joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a0e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sub esp, 0x68
mov edx, dword [esp + 0x78]
mov dword [esp + 0x34], 0x567468
mov eax, dword [esp + 0x74]
mov dword [esp + 0x38], 0x5c04d6
mov dword [esp + 0x40], 0x46a2e3
mov dword [esp + 0x44], esp
mov dword [esp + 0x18], edx
lea edx, [esp + 0x1c]
mov dword [esp], edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x3c], eax
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Register
lea eax, [esp + 0x57]
mov dword [esp], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp + 0x20], 0xffffffff
call fcn.005675a0
mov edx, dword [esp + 0x70]
mov dword [edx], eax
mov eax, dword [esp + 0x18]
or eax, dword [esp + 0x14]
jne 0x46a194
jmp 0x46a2c6
mov edx, dword [esp + 0x14]
mov dword [esp + 8], 0xa
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0
mov dword [esp], edx
mov dword [esp + 4], eax
call sub.libgcc_s_sjlj_1.dll___udivdi3
mov dword [esp + 0x18], edx
or edx, eax
mov dword [esp + 0x14], eax
je 0x46a242
mov edx, dword [esp + 0x14]
mov dword [esp + 8], 0xa
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0
mov dword [esp], edx
mov dword [esp + 4], eax
call sub.libgcc_s_sjlj_1.dll___umoddi3
mov dword [esp + 0x20], 1
mov dword [esp], eax
call fcn.0045a7f0
mov edx, dword [esp + 0x70]
movsx eax, al
mov dword [esp + 4], eax
lea eax, [esp + 0x58]
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.005be0d0
mov ecx, dword [esp + 0x70]
lea edx, [esp + 0x58]
mov dword [esp + 0x20], 2
mov dword [esp], edx
call fcn.00567588
sub esp, 4
mov eax, 0xffffffff
mov ecx, dword [esp + 0x58]
lock xadd dword [ecx - 4], eax
test eax, eax
jg 0x46a160
lea eax, [esp + 0x57]
sub ecx, 0xc
mov dword [esp], eax
call fcn.00567500
sub esp, 4
jmp 0x46a160
lea edx, [esp + 0x57]
sub ecx, 0xc
mov dword [esp], edx
call fcn.00567500
sub esp, 4
mov edx, dword [esp + 0x70]
mov eax, dword [edx]
mov edx, dword [esp + 0x7c]
cmp edx, dword [eax - 0xc]
jbe 0x46a2b1
mov eax, dword [esp + 0x70]
lea edx, [esp + 0x5c]
mov dword [esp + 4], 0x5c8e88
mov dword [esp], edx
mov dword [esp + 0x20], 1
mov dword [esp + 8], eax
call fcn.005bde60
mov ecx, dword [esp + 0x70]
lea eax, [esp + 0x5c]
mov dword [esp + 0x20], 3
mov dword [esp], eax
call fcn.00567588
sub esp, 4
mov eax, 0xffffffff
mov ecx, dword [esp + 0x5c]
lock xadd dword [ecx - 4], eax
test eax, eax
jle 0x46a230
mov edx, dword [esp + 0x70]
mov eax, dword [edx]
mov edx, dword [esp + 0x7c]
cmp edx, dword [eax - 0xc]
ja 0x46a251
lea eax, [esp + 0x1c]
mov dword [esp], eax
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Unregister
mov eax, dword [esp + 0x70]
add esp, 0x68
pop ebp
ret
mov ecx, dword [esp + 0x70]
mov dword [esp], 0x5c8e88
mov dword [esp + 0x20], 1
call fcn.00567658
jmp 0x46a23f
Function at 0x472860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x54]
mov dword [esp + 0x30], esi
mov eax, dword [esp + 0x44]
mov dword [esp + 0x34], edi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x38], ebp
mov edi, dword [esp + 0x40]
cmp ebx, 1
mov ebp, dword [esp + 0x48]
mov edx, dword [esp + 0x50]
je 0x4729e0
cmp ebx, 4
ja 0x4728a7
cmp edx, 3
jbe 0x4728a7
cmp eax, 7
ja 0x472960
cmp ebx, 6
ja 0x4728bb
cmp edx, 5
nop
jbe 0x4728bb
cmp eax, 0xb
ja 0x472980
cmp ebx, 8
nop
jbe 0x472905
cmp ebx, 0x10
jbe 0x472930
cmp edx, 0x1f
jbe 0x4728e1
test ebp, ebp
nop
je 0x4728e1
mov ecx, ebx
call fcn.0040c7c0
test eax, eax
jne 0x4729a0
mov dword [esp + 0x48], ebx
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x44], esi
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x40], edi
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
add esp, 0x3c
jmp fcn.00457ca0
cmp edx, 7
jbe 0x4728c2
cmp eax, 0xf
jbe 0x4728c2
mov dword [esp + 0x44], esi
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x40], edi
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
jmp fcn.00454e90
cmp edx, 0xf
jbe 0x4728c7
cmp eax, 0x1f
jbe 0x4728c7
mov dword [esp + 0x44], esi
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x40], edi
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
jmp fcn.00455620
mov dword [esp + 0x44], esi
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x40], edi
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
jmp fcn.004547d0
mov dword [esp + 0x44], esi
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x40], edi
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
jmp fcn.00454a10
lea edx, [eax + eax]
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 0x1c], eax
call fcn.00597650
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x40], ebp
mov edx, esi
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x38]
mov ecx, eax
mov eax, edi
mov edi, dword [esp + 0x34]
add esp, 0x3c
jmp fcn.00472510
mov eax, dword [esi]
mov dword [esp + 0x44], esi
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x48], 1
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x4c], eax
add esp, 0x3c
jmp fcn.004546c0
Function at 0x472a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], esi
mov ebx, dword [esp + 0x50]
mov esi, dword [esp + 0x54]
mov dword [esp + 0x44], edi
mov edi, dword [esp + 0x70]
mov dword [esp + 0x48], ebp
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x68]
mov dword [esp], ebx
mov edx, dword [esp + 0x6c]
mov dword [esp + 4], esi
mov ebp, dword [esp + 0x64]
mov dword [esp + 8], edi
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0xc], ecx
call fcn.00472860
mov edx, dword [esp + 0x28]
mov dword [esp + 0x64], edi
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], esi
mov edi, dword [esp + 0x44]
mov dword [esp + 0x50], ebx
mov esi, dword [esp + 0x40]
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
mov ebp, dword [esp + 0x48]
mov dword [esp + 0x5c], eax
add esp, 0x4c
jmp fcn.00457810
Function at 0x4731b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], esi
mov ebx, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x8c]
mov dword [esp + 0x58], ebp
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x78]
mov eax, dword [esp + 0x84]
mov dword [esp], ebx
mov edx, dword [esp + 0x88]
mov dword [esp + 4], esi
mov ebp, dword [esp + 0x80]
mov dword [esp + 8], edi
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0xc], ecx
call fcn.00472f20
mov edx, dword [esp + 0x38]
mov dword [esp + 0x74], edi
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x68], ebp
mov dword [esp + 0x64], esi
mov edi, dword [esp + 0x54]
mov dword [esp + 0x60], ebx
mov esi, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x70], edx
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x6c], eax
add esp, 0x5c
jmp fcn.00457810
Function at 0x4736a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sub esp, 0x78
mov eax, dword [esp + 0x80]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x44], 0x567468
mov dword [esp + 0x48], 0x5c0722
mov dword [esp + 0x50], 0x473817
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x54], esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Register
cmp dword [esp + 0x90], 0x47ff
ja 0x473796
movzx eax, byte [esp + 0x20]
mov dword [esp + 4], 5
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
mov byte [esp + 0x68], al
movzx eax, byte [esp + 0x24]
mov byte [esp + 0x69], al
movzx eax, byte [esp + 0x28]
mov byte [esp + 0x6a], al
mov eax, dword [esp + 0x90]
sar eax, 8
mov byte [esp + 0x6b], al
movzx eax, byte [esp + 0x90]
mov byte [esp + 0x6c], al
lea eax, [esp + 0x68]
mov dword [esp], eax
call fcn.005a1520
sub esp, 8
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x8c]
mov dword [esp], eax
call fcn.005a1520
sub esp, 8
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Unregister
add esp, 0x78
pop ebp
ret 0x14
mov dword [esp], 0xc
call sub.libstdc_6.dll___cxa_allocate_exception
mov dword [esp], str.Record_Writer:_Record_is_too_big
lea ecx, [esp + 0x68]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x67]
mov dword [esp + 4], eax
mov dword [esp + 0x30], 1
call fcn.005674b8
push ecx
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x68]
mov dword [esp], 0x50
mov dword [esp + 4], eax
mov dword [esp + 0x30], 2
call fcn.00579a50
push edx
push edx
lea ecx, [esp + 0x68]
call fcn.00567508
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0x579aa0
mov dword [esp + 4], 0x62d660
mov dword [esp + 0x30], 0xffffffff
mov dword [esp], eax
call sub.libstdc_6.dll___cxa_throw
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
test eax, eax
je 0x473837
sub eax, 1
je 0x47382e
ud2
lea ecx, [esp + 0x68]
call fcn.00567508
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.libstdc_6.dll___cxa_free_exception
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp], eax
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Resume
nop
nop
lea esi, [esi]
Function at 0x4b8f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sub esp, 0x68
movzx edx, byte [esp + 0x78]
mov dword [esp + 0x18], ecx
movzx eax, byte [esp + 0x70]
mov dword [esp + 0x44], 0x567468
mov dword [esp + 0x48], 0x5c256e
mov dword [esp + 0x50], 0x4b9092
mov byte [esp + 0x2b], dl
lea edx, [esp + 0x2c]
mov dword [esp], edx
mov byte [esp + 0x20], al
lea eax, [esp + 0x60]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], esp
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Register
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.0048e710
mov eax, dword [esp + 0x18]
cmp byte [esp + 0x20], 0
mov edx, dword [esp + 0x18]
mov dword [eax], 0x6327e8
mov eax, 0
cmovne eax, dword [esp + 0x74]
mov dword [edx + 0x34], 0
mov dword [edx + 0x2c], eax
movzx eax, byte [esp + 0x2b]
mov dword [edx + 0x40], 0
mov dword [edx + 0x3c], 0
mov dword [edx + 0x38], 0
and al, byte [esp + 0x20]
mov byte [edx + 0x30], al
add edx, 0x34
mov dword [esp], 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x30], 1
call fcn.0049b590
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [edx + 0x40], eax
mov dword [esp], 0x30
call fcn.005769c0
sub esp, 4
mov eax, dword [esp + 0x18]
mov dword [eax + 0x44], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x48], 0
add eax, 0x44
mov dword [esp], 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 2
call fcn.0049b590
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov dword [edx + 0x50], eax
mov dword [esp], 0x40
call fcn.005769c0
sub esp, 4
mov eax, dword [esp + 0x18]
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Unregister
add esp, 0x68
pop ebp
ret 0xc
Function at 0x4e3170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
sub esp, 0x94
lea edx, [esp + 0x1c]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x90]
mov dword [esp], edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x34], 0x567468
mov dword [esp + 0x38], 0x5c3523
mov dword [esp + 0x40], 0x4e33cd
mov dword [esp + 0x44], esp
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Register
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x78]
mov dword [esp + 0x20], 0xffffffff
mov dword [esp], eax
call fcn.004c25b0
sub esp, 4
mov eax, dword [esp + 0xa8]
lea ecx, [esp + 0x78]
mov dword [esp + 0x20], 1
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa4]
mov dword [esp], eax
call fcn.004616d0
sub esp, 8
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4e3370
mov ecx, dword [esp + 0x80]
movzx edx, byte [ecx]
shr dl, 7
test dl, dl
mov byte [esp + 0x1b], dl
je 0x4e3270
sub eax, 1
jmp 0x4e322a
mov ecx, dword [esp + 0x80]
sub eax, 1
add ecx, eax
movzx edx, byte [ecx]
lea ebx, [edx - 1]
test dl, dl
mov byte [ecx], bl
jne 0x4e323c
test eax, eax
jne 0x4e3220
mov eax, dword [esp + 0x84]
xor edx, edx
test eax, eax
je 0x4e33bf
lea esi, [esi]
mov eax, dword [esp + 0x80]
add eax, edx
add edx, 1
not byte [eax]
mov eax, dword [esp + 0x84]
cmp eax, edx
jne 0x4e3250
mov ecx, dword [esp + 0x80]
mov dword [esp], ecx
lea ecx, [esp + 0x64]
mov dword [esp + 8], 0x100
mov dword [esp + 4], eax
mov dword [esp + 0x20], 1
call fcn.004e20c0
sub esp, 0xc
mov ecx, dword [esp + 0xa0]
lea eax, [esp + 0x64]
mov dword [esp + 0x20], 3
mov dword [esp], eax
call fcn.00576d10
sub esp, 4
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0xa0]
test ecx, ecx
mov dword [edx + 0x10], eax
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x64]
je 0x4e32d3
test eax, eax
jne 0x4e3320
cmp byte [esp + 0x1b], 0
jne 0x4e3312
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x80]
test ecx, ecx
je 0x4e32f7
test eax, eax
jne 0x4e3350
lea eax, [esp + 0x1c]
mov dword [esp], eax
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Unregister
mov eax, dword [esp + 0x14]
add esp, 0x94
pop ebx
pop ebp
ret 0xc
mov ecx, dword [esp + 0xa0]
call fcn.00453ec0
jmp 0x4e32da
test edx, edx
je 0x4e32d3
mov ebx, dword [ecx]
shl eax, 2
mov dword [esp], edx
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x20], 1
call eax
sub esp, 8
cmp byte [esp + 0x1b], 0
je 0x4e32da
jmp 0x4e3312
test edx, edx
je 0x4e32f7
mov ebx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [ebx + 4]
mov dword [esp + 0x20], 0xffffffff
call eax
sub esp, 8
jmp 0x4e32f7
mov dword [esp], 0
lea ecx, [esp + 0x50]
mov dword [esp + 4], 0
call fcn.004d9f80
sub esp, 8
mov ecx, dword [esp + 0xa0]
lea edx, [esp + 0x50]
mov dword [esp + 0x20], 2
mov dword [esp], edx
call fcn.0058d860
sub esp, 4
lea ecx, [esp + 0x50]
mov dword [esp + 0x20], 1
call fcn.0058d820
jmp 0x4e32da
mov ecx, dword [esp + 0x80]
xor eax, eax
jmp 0x4e3270
Function at 0x4f7da0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
sub esp, 0x84
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x80]
mov dword [esp], edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x34], 0x567468
mov dword [esp + 0x38], 0x5c3ad8
mov dword [esp + 0x40], 0x4f801f
mov dword [esp + 0x44], esp
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Register
lea ecx, [esp + 0x6c]
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 0x20], 0xffffffff
call fcn.004d9f80
sub esp, 8
mov ecx, dword [esp + 0x90]
lea eax, [esp + 0x6c]
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.00457320
sub esp, 8
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x74]
test ecx, ecx
je 0x4f7e3c
test eax, eax
jne 0x4f8000
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4f7fc0
mov ecx, dword [esp + 0x90]
call fcn.00453c30
mov ecx, dword [esp + 0x90]
xor edx, edx
test al, 7
sete dl
mov dword [esp + 0x14], edx
call fcn.00453c90
lea ecx, [esp + 0x5c]
mov dword [esp + 0x20], 0xffffffff
add eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00577d00
sub esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x90]
add eax, dword [esp + 0x5c]
mov dword [esp], eax
call fcn.00453ef0
sub esp, 4
mov dword [esp], 0
lea ecx, [esp + 0x6c]
mov dword [esp + 4], 0
mov dword [esp + 0x20], 1
call fcn.004d9f80
sub esp, 8
mov ecx, dword [esp + 0x90]
lea eax, [esp + 0x6c]
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.00457320
sub esp, 8
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x78]
call fcn.0042b670
mov ebx, dword [esp + 0x10]
test ebx, ebx
jns 0x4f7f5a
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4f7f5a
xor eax, eax
lea esi, [esi]
mov edx, dword [esp + 0x5c]
add edx, eax
add eax, 1
not byte [edx]
cmp dword [esp + 0x60], eax
jne 0x4f7f10
test eax, eax
je 0x4f7f5a
mov edx, dword [esp + 0x5c]
lea ecx, [edx + eax - 1]
add byte [ecx], 1
jne 0x4f7f5a
sub eax, 2
jmp 0x4f7f55
mov ecx, dword [esp + 0x5c]
add ecx, eax
sub eax, 1
movzx edx, byte [ecx]
add edx, 1
test dl, dl
mov byte [ecx], dl
jne 0x4f7f5a
cmp eax, 0xffffffff
jne 0x4f7f40
lea edx, [esp + 0x5c]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x20], 1
mov dword [esp + 8], edx
mov eax, dword [esp + 0x98]
mov edx, dword [esp + 0x94]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004b4590
sub esp, 0xc
lea ecx, [esp + 0x5c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 0xffffffff
call fcn.00576b30
lea eax, [esp + 0x1c]
mov dword [esp], eax
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Unregister
mov eax, dword [esp + 0x10]
add esp, 0x84
pop ebx
pop ebp
ret 0xc
mov edx, dword [esp + 0x98]
mov dword [esp + 8], 0
mov eax, dword [esp + 0x94]
mov dword [esp + 0x20], 0xffffffff
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b4170
sub esp, 0xc
mov dword [esp + 0x10], eax
jmp 0x4f7fa0
test edx, edx
je 0x4f7e3c
mov ebx, dword [ecx]
shl eax, 2
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [ebx + 4]
sub esp, 8
jmp 0x4f7e3c
Function at 0x500920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sub esp, 0x68
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x60]
mov dword [esp], edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x34], 0x567468
mov dword [esp + 0x38], 0x5c3d62
mov dword [esp + 0x40], 0x500aad
mov dword [esp + 0x44], esp
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Register
mov dword [esp + 0x20], 0xffffffff
call fcn.004932b0
mov ecx, eax
call fcn.00453400
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
nop
lea esi, [esi]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
mov eax, dword [eax + 4]
sub eax, edx
sar eax, 2
cmp eax, dword [esp + 0x10]
ja 0x5009d3
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
test edx, edx
je 0x500a0c
mov eax, dword [esp + 0x74]
mov dword [esp + 0x20], 0xffffffff
mov dword [esp], eax
call fcn.004ffce0
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x78]
mov dword [ecx + 8], eax
lea ecx, [esp + 0x1c]
mov dword [esp], ecx
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Unregister
add esp, 0x68
pop ebp
ret 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [edx + eax*4]
test ecx, ecx
je 0x500994
mov edx, dword [esp + 0x70]
mov eax, dword [ecx]
mov dword [esp], edx
mov eax, dword [eax + 0x30]
mov dword [esp + 0x20], 0xffffffff
call eax
sub esp, 4
mov ecx, dword [esp + 0x18]
add dword [esp + 0x10], 1
test eax, eax
mov dword [ecx], eax
je 0x500980
jmp 0x50099e
mov dword [esp], 8
call sub.libstdc_6.dll___cxa_allocate_exception
mov edx, dword [esp + 0x70]
lea ecx, [esp + 0x5c]
mov dword [esp + 0x10], eax
mov eax, dword [edx]
mov dword [esp], edx
mov eax, dword [eax]
mov dword [esp + 0x20], 1
call eax
sub esp, 4
lea ecx, [esp + 0x5c]
mov dword [esp + 4], str.PK_Verifier:_No_working_engine_for
lea eax, [esp + 0x58]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 0x20], 2
call fcn.005bde60
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x58]
mov dword [esp + 0x20], 3
mov dword [esp], edx
call fcn.00576920
sub esp, 4
lea ecx, [esp + 0x58]
call fcn.00567508
lea ecx, [esp + 0x5c]
call fcn.00567508
mov eax, dword [esp + 0x10]
mov dword [esp + 8], fcn.00576970
mov dword [esp + 4], 0x62d42c
mov dword [esp + 0x20], 0xffffffff
mov dword [esp], eax
call sub.libstdc_6.dll___cxa_throw
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x500ad2
cmp eax, 2
je 0x500ac9
test eax, eax
je 0x500adb
ud2
lea ecx, [esp + 0x58]
call fcn.00567508
lea ecx, [esp + 0x5c]
call fcn.00567508
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.libstdc_6.dll___cxa_free_exception
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
mov dword [esp], edx
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Resume
nop
lea esi, [esi]
Function at 0x52c840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sub esp, 0x68
movzx eax, byte [esp + 0x74]
lea edx, [esp + 0x60]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x34], 0x567468
mov dword [esp + 0x38], 0x5c4a06
mov byte [esp + 0x18], al
lea eax, [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 0x40], 0x52c958
mov dword [esp + 0x44], esp
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Register
lea eax, [esp + 0x5a]
mov dword [esp], str.X509_CRL_CRL
mov dword [esp + 4], eax
lea ecx, [esp + 0x5c]
mov dword [esp + 0x20], 0xffffffff
call fcn.005674b8
sub esp, 8
mov eax, dword [esp + 0x70]
lea edx, [esp + 0x5c]
mov dword [esp + 0x20], 1
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0052c600
sub esp, 8
mov eax, 0xffffffff
mov ecx, dword [esp + 0x5c]
lock xadd dword [ecx - 4], eax
test eax, eax
jle 0x52c944
mov eax, dword [esp + 0x14]
movzx edx, byte [esp + 0x18]
mov dword [eax], fcn.00596260
mov byte [eax + 0x58], dl
mov edx, dword [esp + 0x14]
mov dword [eax + 0x5c], 0
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x6c], 0
mov ecx, edx
mov dword [eax + 0x70], 0
mov dword [eax + 0x7c], 0
add eax, 0x6c
mov dword [edx + 0x74], eax
mov dword [edx + 0x78], eax
mov dword [esp + 0x20], 2
call fcn.00462200
lea edx, [esp + 0x1c]
mov dword [esp], edx
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Unregister
add esp, 0x68
pop ebp
ret 8
lea eax, [esp + 0x5b]
sub ecx, 0xc
mov dword [esp], eax
call fcn.00567500
sub esp, 4
jmp 0x52c8d9
Function at 0x559ac0
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x1c]
mov dword [esp + 4], 0x28
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
sub esp, 0xc
test eax, eax
jne 0x559b10
xor ebx, ebx
mov eax, ebx
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x28]
add esp, 0x2c
ret
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 1
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], eax
call fcn.00555310
test eax, eax
je 0x559bb0
mov eax, dword [esp + 0x30]
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x559af5
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], eax
call fcn.00555310
mov dword [esp + 4], 0x64
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 8
test eax, eax
mov eax, dword [esp + 0x1c]
setne bl
mov dword [esp], eax
call edi
sub esp, 4
mov dword [esp], esi
call edi
sub esp, 4
jmp 0x559af7
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x559af5