joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x58
mov edi, ecx
mov eax, dword [esp + 0x6c]
mov ecx, dword [ecx + 0x20]
mov esi, dword [esp + 0x78]
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], ebx
mov eax, dword [ecx]
movsd xmm0, qword [esp + 0x50]
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [esp + 0x30]
movsd qword [esp + 8], xmm0
movsd xmm0, qword [esp + 0x20]
movsd qword [esp], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 1
call dword [eax + 0x98]
sub esp, 0x20
sub esi, dword [esp + 0x74]
mov ebp, esi
sar ebp, 0x1f
add ebx, esi
mov dword [esp + 0x4c], ebx
mov eax, ebp
adc eax, 0
mov dword [esp + 0x48], eax
mov eax, dword [edi + 0x20]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + 0x10]
cmp eax, dword [ecx + 8]
je 0x421c51
call fcn.005507c8
mov ecx, edi
call fcn.00418330
mov ecx, dword [edi + 0x20]
mov dword [esp + 0x20], str.BlockRelocations
mov dword [esp + 0x24], 0x10
mov eax, dword [ecx]
movsd xmm0, qword [esp + 0x20]
movsd qword [esp], xmm0
mov dword [esp + 0x44], ecx
call dword [eax + 0x88]
sub esp, 8
mov ecx, dword [edi + 0x38]
mov eax, dword [esp + 0x70]
mov dword [esp], eax
call fcn.00550b94
sub esp, 4
mov dword [esp + 0x30], eax
mov ebx, dword [edi + 0x4c]
test ebx, ebx
mov dword [esp + 0x2c], edi
je 0x421d19
mov ecx, dword [edi + 0x40]
mov edx, eax
shr edx, 4
mov dword [esp + 0x28], eax
shr eax, 9
xor eax, edx
dec ebx
and eax, ebx
mov edi, eax
shl edi, 4
lea edx, [ecx + edi]
mov dword [esp + 0x40], ecx
mov edi, dword [ecx + edi]
mov ecx, dword [esp + 0x28]
cmp ecx, edi
je 0x421d33
mov dword [esp + 0x3c], ebx
xor ebx, ebx
mov ecx, 1
cmp edi, 0xfffff000
je 0x421da4
xor edi, 0xffffe000
or edi, ebx
cmove ebx, edx
mov dword [esp + 0x38], ebx
add eax, ecx
inc ecx
and eax, dword [esp + 0x3c]
mov edi, eax
shl edi, 4
mov ebx, dword [esp + 0x40]
lea edx, [ebx + edi]
mov edi, dword [ebx + edi]
mov ebx, dword [esp + 0x38]
cmp dword [esp + 0x28], edi
je 0x421d33
jmp 0x421cdc
xor edx, edx
lea ecx, [edi + 0x40]
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0041a800
sub esp, 8
mov edx, eax
mov ebx, dword [edx + 4]
mov edi, dword [edx + 8]
jmp 0x421d43
add ebx, 0xc
cmp ebx, edi
je 0x421d90
mov ecx, dword [ebx + 8]
movsd xmm0, qword [ebx]
movsd qword [esp + 0x20], xmm0
mov eax, dword [ecx]
movsd xmm0, qword [esp + 0x20]
movsd qword [esp], xmm0
call dword [eax + 0x98]
sub esp, 8
cmp eax, esi
mov ecx, edx
sbb ecx, ebp
jb 0x421d40
cmp eax, dword [esp + 0x4c]
sbb edx, dword [esp + 0x48]
jae 0x421d40
mov dword [esp + 4], ebp
mov dword [esp], esi
mov ecx, dword [esp + 0x2c]
mov edx, ebx
call fcn.00415b60
jmp 0x421d40
mov ecx, dword [esp + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x8c]
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
cmovne edx, ebx
mov edi, dword [esp + 0x2c]
jmp 0x421d1b
Function at 0x43cfa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov edi, edx
mov esi, ecx
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x50], esi
mov dword [esp + 0x3c], 0x43d2b0
lea ebp, [esp + 0x50]
mov dword [esp + 0x40], ebp
sub esp, 0x14
movsd xmm0, qword [esp + 0x50]
movsd qword [esp + 0xc], xmm0
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
lea ecx, [esp + 0x14]
call fcn.00550ea6
test byte [esp + 4], 1
jne 0x43cfff
mov esi, dword [esp]
jmp 0x43d1b3
lea ebx, [esp + 0x44]
mov ecx, ebx
push dword [esp + 0x78]
push edi
push dword [esi + 0x3c]
call fcn.00550eb8
mov ecx, ebx
push str.unable_to_parse_DT_
push 0
call fcn.00550f48
movsd xmm0, qword [eax]
movsd qword [esp + 0x18], xmm0
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
lea ecx, [esp + 0x18]
push 0x558038
call fcn.00550f36
movsd xmm0, qword [eax]
movsd qword [esp + 0x24], xmm0
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], ecx
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
xor eax, eax
test byte [esp + 4], 1
je 0x43d08b
mov eax, dword [esp]
mov dword [esp], 0
mov dword [esp + 8], eax
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.00550abc
add esp, 8
movzx eax, byte [esp + 0xc]
test al, 1
je 0x43d0b4
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
jmp 0x43d0ba
shr eax, 1
lea edx, [esp + 0xd]
lea ecx, [esp + 0x24]
push eax
push edx
call fcn.00550f3c
movsd xmm0, qword [eax]
movsd qword [esp + 0x30], xmm0
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], ecx
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov word [esp + 0x60], 0x104
lea eax, [esp + 0x30]
mov dword [esp + 0x50], eax
mov ecx, esi
push ebp
call fcn.0053aad0
test byte [esp + 0x30], 1
jne 0x43d13c
test byte [esp + 0xc], 1
jne 0x43d14f
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x43d11c
mov eax, dword [ecx]
call dword [eax + 4]
test byte [esp + 0x24], 1
jne 0x43d165
test byte [esp + 0x18], 1
jne 0x43d178
test byte [esp + 0x44], 1
jne 0x43d18b
xor esi, esi
test byte [esp + 4], 1
jne 0x43d1a0
jmp 0x43d1b3
push dword [esp + 0x38]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0xc], 1
je 0x43d10f
push dword [esp + 0x14]
call sub.libc.dll_operator_delete_void_
add esp, 4
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x43d117
jmp 0x43d11c
push dword [esp + 0x2c]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x18], 1
je 0x43d12a
push dword [esp + 0x20]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x44], 1
je 0x43d131
push dword [esp + 0x4c]
call sub.libc.dll_operator_delete_void_
add esp, 4
xor esi, esi
test byte [esp + 4], 1
je 0x43d1b3
mov ecx, dword [esp]
mov dword [esp], 0
test ecx, ecx
je 0x43d1b3
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x451b30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov esi, ecx
cmp byte [edx + 0x40], 0
je 0x451b70
mov ecx, edx
call fcn.004485c0
test edx, edx
je 0x451b7a
mov edi, dword [esp + 0x78]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov ebp, edx
mov ebx, dword [edi + 8]
sub ebp, ecx
jbe 0x451bd3
and byte [esi + 8], 0xfe
lea ecx, [edi + ebx*4]
lea eax, [ecx + eax*4]
add eax, 0x10
mov dword [esi], eax
mov dword [esi + 4], ebp
jmp 0x451bcb
mov dword [esp + 0x20], str.no_dynamic_symbol_table_found
jmp 0x451b82
mov dword [esp + 0x20], str.the_dynamic_symbol_table_is_empty
mov word [esp + 0x30], 0x103
mov dword [esp], 0x1c
call sub.libc.dll_operator_new_unsigned_int_
mov edi, eax
call fcn.00550996
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 3
movsd xmm0, qword [esp + 0xc]
movsd qword [esp + 4], xmm0
lea eax, [esp + 0x20]
mov dword [esp], eax
mov ecx, edi
call fcn.005507bc
sub esp, 0xc
or byte [esi + 8], 1
mov dword [esi], edi
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
test eax, eax
je 0x451bfd
lea edi, [edi + ebx*4]
add edi, 0x10
shl eax, 2
xor ebx, ebx
nop word cs:[eax + eax]
cmp dword [edi + ebx], 0
jne 0x451c10
add ebx, 4
cmp eax, ebx
jne 0x451bf0
and byte [esi + 8], 0xfe
mov dword [esi], 0
mov dword [esi + 4], 0
jmp 0x451bcb
mov dword [esp + 0x3c], str.the_first_hashed_symbol_index__
mov dword [esp + 0x44], ecx
mov word [esp + 0x4c], 0x803
lea eax, [esp + 0x3c]
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], str.__is_greater_than_or_equal_to_the_number_of_dynamic_symbols__
mov word [esp + 0x60], 0x302
lea eax, [esp + 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
mov word [esp + 0x1c], 0x802
lea eax, [esp + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0x5580d8
mov word [esp + 0x30], 0x302
mov dword [esp], 0x1c
call sub.libc.dll_operator_new_unsigned_int_
mov edi, eax
call fcn.00550996
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], 3
movsd xmm0, qword [esp + 0x34]
jmp 0x451bae
Function at 0x4868d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x110
mov esi, ecx
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov byte [esp + 0xc0], 0
mov byte [esp + 0x100], 0
add ecx, 0x1d0
call fcn.00486480
mov edi, eax
xor ebx, ebx
cmp edx, ebx
je 0x486f0b
inc ebx
cmp dword [eax], 0
lea eax, [eax + 8]
jne 0x486910
mov dword [esp + 4], 0
test ebx, ebx
je 0x486f1d
shl ebx, 3
add edi, 4
mov dword [esp + 8], 0
jmp 0x48699c
mov ebx, edx
mov dword [esp + 4], 0
test ebx, ebx
jne 0x486931
mov dword [esp + 8], 0
jmp 0x486f33
Function at 0x487500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov edi, edx
mov esi, ecx
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x50], esi
mov dword [esp + 0x3c], 0x487720
lea ebp, [esp + 0x50]
mov dword [esp + 0x40], ebp
sub esp, 0x14
movsd xmm0, qword [esp + 0x50]
movsd qword [esp + 0xc], xmm0
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
lea ecx, [esp + 0x14]
call fcn.00550e5e
test byte [esp + 4], 1
jne 0x48755f
mov esi, dword [esp]
jmp 0x487713
lea ebx, [esp + 0x44]
mov ecx, ebx
push dword [esp + 0x78]
push edi
push dword [esi + 0x3c]
call fcn.00550e70
mov ecx, ebx
push str.unable_to_parse_DT_
push 0
call fcn.00550f48
movsd xmm0, qword [eax]
movsd qword [esp + 0x18], xmm0
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
lea ecx, [esp + 0x18]
push 0x558038
call fcn.00550f36
movsd xmm0, qword [eax]
movsd qword [esp + 0x24], xmm0
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], ecx
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
xor eax, eax
test byte [esp + 4], 1
je 0x4875eb
mov eax, dword [esp]
mov dword [esp], 0
mov dword [esp + 8], eax
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.00550abc
add esp, 8
movzx eax, byte [esp + 0xc]
test al, 1
je 0x487614
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
jmp 0x48761a
shr eax, 1
lea edx, [esp + 0xd]
lea ecx, [esp + 0x24]
push eax
push edx
call fcn.00550f3c
movsd xmm0, qword [eax]
movsd qword [esp + 0x30], xmm0
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], ecx
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov word [esp + 0x60], 0x104
lea eax, [esp + 0x30]
mov dword [esp + 0x50], eax
mov ecx, esi
push ebp
call fcn.0053aad0
test byte [esp + 0x30], 1
jne 0x48769c
test byte [esp + 0xc], 1
jne 0x4876af
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x48767c
mov eax, dword [ecx]
call dword [eax + 4]
test byte [esp + 0x24], 1
jne 0x4876c5
test byte [esp + 0x18], 1
jne 0x4876d8
test byte [esp + 0x44], 1
jne 0x4876eb
xor esi, esi
test byte [esp + 4], 1
jne 0x487700
jmp 0x487713
push dword [esp + 0x38]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0xc], 1
je 0x48766f
push dword [esp + 0x14]
call sub.libc.dll_operator_delete_void_
add esp, 4
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x487677
jmp 0x48767c
push dword [esp + 0x2c]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x18], 1
je 0x48768a
push dword [esp + 0x20]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x44], 1
je 0x487691
push dword [esp + 0x4c]
call sub.libc.dll_operator_delete_void_
add esp, 4
xor esi, esi
test byte [esp + 4], 1
je 0x487713
mov ecx, dword [esp]
mov dword [esp], 0
test ecx, ecx
je 0x487713
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x493600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, edx
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov dword [esp + 4], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], edx
mov dword [esp + 0x50], eax
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
movzx eax, word [eax + 0x12]
rol ax, 8
mov edi, ecx
mov esi, dword [ebp + 0xc]
cmp ax, 8
je 0x4936b6
movzx eax, ax
cmp eax, 0xa4
je 0x4936ed
cmp eax, 0xb7
jne case.0x44ed79.202
mov eax, dword [ebp + 8]
add eax, 0x8fffffff
mov ecx, esi
adc ecx, 0xffffffff
mov esi, edx
xor edx, edx
mov dword [esp + 0x20], edi
mov ebx, 0xe
cmp ebx, eax
mov edi, dword [esp + 0x20]
sbb edx, ecx
mov edx, esi
mov esi, dword [ebp + 0xc]
jb case.0x44ed79.202
jmp dword [eax*4 + 0x565dac]
mov eax, dword [ebp + 8]
add eax, 0x8fffffff
mov ecx, esi
adc ecx, 0xffffffff
mov dword [esp + 0x24], edx
xor edx, edx
mov ebx, 0x35
cmp ebx, eax
sbb edx, ecx
mov edx, dword [esp + 0x24]
jb case.0x44ed79.202
jmp dword [eax*4 + 0x565cd4]
mov ecx, dword [ebp + 8]
mov eax, ecx
xor eax, 0x70000000
or eax, esi
je case.0x44ed79.192
mov eax, ecx
xor eax, 0x70000002
or eax, esi
je case.0x44ed79.192
mov eax, ecx
xor eax, 0x70000001
or eax, esi
je case.0x44ed79.191
Function at 0x4c5860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x110
mov ebx, ecx
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], 0
mov byte [esp + 0xc0], 0
mov byte [esp + 0x100], 0
add ecx, 0x1d0
call fcn.004c5410
mov esi, eax
xor edi, edi
cmp edx, edi
je 0x4c5ef5
inc edi
mov ecx, dword [eax]
or ecx, dword [eax + 4]
lea eax, [eax + 0x10]
jne 0x4c58a0
mov dword [esp + 0xc], 0
test edi, edi
mov dword [esp + 8], ebx
je 0x4c5f0b
shl edi, 4
add esi, 8
mov dword [esp + 0x10], 0
jmp 0x4c592c
mov edi, edx
mov dword [esp + 0xc], 0
test edi, edi
mov dword [esp + 8], ebx
jne 0x4c58c7
mov dword [esp + 0x10], 0
jmp 0x4c5f21
Function at 0x4c6520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov edi, edx
mov esi, ecx
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x50], esi
mov dword [esp + 0x3c], 0x4c6740
lea ebp, [esp + 0x50]
mov dword [esp + 0x40], ebp
sub esp, 0x14
movsd xmm0, qword [esp + 0x50]
movsd qword [esp + 0xc], xmm0
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
lea ecx, [esp + 0x14]
call fcn.00550eca
test byte [esp + 4], 1
jne 0x4c657f
mov esi, dword [esp]
jmp 0x4c6733
lea ebx, [esp + 0x44]
mov ecx, ebx
push dword [esp + 0x78]
push edi
push dword [esi + 0x3c]
call fcn.00550edc
mov ecx, ebx
push str.unable_to_parse_DT_
push 0
call fcn.00550f48
movsd xmm0, qword [eax]
movsd qword [esp + 0x18], xmm0
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
lea ecx, [esp + 0x18]
push 0x558038
call fcn.00550f36
movsd xmm0, qword [eax]
movsd qword [esp + 0x24], xmm0
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], ecx
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
xor eax, eax
test byte [esp + 4], 1
je 0x4c660b
mov eax, dword [esp]
mov dword [esp], 0
mov dword [esp + 8], eax
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.00550abc
add esp, 8
movzx eax, byte [esp + 0xc]
test al, 1
je 0x4c6634
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
jmp 0x4c663a
shr eax, 1
lea edx, [esp + 0xd]
lea ecx, [esp + 0x24]
push eax
push edx
call fcn.00550f3c
movsd xmm0, qword [eax]
movsd qword [esp + 0x30], xmm0
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], ecx
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov word [esp + 0x60], 0x104
lea eax, [esp + 0x30]
mov dword [esp + 0x50], eax
mov ecx, esi
push ebp
call fcn.0053aad0
test byte [esp + 0x30], 1
jne 0x4c66bc
test byte [esp + 0xc], 1
jne 0x4c66cf
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4c669c
mov eax, dword [ecx]
call dword [eax + 4]
test byte [esp + 0x24], 1
jne 0x4c66e5
test byte [esp + 0x18], 1
jne 0x4c66f8
test byte [esp + 0x44], 1
jne 0x4c670b
xor esi, esi
test byte [esp + 4], 1
jne 0x4c6720
jmp 0x4c6733
push dword [esp + 0x38]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0xc], 1
je 0x4c668f
push dword [esp + 0x14]
call sub.libc.dll_operator_delete_void_
add esp, 4
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4c6697
jmp 0x4c669c
push dword [esp + 0x2c]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x18], 1
je 0x4c66aa
push dword [esp + 0x20]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x44], 1
je 0x4c66b1
push dword [esp + 0x4c]
call sub.libc.dll_operator_delete_void_
add esp, 4
xor esi, esi
test byte [esp + 4], 1
je 0x4c6733
mov ecx, dword [esp]
mov dword [esp], 0
test ecx, ecx
je 0x4c6733
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d2ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, edx
mov edi, ecx
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [esp + 4], ecx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x68], edx
mov dword [esp + 0x50], eax
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
movzx eax, word [eax + 0x12]
mov esi, dword [ebp + 0xc]
cmp eax, 8
je 0x4d2d4e
cmp eax, 0xa4
je 0x4d2d85
cmp eax, 0xb7
jne case.0x4c5968.47
mov eax, dword [ebp + 8]
add eax, 0x8fffffff
mov ecx, esi
adc ecx, 0xffffffff
mov esi, edx
xor edx, edx
mov dword [esp + 0x20], edi
mov ebx, 0xe
cmp ebx, eax
mov edi, dword [esp + 0x20]
sbb edx, ecx
mov edx, esi
mov esi, dword [ebp + 0xc]
jb case.0x4c5968.47
jmp dword [eax*4 + 0x5660ec]
mov eax, dword [ebp + 8]
add eax, 0x8fffffff
mov ecx, esi
adc ecx, 0xffffffff
mov dword [esp + 0x24], edx
xor edx, edx
mov ebx, 0x35
cmp ebx, eax
sbb edx, ecx
mov edx, dword [esp + 0x24]
jb case.0x4c5968.47
jmp dword [eax*4 + 0x566014]
mov ecx, dword [ebp + 8]
mov eax, ecx
xor eax, 0x70000000
or eax, esi
je case.0x4c5968.37
mov eax, ecx
xor eax, 0x70000002
or eax, esi
je case.0x4c5968.37
mov eax, ecx
xor eax, 0x70000001
or eax, esi
je case.0x4c5968.36
Function at 0x4d3ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov esi, ecx
cmp byte [edx + 0x40], 0
je 0x4d3f20
mov ecx, edx
call fcn.004cebb0
test edx, edx
je 0x4d3f2a
mov edi, dword [esp + 0x78]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov ebp, edx
mov ebx, dword [edi + 8]
sub ebp, ecx
jbe 0x4d3f83
and byte [esi + 8], 0xfe
lea ecx, [edi + ebx*8]
lea eax, [ecx + eax*4]
add eax, 0x10
mov dword [esi], eax
mov dword [esi + 4], ebp
jmp 0x4d3f7b
mov dword [esp + 0x20], str.no_dynamic_symbol_table_found
jmp 0x4d3f32
mov dword [esp + 0x20], str.the_dynamic_symbol_table_is_empty
mov word [esp + 0x30], 0x103
mov dword [esp], 0x1c
call sub.libc.dll_operator_new_unsigned_int_
mov edi, eax
call fcn.00550996
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 3
movsd xmm0, qword [esp + 0xc]
movsd qword [esp + 4], xmm0
lea eax, [esp + 0x20]
mov dword [esp], eax
mov ecx, edi
call fcn.005507bc
sub esp, 0xc
or byte [esi + 8], 1
mov dword [esi], edi
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
test eax, eax
je 0x4d3fad
lea edi, [edi + ebx*8]
add edi, 0x10
shl eax, 2
xor ebx, ebx
nop word cs:[eax + eax]
cmp dword [edi + ebx], 0
jne 0x4d3fc0
add ebx, 4
cmp eax, ebx
jne 0x4d3fa0
and byte [esi + 8], 0xfe
mov dword [esi], 0
mov dword [esi + 4], 0
jmp 0x4d3f7b
mov dword [esp + 0x3c], str.the_first_hashed_symbol_index__
mov dword [esp + 0x44], ecx
mov word [esp + 0x4c], 0x803
lea eax, [esp + 0x3c]
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], str.__is_greater_than_or_equal_to_the_number_of_dynamic_symbols__
mov word [esp + 0x60], 0x302
lea eax, [esp + 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
mov word [esp + 0x1c], 0x802
lea eax, [esp + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0x5580d8
mov word [esp + 0x30], 0x302
mov dword [esp], 0x1c
call sub.libc.dll_operator_new_unsigned_int_
mov edi, eax
call fcn.00550996
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], 3
movsd xmm0, qword [esp + 0x34]
jmp 0x4d3f5e
Function at 0x504340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x110
mov ebx, ecx
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov byte [esp + 0xc0], 0
mov byte [esp + 0x100], 0
add ecx, 0x1d0
call fcn.00503ef0
xor edi, edi
mov esi, eax
cmp edx, edi
je 0x504a8d
inc edi
mov ecx, dword [eax]
or ecx, dword [eax + 4]
lea eax, [eax + 0x10]
jne 0x504380
mov dword [esp + 0xc], 0
test edi, edi
mov dword [esp + 8], ebx
je 0x504aa3
shl edi, 4
mov edx, esi
add edx, 8
mov dword [esp + 0x10], 0
jmp 0x5043cc
mov edi, edx
mov dword [esp + 0xc], 0
test edi, edi
mov dword [esp + 8], ebx
jne 0x5043a7
mov dword [esp + 0x10], 0
jmp 0x504ab9
Function at 0x5050e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov edi, edx
mov esi, ecx
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x50], esi
mov dword [esp + 0x3c], 0x505300
lea ebp, [esp + 0x50]
mov dword [esp + 0x40], ebp
sub esp, 0x14
movsd xmm0, qword [esp + 0x50]
movsd qword [esp + 0xc], xmm0
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
lea ecx, [esp + 0x14]
call fcn.00550e82
test byte [esp + 4], 1
jne 0x50513f
mov esi, dword [esp]
jmp 0x5052f3
lea ebx, [esp + 0x44]
mov ecx, ebx
push dword [esp + 0x78]
push edi
push dword [esi + 0x3c]
call fcn.00550e94
mov ecx, ebx
push str.unable_to_parse_DT_
push 0
call fcn.00550f48
movsd xmm0, qword [eax]
movsd qword [esp + 0x18], xmm0
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
lea ecx, [esp + 0x18]
push 0x558038
call fcn.00550f36
movsd xmm0, qword [eax]
movsd qword [esp + 0x24], xmm0
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], ecx
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
xor eax, eax
test byte [esp + 4], 1
je 0x5051cb
mov eax, dword [esp]
mov dword [esp], 0
mov dword [esp + 8], eax
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.00550abc
add esp, 8
movzx eax, byte [esp + 0xc]
test al, 1
je 0x5051f4
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
jmp 0x5051fa
shr eax, 1
lea edx, [esp + 0xd]
lea ecx, [esp + 0x24]
push eax
push edx
call fcn.00550f3c
movsd xmm0, qword [eax]
movsd qword [esp + 0x30], xmm0
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], ecx
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov word [esp + 0x60], 0x104
lea eax, [esp + 0x30]
mov dword [esp + 0x50], eax
mov ecx, esi
push ebp
call fcn.0053aad0
test byte [esp + 0x30], 1
jne 0x50527c
test byte [esp + 0xc], 1
jne 0x50528f
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x50525c
mov eax, dword [ecx]
call dword [eax + 4]
test byte [esp + 0x24], 1
jne 0x5052a5
test byte [esp + 0x18], 1
jne 0x5052b8
test byte [esp + 0x44], 1
jne 0x5052cb
xor esi, esi
test byte [esp + 4], 1
jne 0x5052e0
jmp 0x5052f3
push dword [esp + 0x38]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0xc], 1
je 0x50524f
push dword [esp + 0x14]
call sub.libc.dll_operator_delete_void_
add esp, 4
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x505257
jmp 0x50525c
push dword [esp + 0x2c]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x18], 1
je 0x50526a
push dword [esp + 0x20]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x44], 1
je 0x505271
push dword [esp + 0x4c]
call sub.libc.dll_operator_delete_void_
add esp, 4
xor esi, esi
test byte [esp + 4], 1
je 0x5052f3
mov ecx, dword [esp]
mov dword [esp], 0
test ecx, ecx
je 0x5052f3
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret