joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f3e50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x77b993
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x88bba0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 0xc]
push 0
push dword [eax]
push 0xffffffffffffffff
call fcn.005aad70
mov eax, dword [ebp + 8]
mov dword [edi], vtable.Poco::Data::Extraction_class_std::vector_struct_Storage::TableVersion__class_std::allocator_struct_Storage::TableVersion___.0
mov dword [edi + 0x18], eax
mov dword [edi + 0x30], 0xf
mov dword [edi + 0x2c], 0
mov dword [ebp - 4], 0
mov byte [edi + 0x1c], 0
lea esi, [edi + 0x38]
mov byte [ebp - 4], 1
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.007215d8
add esp, 4
test eax, eax
jne 0x4f3ee9
call fcn.0070d678
mov dword [esi], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov esi, dword [edi + 0x18]
mov ecx, esi
push dword [esi + 4]
push dword [esi]
call fcn.004fd140
mov eax, dword [esi]
mov dword [esi + 4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4f3f30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x77b993
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x88bba0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 0xc]
push 0
push dword [eax]
push 0xffffffffffffffff
call fcn.005aad70
mov eax, dword [ebp + 8]
mov dword [edi], vtable.Poco::Data::Extraction_class_std::vector_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____class_std::allocator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____.0
mov dword [edi + 0x18], eax
mov dword [edi + 0x30], 0xf
mov dword [edi + 0x2c], 0
mov dword [ebp - 4], 0
mov byte [edi + 0x1c], 0
lea esi, [edi + 0x34]
mov byte [ebp - 4], 1
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.007215d8
add esp, 4
test eax, eax
jne 0x4f3fc9
call fcn.0070d678
mov dword [esi], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov esi, dword [edi + 0x18]
mov ecx, esi
push dword [esi + 4]
push dword [esi]
call fcn.0042f210
mov eax, dword [esi]
mov dword [esi + 4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4f40a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x77ba12
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x88bba0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x4f40fb
mov dword [edi], 0x7b6040
mov dword [edi + 0x10], 0x7b6048
mov dword [edi + 0x78], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [edi]
lea esi, [edi + 0x18]
push 0
push esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0040efc0
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 4]
mov dword [edi + eax + 0x10], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0xc], eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [ebp - 4], 5
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x78]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.00408ea0
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x4c], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x45], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov dword [esi + 0x50], 0
mov eax, dword [0x89e0d4]
mov dword [esi + 0x48], eax
mov eax, edi
mov dword [esi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4f52a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 4], eax
movdqa xmm0, xmmword [0x7b62d0]
xor ecx, ecx
mov edx, dword [0x87fc60]
movdqu xmmword [ebp - 0x48], xmm0
push esi
movdqa xmm0, xmmword [0x7b62c0]
mov esi, dword [ebp + 8]
movdqu xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x4c], 0
xorps xmm0, xmm0
mov byte [ebp - 0x28], 0
push edi
mov edi, dword [0x87fc4c]
movdqu xmmword [ebp - 0x27], xmm0
movdqu xmmword [ebp - 0x17], xmm0
cmp edx, 0x10
mov eax, 0x87fc4c
cmovae eax, edi
movzx eax, byte [eax + ecx]
xor al, byte [ebp + ecx - 0x48]
cmp edx, 0x10
mov byte [ebp + ecx - 0x28], al
mov eax, 0x87fc4c
cmovae eax, edi
movzx eax, byte [eax + ecx + 1]
xor al, byte [ebp + ecx - 0x47]
cmp edx, 0x10
mov byte [ebp + ecx - 0x27], al
mov eax, 0x87fc4c
cmovae eax, edi
movzx eax, byte [eax + ecx + 2]
xor al, byte [ebp + ecx - 0x46]
cmp edx, 0x10
mov byte [ebp + ecx - 0x26], al
mov eax, 0x87fc4c
cmovae eax, edi
movzx eax, byte [eax + ecx + 3]
xor al, byte [ebp + ecx - 0x45]
mov byte [ebp + ecx - 0x25], al
add ecx, 4
cmp ecx, 0x20
jl 0x4f52f5
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x28], 0
jne 0x4f5377
xor eax, eax
jmp 0x4f5389
lea eax, [ebp - 0x28]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4f5380
sub eax, edx
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0042fb60
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00722035
mov esp, ebp
pop ebp
ret 4
Function at 0x4f7610
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x77c4b4
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa0], 0
mov dword [ebp - 4], 1
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
push 0
push 0x799e88
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.0042fb60
push 0x4fedb0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.004f3cd0
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 3
push ebx
push eax
call fcn.004f3a30
add esp, 0x14
push dword [esi + 4]
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 4
call fcn.005acee0
push str.SELECT__FROM__s_WHERE_component__Order_By_create_time
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 5
push ecx
mov ecx, eax
call fcn.004f2e50
push 0x87fc18
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.004f37a0
mov esi, eax
mov edx, dword [ebp - 0x90]
sub esp, 8
mov ecx, esp
mov byte [ebp - 4], 9
mov edi, 1
mov dword [ecx], edx
mov eax, dword [ebp - 0x8c]
mov dword [ecx + 4], eax
mov eax, edi
lock xadd dword [edx], eax
mov ecx, esi
call fcn.005ac4a0
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 8
mov esi, eax
call fcn.004f4980
mov edx, dword [ebp - 0x98]
sub esp, 8
mov ecx, esp
mov byte [ebp - 4], 0xc
mov dword [ecx], edx
mov eax, dword [ebp - 0x94]
mov dword [ecx + 4], eax
lock xadd dword [edx], edi
inc edi
mov ecx, esi
call fcn.005ac2e0
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xb
mov esi, eax
call fcn.004f4980
mov ecx, esi
call fcn.005abef0
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0xa
call fcn.005abe40
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 2
call fcn.005ad0e0
cmp dword [ebp - 0x14], 0x10
jb 0x4f77af
push dword [ebp - 0x28]
call fcn.00489b60
add esp, 4
cmp dword [ebp + 0x20], 0x10
jb 0x4f77c0
push dword [ebp + 0xc]
call fcn.00489b60
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00722035
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4f7f70
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x77c71d
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xb8], 0
cmp dword [ebp + 0x1c], 0
mov dword [ebp - 4], 0
jne 0x4f7fe0
lea ecx, [ebp - 0x94]
call fcn.00723371
push 0x86061c
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], vtable.InvalidParameter.0
push eax
call fcn.00722044
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
push 0
push 0x799e88
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.0042fb60
push 0x4fedb0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.004f3cd0
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.004f3a30
add esp, 0x14
push dword [esi + 4]
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 4
call fcn.005acee0
push str.SELECT__FROM__s_WHERE_uuid__Order_By_create_time
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 5
push ecx
mov ecx, eax
call fcn.004f2e50
push 0x87fc18
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.004f37a0
mov esi, eax
mov edx, dword [ebp - 0xb4]
sub esp, 8
mov ecx, esp
mov byte [ebp - 4], 9
mov edi, 1
mov dword [ecx], edx
mov eax, dword [ebp - 0xb0]
mov dword [ecx + 4], eax
mov eax, edi
lock xadd dword [edx], eax
mov ecx, esi
call fcn.005ac4a0
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 8
mov esi, eax
call fcn.004f4980
mov edx, dword [ebp - 0xa8]
sub esp, 8
mov ecx, esp
mov byte [ebp - 4], 0xc
mov dword [ecx], edx
mov eax, dword [ebp - 0xa4]
mov dword [ecx + 4], eax
lock xadd dword [edx], edi
inc edi
mov ecx, esi
call fcn.005ac2e0
mov esi, eax
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0xb
call fcn.004f4980
mov ecx, esi
call fcn.005abef0
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0xa
call fcn.005abe40
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 2
call fcn.005ad0e0
cmp dword [ebp - 0x14], 0x10
mov byte [ebp - 4], 1
jb 0x4f8143
push dword [ebp - 0x28]
call fcn.00489b60
add esp, 4
mov ecx, dword [ebp - 0x9c]
mov eax, 0x78787879
mov esi, dword [ebp - 0xa0]
sub ecx, esi
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x4f818a
lea ecx, [ebp - 0x94]
call fcn.00723371
push 0x863234
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], vtable.NoSecureResultsFound.0
push eax
call fcn.00722044
push esi
mov ecx, ebx
call fcn.004f0ea0
lea ecx, [ebp - 0xa0]
call fcn.004f10b0
cmp dword [ebp + 0x20], 0x10
jb 0x4f81ae
push dword [ebp + 0xc]
call fcn.00489b60
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00722035
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4fa130
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x77cea4
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xa0], 0
mov dword [ebp - 4], 1
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
cmp dword [ebp + 0x1c], 0
mov dword [ebp - 0xa0], 1
jne 0x4fa1c4
lea ecx, [ebp - 0xac]
call fcn.00723371
push 0x86061c
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], vtable.InvalidParameter.0
push eax
call fcn.00722044
push 0
push 0x799e88
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.0042fb60
push 0x4fedb0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.004f3cd0
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 3
push ebx
push eax
call fcn.004f3b90
add esp, 0x14
push dword [esi + 4]
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 4
call fcn.005acee0
push str.SELECT_DISTINCT_storage_type_FROM__s_WHERE_component_
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 5
push ecx
mov ecx, eax
call fcn.004f2e50
push 0x87fc18
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.004f37a0
mov esi, eax
mov edx, dword [ebp - 0x90]
sub esp, 8
mov ecx, esp
mov byte [ebp - 4], 9
mov edi, 1
mov dword [ecx], edx
mov eax, dword [ebp - 0x8c]
mov dword [ecx + 4], eax
mov eax, edi
lock xadd dword [edx], eax
mov ecx, esi
call fcn.005ac4a0
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 8
mov esi, eax
call fcn.004f4980
mov edx, dword [ebp - 0x98]
sub esp, 8
mov ecx, esp
mov byte [ebp - 4], 0xc
mov dword [ecx], edx
mov eax, dword [ebp - 0x94]
mov dword [ecx + 4], eax
lock xadd dword [edx], edi
inc edi
mov ecx, esi
call fcn.005ac2e0
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xb
mov esi, eax
call fcn.004f4980
mov ecx, esi
call fcn.005abef0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x88]
call fcn.005abe40
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 2
call fcn.005ad0e0
cmp dword [ebp - 0x14], 0x10
jb 0x4fa2fb
push dword [ebp - 0x28]
call fcn.00489b60
add esp, 4
cmp dword [ebp + 0x20], 0x10
jb 0x4fa30c
push dword [ebp + 0xc]
call fcn.00489b60
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00722035
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x50cb60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push 0
push ebx
call fcn.00723180
mov edi, dword [0x89e40c]
add esp, 0xc
mov edx, dword [0x89e408]
mov eax, edi
sub eax, edx
cmp dword [ebp + 0xc], eax
jb 0x50cbb6
xor ecx, ecx
test eax, eax
je 0x50cbae
mov al, byte [edx + ecx]
xor al, 0x71
mov byte [ecx + ebx], al
inc ecx
mov edi, dword [0x89e40c]
mov eax, edi
mov edx, dword [0x89e408]
sub eax, edx
cmp ecx, eax
jb 0x50cb91
sub edi, edx
mov eax, edi
pop edi
pop ebx
pop ebp
ret
pop edi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x515d80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x77f5c3
mov eax, dword fs:[0]
push eax
sub esp, 0x174
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x17c], 0
cmp dword [ecx + 0x14], 0
mov dword [ebp - 0x180], esi
jbe 0x515dea
push 0xffffffffffffffff
add ecx, 4
mov dword [esi + 0x14], 0xf
push 0
push ecx
mov dword [esi + 0x10], 0
mov ecx, esi
mov byte [esi], 0
call fcn.0042fa30
jmp 0x515f18
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x114], 0
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
jne 0x515e27
xor ecx, ecx
jmp 0x515e39
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x515e30
sub ecx, edx
push ecx
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x12c]
call fcn.0042fb60
push str.CTES_sls_
lea eax, [ebp - 0x12c]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.00415c80
add esp, 0xc
cmp dword [ebp - 0x118], 0x10
mov byte [ebp - 4], 3
jb 0x515e89
push dword [ebp - 0x12c]
call fcn.00489b60
add esp, 4
lea eax, [ebp - 0x144]
mov dword [ebp - 0x118], 0xf
push eax
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
call fcn.00612210
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 4
call fcn.00612d90
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x174]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov byte [esi], 0
call fcn.0042fa30
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x17c], 1
mov byte [ebp - 4], 3
call fcn.006124a0
cmp dword [ebp - 0x130], 0x10
jb 0x515f18
push dword [ebp - 0x144]
call fcn.00489b60
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00722035
mov esp, ebp
pop ebp
ret 4
Function at 0x51d870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push 0
push ebx
call fcn.00723180
mov edi, dword [0x89e4dc]
add esp, 0xc
mov edx, dword [0x89e4d8]
mov eax, edi
sub eax, edx
cmp dword [ebp + 0xc], eax
jb 0x51d8c8
xor ecx, ecx
test eax, eax
je 0x51d8be
mov al, byte [edx + ecx]
xor al, 0x61
mov byte [ecx + ebx], al
inc ecx
mov edi, dword [0x89e4dc]
mov eax, edi
mov edx, dword [0x89e4d8]
sub eax, edx
cmp ecx, eax
jb 0x51d8a1
sub edi, edx
mov eax, edi
pop edi
pop ebx
pop ebp
ret 0x10
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
Function at 0x522940
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 8], ecx
push edi
mov edi, dword [eax + 0x10]
mov dword [ebp - 4], edi
cmp ecx, 0x10
jb 0x522963
mov esi, dword [eax]
jmp 0x522965
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x522981
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x522970
mov ecx, dword [ebx + 0x14]
mov edi, ecx
and edi, edx
cmp dword [ebx + 0x18], edi
ja 0x522996
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add edi, eax
mov ecx, dword [ebx + 8]
lea eax, [edi + edi]
mov edx, dword [ebx]
lea eax, [eax + 1]
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov esi, dword [ecx + edi*8]
mov edi, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], eax
cmp edi, edx
jne 0x5229bf
mov eax, edx
jmp 0x5229c3
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x522ae3
cmp dword [ebp - 8], 0x10
lea ecx, [esi + 8]
jb 0x5229db
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
jmp 0x5229de
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
mov dword [ebp - 4], eax
jb 0x5229ec
mov ecx, dword [ecx]
cmp eax, ebx
mov edx, ebx
cmovb edx, eax
test edx, edx
je 0x522a53
sub edx, 4
jb 0x522a11
lea esp, [esp]
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x522a16
add ecx, 4
add edi, 4
sub edx, 4
jae 0x522a00
cmp edx, 0xfffffffc
je 0x522a4a
mov al, byte [ecx]
cmp al, byte [edi]
jne 0x522a43
cmp edx, 0xfffffffd
je 0x522a4a
mov al, byte [ecx + 1]
cmp al, byte [edi + 1]
jne 0x522a43
cmp edx, 0xfffffffe
je 0x522a4a
mov al, byte [ecx + 2]
cmp al, byte [edi + 2]
jne 0x522a43
cmp edx, 0xffffffff
je 0x522a4a
mov al, byte [ecx + 3]
cmp al, byte [edi + 3]
je 0x522a4a
sbb eax, eax
or eax, 1
jmp 0x522a4c
xor eax, eax
test eax, eax
jne 0x522a63
mov eax, dword [ebp - 4]
cmp eax, ebx
jb 0x522a63
xor eax, eax
cmp dword [ebp - 4], ebx
setne al
test eax, eax
je 0x522a73
mov esi, dword [esi]
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
jmp 0x5229b7
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov edi, dword [ecx + 0x10]
jb 0x522a81
mov ecx, dword [ecx]
cmp dword [ebp - 8], 0x10
jb 0x522a8f
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
cmp ebx, edi
mov eax, edi
cmovb eax, ebx
push eax
push ecx
push dword [ebp + 0xc]
call fcn.0040ed80
add esp, 0xc
test eax, eax
jne 0x522aca
cmp ebx, edi
jb 0x522aca
cmp ebx, edi
setne al
test eax, eax
jne 0x522aca
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
pop edi
mov dword [ebp + 0xc], esi
mov ecx, dword [ecx]
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0xc]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x5364d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi + 0x44]
test al, al
js 0x5365bf
push ebx
xor ebx, ebx
push edi
test al, al
jle 0x536559
lea ecx, [esi + 0x78]
mov dword [ebp - 4], ecx
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x53653e
mov eax, dword [ecx + 0x14]
dec dword [eax + 0x78]
mov edx, dword [eax + 0x88]
mov dword [ecx + 0x10], edx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.00723510
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [ebp + 8]
add esp, 0x10
jmp 0x536547
push ecx
call fcn.0056dd70
add esp, 4
mov ecx, dword [ebp - 4]
inc ebx
movsx eax, byte [esi + 0x44]
add ecx, 4
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x5364f1
mov eax, dword [esi + 0x74]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x5365b0
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.00723510
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [ebp + 8]
add esp, 0x10
pop edi
pop ebx
mov byte [esi + 0x44], 0xff
pop esi
mov esp, ebp
pop ebp
ret
push edx
call fcn.0056dd70
add esp, 4
mov byte [esi + 0x44], 0xff
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret