joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c9630
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c9709
sub esp, 0x10
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 4]
test cl, cl
je 0x4c96eb
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4c96eb
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
call fcn.00483ad0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
movzx edx, byte [eax + 6]
sub ecx, dword [esp + 8]
test dl, dl
je 0x4c96bd
mov dword [esp + 0xc], ecx
mov ecx, dword [eax]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call fcn.004cae50
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
call fcn.004c93f0
jmp 0x4c96e7
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004c93f0
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004cae50
add esp, 0x10
ret
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004cae50
add esp, 0x10
ret
call fcn.00475ee0
jmp fcn.004c9630
Function at 0x4e3900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e3a5f
sub esp, 0x58
mov eax, dword [esp + 0x5c]
mov dword [esp], eax
mov ecx, dword [esp + 0x60]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x64]
mov dword [esp + 8], edx
mov ebx, dword [esp + 0x68]
mov dword [esp + 0xc], ebx
mov ebp, dword [esp + 0x6c]
mov dword [esp + 0x10], ebp
mov esi, dword [esp + 0x70]
mov dword [esp + 0x14], esi
call fcn.004dd810
movzx eax, byte [esp + 0x18]
test al, al
je 0x4e395c
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x4e3968
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x54], edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ecx
mov dword [esp], 0
call fcn.004debf0
mov eax, dword [esp + 4]
mov dword [esp + 0x50], eax
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ebx, dword [eax + 8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x2c], ecx
call fcn.004e3a70
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x54], ebx
mov ebp, dword [esp + 0x40]
mov dword [esp + 0x4c], ebp
mov esi, dword [esp + 0x44]
mov dword [esp + 0x48], esi
mov edi, dword [esp + 0x50]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov eax, dword [0x8c88d8]
test eax, eax
je 0x4e3a30
mov eax, edi
call fcn.004772f0
mov dword [edi], edx
mov ecx, dword [eax]
mov dword [edi + 4], ecx
mov edi, eax
mov dword [edi], edx
mov dword [esp], edi
call fcn.004dece0
mov eax, dword [esp + 0x54]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x88], eax
add esp, 0x58
ret
call fcn.00475ee0
jmp fcn.004e3900
Function at 0x4e7230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e73da
sub esp, 0x54
lea edi, [esp + 0x60]
xor eax, eax
call fcn.004773db
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
xor ebx, ebx
jmp 0x4e725f
inc ebx
cmp edx, ebx
jle 0x4e737e
movzx ebp, byte [ecx + ebx]
xchg ebp, eax
cmp al, 0x25
xchg ebp, eax
je 0x4e7322
xchg ebp, eax
cmp al, 0x2e
xchg ebp, eax
je 0x4e72d3
xchg ebp, eax
cmp al, 0x3a
xchg ebp, eax
jne 0x4e725e
lea edi, [esp + 0x28]
call fcn.004773db
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.004e7a10
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.004778be
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.004778be
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x28]
call fcn.004773db
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.004e7930
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.004778be
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.004778be
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.004773da
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x708a14]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x14
lea edi, [esp + 0x60]
call fcn.004773db
lea ecx, [0x6e3520]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call fcn.0040b2d0
mov ecx, dword [esp + 8]
lea edx, [0x734bc0]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.004773da
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x70769b]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x12
lea edi, [esp + 0x60]
call fcn.004773db
lea ecx, [0x6e3520]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call fcn.0040b2d0
mov ecx, dword [esp + 8]
lea edx, [0x734bc0]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
call fcn.00475ee0
jmp fcn.004e7230
Function at 0x4f3130
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f3258
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov edx, dword [esp + 0x24]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov word [esp + 0xc], cx
call fcn.004f5c10
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 2]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004f5c10
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 4]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004f5c10
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 6]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004f5c10
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004f5c10
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebx, word [ebx + 0xa]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bx
call fcn.004f5c10
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
add esp, 0x1c
ret
call fcn.00475ee0
jmp fcn.004f3130
Function at 0x4f4940
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f4a9d
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.004773d7
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4f4978
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x4f49a1
lea eax, [0x6c0100]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.004726e0
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x30], ecx
lea edi, [esp + 0x34]
mov ebx, eax
xor eax, eax
call fcn.004773d7
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x6c]
mov dword [esp], ecx
call fcn.004f3010
movzx ecx, word [esp + 4]
movzx edx, word [esp + 6]
mov word [esp + 0x42], cx
mov word [esp + 0x44], dx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
lea ebx, [edx + 0xc]
mov ebp, dword [esp + 0x34]
cmp ecx, ebx
jae 0x4f4a47
mov dword [esp + 0x30], edx
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xc
lea eax, [0x6c0100]
mov dword [esp + 0x10], eax
call fcn.00472770
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x58], ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ecx
lea eax, [ebp + edx]
mov dword [esp], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.00477ad0
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], eax
mov byte [esp + 0x40], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x34]
call fcn.00477896
add esp, 0x5c
ret
call fcn.00475ee0
jmp fcn.004f4940
Function at 0x509cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x509e61
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x509d87
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x509d26
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x509d93
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x509d51
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x509d93
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x20]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x509d93
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.00515ac0
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.00510f00
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.00475ee0
jmp fcn.00509cf0
Function at 0x528d70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x528eda
sub esp, 0x58
lea edi, [esp + 0x64]
xor eax, eax
call fcn.004773db
lea ecx, [0x6ebfa0]
mov dword [esp], ecx
call fcn.0040dea0
mov ecx, dword [esp + 4]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x50], ecx
lea edx, [0x6bb760]
mov dword [esp], edx
call fcn.0040dea0
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x5c]
mov dword [ecx], edx
mov edx, dword [esp + 0x60]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x50]
mov dword [ecx + 8], edx
mov edx, dword [0x8a636c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
mov dword [esp + 0xc], 3
call fcn.00521bd0
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x528e8a
mov eax, dword [0x8a1454]
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x54]
movzx edx, word [ecx]
movzx ebx, word [ecx + 2]
movzx ebp, word [ecx + 6]
movzx esi, word [ecx + 8]
movzx edi, word [ecx + 0xa]
movzx eax, word [ecx + 0xc]
movzx ecx, word [ecx + 0xe]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
shr ecx, 1
imul eax, ecx, 0x8313
shr eax, 0x18
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x1c], eax
call fcn.004b7df0
lea edi, [esp + 0x3c]
lea esi, [esp + 0x20]
call fcn.004778be
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.004778be
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x58
ret
call fcn.004bc310
lea edi, [esp + 0x3c]
lea esi, [esp]
call fcn.004778be
lea eax, [0x715f83]
mov dword [esp], eax
mov dword [esp + 4], 0x30
call fcn.00480a00
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x34], ecx
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.004778be
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x7c], eax
add esp, 0x58
ret
call fcn.00475ee0
jmp fcn.00528d70
Function at 0x52ac80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52ae9e
sub esp, 0x50
mov eax, dword [esp + 0x54]
test byte [eax], al
lea ecx, [eax + 0x14]
mov dword [esp + 0x1c], ecx
mov dword [esp], ecx
call fcn.0048dcd0
mov eax, dword [esp + 0x54]
test eax, eax
je 0x52ae48
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x52ae48
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x52adf2
lea eax, [0x6deea0]
mov dword [esp], eax
call fcn.0040dea0
mov eax, dword [esp + 4]
mov dword [esp + 0x4c], eax
lea ecx, [0x6b9580]
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.00406690
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
mov eax, dword [0x8c88d8]
test eax, eax
je 0x52ad62
lea eax, [0x6deea0]
mov dword [esp], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], eax
lea ecx, [esp + 0x20]
mov dword [esp + 8], ecx
call fcn.004120e0
mov edi, dword [esp + 0x4c]
lea esi, [esp + 0x20]
call fcn.004778a0
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x54]
mov ecx, dword [ecx + 0xc]
mov dword [esp], ecx
lea ecx, [esp + 0x40]
mov dword [esp + 4], ecx
call fcn.004068f0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.0048e050
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x4c]
mov eax, dword [eax + 0x1c]
mov dword [esp], eax
lea eax, [esp + 0x44]
mov dword [esp + 4], eax
call fcn.00407340
movzx eax, byte [esp + 8]
test al, al
je 0x52adde
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x50
ret
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
add esp, 0x50
ret
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.0048e050
lea eax, [0x70d827]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.004c8ee0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x50
ret
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.0048e050
lea eax, [0x70f2db]
mov dword [esp], eax
mov dword [esp + 4], 0x20
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.004c8ee0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x50
ret
call fcn.00475ee0
jmp fcn.0052ac80
Function at 0x5866d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x58688c
sub esp, 0x84
lea edi, [esp + 0x24]
mov esi, dword [esp + 0x88]
call fcn.0047788c
lea eax, [esp + 0x24]
mov dword [esp], eax
call fcn.00585cc0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
lea edi, [esp + 0x5c]
xor eax, eax
call fcn.004773d6
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], ecx
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], eax
xor eax, eax
jmp 0x586783
mov ebx, dword [esp + 0x50]
lea eax, [ebx + 1]
cmp eax, 5
jge 0x58682e
mov dword [esp + 0x50], eax
lea edx, [esp + eax*8 + 0x5c]
mov ebx, dword [edx]
mov dword [esp + 0x4c], ebx
mov edx, dword [edx + 4]
imul ecx, eax, 0x33
lea ebp, [esp + 0x14]
mov dword [esp], ebp
mov dword [esp + 4], 8
mov dword [esp + 8], 8
mov ebp, ecx
sar ebp, 0x1f
shr ebp, 0x1d
add ebp, ecx
mov dword [esp + 0x58], ebp
and ebp, 0xfffffff8
sub ecx, ebp
mov dword [esp + 0x54], ecx
shl edx, cl
mov ebp, ebx
shl ebx, cl
lea edi, [ecx - 0x20]
mov ecx, edi
shl ebp, cl
neg ecx
mov eax, dword [esp + 0x4c]
shr eax, cl
cmp ecx, 0x20
sbb ecx, ecx
and eax, ecx
mov esi, dword [esp + 0x54]
cmp esi, 0x20
sbb esi, esi
and edx, esi
or eax, edx
and ebx, esi
mov dword [esp + 0xc], ebx
cmp edi, 0x20
sbb edx, edx
and ebp, edx
or ebp, eax
mov dword [esp + 0x10], ebp
call fcn.0047d8b0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x8c]
xor ecx, ecx
jmp 0x586872
mov eax, dword [esp + 0x8c]
test byte [eax], al
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], 0x20
mov dword [esp + 0x98], 0x20
add esp, 0x84
ret
test byte [edx], al
movzx ebp, byte [esp + ecx + 0x1c]
movzx esi, byte [edx + eax]
or esi, ebp
xchg esi, ebx
mov byte [edx + eax], bl
xchg esi, ebx
inc ecx
mov eax, ebx
cmp ecx, 8
jge 0x58677c
mov ebx, eax
sar eax, 3
add eax, ecx
cmp eax, 0x20
jl 0x58685b
jmp 0x58677c
call fcn.00475ee0
jmp fcn.005866d0
Function at 0x590900
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x590b14
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x590997
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
jmp 0x590af5
cmp ecx, 0xe
jne 0x590a10
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x590af5
cmp ecx, 0xf
jne 0x590a86
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x590af5
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
call fcn.00475ee0
jmp fcn.00590900