joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50292a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x74], 0
mov dword [esp + 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
je 0x502967
mov ecx, dword [esp + 0x78]
add ecx, 0x400
jae 0x502971
mov dword [esp + 4], 0
jmp 0x502984
mov dword [esp + 4], 0
jmp 0x502984
call fcn.00501154
cmp eax, 1
mov dword [esp + 0x38], edx
sete al
mov dword [esp + 4], eax
lea ebp, [esp + 8]
mov edx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov ebx, edx
cmp ebx, edi
jne 0x5029ac
mov esi, dword [esp + 0x70]
mov ecx, esi
push 0x20
pop edx
call fcn.0046417a
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x70]
mov esi, edi
sub esi, ebx
mov eax, dword [eax]
add eax, ebx
cmp byte [esp + 4], 0
je 0x5029db
mov edx, dword [esp + 0x38]
cmp esi, edx
cmovb edx, esi
xor ecx, ecx
push 0x632f54
push esi
push eax
call fcn.00417cca
add esp, 0xc
mov esi, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
and dword [esp + 0x28], 0
mov edx, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
call fcn.00502b45
pop eax
cmp byte [esp + 8], 4
je 0x502a33
mov ecx, ebp
call fcn.00500c58
test al, al
je 0x502b1d
movsd xmm0, qword [esp + 8]
lea eax, [esp + 0x3c]
movsd qword [esp + 0x3c], xmm0
push eax
call fcn.004fdf2b
pop eax
jmp 0x502994
mov esi, dword [esp + 0x28]
test esi, esi
je 0x502b32
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
push 0x63c6a4
push eax
push dword [esp + 0x1c]
call fcn.00417cca
add esp, 0xc
mov dword [esp + 0x18], edx
mov edx, esi
xor ecx, ecx
push 0x63c6b4
push dword [esp + 0x34]
push dword [esp + 0x1c]
call fcn.00417cca
add esp, 0xc
mov eax, dword [esp + 0x70]
add edx, ebx
cmp edx, edi
mov dword [eax + 8], edx
jne 0x502992
mov ebx, dword [esp + 0x34]
cmp edi, ebx
jne 0x502992
mov esi, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
push 0x20
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x24]
push ebp
call fcn.00502be8
add esp, 0x10
cmp byte [esp + 8], 4
je 0x502ae1
mov ecx, ebp
call fcn.00500c58
test al, al
je 0x502b1d
mov ecx, ebp
call fcn.00522035
jmp 0x502ab2
mov edx, dword [esp + 0xc]
test edx, edx
je 0x502b38
xor ecx, ecx
push 0x632f64
push 0x20
lea eax, [esp + 0x44]
push eax
call fcn.00417cca
add esp, 0xc
mov ebx, dword [esp + 0x70]
mov esi, edx
mov edx, eax
add esi, eax
mov ecx, ebx
push esi
call fcn.00464149
pop eax
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
jmp 0x502992
movsd xmm0, qword [esp + 8]
mov eax, dword [esp]
movsd qword [eax], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
sub ebx, dword [esp + 0x10]
jmp 0x502b3a
sub ebx, esi
mov eax, dword [esp]
mov dword [eax + 4], ebx
mov byte [eax], 4
jmp 0x502b2a
Function at 0x5046ad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x74], 0
mov dword [esp + 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
je 0x5046ea
mov ecx, dword [esp + 0x78]
add ecx, 0x400
jae 0x5046f4
mov dword [esp + 4], 0
jmp 0x504707
mov dword [esp + 4], 0
jmp 0x504707
call fcn.00501154
cmp eax, 1
mov dword [esp + 0x38], edx
sete al
mov dword [esp + 4], eax
lea ebp, [esp + 8]
mov edx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov ebx, edx
cmp ebx, edi
jne 0x50472f
mov esi, dword [esp + 0x70]
mov ecx, esi
push 0x20
pop edx
call fcn.0046417a
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x70]
mov esi, edi
sub esi, ebx
mov eax, dword [eax]
add eax, ebx
cmp byte [esp + 4], 0
je 0x50475e
mov edx, dword [esp + 0x38]
cmp esi, edx
cmovb edx, esi
xor ecx, ecx
push 0x632f54
push esi
push eax
call fcn.00417cca
add esp, 0xc
mov esi, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
and dword [esp + 0x28], 0
mov edx, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
call fcn.005048c8
pop eax
cmp byte [esp + 8], 4
je 0x5047b6
mov ecx, ebp
call fcn.00500c58
test al, al
je 0x5048a0
movsd xmm0, qword [esp + 8]
lea eax, [esp + 0x3c]
movsd qword [esp + 0x3c], xmm0
push eax
call fcn.004fdf2b
pop eax
jmp 0x504717
mov esi, dword [esp + 0x28]
test esi, esi
je 0x5048b5
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
push 0x63c6a4
push eax
push dword [esp + 0x1c]
call fcn.00417cca
add esp, 0xc
mov dword [esp + 0x18], edx
mov edx, esi
xor ecx, ecx
push 0x63c6b4
push dword [esp + 0x34]
push dword [esp + 0x1c]
call fcn.00417cca
add esp, 0xc
mov eax, dword [esp + 0x70]
add edx, ebx
cmp edx, edi
mov dword [eax + 8], edx
jne 0x504715
mov ebx, dword [esp + 0x34]
cmp edi, ebx
jne 0x504715
mov esi, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
push 0x20
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x24]
push ebp
call fcn.00502d07
add esp, 0x10
cmp byte [esp + 8], 4
je 0x504864
mov ecx, ebp
call fcn.00500c58
test al, al
je 0x5048a0
mov ecx, ebp
call fcn.00522035
jmp 0x504835
mov edx, dword [esp + 0xc]
test edx, edx
je 0x5048bb
xor ecx, ecx
push 0x632f64
push 0x20
lea eax, [esp + 0x44]
push eax
call fcn.00417cca
add esp, 0xc
mov ebx, dword [esp + 0x70]
mov esi, edx
mov edx, eax
add esi, eax
mov ecx, ebx
push esi
call fcn.00464149
pop eax
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
jmp 0x504715
movsd xmm0, qword [esp + 8]
mov eax, dword [esp]
movsd qword [eax], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
sub ebx, dword [esp + 0x10]
jmp 0x5048bd
sub ebx, esi
mov eax, dword [esp]
mov dword [eax + 4], ebx
mov byte [eax], 4
jmp 0x5048ad
Function at 0x50496b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x74], 0
mov dword [esp + 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
je 0x5049a8
mov ecx, dword [esp + 0x78]
add ecx, 0x400
jae 0x5049b2
mov dword [esp + 4], 0
jmp 0x5049c5
mov dword [esp + 4], 0
jmp 0x5049c5
call fcn.00501154
cmp eax, 1
mov dword [esp + 0x38], edx
sete al
mov dword [esp + 4], eax
lea ebp, [esp + 8]
mov edx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov ebx, edx
cmp ebx, edi
jne 0x5049ed
mov esi, dword [esp + 0x70]
mov ecx, esi
push 0x20
pop edx
call fcn.0046417a
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x70]
mov esi, edi
sub esi, ebx
mov eax, dword [eax]
add eax, ebx
cmp byte [esp + 4], 0
je 0x504a1c
mov edx, dword [esp + 0x38]
cmp esi, edx
cmovb edx, esi
xor ecx, ecx
push 0x632f54
push esi
push eax
call fcn.00417cca
add esp, 0xc
mov esi, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
and dword [esp + 0x28], 0
mov dword [esp + 0x2c], eax
sub esp, 4
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x24]
push ebp
call fcn.004ec210
add esp, 0x10
cmp byte [esp + 8], 4
je 0x504a78
mov ecx, ebp
call fcn.00500c58
test al, al
je 0x504b62
movsd xmm0, qword [esp + 8]
lea eax, [esp + 0x3c]
movsd qword [esp + 0x3c], xmm0
push eax
call fcn.004fdf2b
pop eax
jmp 0x5049d5
mov esi, dword [esp + 0x28]
test esi, esi
je 0x504b77
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
push 0x63c6a4
push eax
push dword [esp + 0x1c]
call fcn.00417cca
add esp, 0xc
mov dword [esp + 0x18], edx
mov edx, esi
xor ecx, ecx
push 0x63c6b4
push dword [esp + 0x34]
push dword [esp + 0x1c]
call fcn.00417cca
add esp, 0xc
mov eax, dword [esp + 0x70]
add edx, ebx
cmp edx, edi
mov dword [eax + 8], edx
jne 0x5049d3
mov ebx, dword [esp + 0x34]
cmp edi, ebx
jne 0x5049d3
mov esi, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
push 0x20
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x24]
push ebp
call fcn.004ec910
add esp, 0x10
cmp byte [esp + 8], 4
je 0x504b26
mov ecx, ebp
call fcn.00500c58
test al, al
je 0x504b62
mov ecx, ebp
call fcn.00522035
jmp 0x504af7
mov edx, dword [esp + 0xc]
test edx, edx
je 0x504b7d
xor ecx, ecx
push 0x632f64
push 0x20
lea eax, [esp + 0x44]
push eax
call fcn.00417cca
add esp, 0xc
mov ebx, dword [esp + 0x70]
mov esi, edx
mov edx, eax
add esi, eax
mov ecx, ebx
push esi
call fcn.00464149
pop eax
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
jmp 0x5049d3
movsd xmm0, qword [esp + 8]
mov eax, dword [esp]
movsd qword [eax], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
sub ebx, dword [esp + 0x10]
jmp 0x504b7f
sub ebx, esi
mov eax, dword [esp]
mov dword [eax + 4], ebx
mov byte [eax], 4
jmp 0x504b6f
Function at 0x504b8a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x74], 0
mov dword [esp + 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
je 0x504bc7
mov ecx, dword [esp + 0x78]
add ecx, 0x400
jae 0x504bd1
mov dword [esp + 4], 0
jmp 0x504be4
mov dword [esp + 4], 0
jmp 0x504be4
call fcn.00501154
cmp eax, 1
mov dword [esp + 0x38], edx
sete al
mov dword [esp + 4], eax
lea ebp, [esp + 8]
mov edx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov ebx, edx
cmp ebx, edi
jne 0x504c0c
mov esi, dword [esp + 0x70]
mov ecx, esi
push 0x20
pop edx
call fcn.0046417a
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x70]
mov esi, edi
sub esi, ebx
mov eax, dword [eax]
add eax, ebx
cmp byte [esp + 4], 0
je 0x504c3b
mov edx, dword [esp + 0x38]
cmp esi, edx
cmovb edx, esi
xor ecx, ecx
push 0x632f54
push esi
push eax
call fcn.00417cca
add esp, 0xc
mov esi, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
and dword [esp + 0x28], 0
mov edx, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
call fcn.00504da5
pop eax
cmp byte [esp + 8], 4
je 0x504c93
mov ecx, ebp
call fcn.00500c58
test al, al
je 0x504d7d
movsd xmm0, qword [esp + 8]
lea eax, [esp + 0x3c]
movsd qword [esp + 0x3c], xmm0
push eax
call fcn.004fdf2b
pop eax
jmp 0x504bf4
mov esi, dword [esp + 0x28]
test esi, esi
je 0x504d92
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
push 0x63c6a4
push eax
push dword [esp + 0x1c]
call fcn.00417cca
add esp, 0xc
mov dword [esp + 0x18], edx
mov edx, esi
xor ecx, ecx
push 0x63c6b4
push dword [esp + 0x34]
push dword [esp + 0x1c]
call fcn.00417cca
add esp, 0xc
mov eax, dword [esp + 0x70]
add edx, ebx
cmp edx, edi
mov dword [eax + 8], edx
jne 0x504bf2
mov ebx, dword [esp + 0x34]
cmp edi, ebx
jne 0x504bf2
mov esi, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
mov edx, dword [esp + 0x1c]
mov ecx, ebp
push 0x20
lea eax, [esp + 0x40]
push eax
call fcn.00504e4c
pop eax
pop ecx
cmp byte [esp + 8], 4
je 0x504d41
mov ecx, ebp
call fcn.00500c58
test al, al
je 0x504d7d
mov ecx, ebp
call fcn.00522035
jmp 0x504d12
mov edx, dword [esp + 0xc]
test edx, edx
je 0x504d98
xor ecx, ecx
push 0x632f64
push 0x20
lea eax, [esp + 0x44]
push eax
call fcn.00417cca
add esp, 0xc
mov ebx, dword [esp + 0x70]
mov esi, edx
mov edx, eax
add esi, eax
mov ecx, ebx
push esi
call fcn.00464149
pop eax
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
jmp 0x504bf2
movsd xmm0, qword [esp + 8]
mov eax, dword [esp]
movsd qword [eax], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
sub ebx, dword [esp + 0x10]
jmp 0x504d9a
sub ebx, esi
mov eax, dword [esp]
mov dword [eax + 4], ebx
mov byte [eax], 4
jmp 0x504d8a
Function at 0x504faf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x74], 0
mov dword [esp + 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
je 0x504fec
mov ecx, dword [esp + 0x78]
add ecx, 0x400
jae 0x504ff6
mov dword [esp + 4], 0
jmp 0x505009
mov dword [esp + 4], 0
jmp 0x505009
call fcn.00501154
cmp eax, 1
mov dword [esp + 0x38], edx
sete al
mov dword [esp + 4], eax
lea ebp, [esp + 8]
mov edx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov ebx, edx
cmp ebx, edi
jne 0x505031
mov esi, dword [esp + 0x70]
mov ecx, esi
push 0x20
pop edx
call fcn.0046417a
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x70]
mov esi, edi
sub esi, ebx
mov eax, dword [eax]
add eax, ebx
cmp byte [esp + 4], 0
je 0x505060
mov edx, dword [esp + 0x38]
cmp esi, edx
cmovb edx, esi
xor ecx, ecx
push 0x632f54
push esi
push eax
call fcn.00417cca
add esp, 0xc
mov esi, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
and dword [esp + 0x28], 0
mov dword [esp + 0x2c], eax
sub esp, 4
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x24]
push ebp
call fcn.005051ce
add esp, 0x10
cmp byte [esp + 8], 4
je 0x5050bc
mov ecx, ebp
call fcn.00500c58
test al, al
je 0x5051a6
movsd xmm0, qword [esp + 8]
lea eax, [esp + 0x3c]
movsd qword [esp + 0x3c], xmm0
push eax
call fcn.004fdf2b
pop eax
jmp 0x505019
mov esi, dword [esp + 0x28]
test esi, esi
je 0x5051bb
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
push 0x63c6a4
push eax
push dword [esp + 0x1c]
call fcn.00417cca
add esp, 0xc
mov dword [esp + 0x18], edx
mov edx, esi
xor ecx, ecx
push 0x63c6b4
push dword [esp + 0x34]
push dword [esp + 0x1c]
call fcn.00417cca
add esp, 0xc
mov eax, dword [esp + 0x70]
add edx, ebx
cmp edx, edi
mov dword [eax + 8], edx
jne 0x505017
mov ebx, dword [esp + 0x34]
cmp edi, ebx
jne 0x505017
mov esi, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
push 0x20
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x24]
push ebp
call fcn.00505237
add esp, 0x10
cmp byte [esp + 8], 4
je 0x50516a
mov ecx, ebp
call fcn.00500c58
test al, al
je 0x5051a6
mov ecx, ebp
call fcn.00522035
jmp 0x50513b
mov edx, dword [esp + 0xc]
test edx, edx
je 0x5051c1
xor ecx, ecx
push 0x632f64
push 0x20
lea eax, [esp + 0x44]
push eax
call fcn.00417cca
add esp, 0xc
mov ebx, dword [esp + 0x70]
mov esi, edx
mov edx, eax
add esi, eax
mov ecx, ebx
push esi
call fcn.00464149
pop eax
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
jmp 0x505017
movsd xmm0, qword [esp + 8]
mov eax, dword [esp]
movsd qword [eax], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
sub ebx, dword [esp + 0x10]
jmp 0x5051c3
sub ebx, esi
mov eax, dword [esp]
mov dword [eax + 4], ebx
mov byte [eax], 4
jmp 0x5051b3
Function at 0x5052ce
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x74], 0
mov dword [esp + 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
je 0x50530b
mov ecx, dword [esp + 0x78]
add ecx, 0x400
jae 0x505315
mov dword [esp + 4], 0
jmp 0x505328
mov dword [esp + 4], 0
jmp 0x505328
call fcn.00501154
cmp eax, 1
mov dword [esp + 0x38], edx
sete al
mov dword [esp + 4], eax
lea ebp, [esp + 8]
mov edx, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov ebx, edx
cmp ebx, edi
jne 0x505350
mov esi, dword [esp + 0x70]
mov ecx, esi
push 0x20
pop edx
call fcn.0046417a
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x70]
mov esi, edi
sub esi, ebx
mov eax, dword [eax]
add eax, ebx
cmp byte [esp + 4], 0
je 0x50537f
mov edx, dword [esp + 0x38]
cmp esi, edx
cmovb edx, esi
xor ecx, ecx
push 0x632f54
push esi
push eax
call fcn.00417cca
add esp, 0xc
mov esi, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
and dword [esp + 0x28], 0
mov edx, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
call fcn.005054e9
pop eax
cmp byte [esp + 8], 4
je 0x5053d7
mov ecx, ebp
call fcn.00500c58
test al, al
je 0x5054c1
movsd xmm0, qword [esp + 8]
lea eax, [esp + 0x3c]
movsd qword [esp + 0x3c], xmm0
push eax
call fcn.004fdf2b
pop eax
jmp 0x505338
mov esi, dword [esp + 0x28]
test esi, esi
je 0x5054d6
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
push 0x63c6a4
push eax
push dword [esp + 0x1c]
call fcn.00417cca
add esp, 0xc
mov dword [esp + 0x18], edx
mov edx, esi
xor ecx, ecx
push 0x63c6b4
push dword [esp + 0x34]
push dword [esp + 0x1c]
call fcn.00417cca
add esp, 0xc
mov eax, dword [esp + 0x70]
add edx, ebx
cmp edx, edi
mov dword [eax + 8], edx
jne 0x505336
mov ebx, dword [esp + 0x34]
cmp edi, ebx
jne 0x505336
mov esi, dword [esp + 0x10]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
push 0x20
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x24]
push ebp
call fcn.0050558c
add esp, 0x10
cmp byte [esp + 8], 4
je 0x505485
mov ecx, ebp
call fcn.00500c58
test al, al
je 0x5054c1
mov ecx, ebp
call fcn.00522035
jmp 0x505456
mov edx, dword [esp + 0xc]
test edx, edx
je 0x5054dc
xor ecx, ecx
push 0x632f64
push 0x20
lea eax, [esp + 0x44]
push eax
call fcn.00417cca
add esp, 0xc
mov ebx, dword [esp + 0x70]
mov esi, edx
mov edx, eax
add esi, eax
mov ecx, ebx
push esi
call fcn.00464149
pop eax
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
jmp 0x505336
movsd xmm0, qword [esp + 8]
mov eax, dword [esp]
movsd qword [eax], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
sub ebx, dword [esp + 0x10]
jmp 0x5054de
sub ebx, esi
mov eax, dword [esp]
mov dword [eax + 4], ebx
mov byte [eax], 4
jmp 0x5054ce
Function at 0x505c16
Capabilities:
Encrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
lea ebx, [esp + 8]
mov esi, ecx
mov edi, edx
mov ecx, ebx
call fcn.004fe1f5
mov eax, dword [ebx]
cmp eax, 2
jne 0x505c40
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
jmp 0x505e0d
xor ecx, ecx
test eax, eax
je 0x505db3
mov eax, dword [edi + 0x58]
xor eax, dword [edi + 0x68]
or eax, dword [edi + 0x5c]
jne 0x505de0
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x68]
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x40], eax
cmp edx, ebp
mov eax, ebp
cmovb eax, edx
push 0x62fb14
mov dword [esp + 0x3c], eax
push eax
call fcn.00528fa6
pop ecx
pop ecx
cmp ebp, edx
jb 0x505e1a
mov ebp, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, edx
mov dword [esp], edx
mov edx, dword [edi + 0x68]
add eax, ebp
add ebx, eax
cmp edx, ebx
jae 0x505cba
mov edx, ebx
lea ecx, [edi + 0x60]
mov ebx, eax
call fcn.0045ed59
mov edx, dword [edi + 0x68]
mov eax, ebx
mov ecx, dword [edi + 0x60]
push 0x62fcc0
push eax
push ebp
mov ebx, eax
mov dword [esp + 0x48], eax
call fcn.004ff4e0
add esp, 0xc
mov ecx, eax
push 0x62fcd0
push dword [esp + 4]
push dword [esp + 0xc]
call fcn.0044f1ee
add esp, 0xc
mov ecx, dword [edi + 0x60]
mov edx, dword [edi + 0x68]
push 0x62fce0
push ebp
call fcn.004ff2c3
pop ecx
pop ecx
test eax, eax
mov ecx, dword [edi + 0x60]
mov dword [esp + 4], eax
cmove edx, eax
mov dword [esp], edx
mov edx, dword [edi + 0x68]
push 0x62fcf0
push ebx
push ebp
call fcn.004ff4e0
add esp, 0xc
mov ebx, edx
mov ecx, dword [edi + 0x60]
mov edx, dword [edi + 0x68]
test eax, eax
mov ebp, eax
cmove ebx, eax
push 0x62fd00
push dword [esp + 0x40]
call fcn.004ff515
pop ecx
pop ecx
mov ecx, dword [esp]
test eax, eax
cmove edx, eax
and dword [esp + 0x2c], 0
and dword [esp + 0x30], 0
and dword [esp + 0x34], 0
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0xc], 7
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 6
mov dword [esp + 0x28], eax
lea eax, [esp + 0x44]
lea ecx, [esp + 8]
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0x70]
push 0
push eax
push 0
push ecx
call dword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x505dba
xor ecx, ecx
jmp 0x505e0d
mov eax, 0x80090317
jmp 0x505e0d
mov eax, dword [esp + 0x14]
add eax, dword [esp + 8]
add eax, dword [esp + 0x20]
cmp dword [edi + 0x68], eax
jb 0x505dce
mov dword [edi + 0x68], eax
mov eax, dword [esp + 0x38]
and dword [edi + 0x5c], 0
and dword [edi + 0x58], 0
mov dword [edi + 0x94], eax
lea ebx, [esp + 8]
mov edx, edi
mov ecx, ebx
call fcn.004ff15c
cmp byte [ebx], 4
je 0x505dfb
mov ecx, dword [esp + 8]
cmp cl, 4
jne 0x505e09
mov eax, dword [edi + 0x94]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x505e12
mov eax, dword [esp + 0xc]
mov dword [esi], ecx
mov dword [esi + 4], eax
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x3e
pop edx
mov ecx, str.assertion_failed:_buf.len_____sizes.cbMaximumMessage_as_usize
push 0x62fcb0
call fcn.00580fe0
pop eax
ud2
Function at 0x5078ef
Capabilities:
Connect socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebp, dword [esp + 0x34]
mov esi, ecx
cmp dl, 4
jne 0x507947
mov eax, dword [0x64fc2c]
cmp eax, 3
jne 0x5079f7
mov edx, dword [ebp]
lea edi, [esp + 4]
mov ecx, edi
call fcn.004ebf90
mov al, byte [edi]
cmp al, 4
jne 0x507962
mov eax, dword [esp + 8]
cmp word [ebp], 0
mov dword [esp], eax
je 0x50797d
movups xmm0, xmmword [ebp + 4]
mov edx, dword [ebp + 0x18]
lea eax, [ebp + 0x14]
add ebp, 0x1c
push 0x1c
pop ecx
mov bx, 0x17
jmp 0x50798d
mov eax, edx
shr eax, 8
mov word [esi + 1], ax
mov eax, edx
shr eax, 0x18
mov byte [esi + 3], al
mov byte [esi], dl
mov dword [esi + 4], ebp
jmp 0x5079ef
mov cl, byte [esp + 7]
movzx edi, word [esp + 5]
mov edx, dword [esp + 8]
mov byte [esi + 3], cl
mov word [esi + 1], di
mov byte [esi], al
mov dword [esi + 4], edx
jmp 0x5079ef
lea eax, [ebp + 2]
add ebp, 6
push 0x10
pop ecx
mov bx, 2
xorps xmm0, xmm0
movzx ebp, word [ebp]
mov eax, dword [eax]
mov word [esp + 4], bx
rol bp, 8
mov word [esp + 6], bp
mov dword [esp + 8], eax
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], edx
push ecx
push edi
mov edi, dword [esp + 8]
push edi
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
je 0x5079c8
mov dword [esi + 4], edi
mov byte [esi], 4
jmp 0x5079ef
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, eax
mov edx, eax
shr eax, 0x18
mov byte [esi], 0
shr ecx, 8
shl edx, 0x18
mov byte [esi + 7], al
mov dword [esi + 1], edx
mov word [esi + 5], cx
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005841b0
jmp 0x50790f