90d6
dec eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x4b906d
mov eax, esp
mov ecx, 0x10
mov edx, esi
mov edi, eax
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov edx, dword [eax]
or edx, dword [eax + 4]
je 0x4b9066
lea esi, [esp + 8]
lea edi, [esp + 0x40]
mov ecx, 0xe
jmp 0x4b907b
xor ebx, ebx
jmp 0x4b90ae
mov ecx, esp
call fcn.004b8e9a
lea edi, [esp + 0x40]
mov ecx, 0xe
mov esi, 0x52c5e0
mov eax, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x10
mov esi, ebx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 4], 0
mov dword [ebx], 1
add ebx, 8
lea esi, [esp + 0x40]
mov ecx, 0xe
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
call fcn.004b8e9a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x5370b0
call fcn.004ec0d0
jmp 0x4b8fb5
mov ecx, 0x5370b0
call fcn.004ec0d0
jmp 0x4b8fe0
mov ecx, 0x5370b0
call fcn.004ec0d0
jmp 0x4b902c
mov ecx, 8
mov edx, 0x48
call fcn.004e8590
push edi
push esi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x4b9142
dec eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [edi + 4]
test eax, eax
je 0x4b9120
lock dec dword [eax]
jne 0x4b9120
mov ecx, dword [edi + 4]
call fcn.00422380
push edi
push 0
push dword [0x537fc8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esi]
test eax, eax
je 0x4b914b
dec eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop edi
ret
mov ecx, esi
call fcn.004ec0d0
jmp 0x4b9103
mov ecx, esi
call fcn.004ec0d0
jmp 0x4b9136
Function at 0x4b90f4
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov eax, dword [0x5370b0]
mov esi, ecx
test eax, eax
je 0x4b90b8
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x4b8fd2
mov ebx, eax
mov eax, dword [eax]
or eax, dword [ebx + 4]
je 0x4b8fd2
add ebx, 8
jmp 0x4b90ae
mov eax, dword [0x5370b0]
test eax, eax
je 0x4b90c7
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4b9062
mov ebx, eax
test eax, eax
jne 0x4b9034
mov al, byte [0x538038]
mov ecx, 0x48
mov edx, 8
call fcn.00439850
test eax, eax
je 0x4b90e5
mov ebx, eax
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx], eax
mov dword [ebx + 0x40], 0x5370b0
mov eax, dword [0x5370b0]
test eax, eax
je 0x4b90d6
dec eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x4b906d
mov eax, esp
mov ecx, 0x10
mov edx, esi
mov edi, eax
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov edx, dword [eax]
or edx, dword [eax + 4]
je 0x4b9066
lea esi, [esp + 8]
lea edi, [esp + 0x40]
mov ecx, 0xe
jmp 0x4b907b
xor ebx, ebx
jmp 0x4b90ae
mov ecx, esp
call fcn.004b8e9a
lea edi, [esp + 0x40]
mov ecx, 0xe
mov esi, 0x52c5e0
mov eax, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x10
mov esi, ebx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 4], 0
mov dword [ebx], 1
add ebx, 8
lea esi, [esp + 0x40]
mov ecx, 0xe
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
call fcn.004b8e9a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x5370b0
call fcn.004ec0d0
jmp 0x4b8fb5
mov ecx, 0x5370b0
call fcn.004ec0d0
jmp 0x4b8fe0
mov ecx, 0x5370b0
call fcn.004ec0d0
jmp 0x4b902c
mov ecx, 8
mov edx, 0x48
call fcn.004e8590
push edi
push esi
mov edi, dword [esp + 0xc]
mov esi, dword [edi]
mov eax, dword [esi]
test eax, eax
je 0x4b9142
dec eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [edi + 4]
test eax, eax
je 0x4b9120
lock dec dword [eax]
jne 0x4b9120
mov ecx, dword [edi + 4]
call fcn.00422380
push edi
push 0
push dword [0x537fc8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esi]
test eax, eax
je 0x4b914b
dec eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop edi
ret
mov ecx, esi
call fcn.004ec0d0
jmp 0x4b9103
mov ecx, esi
call fcn.004ec0d0
jmp 0x4b9136
Function at 0x4c3c18
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x28]
and esi, 0x1f
push edi
mov edi, dword [esp + 0x28]
cmp esi, 8
jb 0x4c3caf
mov eax, esi
shr eax, 3
mov dword [esp + 0x10], eax
cmp dword [esp + 0x30], 1
jne 0x4c3c61
push 8
lea eax, [esp + 0x18]
push edi
push eax
call fcn.004e4a90
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0x18]
jmp 0x4c3c66
mov eax, dword [edi]
mov ecx, dword [edi + 4]
push ecx
push eax
push 0
push 0
call fcn.004c3dea
push 0x1b
xor edx, ebx
xor eax, ebp
push edx
push eax
add edi, 8
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
add esp, 0x1c
push 0x9e3779b1
push 0x85ebca87
push edx
push eax
call fcn.004e3ff0
mov ebp, eax
mov ebx, edx
add ebp, 0xc2b2ae63
adc ebx, 0x85ebca77
sub esi, 8
sub dword [esp + 0x10], 1
jne 0x4c3c40
cmp esi, 4
jb 0x4c3d22
cmp dword [esp + 0x30], 1
jne 0x4c3cd1
push 4
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.004e4a90
mov ecx, dword [esp + 0x34]
add esp, 0xc
jmp 0x4c3cd3
mov ecx, dword [edi]
mov eax, 0x9e3779b1
mov dword [esp + 0x28], ecx
mul ecx
push 0x17
mov ecx, eax
add edi, 4
mov eax, 0x85ebca87
mul dword [esp + 0x2c]
add ecx, edx
xor eax, ebp
xor ecx, ebx
push ecx
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
add esp, 0xc
push 0xc2b2ae3d
push 0x27d4eb4f
push edx
push eax
call fcn.004e3ff0
mov ebp, eax
mov ebx, edx
add ebp, 0x9e3779f9
adc ebx, 0x165667b1
sub esi, 4
test esi, esi
je 0x4c3d66
movzx eax, byte [edi]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.004e3ff0
xor ebx, edx
xor ebp, eax
push 0xb
push ebx
push ebp
inc edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
add esp, 0xc
push 0x9e3779b1
push 0x85ebca87
push edx
push eax
call fcn.004e3ff0
mov ebp, eax
mov ebx, edx
sub esi, 1
jne 0x4c3d26
push 0xc2b2ae3d
xor ecx, ecx
mov esi, ebx
push 0x27d4eb4f
xor ecx, ebx
shr esi, 1
push ecx
xor esi, ebp
push esi
call fcn.004e3ff0
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.004e3ff0
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4d18cd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov eax, dword [0x537eb4]
xor eax, esp
mov dword [esp + 0x6c], eax
mov edx, dword [esp + 0x84]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x7c]
push ebx
mov ebx, dword [esp + 0x84]
push ebp
mov ebp, dword [esp + 0x80]
add ecx, ebp
push esi
push edi
mov edi, dword [esp + 0x98]
lea esi, [edx + ebx]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x14], ebx
mov ebx, ebp
mov dword [esp + 0x38], ebp
push edx
lea ebp, [eax + edi]
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edi
lea esi, [eax + 0x1004]
mov dword [esp + 0x30], esi
lea edx, [eax + 0x1004]
mov esi, dword [eax + 0x2810]
lea ecx, [eax + 0x1808]
mov dword [esp + 0x38], esi
mov esi, dword [esp + 0x18]
push esi
push edx
push ecx
push eax
lea eax, [esp + 0x38]
mov dword [esp + 0x44], ecx
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004d1da0
add esp, 0x20
cmp eax, 0xffffff88
ja 0x4d1ab3
push 0xc
add esi, eax
lea eax, [esp + 0x74]
push 0
push eax
call fcn.004e4930
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
add eax, ecx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x34]
sub eax, esi
mov dword [esp + 0x70], 1
push eax
lea eax, [esp + 0x4c]
push esi
push eax
call fcn.004d0c78
add esp, 0x18
cmp eax, 0xfffffff8
ja 0x4d1ab0
mov eax, dword [esp + 0x10]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x54]
push eax
call fcn.004d0c4a
push dword [esp + 0x38]
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.004d0c4a
push dword [esp + 0x48]
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x7c]
push eax
call fcn.004d0c4a
lea eax, [esp + 0x60]
push eax
call fcn.004d101a
mov edx, dword [esp + 0x3c]
add esp, 0x28
cmp eax, 2
ja 0x4d1a71
test edx, edx
jle 0x4d1a6d
lea eax, [esp + 0x3c]
dec edx
push eax
lea eax, [esp + 0x74]
mov dword [esp + 0x14], edx
push eax
call fcn.004d16f9
pop ecx
pop ecx
push dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push dword [esp + 0x38]
lea esi, [esp + 0x78]
push ebp
push eax
sub esp, 0xc
mov edi, esp
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004d1ac6
add esp, 0x20
cmp eax, 0xffffff88
ja 0x4d1ab3
add ebx, eax
lea eax, [esp + 0x3c]
push eax
call fcn.004d101a
mov edx, dword [esp + 0x14]
pop ecx
cmp eax, 2
jbe 0x4d1a15
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x3c]
push eax
call fcn.004c729a
pop ecx
test eax, eax
je 0x4d1ab0
test edx, edx
js 0x4d1ab0
sub ebp, edi
lea esi, [ebx + ebp]
cmp esi, dword [esp + 0x1c]
jbe 0x4d1a93
push 0xffffffffffffffba
jmp 0x4d1ab2
test ebp, ebp
je 0x4d1aa8
cmp ebx, edi
je 0x4d1aa6
push ebp
push edi
push ebx
call fcn.004e5010
add esp, 0xc
mov ebx, esi
sub ebx, dword [esp + 0x38]
mov eax, ebx
jmp 0x4d1ab3
push 0xffffffffffffffec
pop eax
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e3fdc
add esp, 0x70
ret
Function at 0x4d5f99
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [0x537eb4]
xor eax, esp
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x7c]
push ebx
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x84]
push edi
mov edi, dword [esp + 0x80]
mov ebx, edi
add eax, edi
mov dword [esp + 0x30], edi
mov edi, dword [ebp + 0x2820]
lea edx, [ecx + esi]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x2824]
add eax, edi
mov dword [esp + 0x28], edx
push ecx
mov dword [esp + 0x1c], eax
lea edx, [ebp + 0x1004]
mov eax, dword [ebp + 0x2810]
push esi
mov dword [esp + 0x34], eax
lea eax, [ebp + 0x1808]
push edx
push eax
push ebp
lea eax, [esp + 0x38]
mov dword [esp + 0x24], edi
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004d4ab3
add esp, 0x20
cmp eax, 0xffffff88
ja 0x4d6169
push 0xc
add esi, eax
lea eax, [esp + 0x6c]
push 0
push eax
call fcn.004e4930
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
add eax, ecx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], eax
push 4
pop eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x34]
sub eax, esi
push eax
lea eax, [esp + 0x44]
push esi
push eax
call fcn.004d23fa
add esp, 0x18
cmp eax, 0xffffff88
ja 0x4d6166
push ebp
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.004d2ad1
lea eax, [ebp + 0x1004]
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.004d2ad1
lea eax, [ebp + 0x1808]
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.004d2ad1
lea eax, [esp + 0x58]
push eax
call fcn.004d101a
mov ebp, dword [esp + 0x3c]
add esp, 0x28
cmp eax, 2
jg 0x4d611d
test ebp, ebp
jle 0x4d6119
lea eax, [esp + 0x34]
dec ebp
push eax
lea eax, [esp + 0x6c]
push eax
call fcn.004d5c52
pop ecx
pop ecx
push dword [esp + 0x1c]
lea eax, [esp + 0x14]
push dword [esp + 0x30]
lea esi, [esp + 0x70]
push dword [esp + 0x20]
push eax
sub esp, 0xc
mov edi, esp
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004d617c
add esp, 0x20
cmp eax, 0xffffff88
ja 0x4d6169
add ebx, eax
lea eax, [esp + 0x34]
push eax
call fcn.004d101a
pop ecx
cmp eax, 2
jle 0x4d60c6
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x34]
push eax
call fcn.004c729a
pop ecx
test eax, eax
je 0x4d6166
test ebp, ebp
js 0x4d6166
mov eax, dword [esp + 0x18]
sub eax, edi
cmp edi, dword [esp + 0x18]
ja 0x4d6166
lea esi, [eax + ebx]
cmp esi, dword [esp + 0x1c]
jbe 0x4d6149
push 0xffffffffffffffba
jmp 0x4d6168
test eax, eax
je 0x4d615e
cmp ebx, edi
je 0x4d615c
push eax
push edi
push ebx
call fcn.004e5010
add esp, 0xc
mov ebx, esi
sub ebx, dword [esp + 0x30]
mov eax, ebx
jmp 0x4d6169
push 0xffffffffffffffec
pop eax
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e3fdc
add esp, 0x68
ret