joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a9690
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a97af
sub esp, 0x10
mov eax, dword [esp + 0x14]
movzx ecx, word [eax]
mov edx, dword [esp + 0x18]
cmp word [edx], cx
jne 0x5a97a5
movzx ecx, word [eax + 2]
cmp word [edx + 2], cx
jne 0x5a97a5
movzx ecx, word [eax + 4]
cmp word [edx + 4], cx
jne 0x5a97a5
movzx ecx, word [eax + 6]
cmp word [edx + 6], cx
jne 0x5a97a5
mov ecx, dword [eax + 8]
mov ebx, dword [edx + 0xc]
mov ebp, dword [eax + 0xc]
cmp dword [edx + 8], ecx
jne 0x5a97a5
mov dword [esp], ecx
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
call fcn.00403940
movzx eax, byte [esp + 0xc]
test al, al
je 0x5a97a5
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x18]
mov ebx, dword [edx + 0x14]
mov ebp, dword [eax + 0x14]
cmp dword [edx + 0x10], ecx
jne 0x5a97a5
mov dword [esp], ecx
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
call fcn.00403940
movzx eax, byte [esp + 0xc]
test al, al
je 0x5a97a5
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x18]
mov ebx, dword [edx + 0x1c]
mov ebp, dword [eax + 0x1c]
cmp dword [edx + 0x18], ecx
jne 0x5a97a5
mov dword [esp], ecx
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
call fcn.00403940
movzx eax, byte [esp + 0xc]
test al, al
je 0x5a97a5
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x18]
mov ebx, dword [edx + 0x24]
mov eax, dword [eax + 0x24]
cmp dword [edx + 0x20], ecx
je 0x5a978e
xor eax, eax
jmp 0x5a97a7
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], ebx
call fcn.00403940
movzx eax, byte [esp + 0xc]
jmp 0x5a97a7
xor eax, eax
mov byte [esp + 0x1c], al
add esp, 0x10
ret
call fcn.004649b0
jmp fcn.005a9690
Function at 0x5aee90
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5af07e
mov eax, dword [esp + 4]
lea ecx, [eax - 0x20]
cmp ecx, 2
jbe 0x5af06f
cmp eax, 0x25
je 0x5af066
lea ecx, [eax - 0x28]
cmp ecx, 0x13
jbe 0x5af054
cmp eax, 0x3d
je 0x5af04b
cmp eax, 0x3f
je 0x5af042
lea ecx, [eax - 0x5b]
cmp ecx, 2
jbe 0x5af030
cmp eax, 0xab
je 0x5af027
cmp eax, 0xbb
je 0x5af01e
cmp eax, 0xd7
je 0x5af015
cmp eax, 0xf7
je 0x5af00c
cmp eax, 0x60c
je 0x5af003
cmp eax, 0x61b
je 0x5aeffa
cmp eax, 0x61f
je 0x5aeff1
lea ecx, [eax - 0x621]
cmp ecx, 0x3d
jbe 0x5aefdf
lea ecx, [eax - 0x660]
cmp ecx, 9
jbe 0x5aefcd
lea ecx, [eax - 0x66b]
cmp ecx, 1
jbe 0x5aefbb
lea ecx, [eax - 0x200c]
cmp ecx, 3
jbe 0x5aefa9
lea ecx, [eax - 0x2018]
cmp ecx, 1
jbe 0x5aef97
lea ecx, [eax - 0xfe81]
cmp ecx, 0x7b
ja 0x5aef8e
lea ecx, [0x788290]
mov eax, dword [ecx + eax*4 - 0x3fa04]
mov dword [esp + 8], eax
ret
mov dword [esp + 8], 0
ret
lea ecx, [0x784a24]
mov eax, dword [ecx + eax*4 - 0x8060]
mov dword [esp + 8], eax
ret
lea ecx, [0x785014]
mov eax, dword [ecx + eax*4 - 0x8030]
mov dword [esp + 8], eax
ret
lea ecx, [0x784a1c]
mov eax, dword [ecx + eax*4 - 0x19ac]
mov dword [esp + 8], eax
ret
lea ecx, [0x78717c]
mov eax, dword [ecx + eax*4 - 0x1980]
mov dword [esp + 8], eax
ret
lea ecx, [0x787d8c]
mov eax, dword [ecx + eax*4 - 0x1884]
mov dword [esp + 8], eax
ret
mov dword [esp + 8], 0xf13f
ret
mov dword [esp + 8], 0xf13b
ret
mov dword [esp + 8], 0xf12c
ret
mov dword [esp + 8], 0xf127
ret
mov dword [esp + 8], 0xf126
ret
mov dword [esp + 8], 0xf124
ret
mov dword [esp + 8], 0xf123
ret
lea ecx, [0x784f7c]
mov eax, dword [ecx + eax*4 - 0x16c]
mov dword [esp + 8], eax
ret
mov dword [esp + 8], 0xf13f
ret
mov dword [esp + 8], 0xf13d
ret
lea ecx, [0x7878ec]
mov eax, dword [ecx + eax*4 - 0xa0]
mov dword [esp + 8], eax
ret
mov dword [esp + 8], 0xf125
ret
lea ecx, [0x784f64]
mov eax, dword [ecx + eax*4 - 0x80]
mov dword [esp + 8], eax
ret
call fcn.004649b0
jmp fcn.005aee90
Function at 0x5bdcc0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5bdda9
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.005be970
movzx eax, word [esp + 4]
movzx ecx, byte [esp + 6]
mov edx, dword [esp + 8]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0xc]
test edx, edx
jne 0x5bdd7b
mov edx, dword [esp + 0x30]
mov ebx, dword [edx + 4]
mov ebp, dword [edx]
mov esi, dword [edx + 8]
mov edi, dword [edx + 0xc]
cmp ebx, edi
jb 0x5bdd9f
sub esi, edi
mov edx, esi
xchg esi, ebx
neg ebx
xchg esi, ebx
sar esi, 0x1f
and esi, edi
add ebp, esi
mov dword [esp], ebp
sub ebx, edi
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], cl
call fcn.005bd780
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0xc]
add ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x28]
mov dword [eax + 0xc], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], edi
add esp, 0x2c
ret
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebp
add esp, 0x2c
ret
mov eax, edi
mov ecx, ebx
call fcn.00465e60
nop
call fcn.004649b0
jmp fcn.005bdcc0
Function at 0x5d6d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d6eef
sub esp, 0x30
mov eax, dword [esp + 0x38]
lea ecx, [eax - 4]
mov edx, dword [esp + 0x3c]
cmp edx, ecx
jb 0x5d6ee9
cmp eax, 4
je 0x5d6d76
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x34]
mov edx, dword [eax]
mov ebx, dword [eax + 4]
xor ebp, ebp
mov esi, ebx
mov edi, edx
jmp 0x5d6dbc
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
add esp, 0x30
ret
mov ecx, dword [esp + 0x2c]
add ecx, 0xc
mov edx, dword [esp + 0x1c]
lea ebp, [edx + 1]
mov ebx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
mov esi, eax
mov edi, dword [esp + 0x20]
mov eax, ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edi
cmp ebp, ecx
jge 0x5d6e91
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x2c], eax
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x10], edx
mov dword [esp], ecx
mov dword [esp + 4], edi
call fcn.0044e590
movzx eax, byte [esp + 8]
test al, al
je 0x5d6e04
mov eax, dword [esp + 0x20]
jmp 0x5d6e08
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 4], edx
call fcn.0044e590
movzx eax, byte [esp + 8]
test al, al
je 0x5d6e2f
mov eax, dword [esp + 0x24]
jmp 0x5d6e33
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 4], edx
call fcn.0044e590
movzx eax, byte [esp + 8]
test al, al
je 0x5d6e5a
mov eax, dword [esp + 0x18]
jmp 0x5d6e5e
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x28]
mov dword [esp], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 4], edx
call fcn.0044e590
movzx eax, byte [esp + 8]
test al, al
je 0x5d6e88
mov eax, dword [esp + 0x28]
jmp 0x5d6d9a
mov eax, dword [esp + 0x10]
jmp 0x5d6d9a
mov dword [esp], edx
xor edi, 0x80000000
mov dword [esp + 4], edi
call fcn.0044e350
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov ecx, dword [esp + 0x28]
xor ecx, 0x80000000
mov dword [esp + 4], ecx
call fcn.0044e350
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
add esp, 0x30
ret
call fcn.00465e40
nop
call fcn.004649b0
jmp fcn.005d6d30
Function at 0x5d91a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d9399
sub esp, 0x58
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0x104]
mov edx, dword [eax + 0x108]
mov ebx, dword [eax + 0x10c]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
movzx ecx, word [esp + 0x62]
mov word [esp + 0xc], cx
movzx ecx, word [esp + 0x64]
mov word [esp + 0xe], cx
call fcn.005d0c60
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5d9370
movzx ecx, word [eax]
test cx, cx
je 0x5d9370
mov dword [esp + 0x40], eax
mov dword [esp], eax
movzx ecx, word [esp + 0x60]
mov word [esp + 4], cx
mov dword [esp + 8], 0
call fcn.005d75c0
lea edi, [esp + 0x44]
lea esi, [esp + 0xc]
call fcn.004664ce
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x5d9267
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov byte [esp + 0x78], 0
add esp, 0x58
ret
lea edi, [esp]
lea esi, [esp + 0x44]
call fcn.004664ce
call fcn.005d7980
movzx eax, byte [esp + 0x24]
mov byte [esp + 0x2b], al
mov ecx, dword [esp + 0x5c]
movzx ecx, word [ecx + 0x310]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x38], ebx
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x34], ebp
mov eax, dword [esp + 0x20]
mov dword [esp + 0x30], eax
mov dword [esp], ecx
call fcn.0044e7d0
mov eax, dword [esp + 4]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x40]
movzx ecx, word [ecx]
mov dword [esp], ecx
call fcn.0044e7d0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.0044e470
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0044e3e0
mov eax, dword [esp + 8]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x38]
mov dword [esp], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 4], ecx
call fcn.0044e3e0
mov eax, dword [esp + 8]
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x34]
mov dword [esp], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 4], ecx
call fcn.0044e3e0
mov eax, dword [esp + 8]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 4], ecx
call fcn.0044e3e0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x68], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x6c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], eax
movzx eax, byte [esp + 0x2b]
mov byte [esp + 0x78], al
add esp, 0x58
ret
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov byte [esp + 0x78], 0
add esp, 0x58
ret
call fcn.004649b0
jmp fcn.005d91a0
Function at 0x5db2d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5db4e9
sub esp, 0x74
lea edi, [esp + 0x8c]
xor eax, eax
call fcn.00465fe9
mov ecx, dword [esp + 0x78]
mov dword [esp], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 8], ecx
movzx ecx, word [esp + 0x86]
mov word [esp + 0xc], cx
movzx edx, word [esp + 0x88]
mov word [esp + 0xe], dx
call fcn.005d0c60
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x5db4bd
mov dword [esp], ecx
movzx eax, word [esp + 0x84]
mov word [esp + 4], ax
mov dword [esp + 8], 0
call fcn.005d75c0
lea edi, [esp + 0x2c]
lea esi, [esp + 0xc]
call fcn.004664ce
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x5db444
lea edi, [esp + 0x40]
xor eax, eax
call fcn.00465fea
movzx ecx, word [esp + 0x84]
mov word [esp], cx
call fcn.004096b0
mov ecx, dword [esp + 4]
lea edx, [0x69bdc0]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ecx
movzx ecx, word [esp + 0x86]
mov word [esp], cx
call fcn.004096b0
mov ecx, dword [esp + 4]
lea edx, [0x69bdc0]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ecx
movzx ecx, word [esp + 0x88]
mov word [esp], cx
call fcn.004096b0
mov ecx, dword [esp + 4]
lea edx, [0x69bdc0]
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], ecx
lea ecx, [0x702b79]
mov dword [esp], ecx
mov dword [esp + 4], 0x33
lea ecx, [esp + 0x40]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.004cde70
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x18]
lea edi, [esp + 0x8c]
xor eax, eax
call fcn.00465fe9
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], edx
add esp, 0x74
ret
lea edi, [esp + 0x58]
xor eax, eax
call fcn.00465fe9
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], ebx
lea edi, [esp]
lea esi, [esp + 0x2c]
call fcn.004664ce
call fcn.005d76a0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
movzx ebx, byte [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov eax, ebp
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], edx
mov byte [esp + 0x64], bl
lea edi, [esp + 0x8c]
lea esi, [esp + 0x58]
call fcn.004664ba
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], ebp
add esp, 0x74
ret
lea edi, [esp + 0x8c]
xor eax, eax
call fcn.00465fe9
mov ecx, dword [0x1e84978]
mov edx, dword [0x1e8497c]
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], edx
add esp, 0x74
ret
call fcn.004649b0
jmp fcn.005db2d0
Function at 0x5dbae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5dbcd6
sub esp, 0x4c
lea edi, [esp + 0x60]
xor eax, eax
call fcn.00465fea
nop
mov ecx, dword [esp + 0x54]
movzx edx, word [esp + 0x5c]
mov ebx, dword [esp + 0x50]
mov ebp, ecx
xor esi, esi
jmp 0x5dbb1c
mov ebp, dword [esp + 0x54]
cmp ecx, esi
jle 0x5dbcbe
mov dword [esp + 0x34], ecx
sub ecx, esi
mov dword [esp + 0x3c], ecx
shr ecx, 0x1f
mov edi, dword [esp + 0x3c]
add edi, ecx
sar edi, 1
mov ecx, esi
add esi, edi
cmp ebp, esi
jbe 0x5dbccc
mov dword [esp + 0x3c], esi
shl esi, 4
mov ebp, dword [ebx + esi]
mov dword [esp + 0x40], ebp
mov ebp, dword [ebx + esi + 4]
mov dword [esp + 0x2c], ebp
mov ebp, dword [ebx + esi + 8]
mov dword [esp + 0x30], ebp
movzx ebp, word [ebx + esi + 0xe]
add esi, ebx
cmp word [esi + 0xc], dx
jbe 0x5dbb78
mov esi, ecx
mov ecx, dword [esp + 0x3c]
jmp 0x5dbb18
cmp dx, bp
jbe 0x5dbb87
lea esi, [edi + ecx + 1]
mov ecx, dword [esp + 0x34]
jmp 0x5dbb18
lea eax, [0x6bb3c0]
mov dword [esp], eax
call fcn.0040be50
mov edi, dword [esp + 4]
mov eax, dword [esp + 0x2c]
mov dword [edi + 4], eax
mov ecx, dword [esp + 0x30]
mov dword [edi + 8], ecx
mov edx, dword [0x1eaa9f0]
test edx, edx
jne 0x5dbbb9
mov edx, dword [esp + 0x40]
mov dword [edi], edx
jmp 0x5dbbc2
mov eax, dword [esp + 0x40]
call fcn.00465d80
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xffffffff
lea eax, [0x7850e8]
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.005cd6d0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x5dbc06
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x40]
jmp 0x5dbc96
mov dword [esp + 0x44], eax
lea eax, [0x6bb340]
mov dword [esp], eax
call fcn.0040be50
mov eax, dword [esp + 4]
mov dword [esp + 0x48], eax
lea ecx, [0x7850d4]
mov dword [esp], ecx
lea ecx, [0x785110]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.0048e310
mov eax, dword [esp + 0x24]
test eax, eax
je 0x5dbc6e
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x40]
jmp 0x5dbc96
nop
mov edx, dword [esp + 0x48]
mov ecx, dword [edx + 4]
mov ebx, dword [edx]
mov ebp, dword [edx + 8]
mov eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x5dbcc7
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
lea ebp, [ebx + eax]
mov dword [esp + 0x38], ecx
lea edi, [esp + 0x60]
xor eax, eax
call fcn.00465fea
mov dword [esp + 0x60], ebp
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], edx
mov byte [esp + 0x78], 1
add esp, 0x4c
ret
mov byte [esp + 0x78], 0
add esp, 0x4c
ret
call fcn.00465e60
mov eax, esi
mov ecx, ebp
call fcn.00465e00
nop
call fcn.004649b0
jmp fcn.005dbae0
Function at 0x5fd680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5fd79a
sub esp, 0x6c
mov ecx, dword [esp + 0x70]
mov edx, dword [ecx]
mov edx, dword [edx]
test byte [edx], al
lea esi, [edx + 0x278]
lea edi, [esp + 0x3c]
call fcn.00466488
movzx ecx, word [esp + 0x74]
movzx ecx, cx
lea edx, [esp + 0x3c]
cmp dword [edx + 0x28], ecx
jle 0x5fd77f
mov dword [esp + 0x1c], ecx
lea edi, [esp + 0x20]
xor eax, eax
call fcn.00465fe9
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x28], ecx
movzx ecx, byte [esp + 0x84]
mov byte [esp + 0x38], cl
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x1c]
cmp edx, eax
jbe 0x5fd792
mov edx, eax
shl eax, 4
movzx ebx, word [ecx + eax]
movzx ebp, word [ecx + eax + 2]
mov esi, dword [ecx + eax + 4]
mov edi, dword [ecx + eax + 8]
mov dword [esp + 0x1c], edi
mov edi, dword [ecx + eax + 0xc]
mov eax, edi
mov edi, dword [esp + 0x70]
mov ecx, dword [edi + 8]
mov edi, dword [edi + 4]
cmp ecx, edx
jbe 0x5fd78b
mov word [esp], bx
mov word [esp + 2], bp
mov dword [esp + 4], esi
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x10], eax
shl edx, 5
lea eax, [edi + edx]
mov dword [esp + 0x14], eax
call fcn.00601bc0
movzx eax, byte [esp + 0x18]
mov byte [esp + 0x88], al
add esp, 0x6c
ret
mov byte [esp + 0x88], 0
add esp, 0x6c
ret
mov eax, edx
call fcn.00465e00
mov ecx, edx
call fcn.00465e00
nop
call fcn.004649b0
jmp fcn.005fd680
Function at 0x604c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 8]
cmp eax, dword [ecx + 8]
jbe 0x604db9
sub esp, 0x88
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa8]
mov eax, dword [eax + 0x10]
mov dword [esp], ecx
mov ecx, dword [esp + 0xc4]
mov word [esp + 4], cx
call eax
movzx eax, word [esp + 8]
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0xb8]
cmp edx, eax
jbe 0x604db1
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*4]
mov dword [esp + 0x50], edx
mov eax, dword [ecx + eax*4 + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0xa4]
mov ebx, dword [esp + 0xa8]
mov dword [esp], ecx
mov dword [esp + 4], ebx
call fcn.00603450
mov eax, dword [esp + 8]
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x50]
xor edx, edx
jmp 0x604ceb
mov ebx, dword [esp + 0x4c]
lea ecx, [ebx + 0x34]
mov ebx, dword [esp + 0x3c]
lea edx, [ebx + 1]
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
cmp edx, ebx
jge 0x604da0
mov dword [esp + 0x3c], edx
mov dword [esp + 0x4c], ecx
lea edi, [esp + 0x54]
mov esi, ecx
call fcn.0046647e
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov ebx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x64]
mov esi, eax
mov eax, dword [esp + 0x68]
mov edi, eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x8c]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], esi
call fcn.006050a0
movzx eax, byte [esp + 0x2c]
test al, al
je 0x604cd9
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
cmp eax, ecx
setl al
mov byte [esp + 0xc8], al
add esp, 0x88
ret
mov ecx, edx
call fcn.00465e00
nop
call fcn.004649b0
jmp fcn.00604c40
Function at 0x606b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x1c]
cmp eax, dword [ecx + 8]
jbe 0x606d5c
sub esp, 0x9c
lea edi, [esp + 0xb4]
xor eax, eax
call fcn.00465fd9
lea edi, [esp + 0x40]
call fcn.00465fd9
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0xa4]
mov dword [esp + 0x44], edx
mov ebx, dword [esp + 0xa8]
mov dword [esp + 0x48], ebx
mov ebp, dword [esp + 0xac]
mov dword [esp + 0x4c], ebp
movzx esi, byte [esp + 0xb0]
xchg esi, eax
mov byte [esp + 0x50], al
xchg esi, eax
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
call fcn.00612dd0
mov ecx, dword [esp + 0xa0]
test byte [ecx], al
mov edx, dword [esp + 0xc]
mov dword [esp + 0x34], edx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x38], ebx
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x24], ebp
mov esi, dword [esp + 0x14]
mov dword [esp + 0x28], esi
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x30], ebx
add ecx, 0x278
mov dword [esp + 0x3c], ecx
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call fcn.005fd230
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
movzx ebx, byte [esp + 0x18]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x90], edx
mov byte [esp + 0x98], bl
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x10], ebx
call fcn.005fd4c0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x80], ecx
mov ecx, dword [esp + 0xa0]
add ecx, 0x2a8
mov dword [esp + 0x3c], ecx
mov dword [esp], ecx
mov edx, dword [esp + 0x34]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x24]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 0xc], edx
call fcn.005fd230
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
movzx ebx, byte [esp + 0x18]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x94], edx
mov byte [esp + 0x99], bl
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
call fcn.005fd4c0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x84], ecx
lea edi, [esp + 0xb4]
lea esi, [esp + 0x40]
call fcn.0046641a
add esp, 0x9c
ret
call fcn.004649b0
jmp fcn.00606b90
Function at 0x637fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6380a6
sub esp, 0x38
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
cmp dword [ecx + 4], eax
jne 0x638011
movzx edx, byte [ecx]
test dl, dl
jne 0x6380a2
movzx eax, byte [esp + 0x70]
mov edx, dword [esp + 0x74]
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x54]
mov dword [esp + 0x30], esi
mov edi, dword [esp + 0x4c]
mov esi, dword [ecx + 8]
mov dword [esp + 0x34], esi
mov esi, dword [ecx + 0xc]
mov ecx, dword [ecx + 0x10]
mov byte [esp], al
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
call fcn.00637810
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x3c]
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x10], edx
mov ecx, dword [0x1eaa9f0]
test ecx, ecx
jne 0x638090
mov dword [ebx + 8], eax
jmp 0x638098
lea edi, [ebx + 8]
call fcn.00465d80
mov eax, dword [esp + 0x40]
mov dword [ebx + 4], eax
mov byte [ebx], 1
add esp, 0x38
ret
call fcn.004649b0
jmp fcn.00637fe0