joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f60
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x404130
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.004743b0
jmp fcn.00403f60
Function at 0x409c80
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x409da4
sub esp, 0x2c
movsd xmm0, qword [esp + 0x30]
movsd qword [esp], xmm0
call fcn.00409ea0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, ecx
shr ecx, 0x14
and ecx, 0x7ff
mov ebx, edx
shr edx, 0xf
and edx, 0x1f
shl ebx, 5
shr eax, 0x1b
or eax, ebx
lea ebx, [0x5c61a0]
movsd xmm0, qword [ebx + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x409d97
cmp edx, 0x21
jae 0x409d8b
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and eax, 0xfffff
mov dword [esp + 0x10], eax
movsd xmm0, qword [ebx + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.004684c0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00468540
movsd xmm0, qword [esp + 0x24]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x53aa78]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd qword [esp + 0x38], xmm0
add esp, 0x2c
ret
mov eax, edx
mov ecx, 0x21
call fcn.00475840
mov eax, edx
mov ecx, 0x21
call fcn.00475910
nop
call fcn.004743b0
jmp fcn.00409c80
Function at 0x40d7e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40d908
sub esp, 0x20
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 0x24]
bsf ebx, edx
jne 0x40d808
mov ebx, 0x20
mov ebp, dword [eax + 0x20]
bsf esi, ebp
jne 0x40d815
mov esi, 0x20
cmp ebp, 1
sbb edi, edi
xor edi, 0xffffffff
xchg edi, ebx
not ebx
xchg edi, ebx
and edi, ebx
lea ebx, [esi + edi]
cmp ebx, 0x40
jge 0x40d8fc
mov dword [esp + 0x10], ebp
movzx ecx, word [eax + 0x18]
lea ebp, [ebx + ecx]
movzx eax, word [eax + 0x1a]
cmp ax, bp
jbe 0x40d8fc
lea ebx, [ebx + ecx + 1]
test bx, 0x3f
jne 0x40d865
cmp ax, bx
je 0x40d865
mov dword [esp + 0x28], 0
add esp, 0x20
ret
mov word [esp + 0xa], bx
mov dword [esp + 0xc], edx
lea ecx, [esi + edi - 0x1f]
mov dword [esp + 0x1c], ecx
mov eax, edx
shr edx, cl
mov dword [esp + 0x18], edx
neg ecx
shl eax, cl
lea esi, [esi + edi + 1]
mov edi, ecx
mov ecx, esi
mov ebx, dword [esp + 0xc]
shr ebx, cl
mov edx, dword [esp + 0x10]
shr edx, cl
movzx ebp, bp
mov dword [esp + 0x14], ebp
cmp ecx, 0x20
sbb esi, esi
and edx, esi
and ebx, esi
cmp edi, 0x20
sbb esi, esi
and eax, esi
or eax, edx
mov edx, dword [esp + 0x1c]
cmp edx, 0x20
sbb edx, edx
mov esi, dword [esp + 0x18]
and esi, edx
or eax, esi
mov edx, dword [esp + 0x24]
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], ebx
movzx eax, word [esp + 0xa]
mov word [edx + 0x18], ax
movzx eax, word [edx + 0x3c]
inc eax
mov word [edx + 0x3c], ax
mov dword [esp], edx
call fcn.00429c00
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
imul eax, dword [edx + 0x44]
add eax, dword [esp + 4]
mov dword [esp + 0x28], eax
add esp, 0x20
ret
mov dword [esp + 0x28], 0
add esp, 0x20
ret
call fcn.004743b0
jmp fcn.0040d7e0
Function at 0x417bf0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x417de9
sub esp, 0x18
mov eax, dword [0x5efbe8]
test eax, eax
jne 0x417dd2
lea eax, [0x5efbd8]
mov dword [esp], eax
call fcn.0040bea0
mov eax, dword [0x5efbdc]
test eax, eax
je 0x417c36
cmp dword [eax + 8], 0xcc
jne 0x417cac
mov edx, dword [0x5efbe0]
test edx, edx
jne 0x417c8e
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5f22f0]
mov dword [esp + 8], eax
call fcn.0040de50
mov eax, dword [esp + 0xc]
mov dword [0x5efbe0], eax
mov ecx, dword [0x5efbe4]
mov dword [eax], ecx
mov eax, dword [0x5efbe0]
mov dword [0x5efbe4], eax
movzx eax, byte [0x5f0080]
test al, al
jne 0x417c8e
xor eax, eax
jmp 0x417da3
mov edx, dword [0x5efbe0]
mov ebx, dword [edx + 4]
mov dword [0x5efbe0], ebx
mov ebx, dword [0x5efbdc]
mov dword [edx + 4], ebx
mov dword [0x5efbdc], edx
mov edx, dword [0x5efbdc]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x417d82
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0047aa70
mov eax, dword [0x5efdd0]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x417cfe
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x417d3e
call fcn.00475820
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
lea eax, [0x5efbd8]
mov dword [esp], eax
call fcn.0040c0c0
lea eax, [0x5efbd4]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.0047a540
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00475840
lea edx, [0x5c5240]
movzx ebx, byte [edx + eax]
lea ebp, [0x5f0080]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x417c8e
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x417d8c
mov ecx, 5
call fcn.00475830
lea eax, [0x52b809]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004700b0
nop
call fcn.004743b0
jmp fcn.00417bf0
Function at 0x41c6d0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41c747
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0041cca0
movzx eax, byte [esp + 4]
test al, al
je 0x41c72c
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x41c730
mov dword [esp], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], ecx
call fcn.0041c750
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0041ccf0
add esp, 0xc
ret
add esp, 0xc
ret
lea eax, [0x52b821]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004700b0
nop
call fcn.004743b0
jmp fcn.0041c6d0
Function at 0x42cff0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42d178
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42d0cf
cmp cl, 1
je 0x42d070
cmp cl, 2
jne 0x42d161
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.0047a690
lea eax, [0x5dc288]
mov dword [esp], eax
call fcn.0040bea0
lea eax, [0x5dc260]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00418d40
lea eax, [0x5dc288]
mov dword [esp], eax
call fcn.0040c0c0
jmp 0x42d15d
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00417bf0
lea eax, [0x5dc288]
mov dword [esp], eax
call fcn.0040bea0
lea eax, [0x5dc1c0]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00418d40
lea eax, [0x5dc288]
mov dword [esp], eax
call fcn.0040c0c0
jmp 0x42d15d
cmp cl, 3
je 0x42d118
cmp cl, 4
jne 0x42d0df
mov byte [eax + 8], 1
jmp 0x42d15d
cmp cl, 5
jne 0x42d161
lea eax, [0x5dc288]
mov dword [esp], eax
call fcn.0040bea0
lea eax, [0x5dc238]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00418d40
lea eax, [0x5dc288]
mov dword [esp], eax
call fcn.0040c0c0
jmp 0x42d15d
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00432d40
lea eax, [0x5dc288]
mov dword [esp], eax
call fcn.0040bea0
lea eax, [0x5dc1e8]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00418d40
lea eax, [0x5dc288]
mov dword [esp], eax
call fcn.0040c0c0
add esp, 0x14
ret
lea eax, [0x52901b]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004700b0
nop
call fcn.004743b0
jmp fcn.0042cff0
Function at 0x4599f0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x459bac
sub esp, 0x14
lea eax, [0x5f0074]
mov dword [esp], eax
call fcn.0047a230
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
test eax, eax
je 0x459a27
mov ecx, dword [esp + 0x18]
jmp 0x459a42
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 6]
test dl, dl
je 0x459a42
lea eax, [ecx + 0x30]
mov dword [esp], eax
call fcn.0040bea0
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
call fcn.00459470
mov eax, dword [esp + 0x18]
mov dword [esp], eax
lea ecx, [0x526d4a]
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
call fcn.00459430
mov eax, dword [esp + 0x10]
test eax, eax
je 0x459a80
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004598e0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 5]
test dl, 1
je 0x459ac0
mov ebx, edx
or edx, 2
mov byte [ecx + 5], dl
test dl, 4
jne 0x459ac0
or ebx, 6
mov byte [ecx + 5], bl
mov eax, dword [ecx + 0x2c]
test byte [eax], al
add eax, 0x14
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0047a2a0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0xc]
mov ebx, dword [ecx + 0x10]
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
test ebx, ebx
setg bl
xchg ebp, ebx
sete bl
xchg ebp, ebx
test edx, edx
seta dl
and edx, ebp
or edx, ebx
test eax, eax
jne 0x459b47
movzx ebx, byte [ecx + 6]
test bl, bl
je 0x459b47
inc dword [ecx + 0x28]
mov ebx, dword [ecx + 0x14]
mov ebp, dword [ecx + 0x18]
test ebx, ebx
sete bl
test ebp, ebp
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebp, ebx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x459b47
mov byte [esp + 0xf], dl
lea eax, [ecx + 0x34]
mov dword [esp], eax
call fcn.0047a230
mov eax, dword [esp + 4]
test eax, eax
jle 0x459b3a
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, 1
jmp 0x459b47
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
movzx edx, byte [esp + 0xf]
mov byte [esp + 0xf], dl
mov dword [esp], ecx
call fcn.004594c0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x459b62
movzx edx, byte [esp + 0xf]
jmp 0x459ba4
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x459b75
movzx edx, byte [esp + 0xf]
jmp 0x459ba4
lea ecx, [eax + 0x30]
mov dword [esp], ecx
call fcn.0040c0c0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00459520
mov eax, dword [esp + 4]
mov dword [esp], eax
call fcn.004068c0
movzx edx, byte [esp + 4]
movzx eax, byte [esp + 0xf]
or edx, eax
mov byte [esp + 0x1c], dl
add esp, 0x14
ret
call fcn.004743b0
jmp fcn.004599f0
Function at 0x45bbf0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45bcd7
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp], eax
call fcn.00459470
mov eax, dword [esp + 0x10]
mov dword [esp], eax
lea ecx, [0x528956]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xe
call fcn.00459430
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x45bc4d
call fcn.0045ba50
mov eax, dword [esp + 0x10]
inc dword [eax + 8]
movzx ecx, byte [eax + 5]
test cl, 1
je 0x45bca1
test cl, 4
je 0x45bca1
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
test ebx, ebx
sete bl
xchg ebp, ebx
setg bl
xchg ebp, ebx
test edx, edx
seta dl
and ebx, edx
or ebp, ebx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x45bca1
and ecx, 0xfffffffb
mov byte [eax + 5], cl
mov ecx, dword [eax + 0x2c]
test byte [ecx], al
add ecx, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0xffffffff
call fcn.0047a2a0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0045a0e0
movzx eax, byte [esp + 4]
mov byte [esp + 0xf], al
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call fcn.004594c0
movzx eax, byte [esp + 0xf]
test al, al
je 0x45bcd3
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0045a1a0
add esp, 0x14
ret
call fcn.004743b0
jmp fcn.0045bbf0

Function at 0x4622d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x462379
sub esp, 0x20
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x4622f6
mov ecx, 1
jmp 0x462314
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.004612e0
movzx eax, byte [esp + 8]
xor eax, 1
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x1f], cl
test cl, cl
jne 0x46232a
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
jmp 0x462357
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
movzx eax, byte [esp + 0x30]
mov byte [esp + 0xc], al
call fcn.00460e40
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
movzx eax, byte [esp + 0x30]
mov byte [esp + 0x44], al
movzx eax, byte [esp + 0x1f]
mov byte [esp + 0x48], al
add esp, 0x20
ret
call fcn.004743b0
jmp fcn.004622d0
Function at 0x463910
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x463b04
sub esp, 0x54
mov eax, dword [0x5efcb0]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x50]
mov dword [esp + 0x4c], eax
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x58]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov word [esp + 8], 0x101
call fcn.00461c30
mov eax, dword [esp + 0xc]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x4c]
lea ebp, [ebx + 0xec]
mov dword [esp], ebp
mov ebp, dword [esp + 0x5c]
mov dword [esp + 4], ebp
call fcn.00465ff0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov edx, dword [esp + 0x4c]
mov ebx, dword [edx + 0x54]
mov edx, dword [edx + 0x58]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x10
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 2
call fcn.00461ee0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x28]
mov dword [esp], ebx
call fcn.0044fb00
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x960]
test eax, eax
jne 0x463a51
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x3c]
jmp 0x463ae3
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0044fb00
mov eax, dword [esp + 0x5c]
and eax, 1
shl eax, 5
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov ecx, dword [ecx + 0x960]
lea edx, [0x5d0970]
add eax, edx
cmp ecx, 4
jae 0x463af7
lea eax, [eax + ecx*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x27
lea eax, [esp + 0x44]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.00461ee0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.00461f60
add esp, 0x54
ret
mov eax, ecx
mov ecx, 4
call fcn.00475830
nop
call fcn.004743b0
jmp fcn.00463910
Function at 0x465870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x465a7a
sub esp, 0x68
movzx eax, byte [esp + 0x88]
test al, al
je 0x465a2a
mov ecx, dword [esp + 0x8c]
test ecx, ecx
sete dl
mov ebx, dword [esp + 0x90]
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x46593a
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x34], ebx
movzx eax, al
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x19
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.00461fa0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x4659bc
mov edx, dword [esp + 0x78]
mov dword [esp + 0x48], edx
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x4c], ebp
mov esi, dword [esp + 0x80]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x84]
mov dword [esp + 0x54], esi
movzx eax, al
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ebx
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x30
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 4
call fcn.00461fa0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x89]
test bl, bl
je 0x465a11
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x44], ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov byte [esp + 0xc], 0x22
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.00461fa0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x68
ret
call fcn.0043d9f0
lea eax, [0x528980]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043e250
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
call fcn.0043df40
call fcn.0043dbf0
call fcn.0043da50
lea eax, [0x530a07]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.004700b0
nop
call fcn.004743b0
jmp fcn.00465870
Function at 0x473640
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4736db
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x5efcb0]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00475a07
lea ecx, [0x45fac0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.004742c0
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.004743b0
jmp fcn.00473640