joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6de88530
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x58]
mov esi, dword [esp + 0x5c]
mov ebx, dword [esp + 0x60]
test eax, eax
je 0x6de88583
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
je 0x6de885a3
xor ebp, ebp
test ebx, ebx
je 0x6de88599
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.msvcrt.dll_memcpy
add esp, 0x3c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, 1
cmp dword [esp + 0x2c], esi
jne 0x6de88583
jmp 0x6de88599

Function at 0x6de886d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3c
mov eax, dword [esp + 0x40]
test eax, eax
je 0x6de8871b
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], 4
mov dword [esp + 0x14], edx
lea edx, [esp + 0x28]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
je 0x6de88723
mov eax, dword [esp + 0x48]
add esp, 0x3c
ret
cmp dword [esp + 0x2c], 4
mov eax, dword [esp + 0x28]
jne 0x6de8871b
jmp 0x6de8871f

Function at 0x6de88730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
mov esi, str.0.0.0.0
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x50]
test eax, eax
je 0x6de887f5
mov dword [esp], 0x2000
lea ebp, [esp + 0x2c]
call sub.msvcrt.dll_malloc
mov dword [esp + 0x14], ebp
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x10], eax
mov esi, eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x2c], 0x2000
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call edi
sub esp, 0x18
cmp eax, 0xea
jne 0x6de887eb
mov ebx, 0x2000
add ebx, 0x1000
mov dword [esp], esi
mov dword [esp + 4], ebx
call sub.msvcrt.dll_realloc
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], eax
mov esi, eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x14], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call edi
sub esp, 0x18
cmp eax, 0xea
je 0x6de887a0
test eax, eax
mov eax, str.0.0.0.0
cmovne esi, eax
add esp, 0x3c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6de88800
Capabilities:
Set registry value

Disassembly:
sub esp, 0x2c
xor eax, eax
mov edx, dword [esp + 0x30]
test edx, edx
je 0x6de88846
lea eax, [esp + 0x38]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
test eax, eax
sete al
add esp, 0x2c
ret
Function at 0x6de88a50
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x21c
mov esi, dword [esp + 0x230]
mov ebp, dword [esi*4 + 0x6de8e1ac]
test esi, esi
je 0x6de88a71
cmp esi, 5
jne 0x6de88aa0
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
mov dword [esi*4 + 0x6de944a0], eax
test eax, eax
je 0x6de88b1a
add esp, 0x21c
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [esp + 0x10]
mov dword [esp + 4], 0x200
mov dword [esp], edi
mov ebx, edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
sub esp, 8
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x6de88aba
mov edx, eax
mov dword [esp], ebp
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
cmove ebx, edx
mov ecx, eax
add cl, al
sbb ebx, 3
call sub.msvcrt.dll_strlen
sub ebx, edi
lea eax, [ebx + eax + 2]
cmp eax, 0x200
ja 0x6de88b1a
lea eax, [edi + ebx + 1]
mov byte [edi + ebx], 0x5c
mov dword [esp + 4], ebp
mov ebp, edi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
jmp 0x6de88a71
call sub.msvcrt.dll_abort
nop
Function at 0x6de89710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x64
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x80]
mov esi, dword [esp + 0x78]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp]
mov dword [esp + 4], edx
xor edx, edx
and eax, 0x3f
mov dword [esp + 8], eax
mov eax, ecx
add eax, dword [esp]
adc edx, dword [esp + 4]
mov dword [esi], eax
mov dword [esi + 4], edx
test ecx, ecx
je 0x6de898e2
mov eax, dword [esp + 0x7c]
mov edx, esi
add ecx, eax
mov dword [esp], eax
mov dword [esp + 0xc], ecx
jmp 0x6de8977a
mov dword [esp + 8], eax
add dword [esp], 1
mov eax, dword [esp]
cmp dword [esp + 0xc], eax
je 0x6de898e2
mov ecx, dword [esp]
mov edi, dword [esp + 8]
movzx ecx, byte [ecx]
lea eax, [edi + 1]
mov byte [edx + edi + 0x18], cl
mov ecx, eax
and ecx, 0x3f
mov dword [esp + 8], ecx
jne 0x6de89765
mov eax, dword [edx + 0x20]
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x24]
mov esi, dword [edx + 0x28]
mov edi, dword [edx + 0x2c]
mov ebp, dword [edx + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [edx + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [edx + 0x1c]
mov dword [esp + 0x2c], ebx
xor ebx, ebx
mov dword [esp + 0x3c], eax
mov eax, dword [edx + 0x38]
mov dword [esp + 0x30], esi
mov dword [esp + 0x40], eax
mov eax, dword [edx + 0x3c]
mov dword [esp + 0x34], edi
mov dword [esp + 0x44], eax
mov eax, dword [edx + 0x40]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x48], eax
mov eax, dword [edx + 0x44]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x4c], eax
mov eax, dword [edx + 0x48]
mov dword [esp + 0x50], eax
mov eax, dword [edx + 0x4c]
mov dword [esp + 0x54], eax
mov eax, dword [edx + 0x50]
mov dword [esp + 0x58], eax
mov eax, dword [edx + 0x54]
mov dword [esp + 0x5c], eax
mov ecx, dword [edx + 8]
mov esi, dword [edx + 0xc]
mov edi, dword [edx + 0x10]
mov dword [esp + 0x78], edx
mov ebp, dword [edx + 0x14]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebp
jmp 0x6de8986c
mov eax, ebp
lea edx, [ebx*8]
not eax
sub edx, ebx
or eax, esi
and edx, 0xf
xor eax, edi
add eax, dword [ebx*4 + 0x6de8e280]
add eax, dword [esp + edx*4 + 0x20]
add eax, ecx
mov ecx, dword [ebx*4 + 0x6de8e380]
add ebx, 1
rol eax, cl
mov ecx, ebp
add eax, esi
cmp ebx, 0x40
je 0x6de898b1
mov ebp, edi
mov edi, esi
mov esi, eax
mov eax, ebx
shr eax, 4
cmp eax, 1
je 0x6de898a0
test eax, eax
je 0x6de89890
cmp eax, 2
jne 0x6de89830
mov eax, edi
lea edx, [ebx + ebx*2 + 5]
xor eax, ebp
and edx, 0xf
xor eax, esi
jmp 0x6de89844
mov eax, edi
mov edx, ebx
xor eax, ebp
and eax, esi
xor eax, ebp
jmp 0x6de89844
mov eax, edi
lea edx, [ebx + ebx*4 + 1]
xor eax, esi
and edx, 0xf
and eax, ebp
xor eax, edi
jmp 0x6de89844
mov edx, dword [esp + 0x78]
add eax, dword [esp + 0x14]
add ebp, dword [esp + 0x10]
add esi, dword [esp + 0x18]
add edi, dword [esp + 0x1c]
mov dword [edx + 0xc], eax
add dword [esp], 1
mov eax, dword [esp]
mov dword [edx + 8], ebp
mov dword [edx + 0x10], esi
mov dword [edx + 0x14], edi
cmp dword [esp + 0xc], eax
jne 0x6de8977a
add esp, 0x64
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6de8a500
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6de94838]
test esi, esi
jle 0x6de8a610
mov edi, dword [0x6de9483c]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6de8a534
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6de8a5b5
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x6de8a520
mov dword [esp], eax
mov ebx, eax
call fcn.6de8ac50
test eax, eax
mov edi, eax
je 0x6de8a637
mov eax, dword [0x6de9483c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6de8ad50
add eax, dword [edi + 0xc]
mov edx, dword [0x6de9483c]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6de8a617
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6de8a5ae
sub eax, 4
and eax, 0xfffffffb
jne 0x6de8a5c0
add dword [0x6de94838], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x6de9483c]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6de8a5ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6de8b1d4
lea esi, [esi]
xor esi, esi
jmp 0x6de8a53e
mov eax, dword [0x6de9483c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6de8b1d4
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6de8b1d4
mov esi, esi
lea edi, [edi]

Function at 0x6de8a8d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6de94848
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6de94840]
sub esp, 4
test ebx, ebx
je 0x6de8a925
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6de8a91e
test esi, esi
je 0x6de8a91e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6de8a900
mov dword [esp], 0x6de94848
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6de8b1d4
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6de8b170
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6de8b170
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
jmp fcn.6de813e0

Function at 0x8c2118
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x8c1ea3
sub esp, 4
mov dword [esp], 0xd49263d6
pop edi
call fcn.008c214c
add edx, edi
add edi, 0x7f5c99c7
xor dword [ebx], eax
dec edx
inc ebx
inc edx
mov edi, edi
cmp ebx, esi
jne fcn.008c2118
add edx, edx
mov edi, edi
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0xfc40178
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x6b523668
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x42c5ee
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x45758c]
test eax, eax
je 0x42c62d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42c62d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42c62d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42c62d
cmp dword [ecx + 0x74], 0xe
jbe 0x42c62d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4415fb
Capabilities:
Encode data using xor

Disassembly:
out dx, al
jecxz 0x44165f
call 0x8107fb71
inc edi
xor eax, 0x4db30ec9
and edi, esi
jae 0x441604
add byte [esi], bl
and ch, byte [eax + edx*2 + 0x70]
aas
dec eax
scasd eax, dword es:[edi]
invalid
cmp byte [ebp - 0x5c5eb1ff], ah
invalid

Function at 0x445991
Capabilities:
Encode data using xor

Disassembly:
dec ebx
les eax, [ebp + 0x28]
pop edx
arpl word [esi + ebp*2 + 0x7e], si
jecxz 0x4459da
shr esp, 0x4a
test al, 0xb6
imul edi, dword [eax], 0xffffffc3
adc bh, dh
cli
nop
aad 0x41
mov dl, byte [edx + 0x1de41437]
mov ebp, 0x2330128d
lea edx, [edx]
xor byte [ebx], ah
dec ecx
mov esp, 0x1fd2eafc
add eax, 0xe443886d
shl dword [esi + 0x767f4fc5], 0x31
rol byte [ebp - 0xc041dc1], 0x3d
cli
push ds
js 0x4459b3
xchg esp, eax
lds ebp, [edi + 0x19]
invalid
aam 0xb3
cmp dword [ebp + 0xdf192a0], 0xfffffff2
inc edx
push esp
retf
Function at 0x42c760
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x42c98b
cmp eax, 0x7c
je 0x42c98b
cmp eax, 0x29
jne 0x42c79c
cmp dword [esi + 0x10], 0
jne 0x42c98b
test dword [esi + 0x50], 0x10000000
je 0x42c9a2
cmp eax, 0x2e
jne 0x42c7b0
lea ecx, [esi + 0x24]
push 5
call fcn.0042ca00
jmp 0x42c96f
cmp eax, 0x5c
jne 0x42c815
mov ecx, esi
call fcn.0042c700
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x42c7e2
cmp byte [esi + 0x48], 0x62
jne 0x42c7e2
lea ecx, [esi + 0x24]
push 4
call fcn.0042ca00
mov ecx, esi
call fcn.0042c700
jmp 0x42c97d
test eax, eax
je 0x42c809
cmp byte [esi + 0x48], 0x42
jne 0x42c809
lea ecx, [esi + 0x24]
push 4
call fcn.0042ca00
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0042c700
jmp 0x42c97d
mov ecx, esi
call fcn.0042eaf0
jmp 0x42c976
cmp eax, 0x5b
jne 0x42c8d6
mov ecx, esi
call fcn.0042c700
lea ecx, [esi + 0x24]
call fcn.00431c20
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x42c846
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0042c700
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x42c8c0
cmp eax, 0x5d
jne 0x42c8c0
test dword [esi + 0x2c], 0x100
mov bl, al
je 0x42c86f
mov eax, dword [esi + 0x30]
push 0x5d
mov ecx, dword [eax + 4]
call dword [0x5ad2ac]
mov bl, al
mov edi, dword [esi + 0x28]
mov ecx, dword [edi + 0x18]
test ecx, ecx
jne 0x42c8a4
push 0x20
call fcn.0059df75
add esp, 4
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov ecx, eax
mov dword [edi + 0x18], eax
movzx edx, bl
mov eax, edx
and edx, 7
shr eax, 3
add ecx, eax
movzx eax, byte [ecx]
bts eax, edx
mov byte [ecx], al
mov ecx, esi
call fcn.0042c700
mov ecx, esi
call fcn.00431730
cmp dword [esi + 0x4c], 0x5d
jne 0x42c99b
jmp 0x42c96f
cmp eax, 0x28
jne 0x42c902
mov ecx, esi
call fcn.0042c700
mov ecx, esi
call fcn.0042ec80
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x42c9a2
mov ecx, esi
call fcn.0042c700
test bl, bl
je 0x42c97d
jmp 0x42c976
cmp eax, 0x5e
jne 0x42c91a
lea ecx, [esi + 0x24]
push 2
call fcn.0042ca00
mov ecx, esi
call fcn.0042c700
jmp 0x42c97d
cmp eax, 0x24
jne 0x42c932
lea ecx, [esi + 0x24]
push 3
call fcn.0042ca00
mov ecx, esi
call fcn.0042c700
jmp 0x42c97d
cmp eax, 0x2a
je 0x42c994
cmp eax, 0x2b
je 0x42c994
cmp eax, 0x3f
je 0x42c994
cmp eax, 0x7b
je 0x42c994
cmp eax, 0x7d
jne 0x42c954
test dword [esi + 0x50], 0x10000000
je 0x42c9a9
cmp eax, 0x5d
jne 0x42c962
test dword [esi + 0x50], 0x10000000
je 0x42c99b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0042eee0
mov ecx, esi
call fcn.0042c700
mov ecx, esi
call fcn.0042ed80
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x42c777
pop edi
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa
call fcn.0042b020
push 4
call fcn.0042b020
push 5
call fcn.0042b020
push 6
call fcn.0042b020
int3
Function at 0x477a50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3258
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5f300c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], edx
mov esi, ecx
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov ecx, dword [esi + 0x1c]
cmp dword [esi + 0xc], ecx
push dword [esi + 0x30]
sbb eax, eax
neg eax
inc eax
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.00475ef0
mov ecx, esi
mov dword [esi + 0x30], 9
call fcn.004761d0
mov ecx, esi
call fcn.004761d0
xor edi, edi
mov byte [ebp - 0x2c], 0
mov ebx, 0xf
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], edi
cmp byte [esi + 0x2d], 0
jne 0x477b41
lea ecx, [ecx]
mov edx, dword [esi + 0x38]
cmp edx, 0x20
je 0x477b41
cmp edx, 9
jl 0x477ae2
cmp edx, 0xd
jle 0x477b41
mov ecx, edx
call fcn.00478380
test al, al
jne 0x477b41
push edx
call dword [0x5ad86c]
add esp, 4
mov byte [ebp - 0x30], al
cmp edi, ebx
jae 0x477b19
lea ecx, [edi + 1]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x2c]
cmp ebx, 0x10
jb 0x477b0f
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + edi], al
mov byte [ecx + edi + 1], 0
jmp 0x477b2c
push dword [ebp - 0x30]
mov byte [ebp - 0x34], 0
push dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0042a1d0
mov ecx, esi
call fcn.004761d0
cmp byte [esi + 0x2d], 0
jne 0x477b41
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
jmp 0x477ad0
cmp dword [esi + 0x38], 0x3e
jne 0x477b5d
cmp dword [esi + 0x40], 0x3e
jne 0x477b5d
mov ecx, esi
call fcn.004761d0
mov ecx, esi
call fcn.004761d0
jmp 0x477b64
mov dword [esi + 0x30], 0xb
lea ecx, [ebp - 0x2c]
call fcn.00478400
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x2c]
test al, al
je 0x477b8d
lea eax, [ebp - 0x2c]
cmp ebx, 0x10
jb 0x477b80
mov eax, edi
mov ecx, dword [ebp - 0x38]
push eax
call fcn.00475500
test al, al
je 0x477b94
mov dword [esi + 0x30], 0xb
mov ecx, dword [esi + 0x1c]
cmp dword [esi + 0xc], ecx
push dword [esi + 0x30]
sbb eax, eax
neg eax
inc eax
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.00475ef0
mov dword [esi + 0x30], 0
cmp ebx, 0x10
jb 0x477be5
lea ecx, [ebx + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x477bdb
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x477bdb
call dword [0x5ad78c]
push ecx
push edi
call fcn.0059e222
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0059df64
mov esp, ebp
pop ebp
ret
Function at 0x477c10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2128
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5f300c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov byte [edx], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x1c]
cmp dword [esi + 0xc], ecx
push dword [esi + 0x30]
sbb eax, eax
neg eax
inc eax
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.00475ef0
mov dword [esi + 0x30], 3
mov edx, dword [esi + 0x38]
cmp edx, 0x20
je 0x477c99
cmp edx, 9
jl 0x477c8a
cmp edx, 0xd
jle 0x477c99
mov ecx, edx
call fcn.00478380
test al, al
jne 0x477c99
mov ecx, edx
jmp 0x477ca5
cmp edx, 0x2e
jne 0x477cf0
mov ecx, edx
cmp dword [esi + 0x40], ecx
je 0x477cf0
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov byte [ebp - 0x30], cl
cmp edx, edi
jae 0x477cd4
lea eax, [edx + 1]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
cmp edi, 0x10
jb 0x477cc3
mov eax, dword [ebp - 0x28]
mov byte [eax + edx], cl
mov ecx, esi
mov byte [eax + edx + 1], 0
call fcn.004761d0
jmp 0x477c78
push dword [ebp - 0x30]
mov byte [ebp - 0x2c], 0
push dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0042a1d0
mov ecx, esi
call fcn.004761d0
jmp 0x477c78
mov eax, dword [esi + 0x34]
cmp eax, 0x65
je 0x477d01
cmp eax, 0x45
jne 0x477d8c
mov bl, dl
cmp edx, 0x2b
je 0x477d0d
cmp edx, 0x2d
jne 0x477d8c
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp ecx, edx
jae 0x477d32
lea eax, [ecx + 1]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
cmp edx, 0x10
jb 0x477d28
mov eax, dword [ebp - 0x28]
mov byte [eax + ecx], bl
mov byte [eax + ecx + 1], 0
jmp 0x477d43
push ebx
mov byte [ebp - 0x2c], 0
push dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0042a1d0
mov ecx, esi
call fcn.004761d0
mov ecx, dword [esi + 0x38]
mov bl, cl
cmp ecx, 0x20
je 0x477d8c
cmp ecx, 9
jl 0x477d5e
cmp ecx, 0xd
jle 0x477d8c
call fcn.00478380
test al, al
jne 0x477d8c
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp ecx, edx
jae 0x477d32
lea eax, [ecx + 1]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
cmp edx, 0x10
jb 0x477d28
mov eax, dword [ebp - 0x28]
mov byte [eax + ecx], bl
mov byte [eax + ecx + 1], 0
jmp 0x477d43
lea ecx, [ebp - 0x28]
call fcn.004784d0
test al, al
jne 0x477da6
mov dword [esi + 0x30], 0xb
mov eax, 0xb
jmp 0x477da9
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x1c]
cmp dword [esi + 0xc], ecx
push eax
sbb eax, eax
neg eax
inc eax
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.00475ef0
mov edx, dword [ebp - 0x14]
mov dword [esi + 0x30], 0
cmp edx, 0x10
jb 0x477dfc
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x477df2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x477df2
call dword [0x5ad78c]
push edx
push ecx
call fcn.0059e222
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059df64
mov esp, ebp
pop ebp
ret