joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a4b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
sub esp, 0x84
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x9c]
mov eax, dword [esp + 0x98]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x38], eax
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], 1
mov dword [esp + 0x54], 1
mov dword [esp + 0x58], 1
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x28]
add eax, 0xffffffec
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x24]
add eax, 0xffffffec
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x20]
add eax, 0xffffffec
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x9c], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0049ed80
mov byte [esp + 0x1f], al
mov cl, al
and cl, 1
mov byte [esp + 0x6b], cl
test al, 1
jne 0x4a4c5b
mov eax, dword [esp + 0x40]
mov dword [esp + 0x48], eax
jmp 0x4a4c63
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 1
call fcn.00480ae0
mov bl, byte [esp + 0x1f]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x74], edx
mov bh, bl
xor bh, 0xff
and bh, 1
movzx esi, bh
mov dword [esp + 0x78], esi
imul esi, esi, 0x14
add edx, esi
mov dword [eax + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x7c], edx
and bl, 1
movzx esi, bl
mov dword [esp + 0x80], esi
imul esi, esi, 0x14
add edx, esi
mov dword [eax + 4], edx
cmp dword [eax + 8], ecx
je 0x4a4d20
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
cmp dword [eax + 4], ecx
jne 0x4a4d29
add esp, 0x84
pop esi
pop ebx
ret
jmp 0x4a4bcb
Function at 0x4a4d30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
sub esp, 0x84
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x9c]
mov eax, dword [esp + 0x98]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x38], eax
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], 1
mov dword [esp + 0x54], 1
mov dword [esp + 0x58], 1
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x28]
add eax, 0xffffffe8
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x24]
add eax, 0xffffffe8
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x20]
add eax, 0xffffffe8
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x9c], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0049eea0
mov byte [esp + 0x1f], al
mov cl, al
and cl, 1
mov byte [esp + 0x6b], cl
test al, 1
jne 0x4a4e1b
mov eax, dword [esp + 0x40]
mov dword [esp + 0x48], eax
jmp 0x4a4e23
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 8
mov dword [esp + 0x10], 1
call fcn.00480ae0
mov bl, byte [esp + 0x1f]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x74], edx
mov bh, bl
xor bh, 0xff
and bh, 1
movzx esi, bh
mov dword [esp + 0x78], esi
imul esi, esi, 0x18
add edx, esi
mov dword [eax + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x7c], edx
and bl, 1
movzx esi, bl
mov dword [esp + 0x80], esi
imul esi, esi, 0x18
add edx, esi
mov dword [eax + 4], edx
cmp dword [eax + 8], ecx
je 0x4a4ee0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
cmp dword [eax + 4], ecx
jne 0x4a4ee9
add esp, 0x84
pop esi
pop ebx
ret
jmp 0x4a4d8b
Function at 0x4a4ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
sub esp, 0x84
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x9c]
mov eax, dword [esp + 0x98]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x38], eax
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], 1
mov dword [esp + 0x54], 1
mov dword [esp + 0x58], 1
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x28]
add eax, 0xffffffe8
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x24]
add eax, 0xffffffe8
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x20]
add eax, 0xffffffe8
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x9c], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0049ef00
mov byte [esp + 0x1f], al
mov cl, al
and cl, 1
mov byte [esp + 0x6b], cl
test al, 1
jne 0x4a4fdb
mov eax, dword [esp + 0x40]
mov dword [esp + 0x48], eax
jmp 0x4a4fe3
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 8
mov dword [esp + 0x10], 1
call fcn.00480ae0
mov bl, byte [esp + 0x1f]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x74], edx
mov bh, bl
xor bh, 0xff
and bh, 1
movzx esi, bh
mov dword [esp + 0x78], esi
imul esi, esi, 0x18
add edx, esi
mov dword [eax + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x7c], edx
and bl, 1
movzx esi, bl
mov dword [esp + 0x80], esi
imul esi, esi, 0x18
add edx, esi
mov dword [eax + 4], edx
cmp dword [eax + 8], ecx
je 0x4a50a0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
cmp dword [eax + 4], ecx
jne 0x4a50a9
add esp, 0x84
pop esi
pop ebx
ret
jmp 0x4a4f4b
Function at 0x4a50b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
sub esp, 0x84
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x9c]
mov eax, dword [esp + 0x98]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x38], eax
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], 1
mov dword [esp + 0x54], 1
mov dword [esp + 0x58], 1
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x28]
add eax, 0xffffffe8
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x24]
add eax, 0xffffffe8
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x20]
add eax, 0xffffffe8
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x9c], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0049ee40
mov byte [esp + 0x1f], al
mov cl, al
and cl, 1
mov byte [esp + 0x6b], cl
test al, 1
jne 0x4a519b
mov eax, dword [esp + 0x40]
mov dword [esp + 0x48], eax
jmp 0x4a51a3
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 8
mov dword [esp + 0x10], 1
call fcn.00480ae0
mov bl, byte [esp + 0x1f]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x74], edx
mov bh, bl
xor bh, 0xff
and bh, 1
movzx esi, bh
mov dword [esp + 0x78], esi
imul esi, esi, 0x18
add edx, esi
mov dword [eax + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x7c], edx
and bl, 1
movzx esi, bl
mov dword [esp + 0x80], esi
imul esi, esi, 0x18
add edx, esi
mov dword [eax + 4], edx
cmp dword [eax + 8], ecx
je 0x4a5260
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
cmp dword [eax + 4], ecx
jne 0x4a5269
add esp, 0x84
pop esi
pop ebx
ret
jmp 0x4a510b
Function at 0x4a5270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x84
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xa0]
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x38], eax
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], 1
mov dword [esp + 0x54], 1
mov dword [esp + 0x58], 1
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [esp + 0xa0], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0049ec20
mov byte [esp + 0x1f], al
mov cl, al
and cl, 1
mov byte [esp + 0x6b], cl
test al, 1
jne 0x4a535c
mov eax, dword [esp + 0x40]
mov dword [esp + 0x48], eax
jmp 0x4a5364
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x18], eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 1
call fcn.00480ae0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov bl, byte [esp + 0x1f]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edi, dword [esi]
mov dword [edx], edi
mov edi, dword [esi + 4]
mov dword [edx + 4], edi
mov edi, dword [esi + 8]
mov dword [edx + 8], edi
mov esi, dword [esi + 0xc]
mov dword [edx + 0xc], esi
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x74], edx
mov bh, bl
xor bh, 0xff
and bh, 1
movzx esi, bh
mov dword [esp + 0x78], esi
shl esi, 4
add edx, esi
mov dword [eax + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x7c], edx
and bl, 1
movzx esi, bl
mov dword [esp + 0x80], esi
shl esi, 4
add edx, esi
mov dword [eax + 4], edx
cmp dword [eax + 8], ecx
je 0x4a5423
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
cmp dword [eax + 4], ecx
jne 0x4a542d
add esp, 0x84
pop esi
pop edi
pop ebx
ret
jmp 0x4a52cc
Function at 0x4a5440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
sub esp, 0x84
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x9c]
mov eax, dword [esp + 0x98]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x38], eax
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], 1
mov dword [esp + 0x54], 1
mov dword [esp + 0x58], 1
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x28]
add eax, 0xffffffec
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x24]
add eax, 0xffffffec
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x20]
add eax, 0xffffffec
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x9c], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0049ede0
mov byte [esp + 0x1f], al
mov cl, al
and cl, 1
mov byte [esp + 0x6b], cl
test al, 1
jne 0x4a552b
mov eax, dword [esp + 0x40]
mov dword [esp + 0x48], eax
jmp 0x4a5533
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 1
call fcn.00480ae0
mov bl, byte [esp + 0x1f]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x74], edx
mov bh, bl
xor bh, 0xff
and bh, 1
movzx esi, bh
mov dword [esp + 0x78], esi
imul esi, esi, 0x14
add edx, esi
mov dword [eax + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x7c], edx
and bl, 1
movzx esi, bl
mov dword [esp + 0x80], esi
imul esi, esi, 0x14
add edx, esi
mov dword [eax + 4], edx
cmp dword [eax + 8], ecx
je 0x4a55f0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
cmp dword [eax + 4], ecx
jne 0x4a55f9
add esp, 0x84
pop esi
pop ebx
ret
jmp 0x4a549b
Function at 0x4a5b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
sub esp, 0x60
mov eax, dword [esp + 0x78]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], eax
add eax, 8
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
jne 0x4a5bc9
jmp 0x4a5bd3
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x70], eax
jne 0x4a5bd9
add esp, 0x60
pop esi
pop edi
ret
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x70]
mov eax, dword [eax]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0049ec20
mov byte [esp + 0x1e], al
xor al, 0xff
mov byte [esp + 0x1f], al
mov cl, al
and cl, 1
mov byte [esp + 0x43], cl
test al, 1
jne 0x4a5c18
mov eax, dword [esp + 0x70]
mov dword [esp + 0x2c], eax
jmp 0x4a5c22
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x44], ecx
mov eax, dword [eax + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 1
call fcn.00480ae0
mov eax, dword [esp + 0x28]
mov dl, byte [esp + 0x1e]
mov dh, byte [esp + 0x1f]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edi, dword [esi]
mov dword [ecx], edi
mov edi, dword [esi + 4]
mov dword [ecx + 4], edi
mov edi, dword [esi + 8]
mov dword [ecx + 8], edi
mov esi, dword [esi + 0xc]
mov dword [ecx + 0xc], esi
mov ecx, dword [eax]
mov dword [esp + 0x4c], ecx
and dh, 1
movzx esi, dh
mov dword [esp + 0x50], esi
shl esi, 4
add ecx, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x54], ecx
and dl, 1
movzx edx, dl
mov dword [esp + 0x58], edx
shl edx, 4
add ecx, edx
mov dword [esp + 0x70], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x5c], ecx
add ecx, 0x10
mov dword [eax + 8], ecx
jmp 0x4a5bbc
Function at 0x4aa690
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
movsd xmm0, qword [edx]
movsd qword [esp + 0x10], xmm0
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00559d20
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0054db50
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
lea eax, [esp + 0x18]
mov dword [esp], eax
call fcn.0055ab50
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x20]
mov eax, 1
xor ecx, ecx
cmp edx, 0
cmove eax, ecx
cmp eax, 0
jne 0x4aa713
mov eax, dword [esp + 0xc]
movsd xmm0, qword [esp + 0x10]
movsd qword [eax], xmm0
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
movzx ecx, byte [eax]
mov eax, ecx
mov byte [esp + 0x43], al
mov eax, dword [esp + 0x10]
xor eax, ecx
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x3c], 0x100
mov dword [esp + 0x38], 0x1b3
mov ecx, 0x1b3
mov eax, esi
mul ecx
mov ecx, eax
mov eax, edx
mov edx, dword [esp + 8]
shl esi, 8
add eax, esi
imul edx, edx, 0x1b3
add eax, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x4aa6d9

Function at 0x4aa780
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, esp
mov dword [esi + 8], ebp
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x14], ecx
mov eax, esp
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], 0xffffffff
lea eax, [esi + 0x40]
mov dword [esi + 0x44], 0x4aae10
mov edx, dword fs:[0]
mov dword [esi + 0x40], edx
mov dword fs:[0], eax
mov eax, esp
mov dword [eax], ecx
call fcn.004a8490
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
add ecx, 8
mov dword [esi + 0x48], 0
mov eax, esp
mov dword [eax + 4], ecx
lea ecx, [esi + 0x20]
mov dword [eax], ecx
call fcn.004aa860
jmp 0x4aa7f3
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov edi, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
mov dword [ecx], edi
mov dword [ecx + 4], edx
movsd xmm0, qword [esi + 0x30]
movsd qword [ecx + 0x18], xmm0
movsd xmm0, qword [esi + 0x20]
movsd xmm1, qword [esi + 0x28]
movsd qword [ecx + 0x10], xmm1
movsd qword [ecx + 8], xmm0
mov ecx, dword [esi + 0x40]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b2920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
sub esp, 0x70
mov eax, dword [esp + 0x78]
mov dword [esp + 0x1c], eax
cmp dword [eax + 8], 0
ja 0x4b2934
jmp 0x4b29ad
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov edx, dword [ecx + 4]
mov dword [esp + 0x3c], edx
imul edx, edx, 0x18
add eax, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x40], eax
mov eax, dword [ecx]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov edx, dword [ecx + 4]
sub edx, dword [ecx + 8]
mov dword [esp + 0x5c], edx
imul edx, edx, 0x18
add eax, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x60], eax
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x64], eax
jmp 0x4b29c9
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
mov dword [esp + 0x68], eax
mov ecx, dword [edx + 0xc]
sub ecx, dword [edx + 8]
mov dword [esp + 0x6c], ecx
mov dword [eax + 8], ecx
add esp, 0x70
pop esi
ret
jmp 0x4b29cb
mov eax, dword [esp + 0x18]
cmp eax, 0
sete al
and al, 1
mov byte [esp + 0x23], al
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov al, byte [esp + 0x23]
and al, 1
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 8
movzx eax, al
mov dword [esp + 0xc], eax
call fcn.00480e30
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
imul esi, eax, 0x18
mov eax, esp
mov dword [eax + 8], esi
mov dword [eax + 4], edx
mov dword [eax], ecx
call sub.VCRUNTIME140.dll_memmove
jmp 0x4b29ad