joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50ebd0
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x50ebe0
sub eax, edx
mov edx, eax
mov eax, 0x1505
mov ecx, 0
je 0x50ec16
push ebx
push edi
lea esp, [esp]
movsx edi, byte [ecx + esi]
mov ebx, eax
shl ebx, 5
add ebx, eax
add edi, ebx
inc ecx
mov eax, edi
cmp ecx, edx
jb 0x50ec00
pop edi
pop ebx
pop esi
ret

Function at 0x50f0a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6605be
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], str.SendShopAddSellPacket_Error_n
mov dword [esp + 0x18], 2
call fcn.0050eca0
mov eax, dword [esi + 0x30]
xor ebx, ebx
cmp eax, ebx
je 0x50f0ee
push eax
call fcn.00611358
add esp, 4
mov eax, dword [esi + 0x24]
push eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call fcn.00611358
add esp, 4
lea ecx, [esi + 4]
mov byte [esp + 0x18], bl
call fcn.005654d0
mov dword [esi], 0x687904
mov dword [0x70b5dc], ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x52fe30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6628e8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0051acc0
mov ecx, dword [esp + 0x30]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x34], 0
call fcn.00595820
add esp, 0xc
test al, al
jne 0x52fe9d
lea ecx, [esp + 8]
call fcn.0052fd70
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4
add esi, 0xd0
lea edx, [esp + 8]
push esi
push edx
call fcn.00595de0
add esp, 8
lea ecx, [esp + 8]
call fcn.0052fd70
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4
Function at 0x540b40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x663c08
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x705e7c]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov eax, dword [esp + 0x80]
cmp dword [eax], 0x54525059
mov edi, ecx
mov ecx, dword [esp + 0x88]
jne 0x540d4f
cmp byte [eax + 4], 0xd
lea esi, [eax + 4]
jne 0x540d41
cmp byte [esi + 1], 0xa
jne 0x540d41
lea ecx, [esp + 0x14]
add esi, 2
call fcn.00450c40
xor ebx, ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x78], ebx
call fcn.00586e10
mov eax, dword [esp + 0x84]
push esi
add eax, 0xfffffffa
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x80], 1
call fcn.00587360
push ebx
lea ecx, [esp + 0x30]
call fcn.00586dd0
push 0xffffffffffffffff
push ebx
lea esi, [edi + 0x1c]
push eax
mov ecx, esi
call fcn.00418140
cmp dword [esi + 0x18], 0x10
jb 0x540c00
mov esi, dword [esi + 4]
jmp 0x540c03
add esi, 4
push esi
call fcn.006140fe
add esp, 4
lea ecx, [esp + 0x2c]
mov dword [edi + 0x3c], eax
mov ebp, 1
call fcn.00586db0
cmp eax, ebp
jbe 0x540d27
push 0x689edc
lea ecx, [esp + 0x18]
push ecx
push ebp
lea ecx, [esp + 0x38]
call fcn.00587160
test al, al
je 0x540d15
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x20]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x540c63
call fcn.006121a6
mov ecx, dword [esp + 0x20]
push ecx
call fcn.005874d0
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add esp, 4
add eax, edx
jne 0x540c92
call fcn.006121a6
mov ecx, dword [esp + 0x20]
push 0xffffffffffffffff
push ebx
push ecx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
call fcn.00418140
mov eax, dword [esp + 0x20]
mov byte [esp + 0x78], 2
mov esi, eax
cmp eax, dword [esp + 0x24]
jbe 0x540cc9
call fcn.006121a6
mov eax, dword [esp + 0x14]
push esi
push eax
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x20]
call fcn.005409b0
mov eax, dword [esp + 0x54]
mov esi, 0x10
cmp dword [esp + 0x68], esi
jae 0x540cf0
lea eax, [esp + 0x54]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, edi
call fcn.00540a30
mov byte [esp + 0x78], 1
cmp dword [esp + 0x68], esi
jb 0x540d15
mov edx, dword [esp + 0x54]
push edx
call fcn.00611358
add esp, 4
lea ecx, [esp + 0x2c]
inc ebp
call fcn.00586db0
cmp ebp, eax
jb 0x540c25
lea ecx, [esp + 0x2c]
mov byte [esp + 0x78], bl
call fcn.00586e30
lea ecx, [esp + 0x14]
call fcn.00450db0
mov al, 1
jmp 0x540d51
push ecx
push 0x68a648
call fcn.00584ec0
add esp, 8
xor al, al
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.006117ae
add esp, 0x68
ret 0xc
Function at 0x564390
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x664fb1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
lea ecx, [esi + 0x4c]
mov dword [esi], 0x68b674
call fcn.0058a9c0
xor ebx, ebx
lea ecx, [esi + 0x60]
mov dword [esp + 0x1c], ebx
call fcn.005735d0
lea edi, [esi + 0x78]
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.004dd280
push ebx
push 0x8000
mov ecx, edi
mov byte [esp + 0x24], 2
mov dword [esi + 0x5c], 0xffffffff
mov byte [esi + 0x48], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x70], ebx
mov byte [esi + 0x74], bl
call fcn.004ddc20
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
jne 0x564441
call fcn.006121a6
mov ecx, dword [edi + 0xc]
push 0x8000
push 0x6e4848
push ecx
call fcn.00610f70
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x565c00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x665038
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x40]
cmp dword [eax + 0x18], 0x10
mov ecx, dword [eax + 0x14]
jb 0x565c38
mov eax, dword [eax + 4]
jmp 0x565c3b
add eax, 4
push ecx
push eax
call fcn.00564770
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x4c]
add esp, 8
push eax
lea ecx, [esp + 0x1c]
call fcn.00450cb0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xc]
push edx
lea ecx, [esi + 0x20]
mov dword [esp + 0x40], 0
call fcn.00565810
lea ecx, [esp + 0x18]
call fcn.00450db0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 8
Function at 0x569ab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66551f
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.00559930
xor ebx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esi + 4], 0x68b898
mov eax, esi
mov dword [esi + 8], 0x68b8a0
mov dword [0x74737c], eax
push 4
mov byte [esp + 0x30], 2
mov dword [esi], 0x68b8d0
mov dword [esi + 4], 0x68b8c8
mov dword [esi + 8], 0x68b8c0
lea edi, [esi + 0xc]
call fcn.00611363
add esp, 4
cmp eax, ebx
je 0x569b2a
mov dword [eax], edi
jmp 0x569b2c
xor eax, eax
mov dword [edi], eax
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
lea edx, [esp + 0x13]
push edx
lea eax, [esp + 0x17]
mov ebx, 3
lea ecx, [esi + 0x2c]
push eax
mov byte [esp + 0x34], bl
call fcn.00596b60
lea ecx, [esi + 0x4c]
mov byte [esp + 0x2c], 4
call fcn.0051acc0
lea ecx, [esi + 0x78]
mov byte [esp + 0x2c], 5
call fcn.00569880
fldz
fst dword [esp + 0x18]
mov dword [esi + 0x70], ebx
mov ecx, dword [esp + 0x18]
fst dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
fstp dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], eax
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x56d060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x665678
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x705e7c]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
mov esi, ecx
mov ecx, dword [esp + 8]
push ecx
push edx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.0056cb20
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.0056ce00
cmp dword [esp + 0x24], 0x10
jb 0x56d0fa
mov edx, dword [esp + 0x10]
push edx
call fcn.00611358
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.006117ae
add esp, 0x30
ret 0x1c

Function at 0x5730a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x665b03
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00567e30
xor eax, eax
mov dword [esi], 0x68bccc
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x20], al
mov ecx, esi
mov byte [esp + 0x14], 1
call fcn.00573000
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x573110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x665b03
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x68bccc
mov dword [esp + 0x14], 1
call fcn.00573030
cmp dword [esi + 0x34], 0x10
jb 0x57315d
mov eax, dword [esi + 0x20]
push eax
call fcn.00611358
add esp, 4
xor eax, eax
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], eax
mov ecx, esi
mov byte [esi + 0x20], al
mov dword [esp + 0x14], 0xffffffff
call fcn.00567e50
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x573220
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6661c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x68bcd8
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.00573110
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00568460
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x580010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6661c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x68bfe0
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.0057f8f0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00568460
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x580550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x666280
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x705e7c]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x20], eax
mov eax, 7
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], esi
mov word [esp + 0x48], cx
xor edx, edx
mov dword [esp + 0x6c], esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], esi
mov word [esp + 0x2c], dx
mov ebp, dword [esp + 0x78]
xor bl, bl
cmp ebp, esi
mov byte [esp + 0x6c], 1
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
jle 0x58067c
mov eax, dword [esp + 0x20]
lea edi, [eax + esi*2]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x28]
push edx
mov eax, ebp
sub eax, esi
push eax
push edi
call fcn.00580390
add esp, 0x10
cmp eax, 2
jne 0x5805fe
mov bl, 1
mov dword [esp + 0x14], esi
jmp 0x58065a
cmp eax, 5
jne 0x580607
xor bl, bl
jmp 0x58065a
test eax, eax
je 0x58062e
cmp eax, 1
je 0x58062e
cmp eax, 3
jne 0x58061f
mov dword [esp + 0x18], 1
jmp 0x58065a
cmp eax, 4
jne 0x58065a
mov dword [esp + 0x18], 0
jmp 0x58065a
cmp dword [esp + 0x18], 0
jne 0x58065a
test bl, bl
jne 0x58063d
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x7c]
cmp ecx, dword [esp + 0x1c]
jle 0x5806c6
movzx edx, word [edi]
inc dword [esp + 0x1c]
push edx
push 1
lea ecx, [esp + 0x4c]
call fcn.0055f810
add esi, dword [esp + 0x24]
cmp esi, ebp
jl 0x5805d2
cmp dword [esp + 0x40], 8
jb 0x58067a
mov eax, dword [esp + 0x2c]
push eax
call fcn.00611358
add esp, 4
xor esi, esi
xor ecx, ecx
cmp dword [esp + 0x5c], 8
mov dword [esp + 0x3c], esi
mov word [esp + 0x2c], cx
mov dword [esp + 0x40], 7
jb 0x5806a3
mov edx, dword [esp + 0x48]
push edx
call fcn.00611358
add esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.006117ae
add esp, 0x5c
ret
mov esi, 8
cmp dword [esp + 0x40], esi
jb 0x5806de
mov eax, dword [esp + 0x2c]
push eax
call fcn.00611358
add esp, 4
xor ecx, ecx
cmp dword [esp + 0x5c], esi
mov dword [esp + 0x3c], 0
jmp 0x580687
Function at 0x585730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6667a0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x705e7c]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, dword [esp + 0x78]
mov eax, dword [esp + 0x74]
mov ebp, dword [esp + 0x70]
push 0xa
mov ecx, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
call fcn.004945b0
mov esi, dword [edi + 0x10]
cmp dword [edi + 0xc], esi
jbe 0x58578c
call fcn.006121a6
mov ebx, dword [edi]
mov edi, dword [edi + 0xc]
mov ecx, dword [esp + 0x14]
cmp edi, dword [ecx + 0x10]
jbe 0x5857a3
call fcn.006121a6
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
push esi
push ebx
push edi
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.00451740
xor ebx, ebx
mov eax, ebp
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5857d0
sub eax, edx
push eax
push ebp
lea ecx, [esp + 0x48]
call fcn.00417c40
mov dword [esp + 0x68], ebx
xor edi, edi
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov eax, ebp
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x585800
sub eax, edx
push eax
push edi
push ebp
lea ecx, [esp + 0x4c]
call fcn.00495d30
mov esi, eax
cmp esi, ebx
jl 0x5858f9
cmp esi, dword [esp + 0x54]
jbe 0x58582a
call fcn.006121a6
mov eax, dword [esp + 0x44]
mov edi, 0x10
cmp dword [esp + 0x58], edi
jae 0x58583d
lea eax, [esp + 0x44]
cmp byte [eax + esi], 0x22
jne 0x585862
push 1
inc esi
push esi
push 0x6b2630
lea ecx, [esp + 0x4c]
call fcn.0044a000
cmp eax, ebx
jl 0x585911
lea edi, [eax + 1]
jmp 0x58587e
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x585867
sub eax, edx
push eax
push esi
push ebp
lea ecx, [esp + 0x4c]
call fcn.0044a000
mov edi, eax
sub eax, esi
push eax
push esi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x4c]
call fcn.00494560
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x6c], 1
call fcn.00450e10
mov esi, 0x10
mov byte [esp + 0x68], bl
cmp dword [esp + 0x3c], esi
jb 0x5858bb
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00611358
add esp, 4
cmp edi, dword [esp + 0x54]
jb 0x5857f0
cmp dword [esp + 0x58], esi
jb 0x5858d8
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00611358
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.006117ae
add esp, 0x58
ret
cmp dword [esp + 0x58], 0x10
jb 0x58590d
mov edx, dword [esp + 0x44]
push edx
call fcn.00611358
add esp, 4
xor al, al
jmp 0x5858da
cmp dword [esp + 0x58], edi
jb 0x58590d
mov eax, dword [esp + 0x44]
push eax
call fcn.00611358
add esp, 4
xor al, al
jmp 0x5858da
Function at 0x586f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6667a0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x705e7c]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, dword [esp + 0x74]
mov eax, dword [esp + 0x78]
mov ebp, ecx
push 0xa
mov ecx, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
call fcn.004945b0
mov esi, dword [edi + 0x10]
cmp dword [edi + 0xc], esi
jbe 0x586fba
call fcn.006121a6
mov ebx, dword [edi]
mov edi, dword [edi + 0xc]
mov ecx, dword [esp + 0x14]
cmp edi, dword [ecx + 0x10]
jbe 0x586fd1
call fcn.006121a6
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
push esi
push ebx
push edi
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.00451740
xor esi, esi
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], esi
mov byte [esp + 0x44], 0
mov eax, dword [esp + 0x70]
push eax
mov ecx, ebp
mov dword [esp + 0x6c], esi
call fcn.00586dd0
mov edi, eax
xor ebp, ebp
jmp 0x587010
mov ebx, dword [esp + 0x18]
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x587020
sub eax, edx
push eax
push ebp
push ebx
mov ecx, edi
call fcn.00495d30
mov esi, eax
test esi, esi
jl 0x58712d
cmp esi, dword [edi + 0x14]
jbe 0x587047
call fcn.006121a6
mov ebp, 0x10
cmp dword [edi + 0x18], ebp
jb 0x587056
mov eax, dword [edi + 4]
jmp 0x587059
lea eax, [edi + 4]
cmp byte [eax + esi], 0x22
jne 0x58707c
push 1
inc esi
push esi
push 0x6b2630
mov ecx, edi
call fcn.0044a000
test eax, eax
jl 0x587146
lea ebp, [eax + 1]
jmp 0x587096
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x587081
sub eax, edx
push eax
push esi
push ebx
mov ecx, edi
call fcn.0044a000
mov ebp, eax
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
call fcn.00494560
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x6c], 1
call fcn.00450e10
mov esi, 0x10
mov byte [esp + 0x68], 0
cmp dword [esp + 0x3c], esi
jb 0x5870d2
mov edx, dword [esp + 0x28]
push edx
call fcn.00611358
add esp, 4
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5870d7
sub eax, edx
push eax
push ebp
push ebx
mov ecx, edi
call fcn.00495d30
test eax, eax
jl 0x5870f7
cmp ebp, dword [edi + 0x14]
jb 0x587010
cmp dword [esp + 0x58], esi
jb 0x58710a
mov edx, dword [esp + 0x44]
push edx
call fcn.00611358
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.006117ae
add esp, 0x58
ret 0xc
cmp dword [esp + 0x58], 0x10
jb 0x587141
mov eax, dword [esp + 0x44]
push eax
call fcn.00611358
add esp, 4
or eax, 0xffffffff
jmp 0x58710c
cmp dword [esp + 0x58], ebp
jb 0x587159
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00611358
add esp, 4
mov eax, 0xfffffffe
jmp 0x58710c
Function at 0x587160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6667a0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x705e7c]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, dword [esp + 0x74]
mov eax, dword [esp + 0x78]
mov ebp, ecx
push 0xa
mov ecx, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
call fcn.004945b0
mov esi, dword [edi + 0x10]
cmp dword [edi + 0xc], esi
jbe 0x5871ba
call fcn.006121a6
mov ebx, dword [edi]
mov edi, dword [edi + 0xc]
mov ecx, dword [esp + 0x14]
cmp edi, dword [ecx + 0x10]
jbe 0x5871d1
call fcn.006121a6
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
push esi
push ebx
push edi
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.00451740
xor esi, esi
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], esi
mov byte [esp + 0x44], 0
mov eax, dword [esp + 0x70]
push eax
mov ecx, ebp
mov dword [esp + 0x6c], esi
call fcn.00586dd0
mov edi, eax
xor ebp, ebp
jmp 0x587210
mov ebx, dword [esp + 0x18]
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x587220
sub eax, edx
push eax
push ebp
push ebx
mov ecx, edi
call fcn.00495d30
mov esi, eax
test esi, esi
jl 0x58732d
cmp esi, dword [edi + 0x14]
jbe 0x587247
call fcn.006121a6
mov ebp, 0x10
cmp dword [edi + 0x18], ebp
jb 0x587256
mov eax, dword [edi + 4]
jmp 0x587259
lea eax, [edi + 4]
cmp byte [eax + esi], 0x22
jne 0x58727c
push 1
inc esi
push esi
push 0x6b2630
mov ecx, edi
call fcn.0044a000
test eax, eax
jl 0x587345
lea ebp, [eax + 1]
jmp 0x587296
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x587281
sub eax, edx
push eax
push esi
push ebx
mov ecx, edi
call fcn.0044a000
mov ebp, eax
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
call fcn.00494560
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x6c], 1
call fcn.00450e10
mov esi, 0x10
mov byte [esp + 0x68], 0
cmp dword [esp + 0x3c], esi
jb 0x5872d2
mov edx, dword [esp + 0x28]
push edx
call fcn.00611358
add esp, 4
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5872d7
sub eax, edx
push eax
push ebp
push ebx
mov ecx, edi
call fcn.00495d30
test eax, eax
jl 0x5872f7
cmp ebp, dword [edi + 0x14]
jb 0x587210
cmp dword [esp + 0x58], esi
jb 0x58730a
mov edx, dword [esp + 0x44]
push edx
call fcn.00611358
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.006117ae
add esp, 0x58
ret 0xc
cmp dword [esp + 0x58], 0x10
jb 0x587341
mov eax, dword [esp + 0x44]
push eax
call fcn.00611358
add esp, 4
xor al, al
jmp 0x58730c
cmp dword [esp + 0x58], ebp
jb 0x587341
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00611358
add esp, 4
xor al, al
jmp 0x58730c