joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497790
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x6816e0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49797a
sub esp, 0x48
mov eax, dword [0x63e63c]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 2]
movzx ebx, word [ecx + 8]
movzx ebp, word [ecx + 0xa]
movzx esi, word [ecx + 0xc]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.00494470
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.00469aae
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.00469aae
call fcn.00493110
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.004627e0
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
mov eax, ebp
sar ebp, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x497867
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x497881
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x4978f8
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x4978ce
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x4978ca
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x4978c3
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x4978d0
mov ebx, 0x1d
jmp 0x4978ee
mov ebp, eax
jmp 0x4978d0
mov ebp, eax
cmp ebp, 0xd
jae 0x49796d
lea eax, [ebp - 1]
lea edx, [0x635880]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x497963
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x4978f8
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x49792a
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x497932
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
mov dword [esp + 0x54], eax
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov ecx, 0xd
call fcn.00469400
mov eax, ebp
mov ecx, 0xd
call fcn.00469400
nop
call fcn.00467f80
jmp fcn.00497790
Function at 0x4b1d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x6816e0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b1e4a
sub esp, 0x20
mov ecx, dword [esp + 0x24]
test byte [ecx], al
mov edx, dword [esp + 0x28]
mov ebx, edx
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x1c], ecx
xor eax, eax
jmp 0x4b1d90
mov ebp, dword [esp + 0x14]
inc ebp
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, ebp
cmp eax, 4
jge 0x4b1dc9
mov dword [esp + 0x14], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.0046da40
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x2c]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x4b1d83
mov byte [esp + 0x30], 1
add esp, 0x20
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x4b1dd3
inc eax
cmp eax, 4
jge 0x4b1de9
mov dword [esp + 0x18], eax
lea ebp, [ecx + eax*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
xor edi, edi
jmp 0x4b1e43
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.0046da90
mov byte [esp + 0x30], 0
add esp, 0x20
ret
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
and esi, 0xff
xor edx, esi
mov esi, dword [esp + 0xc]
shr esi, 8
shl ebp, 0x18
mov eax, edx
mov ebx, 0x1b3
mul ebx
inc edi
or esi, ebp
mov ebp, dword [esp + 0x10]
shr ebp, 8
mov ebx, dword [esp + 0x28]
mov edx, eax
mov eax, dword [esp + 0x18]
cmp edi, 8
jl 0x4b1e0c
jmp 0x4b1dd2
call fcn.00467f80
jmp fcn.004b1d50
Function at 0x4b6930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x6816e0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b6b6f
sub esp, 0x74
mov byte [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
lea eax, [esp + 0x64]
mov dword [esp], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 4], eax
mov dword [esp + 8], 3
call fcn.004b7350
mov eax, dword [esp + 0xc]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov ecx, dword [esp + 0x7c]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov ebp, dword [ecx + 0xc]
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 1
call fcn.004bb480
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], edx
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x7c]
movzx ecx, byte [eax]
mov byte [esp + 0x54], cl
mov byte [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x44]
mov dword [esp], ecx
lea ecx, [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x80]
mov dword [esp + 0xc], edx
mov byte [esp + 0x10], 0
call fcn.004b3e90
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov byte [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
lea ecx, [esp + 0x34]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call fcn.004b34e0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x30], eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x80]
mov dword [esp + 8], ecx
call fcn.004b3840
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], eax
lea ecx, [esp + 0x54]
mov dword [esp + 8], ecx
call fcn.004b34e0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x80]
mov dword [esp + 8], ecx
call fcn.004b3840
mov eax, dword [0x63e670]
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004b3290
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x7c]
mov dword [esp + 8], ecx
call fcn.004b34e0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x80]
mov dword [esp + 8], ecx
call fcn.004b3840
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
call fcn.004b34e0
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 8], ecx
call fcn.004b3840
mov eax, dword [esp + 0x78]
mov dword [esp + 0x84], eax
add esp, 0x74
ret
call fcn.00467f80
jmp fcn.004b6930
Function at 0x526aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x6816e0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x526ca2
sub esp, 0x84
mov byte [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
lea eax, [esp + 0x74]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 0
call fcn.004b2f90
mov eax, dword [esp + 0xc]
mov dword [esp + 0x40], eax
mov byte [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov byte [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov byte [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x88]
mov ebx, dword [esp + 0x94]
xor ebp, ebp
lea esi, [esp + 0x44]
lea edi, [esp + 0x54]
lea ebp, [esp + 0x64]
mov dword [esp + 0x3c], ebp
xor ebp, ebp
jmp 0x526b94
inc ebp
mov ebx, dword [esp + 0x94]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
cmp ecx, ebp
jle 0x526bb1
mov dword [esp + 0x38], ebp
movzx eax, byte [ebx + ebp]
mov byte [esp + 0x30], al
xor eax, eax
mov dword [esp + 0x2c], eax
movzx eax, byte [esp + 0x30]
jmp 0x526c14
mov dword [esp], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.00524e70
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], ecx
add esp, 0x84
ret
mov ebp, dword [esp + 0x2c]
inc ebp
shl ebx, 1
mov dword [esp + 0x2c], ebp
mov esi, edx
mov edi, ecx
mov dword [esp + 0x3c], eax
mov eax, ebx
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x88]
mov ebx, dword [esp + 0x94]
mov ebp, dword [esp + 0x38]
mov ebx, dword [esp + 0x2c]
cmp ebx, 8
jge 0x526b84
mov byte [esp + 0x2b], al
mov dword [esp], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.00526480
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
movzx ebx, byte [esp + 0x2b]
test bl, 0x80
je 0x526be6
mov ebx, dword [esp + 0x88]
mov dword [esp], ebx
mov ebp, dword [esp + 0x8c]
mov dword [esp + 4], ebp
mov esi, dword [esp + 0x90]
mov dword [esp + 8], esi
mov edi, dword [esp + 0x40]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
call fcn.00525030
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x2b]
jmp 0x526be6
call fcn.00467f80
jmp fcn.00526aa0
Function at 0x528010
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword [0x6816e0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5280b6
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x528069
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x5280a0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.00467f80
jmp fcn.00528010
Function at 0x40342f
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40344d
mov eax, 0x5cd1e8
push eax
push 1
mov ebx, 0x50da80
call fcn.0050d4cf
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x403477
mov eax, 0
jmp 0x4034eb
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x4034d8
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x4034c1
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x4034b0
xor ecx, eax
xor edx, ebx
dec edi
jne 0x4034a1
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x4178bb
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x4178dd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
pop edx
mov dword [ebp - 4], 0
push eax
push ecx
push edx
push ebx
push esi
push edi
nop
nop
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getsockname
cpuid
shr ecx, 0x10
mov esi, ecx
nop
pop edx
pop ecx
pop ebx
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add esi, eax
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, al
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, cl
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, dl
add esi, ebx
nop
imul esi, esi, 0x666
mov dword [ebp - 4], esi
nop
pop edi
pop esi
pop ebx
pop edx
pop ecx
pop eax
mov eax, dword [ebp - 4]
jmp 0x417a03
mov esp, ebp
pop ebp
ret
Function at 0x419981
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x419bce
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x419acb
cmp byte [edx + edi], 0xd
jne 0x419acb
cmp byte [edx + edi + 1], 0xa
je 0x419b04
mov al, byte [edx + edi]
cmp al, 0xa
je 0x419b04
cmp al, 0x3d
jne 0x419ae0
inc ecx
cmp ecx, 2
ja 0x419bdc
cmp al, 0x7f
ja 0x419bdc
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x419bdc
cmp al, 0x40
jae 0x419b03
test ecx, ecx
jne 0x419bdc
inc esi
inc edx
cmp edx, ebx
jb 0x419ab5
test esi, esi
je 0x419bce
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x419bed
cmp dword [ecx], eax
jb 0x419bed
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x419bbd
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x419bb9
cmp al, 0xa
je 0x419bb9
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x419bb9
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x419ba4
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x419bb1
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x419bb9
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x419b55
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x4d4118
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4d413b
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4d413b
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4d4145
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4d4187
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4d41e9
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4d41e4
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4d41cf
test dl, dl
je 0x4d41cb
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4d41cf
add ecx, 2
add eax, 2
test dl, dl
jne 0x4d41af
xor eax, eax
jmp 0x4d41d4
sbb eax, eax
or eax, 1
test eax, eax
je 0x4d41f5
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4d419c
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4d427a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4d429d
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4d429d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4d42a7
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4d42e9
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4d434b
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4d4346
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4d4331
test dl, dl
je 0x4d432d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4d4331
add ecx, 2
add eax, 2
test dl, dl
jne 0x4d4311
xor eax, eax
jmp 0x4d4336
sbb eax, eax
or eax, 1
test eax, eax
je 0x4d4357
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4d42fe
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4d43e9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4d440c
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4d440c
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4d4416
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4d4458
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4d44ba
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4d44b5
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4d44a0
test dl, dl
je 0x4d449c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4d44a0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4d4480
xor eax, eax
jmp 0x4d44a5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4d44c6
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4d446d
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4d4553
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4d4576
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4d4576
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4d4580
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4d45c2
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4d4624
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4d461f
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4d460a
test dl, dl
je 0x4d4606
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4d460a
add ecx, 2
add eax, 2
test dl, dl
jne 0x4d45ea
xor eax, eax
jmp 0x4d460f
sbb eax, eax
or eax, 1
test eax, eax
je 0x4d4630
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4d45d7
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8