joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58d090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58d25e
sub esp, 0x4c
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
mov dword [esp + 0x30], ecx
mov edx, dword [eax + 0x38]
mov ebx, dword [ecx + 0x164]
mov ebp, dword [ecx + 0x168]
mov esi, dword [ecx + 0x16c]
mov edi, dword [eax + 0x3c]
mov ecx, dword [eax + 0x40]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ecx
call fcn.005971c0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x34]
mov ebx, eax
xor eax, eax
call fcn.0045af8a
mov dword [esp + 0x40], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edx
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.00593940
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 0x3c]
mov edx, dword [eax + 0x40]
mov ecx, dword [ecx + 0x20]
mov dword [esp], edx
call ecx
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.00593940
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x30]
mov dword [esp], ebx
mov byte [esp + 4], 0x16
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call fcn.00581ab0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
test eax, eax
jne 0x58d252
mov eax, dword [esp + 0x30]
lea ecx, [eax + 0x118]
mov edx, dword [esp + 0x50]
mov ebx, dword [edx + 0x38]
mov ebp, dword [edx + 0x50]
mov esi, dword [edx + 0x54]
mov edi, dword [edx + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
call fcn.0057c6d0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x28]
movzx edx, byte [ecx + 0x61]
test dl, dl
je 0x58d1cf
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
add esp, 0x4c
ret
mov ecx, dword [ecx + 0x84]
test ecx, ecx
je 0x58d1bb
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 0x38]
mov edx, dword [eax + 0x44]
mov ebx, dword [eax + 0x48]
mov ebp, dword [eax + 0x4c]
mov esi, dword [eax + 0x3c]
mov eax, dword [eax + 0x40]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
lea ecx, [0x67046b]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0xa
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
call fcn.00596d90
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x30]
mov dword [ebx + 0x78], ecx
mov dword [ebx + 0x7c], edx
mov ecx, dword [0x8326a0]
test ecx, ecx
jne 0x58d245
mov dword [ebx + 0x74], eax
jmp 0x58d1bb
lea edi, [ebx + 0x74]
call fcn.0045ace0
jmp 0x58d1bb
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
add esp, 0x4c
ret
call fcn.00459790
jmp fcn.0058d090
Function at 0x594c30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x594e6d
sub esp, 0x54
mov eax, dword [esp + 0x60]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
cmp edx, 2
jl 0x594e3d
movzx ebx, byte [ecx]
shl ebx, 8
movzx ebp, byte [ecx + 1]
or ebx, ebp
add edx, 0xfffffffe
cmp ebx, edx
jne 0x594e0d
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x50], ecx
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
lea edx, [0x63f9a0]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004090f0
mov eax, dword [esp + 0x40]
add eax, 0xfffffffe
mov ecx, eax
neg eax
sar eax, 0x1f
and eax, 2
mov edx, dword [esp + 0x50]
add eax, edx
mov edx, dword [esp + 0xc]
movzx ebx, byte [esp + 0x14]
mov ebp, dword [esp + 0x10]
test bl, bl
je 0x594dc2
mov dword [esp + 0x38], edx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ebp
mov ebx, dword [esp + 0x58]
mov esi, dword [ebx]
mov ebx, dword [ebx + 4]
test esi, esi
je 0x594db1
mov dword [esp + 0x44], ebx
mov dword [esp + 0x34], esi
lea eax, [0x63ea00]
mov dword [esp], eax
call fcn.0040b4f0
mov eax, dword [esp + 4]
mov dword [eax], 0x30
mov ecx, dword [esp + 0x38]
mov ecx, dword [ecx + 0x10]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x14], edx
lea edx, [0x6221a0]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x30]
test eax, eax
je 0x594d91
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ebp
add esp, 0x54
ret
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
add esp, 0x54
ret
mov esi, dword [0x81b960]
mov ebx, dword [0x81b964]
jmp 0x594cef
lea eax, [0x63eca0]
mov dword [esp], eax
call fcn.0040b4f0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x40
lea ecx, [0x682626]
mov dword [eax], ecx
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
lea ecx, [0x6c8150]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
add esp, 0x54
ret
mov eax, dword [0x81b998]
mov ecx, dword [0x81b99c]
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
mov eax, dword [0x81b998]
mov ecx, dword [0x81b99c]
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
call fcn.00459790
jmp fcn.00594c30
Function at 0x5951a0
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5952a5
sub esp, 0x28
lea eax, [0x650320]
mov dword [esp], eax
call fcn.0040b4f0
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
nop
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
mov ecx, dword [esp + 0x30]
test ecx, ecx
jle 0x59525d
mov edx, dword [esp + 0x2c]
xor ebx, ebx
jmp 0x595224
mov ebp, dword [esp + 0x20]
lea edx, [ebp + 0xc]
mov ebx, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ebx
lea ecx, [0x6cafa0]
test byte [ecx], al
mov ebp, dword [edx]
mov esi, dword [edx + 4]
mov edi, dword [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov dword [esp + 0xc], edi
call fcn.00551980
mov eax, dword [esp + 0x1c]
inc eax
mov ecx, dword [esp + 0x30]
cmp ecx, eax
jg 0x595217
lea eax, [0x6cafa0]
test byte [eax], al
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.00551b80
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
add esp, 0x28
ret
call fcn.00459790
jmp fcn.005951a0
Function at 0x5952b0
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x59544f
sub esp, 0x2c
lea eax, [0x633cc0]
mov dword [esp], eax
mov dword [esp + 4], 0x24
mov dword [esp + 8], 0x24
call fcn.00442930
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
nop
lea ecx, [0x6501a0]
mov dword [esp], ecx
call fcn.0040b4f0
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
nop
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov ecx, dword [esp + 0x34]
test ecx, ecx
jle 0x59538d
mov edx, dword [esp + 0x30]
xor ebx, ebx
jmp 0x595354
mov ebp, dword [esp + 0x20]
lea edx, [ebp + 0xc]
mov ebx, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ebx
lea ecx, [0x6caf60]
test byte [ecx], al
mov ebp, dword [edx]
mov esi, dword [edx + 4]
mov edi, dword [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov dword [esp + 0xc], edi
call fcn.00558730
mov eax, dword [esp + 0x1c]
inc eax
mov ecx, dword [esp + 0x34]
cmp eax, ecx
jl 0x595347
lea eax, [0x6caf60]
test byte [eax], al
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.00558930
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp ecx, 0x24
jge 0x595445
mov edx, dword [esp + 0x28]
cmp edx, eax
je 0x5953de
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0045b690
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
call fcn.005951a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
cmp ecx, 0x14
jge 0x59543e
mov edx, dword [esp + 0x28]
lea ebx, [edx + 0x10]
cmp eax, ebx
je 0x595422
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0045b690
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 0x24
mov dword [esp + 0x44], 0x24
add esp, 0x2c
ret
mov ecx, 0x14
jmp 0x595407
mov ecx, 0x24
jmp 0x5953c6
call fcn.00459790
jmp fcn.005952b0
Function at 0x598130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x598307
sub esp, 0x40
lea eax, [0x633cc0]
mov dword [esp], eax
mov dword [esp + 4], 0
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x68]
lea ebx, [edx + ecx]
mov dword [esp + 0x30], ebx
mov dword [esp + 8], ebx
call fcn.00442930
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x5c]
cmp ecx, edx
jb 0x5982d4
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
mov dword [esp], eax
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
call fcn.0045b690
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
cmp eax, ecx
ja 0x5982a1
mov edx, dword [esp + 0x38]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov eax, dword [esp + 0x5c]
add eax, edx
mov dword [esp], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 8], eax
call fcn.0045b690
lea eax, [0x633cc0]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
call fcn.00442930
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
movzx ecx, word [esp + 0x44]
mov word [esp], cx
mov ecx, dword [esp + 0x48]
mov dword [esp + 4], ecx
call fcn.00598070
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x14], ecx
mov ecx, dword [str.master_secret]
mov ebx, dword [0x815ed4]
mov ebp, dword [0x815ed8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], ecx
mov ecx, dword [edx]
call ecx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x30
mov dword [esp + 0x78], 0x30
add esp, 0x40
ret
lea edx, [0x633cc0]
mov dword [esp], edx
mov ebx, dword [esp + 0x38]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.004429e0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
jmp 0x5981b6
lea ebx, [0x633cc0]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call fcn.004429e0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x5c]
jmp 0x598186
call fcn.00459790
jmp fcn.00598130
Function at 0x598ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x599056
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x599027
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x59903d
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
je 0x599002
cmp ax, 0x303
jae 0x598f76
cmp cl, 0xe3
jne 0x598f41
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
add esp, 0x48
ret
mov edi, esp
lea esi, [esp + 0x4c]
call fcn.0045b41e
call fcn.00598ba0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call fcn.00506930
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x20]
mov dword [esp], ecx
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
je 0x598ec8
jmp 0x598ed4
lea eax, [0x633ac0]
mov dword [esp], eax
lea eax, [0x6c4bd0]
mov dword [esp + 4], eax
call fcn.00430630
nop
call fcn.00459790
jmp fcn.00598ea0
Function at 0x5b4090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5b4137
sub esp, 0xc
lea eax, [0x636520]
mov dword [esp], eax
call fcn.0040b4f0
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.005b3fd0
mov eax, dword [esp + 8]
xor ecx, ecx
jmp 0x5b4102
mov esi, ebx
shl ebx, 0xa
lea edi, [eax + ebx]
mov dword [edi + ecx*4], ebp
lea ebx, [esi + 1]
mov edx, ebp
cmp ebx, 8
jge 0x5b4101
mov ebp, edx
and edx, 0xff
shr ebp, 8
xor ebp, dword [eax + edx*4]
cmp ebx, 8
jb 0x5b40d7
jmp 0x5b411e
inc ecx
cmp ecx, 0x100
jge 0x5b4116
jae 0x5b412a
mov edx, dword [eax + ecx*4]
mov ebx, 1
jmp 0x5b40e7
mov dword [esp + 0x14], eax
add esp, 0xc
ret
mov eax, ebx
mov ecx, 8
call fcn.0045ad60
mov eax, ecx
mov ecx, 0x100
call fcn.0045ad60
nop
call fcn.00459790
jmp fcn.005b4090
Function at 0x5c2780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c2906
sub esp, 0x6c
mov eax, dword [esp + 0x70]
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x38]
mov ebx, dword [eax + 0x3c]
mov byte [esp], 7
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.005c2e80
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x28]
test eax, eax
jne 0x5c28fa
mov dword [esp + 0x38], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], esi
mov eax, dword [esp + 0x70]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.005c2180
movzx eax, byte [esp + 0x20]
lea esi, [esp + 0xc]
lea edi, [esp + 0x44]
call fcn.0045b46e
test al, al
je 0x5c28a2
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x70]
mov dword [edx + 0x38], ecx
mov ecx, dword [esp + 0x34]
mov dword [edx + 0x3c], ecx
mov ecx, dword [0x8326a0]
test ecx, ecx
jne 0x5c2894
mov ecx, dword [esp + 0x38]
mov dword [edx + 0x34], ecx
lea edi, [esp + 0x58]
xor eax, eax
call fcn.0045af8b
mov ecx, dword [esp + 0x44]
mov ebx, dword [esp + 0x48]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], ebx
mov ecx, dword [esp + 0x4c]
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ebx
mov dword [esp], edx
lea edi, [esp + 4]
lea esi, [esp + 0x58]
call fcn.0045b46e
call fcn.005c2c20
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x6c
ret
lea edi, [edx + 0x34]
mov eax, dword [esp + 0x38]
call fcn.0045ace0
jmp 0x5c2840
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00408b00
mov eax, dword [esp + 4]
lea ecx, [0x6c8f90]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
lea eax, [0x6c8f70]
mov dword [esp], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
call fcn.00408d80
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x6c
ret
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], edi
add esp, 0x6c
ret
call fcn.00459790
jmp fcn.005c2780
Function at 0x5da520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5da767
sub esp, 0x34
lea eax, [0x62c340]
mov dword [esp], eax
call fcn.0040b4f0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
lea ecx, [0x63b9c0]
mov dword [esp], ecx
call fcn.0040b4f0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
call fcn.0049d5f0
mov eax, dword [esp + 0x38]
test byte [eax], al
lea edi, [eax + 0x78]
mov ecx, dword [0x8326a0]
test ecx, ecx
jne 0x5da737
mov esi, esp
call fcn.0045b46e
movzx ecx, byte [eax + 0x4d]
test cl, cl
je 0x5da71e
mov ecx, 1
test cl, cl
jne 0x5da6f2
lea edi, [eax + 0x8c]
mov ecx, dword [0x8326a0]
test ecx, ecx
jne 0x5da6db
xor eax, eax
call fcn.0045af8b
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0x5c]
test ecx, ecx
je 0x5da6d4
mov ecx, dword [ecx]
mov edx, ecx
add ecx, 1
mov ebx, edx
sar edx, 0x1f
add ebx, 1
adc edx, 0
test edx, edx
setl bl
cmp dword [eax + 0xa4], ecx
setae cl
test edx, edx
sete dl
and edx, ecx
or ebx, edx
test bl, bl
jne 0x5da6ac
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
test edx, edx
je 0x5da638
inc dword [eax + 0x64]
mov ecx, dword [eax + 0x38]
mov dword [esp], ecx
call fcn.0046d150
mov eax, dword [esp + 0x38]
dec dword [eax + 0x64]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov ebx, dword [ecx + 4]
test edx, edx
je 0x5da565
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
add esp, 0x34
ret
lea eax, [0x62c340]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00404780
mov eax, dword [0x8326a0]
mov ecx, dword [esp + 8]
test eax, eax
jne 0x5da69d
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov dword [esp], 0x10
lea ecx, [0x6895e0]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x10], ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x14], ebp
call fcn.0043a390
mov eax, dword [esp + 0x38]
jmp 0x5da606
mov edi, dword [esp + 0x1c]
mov eax, ecx
call fcn.0045ace0
mov eax, edi
jmp 0x5da662
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
test eax, eax
jne 0x5da6ca
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
add esp, 0x34
ret
mov dword [esp], eax
call fcn.004050f0
jmp 0x5da6b6
xor ecx, ecx
jmp 0x5da5cd
lea eax, [0x66c3e0]
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.00410c20
jmp 0x5da5bc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
test eax, eax
jne 0x5da714
mov eax, dword [0x81bd68]
mov ecx, dword [0x81bd6c]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x34
ret
mov dword [esp], eax
call fcn.004050f0
jmp 0x5da6fc
mov dword [esp], eax
call fcn.005d84c0
movzx ecx, byte [esp + 4]
xor ecx, 1
mov eax, dword [esp + 0x38]
jmp 0x5da599
mov eax, edi
lea edi, [esp + 0x20]
mov esi, esp
call fcn.0045b46e
lea ecx, [0x66c3e0]
mov dword [esp], ecx
mov dword [esp + 4], eax
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
call fcn.00410a20
mov eax, dword [esp + 0x38]
jmp 0x5da588
call fcn.00459790
jmp fcn.005da520
Function at 0x5de570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5de7b1
sub esp, 0x64
mov eax, dword [esp + 0x6c]
movzx ecx, byte [eax + 0xa6]
test cl, cl
jne 0x5de799
mov byte [eax + 0xa6], 1
mov ecx, dword [esp + 0x70]
mov edx, dword [ecx]
movzx edx, byte [edx + 2]
test dl, 1
je 0x5de781
mov dword [esp], ecx
call fcn.005d3a50
mov eax, dword [esp + 8]
test eax, eax
jg 0x5de769
call fcn.0040bf90
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x70]
mov dword [esp], ecx
call fcn.005d3980
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
test eax, eax
jle 0x5de6ab
mov dword [esp + 0x28], eax
xor edx, edx
jmp 0x5de605
mov eax, dword [esp + 0x38]
add eax, 0x14
mov edx, ecx
mov ecx, eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x24], edx
lea edi, [esp + 0x50]
mov esi, ecx
call fcn.0045b46e
lea edi, [esp + 0x3c]
lea esi, [esp + 0x50]
call fcn.0045b46e
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.005aa8c0
mov eax, dword [esp + 0x44]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x20], ecx
lea edx, [0x663600]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
call fcn.0040ff70
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
lea ebx, [ecx + 1]
mov ebp, dword [eax]
cmp ebx, edx
ja 0x5de718
lea edx, [ecx + 1]
mov dword [eax + 4], edx
lea edx, [ebp + ecx*8 + 4]
mov ebx, dword [esp + 0x20]
mov dword [edx], ebx
mov edx, dword [0x8326a0]
lea edi, [ebp + ecx*8]
test edx, edx
jne 0x5de70d
mov ecx, dword [esp + 0x34]
mov dword [edi], ecx
mov ecx, dword [esp + 0x24]
inc ecx
mov edx, dword [esp + 0x28]
cmp ecx, edx
jl 0x5de5fa
mov ecx, dword [0x8326a0]
test ecx, ecx
jne 0x5de6f8
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x6c]
mov dword [ecx + 0xa8], eax
nop
mov eax, dword [esp + 0x68]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.005df460
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
add esp, 0x64
ret
mov ecx, dword [esp + 0x6c]
lea edi, [ecx + 0xa8]
mov eax, dword [esp + 0x2c]
call fcn.0045ace0
jmp 0x5de6c3
mov eax, dword [esp + 0x34]
call fcn.0045ace0
jmp 0x5de69a
mov dword [esp + 0x30], eax
lea eax, [0x633ac0]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
call fcn.004429e0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x30]
mov dword [edi + 8], edx
mov edx, dword [0x8326a0]
test edx, edx
jne 0x5de762
mov dword [edi], eax
mov ebp, eax
mov eax, edi
jmp 0x5de676
call fcn.0045ace0
jmp 0x5de759
lea eax, [0x6c8bd0]
mov dword [esp + 0x74], eax
lea eax, [0x6c3adc]
mov dword [esp + 0x78], eax
add esp, 0x64
ret
lea eax, [0x6c8bd0]
mov dword [esp + 0x74], eax
lea eax, [0x6c3ad8]
mov dword [esp + 0x78], eax
add esp, 0x64
ret
lea eax, [0x6c8bd0]
mov dword [esp + 0x74], eax
lea eax, [0x6c3ad4]
mov dword [esp + 0x78], eax
add esp, 0x64
ret
call fcn.00459790
jmp fcn.005de570