joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d7850
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x78bd58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d7a3a
sub esp, 0x48
mov eax, dword [0x7423a4]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 2]
movzx ebx, word [ecx + 8]
movzx ebp, word [ecx + 0xa]
movzx esi, word [ecx + 0xc]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.004d39c0
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.004705fe
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.004705fe
call fcn.004cfe80
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.00467fc0
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
mov eax, ebp
sar ebp, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x4d7927
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x4d7941
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x4d79b8
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x4d798e
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x4d798a
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x4d7983
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x4d7990
mov ebx, 0x1d
jmp 0x4d79ae
mov ebp, eax
jmp 0x4d7990
mov ebp, eax
cmp ebp, 0xd
jae 0x4d7a2d
lea eax, [ebp - 1]
lea edx, [0x732f60]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x4d7a23
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x4d79b8
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x4d79ea
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x4d79f2
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
mov dword [esp + 0x54], eax
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov ecx, 0xd
call fcn.0046ff60
mov eax, ebp
mov ecx, 0xd
call fcn.0046ff60
nop
call fcn.0046eae0
jmp fcn.004d7850
Function at 0x50abc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x78bd58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50acba
sub esp, 0x20
mov ecx, dword [esp + 0x24]
test byte [ecx], al
mov edx, dword [esp + 0x28]
mov ebx, edx
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x1c], ecx
xor eax, eax
jmp 0x50ac00
mov ebp, dword [esp + 0x14]
inc ebp
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, ebp
cmp eax, 4
jge 0x50ac39
mov dword [esp + 0x14], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.00475150
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x2c]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x50abf3
mov byte [esp + 0x30], 1
add esp, 0x20
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x50ac43
inc eax
cmp eax, 4
jge 0x50ac59
mov dword [esp + 0x18], eax
lea ebp, [ecx + eax*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
xor edi, edi
jmp 0x50acb3
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.004751a0
mov byte [esp + 0x30], 0
add esp, 0x20
ret
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
and esi, 0xff
xor edx, esi
mov esi, dword [esp + 0xc]
shr esi, 8
shl ebp, 0x18
mov eax, edx
mov ebx, 0x1b3
mul ebx
inc edi
or esi, ebp
mov ebp, dword [esp + 0x10]
shr ebp, 8
mov ebx, dword [esp + 0x28]
mov edx, eax
mov eax, dword [esp + 0x18]
cmp edi, 8
jl 0x50ac7c
jmp 0x50ac42
call fcn.0046eae0
jmp fcn.0050abc0
Function at 0x50c4b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x78bd58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50c65a
sub esp, 0x54
lea edi, [esp + 0x60]
xor eax, eax
call fcn.0047011b
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
xor ebx, ebx
jmp 0x50c4df
inc ebx
cmp edx, ebx
jle 0x50c5fe
movzx ebp, byte [ecx + ebx]
xchg ebp, eax
cmp al, 0x25
xchg ebp, eax
je 0x50c5a2
xchg ebp, eax
cmp al, 0x2e
xchg ebp, eax
je 0x50c553
xchg ebp, eax
cmp al, 0x3a
xchg ebp, eax
jne 0x50c4de
lea edi, [esp + 0x28]
call fcn.0047011b
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.0050ce40
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.004705fe
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.004705fe
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x28]
call fcn.0047011b
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.0050ca30
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.004705fe
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.004705fe
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.0047011a
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x5dfca7]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x14
lea edi, [esp + 0x60]
call fcn.0047011b
lea ecx, [0x5c5820]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call fcn.0040e660
mov ecx, dword [esp + 8]
lea edx, [0x6221cc]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.0047011a
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x5dece1]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x12
lea edi, [esp + 0x60]
call fcn.0047011b
lea ecx, [0x5c5820]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call fcn.0040e660
mov ecx, dword [esp + 8]
lea edx, [0x6221cc]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
call fcn.0046eae0
jmp fcn.0050c4b0
Function at 0x51c100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x78bd58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51c2bc
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.00470117
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x51c138
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x51c161
lea eax, [0x5b1ec0]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.00454420
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x30], ecx
lea edi, [esp + 0x34]
mov ebx, eax
xor eax, eax
call fcn.00470117
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x50], ecx
movzx ecx, word [esp + 0x70]
shl ecx, 0xb
movzx edx, word [esp + 0x78]
movzx ebx, byte [esp + 0x75]
or edx, ecx
test bl, bl
je 0x51c1a4
or edx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x51c1b3
or edx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x51c1c2
or edx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x51c1d1
or edx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x51c1e0
or edx, 0xffff8000
movzx eax, byte [esp + 0x76]
test al, al
je 0x51c1ec
or edx, 0x20
movzx eax, byte [esp + 0x77]
test al, al
je 0x51c1f8
or edx, 0x10
movzx eax, word [esp + 0x6c]
mov word [esp + 0x42], ax
mov word [esp + 0x44], dx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x34]
cmp eax, edx
jae 0x51c268
mov dword [esp + 0x30], ecx
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
lea eax, [0x5b1ec0]
mov dword [esp + 0x10], eax
call fcn.004544e0
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x58], ebx
add ecx, ebx
mov dword [esp], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xc
call fcn.00470810
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov byte [esp + 0x40], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x34]
call fcn.004705d6
add esp, 0x5c
ret
call fcn.0046eae0
jmp fcn.0051c100
Function at 0x534340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x78bd58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5344b1
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x5343d7
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x534376
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x5343e3
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x5343a1
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x5343e3
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x5343e3
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.00534130
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.0053c4c0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.0046eae0
jmp fcn.00534340
Function at 0x551ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x78bd58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x20]
cmp eax, dword [ecx + 8]
jbe 0x551d77
sub esp, 0xa0
lea edi, [esp + 0x60]
xor eax, eax
call fcn.00470116
mov dword [esp + 0x64], 0xb
lea ecx, [0x5dbd76]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x6c], 0xa
lea ecx, [0x5db82d]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x74], 8
lea ecx, [0x5daf25]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x7c], 9
lea ecx, [0x5db38a]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x84], 0xa
lea ecx, [0x5db837]
mov dword [esp + 0x80], ecx
xor ecx, ecx
jmp 0x551b76
mov edx, dword [esp + 0x2c]
lea ecx, [edx + 1]
xor eax, eax
cmp ecx, 5
jge 0x551d52
mov dword [esp + 0x2c], ecx
lea eax, [esp + ecx*8 + 0x60]
mov edx, dword [eax]
mov dword [esp + 0x34], edx
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
lea ebx, [0x5db841]
mov dword [esp], ebx
mov dword [esp + 4], 0xa
call fcn.004e9ab0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], ecx
lea edi, [esp + 0x48]
mov edx, eax
xor eax, eax
call fcn.0047011a
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x48], edx
mov dword [esp + 0x54], 8
lea ecx, [0x5daf2d]
mov dword [esp + 0x50], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x5c], edx
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x58], ebx
lea ebp, [esp + 0x48]
mov dword [esp], ebp
mov dword [esp + 4], 3
mov dword [esp + 8], 3
call fcn.005069f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
call fcn.00504c90
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
test eax, eax
jne 0x551c46
mov eax, dword [esp + 0x10]
test eax, eax
je 0x551b6d
jmp 0x551d2d
mov dword [esp + 0x30], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0040e820
mov eax, dword [esp + 8]
lea ecx, [0x5b1e40]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x551c9f
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x44], ecx
lea edi, [esp + 0x88]
xor eax, eax
call fcn.0047011a
lea ecx, [0x551d90]
mov dword [esp + 0x88], ecx
mov dword [esp + 0x90], 0x27
lea edx, [0x5e7281]
mov dword [esp + 0x8c], edx
mov dword [esp + 0x98], 2
mov dword [esp + 0x9c], 2
lea ebx, [esp + 0x38]
mov dword [esp + 0x94], ebx
mov ebx, dword [0x74ce40]
mov dword [esp], ebx
mov dword [esp + 4], 0
mov dword [esp + 8], 2
lea ebx, [esp + 0x88]
mov dword [esp + 0xc], ebx
call fcn.00502e10
jmp 0x551b6d
mov byte [esp + 0xa4], 1
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0
add esp, 0xa0
ret
mov byte [esp + 0xa4], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0
add esp, 0xa0
ret
call fcn.0046eae0
jmp fcn.00551ae0
Function at 0x558f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x78bd58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5591c8
sub esp, 0x70
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x64], 5
lea eax, [0x5da5e9]
mov dword [esp + 0x60], eax
mov dword [esp + 0x6c], 0x26
lea eax, [0x5e6e57]
mov dword [esp + 0x68], eax
lea eax, [0x5da2a1]
mov dword [esp], eax
mov dword [esp + 4], 3
lea eax, [esp + 0x60]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00552650
mov eax, dword [esp + 0x14]
mov dword [esp + 0x38], eax
lea ecx, [0x5cc640]
mov dword [esp], ecx
call fcn.00410f90
mov eax, dword [esp + 4]
mov byte [eax], 1
mov ecx, dword [esp + 0x38]
test byte [ecx], al
mov edx, dword [0x78be40]
test edx, edx
je 0x559033
call fcn.0046fef0
mov dword [edi], eax
mov edx, dword [ecx + 0x4c]
mov dword [edi + 4], edx
mov dword [ecx + 0x4c], eax
mov dword [esp], ecx
call fcn.005554c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test eax, eax
jne 0x5590a5
mov dword [esp], 0
call fcn.00458180
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
lea eax, [0x620494]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0xffffffff
call fcn.00484a20
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
xor edx, edx
xor ebx, ebx
jmp 0x55915b
mov dword [esp + 0x2c], eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
je 0x5590c0
mov edx, dword [eax + 4]
jmp 0x5590c2
mov edx, eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ecx
lea edi, [esp + 0x48]
xor eax, eax
call fcn.0047011a
lea ecx, [0x5591e0]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x50], 0x30
lea ecx, [0x5e9496]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x58], 1
mov dword [esp + 0x5c], 1
lea ecx, [esp + 0x40]
mov dword [esp + 0x54], ecx
mov ecx, dword [0x74ce40]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 2
lea ecx, [esp + 0x48]
mov dword [esp + 0xc], ecx
call fcn.00502e10
mov byte [esp + 0x74], 0
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x78], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x7c], ecx
add esp, 0x70
ret
mov ebp, dword [esp + 0x30]
lea edx, [ebp + 1]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x24]
cmp edx, ecx
jge 0x559192
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], ebx
lea ecx, [eax + edx*8]
mov ebx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.00486450
mov eax, dword [esp + 0xc]
test eax, eax
je 0x55918c
mov eax, dword [esp + 0x28]
lea ebx, [eax + 1]
jmp 0x55914c
mov ebx, dword [esp + 0x28]
jmp 0x55914c
test ebx, ebx
jg 0x5591af
mov byte [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x70
ret
mov byte [esp + 0x74], 1
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x70
ret
call fcn.0046eae0
jmp fcn.00558f70
Function at 0x559260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x78bd58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0xc]
cmp eax, dword [ecx + 8]
jbe 0x559446
sub esp, 0x8c
lea edi, [esp + 0x1c]
xor eax, eax
call fcn.00470104
mov dword [esp + 0x20], 7
lea ecx, [0x5dab8f]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], 6
lea ecx, [0x5da85e]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x30], 7
lea ecx, [0x5dab96]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x38], 7
lea ecx, [0x5dab9d]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x40], 0xb
lea ecx, [0x5dbd8c]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x48], 7
lea ecx, [0x5daba4]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x50], 5
lea ecx, [0x5da5ee]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x58], 8
lea ecx, [0x5daf3d]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x60], 9
lea ecx, [0x5db39c]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x68], 8
lea ecx, [0x5daf45]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x70], 0x12
lea ecx, [0x5de753]
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x78], 5
lea ecx, [0x5da5f3]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x80], 6
lea ecx, [0x5da864]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x88], 0xd
lea ecx, [0x5dc9c8]
mov dword [esp + 0x84], ecx
lea ecx, [0x5daf4d]
mov dword [esp], ecx
mov dword [esp + 4], 8
call fcn.004e9ab0
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.00485990
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], edx
xor eax, eax
jmp 0x5593d9
mov ebx, dword [esp + 0x14]
inc ebx
mov ecx, dword [esp + 0x18]
mov edx, eax
mov eax, ebx
cmp eax, 0xe
jge 0x559437
mov dword [esp + 0x14], eax
lea ecx, [esp + eax*8 + 0x1c]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.00485990
mov eax, dword [esp + 0x10]
cmp dword [esp + 0xc], eax
jne 0x5593cc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x18]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00406dd0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x559428
mov eax, dword [esp + 0x10]
jmp 0x5593cc
mov byte [esp + 0x90], 1
add esp, 0x8c
ret
mov byte [esp + 0x90], 0
add esp, 0x8c
ret
call fcn.0046eae0
jmp fcn.00559260
Function at 0x563b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x78bd58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x563d4c
sub esp, 0x24
mov eax, dword [esp + 0x28]
test byte [eax], al
mov ecx, dword [0x78be40]
test ecx, ecx
jne 0x563b9d
mov ecx, dword [esp + 0x38]
jmp 0x563bb4
mov ecx, dword [eax + 0x10]
call fcn.0046ff00
mov dword [edi], ecx
mov ecx, dword [esp + 0x38]
mov dword [edi + 4], ecx
mov edx, dword [eax + 0x2c]
mov dword [edi + 8], edx
mov dword [eax + 0x10], 0
mov dword [eax + 0x2c], ecx
lea edx, [0x5ade60]
mov dword [esp], edx
call fcn.00410f90
mov eax, dword [esp + 4]
mov dword [eax + 4], 1
lea ecx, [0x62065c]
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
mov dword [ecx + 0x74], 1
mov dword [ecx + 0x78], 1
mov edx, dword [0x78be40]
test edx, edx
jne 0x563c05
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x3c]
jmp 0x563c2c
call fcn.0046ff30
mov dword [edi], eax
mov edx, dword [ecx + 0x70]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [edi + 8], edx
mov ebx, dword [ecx + 0x20]
mov dword [edi + 0xc], ebx
mov ebx, dword [esp + 0x3c]
mov dword [edi + 0x10], ebx
mov ebp, dword [ecx + 0x7c]
mov dword [edi + 0x14], ebp
mov dword [ecx + 0x70], eax
mov eax, dword [esp + 0x30]
mov dword [ecx + 0x24], eax
mov ebp, dword [esp + 0x34]
mov dword [ecx + 0x28], ebp
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x7c], ebx
xor ebx, ebx
jmp 0x563c48
inc ebx
mov dword [esp + 0x1c], ebx
cmp eax, ebx
jle 0x563ca3
mov ebp, dword [edx + ebx*4]
test ebp, ebp
je 0x563c47
lea eax, [0x5b4ca0]
mov dword [esp], eax
mov dword [esp + 4], ebp
lea ecx, [0x5da765]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 5
call fcn.004151c0
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x563c97
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
jmp 0x563c47
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x1c]
mov edx, dword [ecx + 0x20]
mov dword [esp + 0x20], edx
mov ebp, dword [ecx + 0x24]
mov dword [esp + 0x18], ebp
xor esi, esi
jmp 0x563cb6
inc esi
cmp esi, ebp
jge 0x563d25
mov edi, dword [edx + esi*4]
test edi, edi
je 0x563cb5
mov dword [esp + 0x14], esi
lea eax, [0x5b4ca0]
mov dword [esp], eax
mov dword [esp + 4], edi
lea ecx, [0x5db1e5]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 8
call fcn.004151c0
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x563d0d
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
jmp 0x563cb5
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
jmp 0x563d27
cmp eax, ebx
setle al
cmp esi, ebp
setge dl
mov ecx, dword [ecx + 0x14]
test ecx, 1
setne cl
mov ebx, dword [esp + 0x38]
mov byte [ebx + 0x4d], cl
mov byte [ebx + 0x4e], al
mov byte [ebx + 0x4f], dl
add esp, 0x24
ret
call fcn.0046eae0
jmp fcn.00563b70