joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b5e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46b702
sub esp, 0x4c
mov eax, dword [esp + 0x64]
test eax, eax
jle 0x46b6fb
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x40], ecx
mov eax, dword [0x9b8840]
mov dword [esp], eax
call fcn.00469590
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov dword [esp], eax
mov dword [esp + 4], 7
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call fcn.0043f6a0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
test eax, eax
jne 0x46b6f5
test ecx, ecx
je 0x46b6e7
cmp ecx, 0x3e5
jne 0x46b6bb
mov ecx, dword [0x991764]
mov edx, dword [0x991760]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
lea eax, [0x79c4c0]
mov dword [esp], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
call fcn.0040bef0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x38]
jmp 0x46b6ab
lea ecx, [0x799ec8]
lea edx, [0x79c4c0]
jmp 0x46b6ab
xor edx, edx
mov ecx, edx
jmp 0x46b6ab
xor ecx, ecx
jmp 0x46b609
call fcn.0044ae20
jmp fcn.0046b5e0
Function at 0x46d890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46d97f
sub esp, 0x54
mov eax, dword [0x9b8920]
mov dword [esp], eax
call fcn.00469590
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 8
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
call fcn.0043f6a0
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x46d95b
xor eax, eax
mov ecx, eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], eax
add esp, 0x54
ret
mov dword [esp + 0x38], eax
lea eax, [0x79c4c0]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040bef0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
jmp 0x46d94f
call fcn.0044ae20
jmp fcn.0046d890

Function at 0x46de60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46df6c
sub esp, 0x4c
mov eax, dword [0x9b8978]
mov dword [esp], eax
call fcn.00469590
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 9
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], eax
call fcn.0043f6a0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
cmp eax, 0xffffffff
jne 0x46df66
test ecx, ecx
je 0x46df58
cmp ecx, 0x3e5
jne 0x46df34
mov eax, dword [0x991760]
mov ecx, dword [0x991764]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], ecx
lea eax, [0x79c4c0]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040bef0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
jmp 0x46df28
lea ecx, [0x799e5c]
lea eax, [0x79c4c0]
jmp 0x46df28
xor ecx, ecx
mov eax, ecx
jmp 0x46df28
call fcn.0044ae20
jmp fcn.0046de60
Function at 0x491b60
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x491b9c
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
xor ebx, ebx
jmp 0x491b93
lea ebp, [ebx + 1]
imul edx, edx, 0x1000193
movzx esi, byte [ecx + ebx]
xor edx, esi
mov ebx, ebp
cmp ebx, eax
jl 0x491b82
mov dword [esp + 0x14], edx
ret
call fcn.0044ae20
jmp fcn.00491b60
Function at 0x4ca160
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ca208
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x4ca1cf
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
jmp 0x4ca1b9
call fcn.0044ae20
jmp fcn.004ca160
Function at 0x4f6ce0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f6efd
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x4f6d97
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x4f6e10
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x4f6d78
cmp ecx, 0xf
jne 0x4f6e89
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x4f6d78
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x4f6d78
call fcn.0044ae20
jmp fcn.004f6ce0
Function at 0x5e4350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e453b
sub esp, 0x30
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x5e4532
mov eax, 7
lea ecx, [0x71c8cf]
mov edx, dword [esp + 0x34]
movzx ebx, byte [edx + 1]
test bl, bl
jne 0x5e4515
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
movzx ebx, byte [edx + 0x44]
test bl, bl
jne 0x5e44c9
mov edx, dword [edx + 0x78]
mov dword [esp + 4], edx
lea edx, [0x6cd9c0]
mov dword [esp], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.004088c0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
test edx, edx
jne 0x5e44a3
mov eax, dword [esp + 0x38]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
lea eax, [0x6cae00]
mov dword [esp], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call fcn.0040bcf0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
lea eax, [0x7294de]
mov dword [esp], eax
mov dword [esp + 4], 0x19
lea eax, [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004a2d20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
nop
call fcn.00426b00
add esp, 0x30
ret
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
nop
call fcn.00426b00
add esp, 0x30
ret
lea eax, [edx + 0x48]
mov dword [esp + 0x1c], eax
mov dword [esp], eax
call fcn.00451dd0
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp], 4
lea eax, [0x74fd00]
mov dword [esp + 4], eax
call fcn.004262e0
test eax, eax
jne 0x5e450b
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
jmp 0x5e43cc
nop
call fcn.00426b00
add esp, 0x30
ret
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004b1870
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x34]
jmp 0x5e43b8
mov ecx, dword [esp + 0x38]
jmp 0x5e43a8
call fcn.0044ae20
jmp fcn.005e4350
Function at 0x5f0720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f0897
sub esp, 0x58
lea eax, [0x6cf4c0]
mov dword [esp], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call fcn.00439020
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x1c], edx
xor ebx, ebx
mov ebp, dword [esp + 0x5c]
jmp 0x5f077d
lea ebp, [esi + 0x14]
inc ebx
mov ecx, dword [esp + 0x20]
mov edx, edi
mov esi, ecx
mov ecx, dword [esp + 0x60]
cmp ebx, ecx
jge 0x5f0870
lea edi, [esp + 0x44]
mov esi, ebp
call fcn.0044cd6e
lea edi, [esp + 0x30]
lea esi, [esp + 0x44]
call fcn.0044cd6e
mov ecx, dword [esp + 0x34]
test ecx, ecx
jg 0x5f07ff
mov ecx, dword [esp + 0x3c]
mov esi, ebp
mov ebp, dword [esp + 0x40]
cmp ebx, edx
jae 0x5f0890
mov edi, edx
lea edx, [eax + ebx*8]
mov dword [edx], ecx
mov ecx, dword [0x9cadb0]
lea edx, [eax + ebx*8 + 4]
test ecx, ecx
jne 0x5f07d6
mov dword [edx], ebp
jmp 0x5f0773
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], esi
mov dword [esp], edx
mov dword [esp + 4], ebp
call fcn.0040ecd0
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x1c]
jmp 0x5f0773
lea eax, [0x6d86a0]
mov dword [esp], eax
call fcn.0040e460
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x38
mov ecx, dword [0x9cadb0]
test ecx, ecx
jne 0x5f0854
lea ecx, [0x735caf]
mov dword [eax], ecx
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
lea ecx, [0x79b5e0]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
add esp, 0x58
ret
mov dword [esp + 0x28], eax
mov dword [esp], eax
lea ecx, [0x735caf]
mov dword [esp + 4], ecx
call fcn.0040ecd0
mov eax, dword [esp + 0x28]
jmp 0x5f082a
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
add esp, 0x58
ret
call fcn.00426060
ud2
call fcn.0044ae20
jmp fcn.005f0720
Function at 0x5f39c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f3be5
sub esp, 0x6c
mov ecx, dword [esp + 0x70]
movzx edx, byte [ecx + 0x3c]
test dl, dl
jne 0x5f3bd9
mov edx, dword [ecx + 0x4c]
test edx, edx
jle 0x5f39fb
mov ebx, dword [ecx + 0x30]
cmp ebx, edx
jg 0x5f3bcd
mov edx, dword [ecx + 0x24]
test edx, edx
je 0x5f3bc6
mov ebx, dword [edx]
test ebx, ebx
jg 0x5f3b13
mov eax, dword [esp + 0x78]
test eax, eax
je 0x5f3a24
mov byte [esp + 0x80], 0
add esp, 0x6c
ret
mov eax, dword [ecx + 0x48]
test eax, eax
jne 0x5f3b06
mov eax, 2
mov edx, dword [ecx + 0x20]
mov ebx, dword [ecx + 0x1c]
mov ebp, dword [ecx + 0x18]
lea esi, [ecx + 0x18]
cmp eax, ebx
jle 0x5f3a18
lea eax, [ebx + 1]
cmp eax, edx
jg 0x5f3a91
lea eax, [ebx + 1]
mov dword [ecx + 0x1c], eax
mov eax, dword [0x9cadb0]
lea edx, [ebp + ebx*4]
test eax, eax
jne 0x5f3a7b
mov eax, dword [esp + 0x74]
mov dword [ebp + ebx*4], eax
mov dword [esp], ecx
call fcn.005f2040
mov byte [esp + 0x80], 1
add esp, 0x6c
ret
mov dword [esp], edx
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
call fcn.0040ecd0
mov ecx, dword [esp + 0x70]
jmp 0x5f3a67
mov dword [esp + 0x2c], esi
lea ecx, [0x705de0]
mov dword [esp], ecx
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
call fcn.004391a0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x70]
mov dword [ebx + 0x20], edx
mov edx, dword [0x9cadb0]
test edx, edx
jne 0x5f3ae0
mov dword [ebx + 0x18], eax
mov ebx, ecx
mov ebp, eax
mov ecx, dword [esp + 0x70]
jmp 0x5f3a4b
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0040ecd0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x70]
jmp 0x5f3ad3
jge 0x5f3a34
xor eax, eax
jmp 0x5f3a34
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.0044c884
lea ecx, [0x6ce140]
mov dword [esp], ecx
mov dword [esp + 4], edx
lea edx, [esp + 0x3c]
mov dword [esp + 8], edx
call fcn.00406d90
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x5f3bbe
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [esp + 0x24], eax
mov ebx, dword [esp + 0x70]
mov ebx, dword [ebx + 0x24]
mov dword [esp + 4], ebx
lea ebx, [0x6ce140]
mov dword [esp], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call fcn.00409e50
mov eax, dword [esp + 0x78]
test eax, eax
je 0x5f3bb4
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
call fcn.00402f10
mov byte [esp + 0x80], 1
add esp, 0x6c
ret
mov ecx, dword [esp + 0x74]
mov byte [ecx + 0x38], 1
jmp 0x5f3b78
xor ecx, ecx
mov edx, ecx
xor eax, eax
jmp 0x5f3b4b
xor ebx, ebx
jmp 0x5f3a08
mov byte [esp + 0x80], 0
add esp, 0x6c
ret
mov byte [esp + 0x80], 0
add esp, 0x6c
ret
call fcn.0044ae20
jmp fcn.005f39c0
Function at 0x5f3bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f3db8
sub esp, 0x48
xor eax, eax
xor ecx, ecx
mov edx, ecx
mov ebx, edx
mov ebp, ebx
jmp 0x5f3c2c
mov esi, dword [esp + 0x34]
lea eax, [esi + 1]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
cmp eax, 2
jge 0x5f3dab
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
mov ecx, dword [esp + 0x50]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov ebx, dword [esp + 0x58]
mov dword [esp + 0xc], ebx
mov ebp, dword [esp + 0x5c]
mov dword [esp + 0x10], ebp
mov esi, dword [esp + 0x60]
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x64]
mov dword [esp + 0x18], edi
mov edi, dword [esp + 0x68]
mov dword [esp + 0x1c], edi
mov byte [esp + 0x20], 1
call fcn.005f3e60
mov eax, dword [esp + 0x24]
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x3c], ecx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x40], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x44], ebx
mov ebp, dword [0x9b8b50]
cmp edx, ebp
jne 0x5f3ccf
mov dword [esp], edx
mov dword [esp + 4], ebx
mov eax, dword [0x9b8b54]
mov dword [esp + 8], eax
call fcn.00402150
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5f3c15
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [0x9b8b50]
cmp ecx, ebp
je 0x5f3cfd
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
add esp, 0x48
ret
mov dword [esp + 0x38], edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], ebx
mov dword [esp], ecx
mov dword [esp + 4], eax
mov edx, dword [0x9b8b54]
mov dword [esp + 8], edx
call fcn.00402150
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5f3d3e
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
jmp 0x5f3ce9
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 0
call fcn.005f3e60
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ebx
add esp, 0x48
ret
mov eax, ecx
mov ecx, edx
mov edx, ebx
mov ebx, ebp
jmp 0x5f3cdf
call fcn.0044ae20
jmp fcn.005f3bf0
Function at 0x60a940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x60ab1f
sub esp, 0x68
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x60ab0a
mov ecx, dword [eax]
lea eax, [0x6cae00]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call fcn.00439020
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edx
lea edi, [esp + 0x38]
xor eax, eax
call fcn.0044c884
lea eax, [0x6cd740]
mov dword [esp], eax
mov ecx, dword [esp + 0x6c]
mov dword [esp + 4], ecx
lea ebp, [esp + 0x38]
mov dword [esp + 8], ebp
call fcn.00406d90
xor eax, eax
jmp 0x60a9d3
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.00407070
mov eax, dword [esp + 0x28]
inc eax
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x60aa20
mov ecx, dword [esp + 0x3c]
mov ecx, dword [ecx]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
mov ebx, dword [esp + 0x20]
cmp eax, ebx
jae 0x60ab18
mov dword [esp + 0x28], eax
mov ebp, dword [esp + 0x34]
lea esi, [ebp + eax*8 + 4]
mov dword [esi], edx
lea edx, [ebp + eax*8]
mov esi, dword [0x9cadb0]
test esi, esi
jne 0x60aa12
mov dword [edx], ecx
jmp 0x60a9c2
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.0040ecd0
jmp 0x60a9c2
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 8], edx
call fcn.004ac3f0
lea eax, [0x6acb80]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call fcn.00439020
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x30], edx
xor ebx, ebx
jmp 0x60aa7d
lea ebx, [ecx + 1]
mov eax, edx
mov ecx, dword [esp + 0x1c]
mov edx, ebp
mov ebp, dword [esp + 0x20]
cmp ebx, ebp
jge 0x60aafa
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x34]
lea ecx, [eax + ebx*8]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
lea ebp, [0x6cd740]
mov dword [esp], ebp
mov esi, dword [esp + 0x6c]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call fcn.004088c0
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
cmp ecx, edx
jae 0x60ab11
mov ebx, dword [0x9cadb0]
mov ebp, dword [esp + 0x30]
lea esi, [ebp + ecx*4]
test ebx, ebx
jne 0x60aadd
mov dword [ebp + ecx*4], eax
jmp 0x60aa72
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0040ecd0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov ebp, dword [esp + 0x30]
jmp 0x60aa72
mov dword [esp + 0x70], edx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x68
ret
xor ecx, ecx
jmp 0x60a967
call fcn.00426060
ud2
call fcn.00426060
ud2
call fcn.0044ae20
jmp fcn.0060a940
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..retplne
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x4de06ae
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x40f32181
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219