joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44e293
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x44e28b
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x44e16c
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x44e16c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x44e17f
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x44e260
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x44e252
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x44e24b
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x44e1d6
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x44e21f
mov eax, 1
cmp eax, ecx
ja 0x44e20d
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.0045ea40
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x44e246
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x44e212
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x44e1db
call fcn.0045e9e0
xor eax, eax
call fcn.0045e9d0
call fcn.0045ea40
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x44e286
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x44e257
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x44e184
call fcn.0045e9e0
xor eax, eax
call fcn.0045e9d0
nop
call fcn.0045d540
jmp fcn.0044e110
Function at 0x455970
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x455a0f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0045eb77
lea ecx, [0x455a20]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0045d430
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0045d540
jmp fcn.00455970
Function at 0x45e800
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x7e78e0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45cfcb
je 0x45d01e
cmp ebx, 0x20
jbe 0x45d024
cmp ebx, 0x40
jbe 0x45d06a
jmp 0x45d10b
test ebx, ebx
je 0x45d014
add eax, 0x10
test ax, 0xff0
je 0x45d000
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x68d080]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x68d180]
jmp 0x45cfe8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45cfe8
pxor xmm1, xmmword [0x7e78f0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x7e78f0]
pxor xmm2, xmmword [0x7e7900]
pxor xmm3, xmmword [0x7e7910]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x7e78f0]
pxor xmm2, xmmword [0x7e7900]
pxor xmm3, xmmword [0x7e7910]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45d16a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x7e749a], 0
je 0x45e81a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45cf90
jmp fcn.00407da0
Function at 0x45e820
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40276e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00407da0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045d540
jmp 0x402730
cmp byte [0x7e749a], 0
je 0x45e83b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45cf90
jmp 0x402730
Function at 0x4ced80
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4cee28
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x4ceddb
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x4cee12
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.0045d540
jmp fcn.004ced80
Function at 0x4e4740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e48a1
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x4e47c7
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
jne 0x4e47cb
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4e4791
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4e47cb
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4e47d3
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004e4520
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.004e9170
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], ecx
add esp, 0x48
ret
call fcn.0045d540
jmp fcn.004e4740
Function at 0x569270
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x569486
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x569309
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
jmp 0x569467
cmp ecx, 0xe
jne 0x569382
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x569467
cmp ecx, 0xf
jne 0x5693f8
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x569467
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
call fcn.0045d540
jmp fcn.00569270
Function at 0x56b0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56b284
add esp, 0xffffff80
lea edi, [esp + 0x30]
mov esi, dword [esp + 0x84]
call fcn.0045f02c
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.0056ab10
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x58]
xor eax, eax
call fcn.0045eb76
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x56b152
mov edx, dword [esp + 0x10]
lea ecx, [edx + 1]
cmp ecx, 5
jge 0x56b225
mov dword [esp + 0x10], ecx
imul edx, ecx, 0x33
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1d
add edx, ebx
sar edx, 3
mov dword [esp + 0x1c], edx
shl edx, 3
sub ebx, edx
cmp ebx, 0x20
sbb edx, edx
lea esi, [esp + ecx*8 + 0x58]
mov edi, dword [esi]
mov dword [esp + 0xc], edi
mov esi, dword [esi + 4]
mov ecx, ebx
shl edi, cl
and edi, edx
mov dword [esp + 8], edi
xchg edi, eax
mov byte [esp + 0x20], al
xchg edi, eax
lea ebp, [ecx - 0x20]
mov dword [esp + 0x18], ebp
cmp ebp, 0x20
sbb edi, edi
mov dword [esp + 0x14], edi
xchg ebp, ebx
neg ebx
xchg ebp, ebx
cmp ebp, 0x20
sbb edi, edi
shl esi, cl
and esi, edx
mov ecx, ebp
mov edx, dword [esp + 0xc]
mov ebx, edx
shr edx, cl
and edx, edi
or edx, esi
mov ecx, dword [esp + 0x18]
shl ebx, cl
mov ebp, dword [esp + 0x14]
and ebx, ebp
or ebx, edx
mov edx, dword [esp + 8]
mov ebp, edx
shr edx, 8
mov esi, ebx
shl ebx, 0x18
or edx, ebx
mov byte [esp + 0x21], dl
mov edx, ebp
shr ebp, 0x10
mov ebx, esi
shl esi, 0x10
or esi, ebp
xchg esi, eax
mov byte [esp + 0x22], al
xchg esi, eax
mov ebp, ebx
shl ebx, 8
shr edx, 0x18
or edx, ebx
mov byte [esp + 0x23], dl
mov dword [esp + 0x24], ebp
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
mov edx, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x56b256
test byte [eax], al
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], 0x20
mov dword [esp + 0x94], 0x20
sub esp, 0xffffff80
ret
movzx esi, byte [eax + ebp]
or esi, ebx
xchg esi, ebx
mov byte [eax + ebp], bl
xchg esi, ebx
inc ecx
cmp ecx, 8
jge 0x56b14b
movzx ebx, byte [esp + ecx + 0x28]
lea ebp, [edx + ecx]
cmp ebp, 0x20
jge 0x56b14b
test byte [eax], al
cmp ebp, 0x20
jb 0x56b248
mov eax, ebp
mov ecx, 0x20
call fcn.0045e9d0
nop
call fcn.0045d540
jmp fcn.0056b0a0
Function at 0x56f6f0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56f863
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x56f723
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x56f723
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x56f729
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x56f737
cmp ecx, 4
jne 0x56f768
cmp al, 0x2c
ja 0x56f750
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x56f762
cmp al, 0x24
je 0x56f762
cmp al, 0x26
jae 0x56f762
jmp 0x56f768
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x56f762
cmp al, 0x5b
je 0x56f762
cmp al, 0x5d
jne 0x56f768
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x56f79f
cmp al, 0x26
ja 0x56f781
cmp al, 0x24
je 0x56f7be
cmp al, 0x26
je 0x56f7be
jmp 0x56f845
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x56f7be
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x56f83f
cmp al, 0x2f
je 0x56f7be
jmp 0x56f845
cmp al, 0x3d
ja 0x56f7b6
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x56f7be
cmp al, 0x3d
je 0x56f7be
jmp 0x56f845
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x56f835
cmp ecx, 2
jg 0x56f7f9
cmp ecx, 1
je 0x56f7ee
cmp ecx, 2
jne 0x56f845
cmp al, 0x2f
je 0x56f7dc
cmp al, 0x3b
je 0x56f7dc
cmp al, 0x2c
jne 0x56f7e3
mov eax, 1
jmp 0x56f7e9
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x56f81f
cmp al, 0x40
je 0x56f80d
cmp al, 0x2f
je 0x56f80d
cmp al, 0x3f
jne 0x56f814
mov eax, 1
jmp 0x56f81a
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x56f82f
cmp ecx, 7
jne 0x56f845
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x56f83f
cmp al, 0x7e
jne 0x56f845
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x56f85d
cmp al, 0x21
je 0x56f857
add eax, 0xffffffd8
cmp al, 2
ja 0x56f85d
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.0045d540
jmp fcn.0056f6f0
Function at 0x5c1380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c153b
sub esp, 0x6c
mov edx, dword [esp + 0x70]
mov ebx, dword [edx + 0xe0]
test ebx, ebx
jg 0x5c13bd
mov ebx, dword [esp + 0x78]
dec ebx
mov ebp, dword [esp + 0x74]
mov esi, dword [esp + 0x7c]
mov eax, dword [esp + 0x80]
jmp 0x5c13e1
mov byte [esp + 0x84], 1
add esp, 0x6c
ret
mov dword [ecx + 0x104], ebx
mov ebp, dword [esp + 0x74]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov edx, ecx
mov ecx, ebx
mov ebx, dword [edx + 0xfc]
cmp ebp, ebx
jge 0x5c14a6
mov edi, ebp
mov ebp, dword [edx + 0xcc]
mov dword [esp + 0x20], ebp
mov edx, dword [edx + 0xd0]
mov dword [esp + 0x1c], edx
lea ebp, [edx - 1]
mov dword [esp + 0x14], ecx
jmp 0x5c14d7
mov esi, dword [esp + 0x10]
mov dword [esp + 0x18], eax
lea edi, [esp + 0x24]
xor eax, eax
call fcn.0045eb6e
mov dword [esp + 0x24], 9
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], esi
mov edx, dword [esp + 0x18]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x70]
mov dword [esp], ebx
mov dword [esp + 4], 0xffffffff
lea ebp, [esp + 0x24]
mov dword [esp + 8], ebp
call fcn.005a14f0
mov ecx, dword [esp + 0x70]
mov edx, dword [ecx + 0x104]
mov ebx, dword [ecx + 0x100]
lea eax, [edx - 1]
cmp edx, eax
jbe 0x5c152a
mov ebx, dword [ebx + edx*4 - 4]
mov dword [ecx + 0xfc], ebx
mov edx, dword [ecx + 0x108]
mov ebx, dword [ecx + 0x104]
dec ebx
cmp edx, ebx
jae 0x5c13c9
jmp 0x5c1523
mov byte [esp + 0x84], 1
add esp, 0x6c
ret
mov edi, dword [esp + 0xc]
dec edi
mov eax, dword [ebp + eax]
mov ebp, edi
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x74]
mov edi, ebx
mov ebx, ecx
mov ecx, eax
mov eax, esi
mov esi, edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x10], esi
test ebp, ebp
jl 0x5c1417
cmp ebp, edx
jae 0x5c1531
mov dword [esp + 0xc], ebp
imul edx, ebp, 0x54
mov ebp, dword [esp + 0x20]
lea esi, [ebp + edx + 0x24]
cmp dword [esi], ecx
jl 0x5c1413
mov esi, dword [ebp + edx + 0x20]
mov ecx, ebx
inc ebx
cmp esi, ebx
jne 0x5c1515
mov ebx, dword [ebp + edx + 0x1c]
mov eax, edx
mov edx, dword [ebp + edx + 0x18]
jmp 0x5c14b2
mov esi, eax
mov ebx, dword [esp + 0x10]
mov eax, edx
mov edx, dword [esp + 0x14]
jmp 0x5c14b2
mov ecx, ebx
call fcn.0045ea10
mov ecx, edx
call fcn.0045e9d0
mov eax, ebp
mov ecx, edx
call fcn.0045e9d0
nop
call fcn.0045d540
jmp fcn.005c1380
Function at 0x5c1ad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c1d0b
sub esp, 0x70
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x84]
mov edx, dword [eax + 0x88]
mov ebx, dword [eax + 0x8c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
call fcn.005c1380
movzx eax, byte [esp + 0x14]
test al, al
je 0x5c1cf7
nop
mov edx, dword [esp + 0x74]
mov ebx, dword [edx + 0x110]
mov ecx, dword [edx + 0x114]
lea eax, [ecx - 1]
cmp ecx, eax
jbe 0x5c1d05
lea ebp, [ecx + ecx*4]
lea esi, [ebx + ebp*4 - 0x14]
mov ecx, esi
movzx esi, byte [esi]
xchg esi, eax
test al, al
xchg esi, eax
je 0x5c1c3a
lea esi, [ebx + ebp*4 - 0x13]
movzx esi, byte [esi]
xchg esi, eax
test al, al
xchg esi, eax
je 0x5c1bff
nop
mov ecx, dword [ebx + ebp*4 - 8]
mov esi, dword [ebx + ebp*4 - 4]
mov ebx, dword [ebx + ebp*4 - 0xc]
mov dword [edx], 3
mov dword [edx + 0x24], 0x1b
mov ebp, dword [0x7e77b0]
test ebp, ebp
jne 0x5c1b9a
lea ebp, [0x637a49]
mov dword [edx + 0x20], ebp
jmp 0x5c1ba8
lea edi, [edx + 0x20]
lea eax, [0x637a49]
call fcn.0045e950
mov dword [edx + 0x28], ebx
mov dword [edx + 0x2c], ecx
mov dword [edx + 0x30], esi
mov dword [edx + 8], 0x1b
mov ecx, dword [0x7e77b0]
test ecx, ecx
jne 0x5c1bcd
lea eax, [0x6375c0]
mov dword [edx + 4], eax
jmp 0x5c1bdb
lea edi, [edx + 4]
lea eax, [0x6375c0]
call fcn.0045e950
mov eax, dword [edx + 0x88]
mov ecx, dword [edx + 0x8c]
mov ebx, dword [edx + 0x84]
mov dword [edx + 0x14], ebx
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], ecx
mov byte [esp + 0x7c], 0
add esp, 0x70
ret
mov byte [ecx], 0
mov ebx, dword [edx + 0x11c]
mov ecx, dword [edx + 0x114]
mov esi, dword [edx + 0x110]
cmp ecx, eax
jbe 0x5c1d00
mov eax, dword [esi + ebp*4 - 0x10]
lea ecx, [0x607b80]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
call fcn.0040e770
mov edx, dword [esp + 0x74]
mov byte [edx + 0x10c], 0
mov eax, dword [edx + 0x88]
mov dword [esp + 0x24], eax
mov ecx, dword [edx + 0x8c]
mov dword [esp + 0x20], ecx
mov ebx, dword [edx + 0x84]
mov dword [esp + 0x1c], ebx
mov dword [esp], edx
call fcn.005bf860
mov eax, dword [esp + 0x74]
mov dword [esp], eax
call fcn.005bf860
mov eax, dword [esp + 0x74]
mov dword [esp], eax
call fcn.005bf860
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x88]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0x8c]
mov ebx, dword [eax + 0x84]
lea edi, [esp + 0x28]
mov ebp, eax
xor eax, eax
call fcn.0045eb6e
mov eax, dword [esp + 0x78]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ebx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edx
mov dword [esp], ebp
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x28]
mov dword [esp + 8], eax
call fcn.005a14f0
mov byte [esp + 0x7c], 1
add esp, 0x70
ret
mov byte [esp + 0x7c], 0
add esp, 0x70
ret
call fcn.0045e9d0
call fcn.0045e9d0
nop
call fcn.0045d540
jmp fcn.005c1ad0