joyce8/EMBER2024-capa huggingface dataset:
Function at 0x558f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x559156
sub esp, 0x34
lea eax, [0x8d8fa0]
mov dword [esp], eax
call fcn.0040ae10
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x559031
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
movzx edi, byte [ebx + esi]
xchg edi, eax
mov byte [esp + 0x1e], al
xchg edi, eax
movzx edi, byte [esp + 0x1f]
movzx ebx, byte [esp + 0x1e]
xor edi, ebx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov edi, dword [esp + 0x2c]
mov ebx, edi
cmp esi, edx
jge 0x55900c
cmp ebp, eax
jge 0x55900c
jae 0x55914c
movzx edi, byte [ebp + ecx]
cmp esi, edx
jb 0x558fc7
jmp 0x559143
mov edx, dword [esp + 0x30]
movzx esi, byte [edx + 3]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 3], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
je 0x559104
mov eax, edx
mov ecx, ebp
mov edx, ebx
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x3c]
cmp ecx, ebp
jge 0x55913f
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x50]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 0x14]
mov esi, dword [esp + 0x48]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
xor esi, esi
jmp 0x558ff0
movzx esi, byte [edx + 2]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 2], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x559027
movzx esi, byte [edx + 1]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 1], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x559027
movzx esi, byte [edx]
inc esi
xchg esi, eax
mov byte [edx], al
xchg esi, eax
jmp 0x559027
add esp, 0x34
ret
mov eax, esi
mov ecx, edx
call fcn.00457060
mov ecx, eax
mov eax, ebp
call fcn.00457060
nop
call fcn.004557a0
jmp fcn.00558f90
Function at 0x55e1f0
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x55e237
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
ret
call fcn.004557a0
jmp fcn.0055e1f0
Function at 0x57a0d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57a1f1
sub esp, 0x6c
lea edi, [esp + 0x90]
xor eax, eax
call fcn.004572ab
mov ecx, dword [esp + 0x70]
mov edx, dword [ecx + 4]
test edx, edx
setne bl
mov ebp, dword [ecx]
test ebp, ebp
setne cl
or ebx, ecx
test bl, bl
jne 0x57a1c4
mov eax, dword [esp + 0x74]
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x78]
mov dword [esp], ecx
call eax
movzx eax, byte [esp + 0x18]
lea esi, [esp + 4]
lea edi, [esp + 0x44]
call fcn.0045778e
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x3c], edx
test al, al
jne 0x57a18e
mov eax, dword [esp + 0x70]
lea esi, [eax + 8]
lea edi, [esp + 0x58]
call fcn.0045778e
mov edi, esp
lea esi, [esp + 0x90]
call fcn.0045778e
mov edi, dword [esp + 0x40]
lea esi, [esp + 0x58]
call fcn.0045778e
call fcn.00579f20
lea edi, [esp + 0x90]
mov esi, dword [esp + 0x3c]
call fcn.0045778e
add esp, 0x6c
ret
mov edi, esp
lea esi, [esp + 0x90]
call fcn.0045778e
mov edi, dword [esp + 0x40]
lea esi, [esp + 0x44]
call fcn.0045778e
call fcn.00579f20
lea edi, [esp + 0x90]
mov esi, dword [esp + 0x3c]
call fcn.0045778e
mov ecx, dword [esp + 0x40]
jmp 0x57a14a
mov edi, esp
lea esi, [esp + 0x7c]
call fcn.0045778e
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edx
call fcn.004b0dd0
lea esi, [esp + 0x1c]
lea edi, [esp + 0x90]
call fcn.0045778e
jmp 0x57a114
call fcn.004557a0
jmp fcn.0057a0d0
Function at 0x589e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x589f82
sub esp, 0x40
mov eax, dword [esp + 0x70]
cmp eax, 4
jne 0x589f77
mov ecx, dword [esp + 0x6c]
cmp dword [ecx], 0x6c616964
je 0x589f55
xor edx, edx
test dl, dl
jne 0x589f20
mov edx, dword [esp + 0x60]
mov ebx, dword [esp + 0x5c]
mov dword [esp + 0x60], edx
mov dword [esp + 0x5c], ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp], ebp
mov esi, dword [esp + 0x50]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x54]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.00589c40
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x30], eax
call fcn.00593130
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], edx
mov dword [esp + 0x80], ecx
add esp, 0x40
ret
mov eax, dword [esp + 0x5c]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x60]
mov dword [esp], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x50]
mov dword [esp + 8], edx
call eax
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
jmp 0x589e58
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x60]
mov dword [esp], edx
call ecx
movzx edx, byte [esp + 4]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
jmp 0x589e48
mov ecx, dword [esp + 0x6c]
xor edx, edx
jmp 0x589e48
call fcn.004557a0
jmp fcn.00589e10
Function at 0x5a3100
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a32de
movzx eax, byte [esp + 4]
cmp al, 0x61
jb 0x5a312b
cmp al, 0x7a
ja 0x5a312b
mov byte [esp + 0xc], 0
ret
cmp al, 0x41
jb 0x5a32d7
cmp al, 0x5a
setbe cl
test cl, cl
jne 0x5a3125
cmp al, 0x30
jb 0x5a32d0
cmp al, 0x39
setbe cl
test cl, cl
jne 0x5a3125
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x5a32c2
cmp al, 0x2c
ja 0x5a329f
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x5a3175
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x5a316f
lea edx, [eax - 0x26]
cmp dl, 6
jbe 0x5a316f
cmp al, 0x2f
ja 0x5a3265
cmp al, 0x26
ja 0x5a323d
cmp al, 0x24
jne 0x5a3232
cmp ecx, 2
jg 0x5a31f6
cmp ecx, 1
je 0x5a31eb
cmp ecx, 2
jne 0x5a31cd
cmp al, 0x2f
jne 0x5a31bb
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
je 0x5a31b1
cmp al, 0x2c
je 0x5a31b1
cmp al, 0x3f
sete al
jmp 0x5a31b6
cmp ecx, 7
jne 0x5a31e5
cmp al, 0x21
jne 0x5a31dd
mov byte [esp + 0xc], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x5a31d7
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x5a321c
cmp al, 0x40
jne 0x5a320a
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
je 0x5a3200
cmp al, 0x3f
je 0x5a3200
cmp al, 0x3a
sete al
jmp 0x5a3205
cmp ecx, 6
je 0x5a322c
cmp ecx, 7
jne 0x5a31cd
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x5a319d
jmp 0x5a31cd
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5a319d
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x5a3257
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x5a319d
jmp 0x5a31cd
cmp al, 0x3d
ja 0x5a3284
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5a319d
cmp al, 0x3d
je 0x5a319d
jmp 0x5a31cd
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x5a319d
cmp al, 0x5f
je 0x5a3251
cmp al, 0x7e
je 0x5a3251
jmp 0x5a31cd
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x5a316f
cmp al, 0x5b
je 0x5a316f
cmp al, 0x5d
je 0x5a316f
jmp 0x5a3182
cmp ecx, 4
je 0x5a315e
jmp 0x5a3182
xor ecx, ecx
jmp 0x5a314d
xor ecx, ecx
jmp 0x5a313a
call fcn.004557a0
jmp fcn.005a3100
Function at 0x5a9880
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a98ce
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
ret
call fcn.004557a0
jmp fcn.005a9880
Function at 0x5abf60
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ac008
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x5abfcf
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
jmp 0x5abfb9
call fcn.004557a0
jmp fcn.005abf60
Function at 0x5de490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5de675
sub esp, 0x48
mov eax, dword [0xdb9a8c]
mov dword [esp + 0x28], eax
lea ecx, [0x8ebc40]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
call fcn.00440500
mov eax, dword [esp + 0xc]
mov ecx, dword [0xdb9a8c]
mov dword [esp + 0x34], ecx
mov edx, dword [0xdb9a88]
mov dword [esp + 0x44], edx
movzx ebx, byte [esp + 0x50]
mov ebp, dword [esp + 0x4c]
mov esi, dword [esp + 0x28]
xor edi, edi
xor edi, edi
mov dword [esp + 0x24], edi
jmp 0x5de50e
inc edi
mov ebx, dword [esp + 0x44]
movzx ebx, byte [esp + 0x50]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x44]
cmp edi, ecx
jge 0x5de661
movzx ebx, word [edx + edi*2]
test ebp, ebp
je 0x5de52e
movzx edx, word [ebp + 0x88]
test dx, dx
jne 0x5de65a
cmp bx, 0x301
jae 0x5de53b
mov edx, dword [esp + 0x24]
jmp 0x5de4fc
test ebp, ebp
je 0x5de55c
movzx edx, word [ebp + 0x88]
test dx, dx
je 0x5de653
cmp bx, dx
jae 0x5de55a
mov edx, dword [esp + 0x24]
jmp 0x5de4fc
test ebp, ebp
je 0x5de575
movzx edx, word [ebp + 0x8a]
test dx, dx
je 0x5de575
cmp bx, dx
jbe 0x5de575
mov edx, dword [esp + 0x24]
jmp 0x5de4fc
movzx edx, byte [esp + 0x50]
test dl, dl
je 0x5de58e
cmp bx, 0x301
jae 0x5de58e
mov edx, dword [esp + 0x24]
jmp 0x5de4fc
mov dword [esp + 0x30], edi
mov word [esp + 0x22], bx
cmp bx, 0x304
je 0x5de618
mov dword [esp + 0x38], eax
xor eax, eax
mov byte [esp + 0x21], al
mov eax, dword [esp + 0x38]
movzx edx, byte [esp + 0x21]
test dl, dl
je 0x5de5be
mov edx, dword [esp + 0x24]
jmp 0x5de4fc
mov edx, dword [esp + 0x24]
lea ebp, [edx + 1]
cmp ebp, esi
ja 0x5de5d8
mov word [eax + edx*2], bx
mov edx, ebp
mov ebp, dword [esp + 0x4c]
jmp 0x5de4fc
lea ecx, [0x8ebc40]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
call fcn.00440660
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
lea ebp, [ecx + 1]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x24]
movzx ebx, word [esp + 0x22]
mov edi, dword [esp + 0x30]
jmp 0x5de5c9
mov dword [esp + 0x2c], esi
mov dword [esp + 0x40], eax
call fcn.005de680
movzx eax, byte [esp]
xor eax, 1
mov ecx, dword [esp + 0x34]
movzx edx, byte [esp + 0x50]
movzx ebx, word [esp + 0x22]
mov ebp, dword [esp + 0x4c]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov byte [esp + 0x21], al
mov eax, dword [esp + 0x40]
jmp 0x5de5ac
test ebp, ebp
jmp 0x5de55c
test ebp, ebp
jmp 0x5de53d
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], esi
add esp, 0x48
ret
call fcn.004557a0
jmp fcn.005de490
Function at 0x5dfa80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5dfb94
sub esp, 0x24
mov ecx, dword [esp + 0x2c]
cmp ecx, 1
jl 0x5dfb79
mov edx, dword [esp + 0x28]
movzx ebx, byte [ecx + edx - 1]
lea eax, [ecx - 1]
movzx ebp, bl
mov esi, eax
sub eax, ebp
cmp ecx, 0x100
jge 0x5dfb6d
mov edi, ecx
mov dword [esp + 0x18], esi
mov byte [esp + 0xb], bl
mov dword [esp + 0x14], ebp
not eax
sar eax, 0x1f
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
jmp 0x5dfb2d
inc ebx
xchg ebp, ebx
not ebx
xchg ebp, ebx
sar ebp, 0x1f
mov dword [esp + 0x10], ebp
movzx esi, byte [edx + esi]
movzx edx, byte [esp + 0xb]
and ebp, edx
mov edx, dword [esp + 0x10]
and esi, edx
xor ebp, esi
xchg ebp, ebx
not ebx
xchg ebp, ebx
and eax, ebp
movzx edx, byte [esp + 0xb]
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x18]
mov edx, ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
movzx ebx, byte [esp + 0xb]
mov ebx, dword [esp + 0xc]
cmp ebx, ecx
jge 0x5dfb3f
sub ebp, ebx
sub esi, ebx
cmp esi, edi
jb 0x5dfae8
jmp 0x5dfb8a
mov ecx, eax
shl eax, 4
and ecx, eax
mov eax, ecx
shl ecx, 2
and ecx, eax
mov eax, ecx
shl ecx, 1
and ecx, eax
sar cl, 7
movzx eax, byte [esp + 0xb]
and eax, ecx
movzx eax, al
inc eax
mov dword [esp + 0x34], eax
mov byte [esp + 0x38], cl
add esp, 0x24
ret
mov edi, ecx
mov ecx, 0x100
jmp 0x5dfac7
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x24
ret
mov eax, esi
mov ecx, edi
call fcn.00457060
nop
call fcn.004557a0
jmp fcn.005dfa80
Function at 0x5e5370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 8]
cmp eax, dword [ecx + 8]
jbe 0x5e5568
sub esp, 0x88
lea edi, [esp + 0x90]
xor eax, eax
call fcn.00457299
mov ecx, dword [esp + 0x8c]
test byte [ecx], al
lea edx, [ecx + 0x10]
mov dword [esp + 0x28], edx
mov dword [esp], edx
call fcn.004723c0
mov dword [esp + 8], 4
lea ecx, [0x9b2b60]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 8]
mov dword [esp], ecx
call fcn.0042c560
test eax, eax
jne 0x5e555b
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.00457299
mov ecx, dword [esp + 0x8c]
lea edx, [ecx + 0xc]
mov dword [esp], edx
call fcn.0045db30
cmp dword [esp + 4], 1
sete cl
mov byte [esp + 0x2e], cl
mov ecx, dword [esp + 0x8c]
mov edx, dword [ecx + 0x64]
mov ebx, dword [ecx + 0x60]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], edx
movzx edx, byte [esp + 0x2e]
test dl, dl
je 0x5e54de
movzx eax, word [ecx + 0x20]
mov word [esp + 0x2c], ax
mov eax, dword [ecx + 0xa8]
mov edx, dword [ecx + 0xa4]
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
movzx eax, byte [ecx + 0x2c]
mov byte [esp + 0x2f], al
movzx eax, byte [ecx + 0xac]
xor eax, 1
mov byte [esp + 0x3c], al
movzx eax, word [ecx + 0x2e]
mov word [esp + 0x30], ax
mov eax, dword [ecx + 0x50]
mov edx, dword [ecx + 0x4c]
mov ebx, dword [ecx + 0x48]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], eax
mov eax, dword [ecx + 0x54]
mov edx, dword [ecx + 0x5c]
mov ebx, dword [ecx + 0x58]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], edx
mov eax, dword [ecx + 0x40]
mov edx, dword [ecx + 0x44]
mov ebx, dword [ecx + 0x3c]
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], edx
mov eax, dword [ecx + 0x38]
mov edx, dword [ecx + 0x34]
mov ebx, dword [ecx + 0x30]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], edx
mov dword [esp + 0x74], eax
movzx eax, byte [ecx + 0x2c]
test al, al
je 0x5e5504
mov eax, dword [ecx + 0x24]
mov eax, dword [eax + 0x9c]
test eax, eax
je 0x5e54fb
lea eax, [0x9b2034]
mov dword [esp + 0x78], eax
lea edi, [esp + 0x90]
lea esi, [esp + 0x2c]
call fcn.004576da
nop
call fcn.0042cca0
add esp, 0x88
ret
mov eax, dword [ecx + 0x6c]
mov dword [esp + 0x78], eax
jmp 0x5e54de
cmp word [ecx + 0x20], 0x304
je 0x5e54c7
movzx eax, byte [ecx + 0x7c]
test al, al
je 0x5e5536
lea eax, [ecx + 0x89]
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], 0xc
mov dword [esp + 0x84], 0xc
jmp 0x5e54c7
lea eax, [ecx + 0x95]
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], 0xc
mov dword [esp + 0x84], 0xc
jmp 0x5e54c7
nop
call fcn.0042cca0
add esp, 0x88
ret
call fcn.004557a0
jmp fcn.005e5370
Function at 0x5ee8b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5eea87
sub esp, 0x4c
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
mov edx, dword [eax + 0x38]
mov ebx, dword [ecx + 0x15c]
mov ebp, dword [ecx + 0x158]
mov esi, dword [ecx + 0x154]
mov edi, dword [eax + 0x40]
mov ecx, dword [eax + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
call fcn.00601b70
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x34]
mov ebx, eax
xor eax, eax
call fcn.004572aa
lea edi, [esp + 0x34]
call fcn.004572aa
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], edx
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.005f57d0
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 0x3c]
mov edx, dword [eax + 0x40]
mov ecx, dword [ecx + 0x20]
mov dword [esp], edx
call ecx
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.005f57d0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x2c]
mov dword [esp], ebx
mov byte [esp + 4], 0x16
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
call fcn.005e37a0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
test eax, eax
jne 0x5eea7b
mov eax, dword [esp + 0x2c]
lea ecx, [eax + 0x108]
mov edx, dword [esp + 0x50]
mov ebx, dword [edx + 0x38]
mov ebp, dword [edx + 0x50]
mov esi, dword [edx + 0x54]
mov edi, dword [edx + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
call fcn.005df7d0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x24]
movzx edx, byte [ecx + 0x5d]
test dl, dl
je 0x5ee9f8
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
add esp, 0x4c
ret
mov ecx, dword [ecx + 0x80]
test ecx, ecx
je 0x5ee9e4
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 0x38]
mov edx, dword [eax + 0x44]
mov ebx, dword [eax + 0x48]
mov ebp, dword [eax + 0x4c]
mov esi, dword [eax + 0x40]
mov eax, dword [eax + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
lea ecx, [0x987710]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0xa
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], esi
call fcn.00601730
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov dword [ebx + 0x74], ecx
mov dword [ebx + 0x78], edx
mov ecx, dword [0xdd7ec0]
test ecx, ecx
jne 0x5eea6e
mov dword [ebx + 0x70], eax
jmp 0x5ee9e4
lea edi, [ebx + 0x70]
call fcn.00456fe0
jmp 0x5ee9e4
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
add esp, 0x4c
ret
call fcn.004557a0
jmp fcn.005ee8b0
Function at 0x602e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x602fe7
sub esp, 0x40
lea eax, [0x8ebd00]
mov dword [esp], eax
mov dword [esp + 4], 0
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x68]
lea ebx, [edx + ecx]
mov dword [esp + 0x30], ebx
mov dword [esp + 8], ebx
call fcn.00440500
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x30]
cmp ecx, edx
ja 0x602fb4
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], edx
mov dword [esp], eax
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
call fcn.004579b0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
cmp eax, ecx
ja 0x602f81
mov edx, dword [esp + 0x38]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov eax, dword [esp + 0x5c]
add eax, edx
mov dword [esp], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 8], eax
call fcn.004579b0
lea eax, [0x8ebd00]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
call fcn.00440500
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
movzx ecx, word [esp + 0x44]
mov word [esp], cx
mov ecx, dword [esp + 0x48]
mov dword [esp + 4], ecx
call fcn.00602d30
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x14], ecx
mov ecx, dword [str.master_secret]
mov ebx, dword [0xdb9a3c]
mov ebp, dword [0xdb9a40]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], ecx
mov ecx, dword [edx]
call ecx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x30
mov dword [esp + 0x78], 0x30
add esp, 0x40
ret
lea edx, [0x8ebd00]
mov dword [esp], edx
mov ebx, dword [esp + 0x38]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.00440660
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
jmp 0x602e96
lea ebx, [0x8ebd00]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.00440660
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x5c]
jmp 0x602e66
call fcn.004557a0
jmp fcn.00602e10